Function at 0x14009ef60
Capabilities:
Accept command line arguments
Acquire debug privileges
Get common file path
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4940]
mov eax, 0x4a40
call fcn.1400b5dc0
sub rsp, rax
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rbp + 0x4930], rax
mov dword [rbp - 0x64], r9d
mov qword [rbp - 0x78], r8
mov rbx, rcx
mov qword [rbp - 0x30], rcx
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x154]
call fcn.1400b88a0
mov dword [rbp + 0x150], 0x11c
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009f02e
mov dword [rbp - 0x1c], 4
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [0x14010ad40]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SetDllDirectoryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009f059
lea rcx, [0x1400f6914]
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [0x140143520], rbx
mov dword [rbp - 0x28], 0x104
lea rdx, [rbp - 0x28]
lea rcx, [0x140143100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 0x104
lea rcx, [0x140143310]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x5c
lea rcx, [0x140143316]
call fcn.1400ba484
xor ebx, ebx
mov word [rax], bx
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [0x1400f7478]
call fcn.140005e90
test eax, eax
je 0x1400a08a0
lea r9, str.OpenLog
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f0e1
mov r15d, r12d
lea r13, [rdi + 8]
mov qword [rbp - 0x80], r13
mov edx, dword [rsp + 0x50]
lea eax, [rdx - 1]
mov r8d, 0xfffd
cmp eax, r12d
jle 0x14009f168
mov r14, r13
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f159
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f148
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a00b4
mov edx, dword [rsp + 0x50]
lea r9, str.OpenLog
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f110
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x58], rbx
lea r9, str.Terminate
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f180
mov r15d, r12d
cmp edx, r12d
jle 0x14009f1f5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f1e9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f1d8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a00f9
mov edx, dword [rsp + 0x50]
lea r9, str.Terminate
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f1a0
mov qword [rbp], rbx
lea r9, str.WaitForIdle
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f210
mov r15d, r12d
cmp edx, r12d
jle 0x14009f285
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f279
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f268
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a012f
mov edx, dword [rsp + 0x50]
lea r9, str.WaitForIdle
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f230
mov qword [rbp - 0x18], rbx
lea r9, str.SaveAs
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f2a0
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f318
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f309
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f2f8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0165
mov edx, dword [rsp + 0x50]
lea r9, str.SaveAs
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f2c0
mov qword [rsp + 0x78], rbx
lea r9, str.SaveAs1
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f330
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f3a8
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f399
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f388
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a01aa
mov edx, dword [rsp + 0x50]
lea r9, str.SaveAs1
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f350
mov qword [rbp + 0x60], rbx
lea r9, str.SaveAs2
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f3c0
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f438
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f429
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f418
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a01ee
mov edx, dword [rsp + 0x50]
lea r9, str.SaveAs2
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f3e0
mov qword [rbp + 0x58], rbx
lea r9, str.SaveApplyFilter
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f450
mov r15d, r12d
cmp edx, r12d
jle 0x14009f4c5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f4b9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f4a8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0232
mov edx, dword [rsp + 0x50]
lea r9, str.SaveApplyFilter
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f470
mov qword [rsp + 0x70], rbx
lea r9, str.EnableBootLogging
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f4e0
mov r15d, r12d
cmp edx, r12d
jle 0x14009f555
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f549
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f538
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0269
mov edx, dword [rsp + 0x50]
lea r9, str.EnableBootLogging
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f500
mov qword [rbp - 8], rbx
lea r9, str.ConvertBootLog
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f570
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f5e8
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f5d9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f5c8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a029f
mov edx, dword [rsp + 0x50]
lea r9, str.ConvertBootLog
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f590
mov qword [rbp - 0x60], rbx
lea r9, str.Altitude
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f600
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f678
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f669
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f658
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a02e3
mov edx, dword [rsp + 0x50]
lea r9, str.Altitude
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f620
mov qword [rbp - 0x40], rbx
lea r9, str.LoadConfig
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f690
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f708
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f6f9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f6e8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0327
mov edx, dword [rsp + 0x50]
lea r9, str.LoadConfig
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f6b0
mov qword [rbp + 8], rbx
lea r9, str.NoFilter
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f720
mov r15d, r12d
cmp edx, r12d
jle 0x14009f795
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f789
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f778
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a036b
mov edx, dword [rsp + 0x50]
lea r9, str.NoFilter
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f740
mov qword [rbp + 0x30], rbx
lea r9, str.BackingFile
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f7b0
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f828
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f819
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f808
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a03a1
mov edx, dword [rsp + 0x50]
lea r9, str.BackingFile
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f7d0
mov qword [rbp - 0x38], rbx
lea r9, str.OriginalPath
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f840
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009f8b8
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f8a9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f898
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a03e5
mov edx, dword [rsp + 0x50]
lea r9, str.OriginalPath
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009f860
mov qword [rbp + 0x50], rbx
lea r9, str.PagingFile
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f8d0
mov r15d, r12d
cmp edx, r12d
jle 0x14009f945
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f939
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f928
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0429
mov edx, dword [rsp + 0x50]
lea r9, str.PagingFile
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f8f0
mov qword [rsp + 0x68], rbx
lea r9, str.Profiling
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f960
mov r15d, r12d
cmp edx, r12d
jle 0x14009f9d5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009f9c9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009f9b8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0460
mov edx, dword [rsp + 0x50]
lea r9, str.Profiling
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009f980
mov qword [rbp + 0x38], rbx
lea r9, str.RingBuffer
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009f9f0
mov r15d, r12d
cmp edx, r12d
jle 0x14009fa65
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fa59
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fa48
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0496
mov edx, dword [rsp + 0x50]
lea r9, str.RingBuffer
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fa10
mov qword [rbp + 0x10], rbx
lea r9, str.RingBufferSize
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fa80
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009faf8
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fae9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fad8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a04cc
mov edx, dword [rsp + 0x50]
lea r9, str.RingBufferSize
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009faa0
mov qword [rbp + 0x18], rbx
lea r9, str.RingBufferLen
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fb10
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009fb88
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fb79
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fb68
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0510
mov edx, dword [rsp + 0x50]
lea r9, str.RingBufferLen
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009fb30
mov qword [rbp + 0x20], rbx
lea r9, str.NoConnect
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fba0
mov r15d, r12d
cmp edx, r12d
jle 0x14009fc15
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fc09
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fbf8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0554
mov edx, dword [rsp + 0x50]
lea r9, str.NoConnect
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fbc0
mov qword [rbp - 0x48], rbx
lea r9, str.Client
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fc30
mov r15d, r12d
cmp edx, r12d
jle 0x14009fca5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fc99
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fc88
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a058a
mov edx, dword [rsp + 0x50]
lea r9, str.Client
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fc50
mov qword [rbp - 0x58], rbx
lea r9, str.Minimized
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fcc0
mov r15d, r12d
cmp edx, r12d
jle 0x14009fd35
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fd29
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fd18
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a05c0
mov edx, dword [rsp + 0x50]
lea r9, str.Minimized
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fce0
mov qword [rbp + 0x70], rbx
lea r9, str.Quiet
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fd50
mov r15d, r12d
cmp edx, r12d
jle 0x14009fdc5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fdb9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fda8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a05f6
mov edx, dword [rsp + 0x50]
lea r9, str.Quiet
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fd70
mov qword [rbp - 0x50], rbx
lea r9, str.Runtime
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fde0
mov r15d, r12d
lea eax, [rdx - 1]
cmp eax, r12d
jle 0x14009fe58
mov r14, r13
mov r8d, 0xfffd
nop
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fe49
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fe38
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a062c
mov edx, dword [rsp + 0x50]
lea r9, str.Runtime
mov r8d, 0xfffd
inc r15d
add r14, 8
lea eax, [rdx - 1]
cmp r15d, eax
jl 0x14009fe00
mov qword [rbp - 0x10], rbx
lea r9, [0x14010af90]
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009fe70
mov r15d, r12d
cmp edx, r12d
jle 0x14009fee5
mov r14, r13
mov r8d, 0xfffd
nop dword [rax + rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fed9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009fec8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a0670
mov edx, dword [rsp + 0x50]
lea r9, [0x14010af90]
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009fe90
mov r13, rbx
mov qword [rbp + 0x68], rbx
lea r9, str.ExternalCapture
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009ff00
mov r15d, r12d
cmp edx, r12d
jle 0x14009ff75
mov r14, qword [rbp - 0x80]
mov r8d, 0xfffd
nop dword [rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009ff69
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009ff58
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a06a6
mov edx, dword [rsp + 0x50]
lea r9, str.ExternalCapture
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009ff20
mov qword [rbp + 0x28], rbx
lea r9, str.Run32
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x14009ff90
mov r15d, r12d
cmp edx, r12d
jle 0x1400a0005
mov r14, qword [rbp - 0x80]
mov r8d, 0xfffd
nop dword [rax]
mov rcx, qword [r14]
movzx eax, word [rcx]
sub ax, 0x2d
test r8w, ax
jne 0x14009fff9
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x14009ffe8
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a06dc
mov edx, dword [rsp + 0x50]
lea r9, str.Run32
mov r8d, 0xfffd
inc r15d
add r14, 8
cmp r15d, edx
jl 0x14009ffb0
mov r12, rbx
test r12, r12
setne sil
mov byte [rsp + 0x54], sil
mov r14, qword [rsp + 0x58]
test r14, r14
jne 0x1400a0770
mov rsi, 0xffffffffffffffff
lea r9, [0x1400f6914]
inc rsi
cmp word [r9 + rsi*2], bx
jne 0x1400a0030
mov r15d, 1
cmp edx, r15d
jle 0x1400a0763
mov r14, qword [rbp - 0x80]
nop dword [rax]
mov rcx, qword [r14]
mov qword [rsp + 0x58], rcx
movzx eax, word [rcx]
sub ax, 0x2d
mov r8d, 0xfffd
test r8w, ax
jne 0x1400a073c
add rcx, 2
mov r8, rsi
mov rdx, r9
call fcn.1400cef68
test eax, eax
jne 0x1400a0097
mov rax, qword [r14]
movzx ecx, word [rax + rsi*2 + 2]
call fcn.1400ce804
test eax, eax
je 0x1400a070e
inc r15d
add r14, 8
mov edx, dword [rsp + 0x50]
cmp r15d, edx
jge 0x1400a0763
lea r9, [0x1400f6914]
jmp 0x1400a0050
movsxd rax, r15d
lea rcx, [rax*8]
mov rax, qword [rdi + rax*8 + 8]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f171
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f1f9
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp - 0x18], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f289
movsxd rax, r15d
lea rcx, [rax*8]
mov r8, qword [rdi + rax*8 + 8]
mov qword [rsp + 0x78], r8
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f31d
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 0x60], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f3ac
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 0x58], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f43c
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rsp + 0x70], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f4ca
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp - 8], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f559
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp - 0x60], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f5ec
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp - 0x40], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f67c
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 8], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f70c
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp + 0x30], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f799
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp - 0x38], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f82c
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 0x50], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009f8bc
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rsp + 0x68], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f94a
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp + 0x38], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009f9d9
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp + 0x10], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009fa69
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 0x18], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009fafc
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp + 0x20], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009fb8c
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp - 0x48], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009fc19
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp - 0x58], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009fca9
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp + 0x70], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009fd39
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp - 0x50], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009fdc9
movsxd rax, r15d
lea rcx, [rax*8]
mov r14, qword [rdi + rax*8 + 8]
mov qword [rbp - 0x10], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
sub eax, 2
movsxd r8, eax
shl r8, 3
lea rdx, [rdi + 0x10]
add rdx, rcx
add rcx, rdi
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
sub edx, 2
mov dword [rsp + 0x50], edx
jmp 0x14009fe5c
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r13, qword [rcx]
mov qword [rbp + 0x68], r13
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009feec
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rbp + 0x28], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x14009ff79
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r12, qword [rcx]
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
mov edx, dword [rsp + 0x50]
dec edx
mov dword [rsp + 0x50], edx
jmp 0x1400a0008
movsxd rax, r15d
lea rcx, [rdi + rax*8]
mov r14, qword [rcx]
mov qword [rsp + 0x58], r14
mov eax, dword [rsp + 0x50]
sub eax, r15d
dec eax
movsxd r8, eax
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
dec dword [rsp + 0x50]
jmp 0x1400a076b
movsxd rax, r15d
lea rcx, [rdi + rax*8]
sub edx, r15d
dec edx
movsxd r8, edx
shl r8, 3
lea rdx, [rcx + 8]
call fcn.1400b9c80
dec dword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
jmp 0x1400a076b
mov r14, rbx
mov qword [rsp + 0x58], rbx
movzx esi, byte [rsp + 0x54]
test r13, r13
jne 0x1400a0798
test r14, r14
jne 0x1400a0798
call fcn.1400729a0
test al, al
jne 0x1400a0798
movzx eax, byte [0x140143309]
test al, al
je 0x1400a0793
test r12, r12
jne 0x1400a079f
mov r15b, 1
jmp 0x1400a07a2
movzx eax, byte [0x140143309]
xor r15b, r15b
test al, al
je 0x1400a07b0
test r12, r12
jne 0x1400a07b0
mov r14b, 1
jmp 0x1400a07b3
xor r14b, r14b
mov r12, qword [rsp + 0x58]
test r12, r12
je 0x1400a07f8
test r14b, r14b
je 0x1400a07f8
mov ecx, 0x688
call fcn.1400b5680
test rax, rax
je 0x1400a07db
mov rcx, rax
call fcn.14002f070
jmp 0x1400a07de
mov rax, rbx
mov rdx, r12
mov rcx, rax
call fcn.1400abe20
cmp eax, 0xffffffff
je 0x1400a07f8
test al, 1
movzx r14d, r14b
cmove r14d, ebx
test r15b, r15b
je 0x1400a08e2
mov dword [rbp - 0x68], ebx
lea r8, [rbp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400a085a
mov dword [rbp - 0x24], 4
lea rax, [rbp - 0x24]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.EnableLUA
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.14005ffb0
test al, al
je 0x1400a0870
cmp dword [rbp - 0x68], ebx
jne 0x1400a08e2
lea rcx, str.Process_Monitor_must_be_run_from_an_administrator_account.
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Process_Monitor_must_be_run_from_an_administrator_account.
call fcn.1400b0780
mov qword [rbp - 0x30], rax
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1400746d0
mov r12d, 1
mov ebx, r12d
mov r15d, ebx
mov ebx, r15d
mov r15d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r15d
mov rcx, qword [rbp + 0x4930]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x4a88]
add rsp, 0x4a40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14b, r14b
jne 0x1400a1a8c
test r15b, r15b
jne 0x1400a1a8c
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1400a0913
mov r8, rax
mov edx, 0x104
lea rcx, [0x140142ed0]
call fcn.1400ce79c
jmp 0x1400a0928
mov r8d, 0x104
lea rdx, [0x140142ed0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, ebx
mov r12d, 2
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x1400a0947
mov r13d, r12d
mov rcx, rax
mov qword [rsp + 0x78], rax
jmp 0x1400a0968
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x1400a0963
mov r15d, 1
mov r13d, r15d
mov rcx, rax
mov qword [rsp + 0x78], rax
jmp 0x1400a096e
mov rcx, qword [rsp + 0x78]
mov r15d, 1
cmp qword [rbp + 0x68], rbx
jne 0x1400a1a67
cmp dword [rsp + 0x50], 1
jne 0x1400a19c9
mov r14, qword [rsp + 0x68]
test r14, r14
je 0x1400a0997
cmp qword [rbp - 0x38], rbx
jne 0x1400a19c9
test rcx, rcx
je 0x1400a09c4
cmp qword [rsp + 0x58], rbx
jne 0x1400a09c4
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.The__SaveAs_option_is_valid_only_when_used_with__OpenLog
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400a08a6
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400a0a0c
mov rdx, rax
mov rcx, qword [0x140143518]
call fcn.1400936a0
test al, al
je 0x1400a08a9
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.140031cf0
xor ecx, ecx
call fcn.1400780d0
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.14002fa80
jmp 0x1400a08a9
cmp qword [rsp + 0x70], rbx
je 0x1400a0a6d
test rcx, rcx
jne 0x1400a0a6d
lea rcx, str.The__SaveApplyFilter_option_is_valid_only_when_used_with__SaveAs
call fcn.1400b0640
mov rdx, rax
lea rcx, str.The__SaveApplyFilter_option_is_valid_only_when_used_with__SaveAs
call fcn.1400b0780
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x60]
call fcn.1400b0200
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400a0a68
call fcn.1400b0810
nop
jmp 0x1400a08ac
lea rcx, [0x1401424a0]
call fcn.140031000
test al, al
jne 0x1400a0a9e
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Procmon_was_unable_to_allocate_sufficient_memory_to_run._nTry_increasing_the_size_of_your_page_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400a08ac
cmp qword [rbp - 0x18], rbx
je 0x1400a0af2
mov esi, ebx
nop word [rax + rax]
xor edx, edx
lea rcx, str.PROCMON_WINDOW_CLASS
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400a0ad9
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jl 0x1400a0ab0
jmp 0x1400a08ac
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400a08a9
mov r9d, 0xffffffff
mov dword [rsp + 0x60], r9d
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400a0b71
lea r8, [rsp + 0x60]
lea rdx, [0x1400f8af4]
mov rcx, rax
call fcn.14005ccc0
cmp eax, 1
je 0x1400a0b40
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Runtime_parameter_must_be_specified_in_seconds.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400a08ac
mov r9d, dword [rsp + 0x60]
lea eax, [r9 - 1]
cmp eax, 0xe0f
jbe 0x1400a0b71
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Runtime_parameter_must_be_between_1_and_3600_seconds.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400a08ac
cmp qword [rbp - 8], rbx
je 0x1400a0b8e
mov r8b, 1
movzx edx, r8b
xor ecx, ecx
call fcn.140026ec0
movzx r15d, al
jmp 0x1400a08ac
cmp qword [rbp], rbx
je 0x1400a0bc5
xor edx, edx
lea rcx, str.PROCMON_WINDOW_CLASS
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400a08ac
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800a
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400a08a9
mov rcx, qword [0x140143598]
test rcx, rcx
je 0x1400a0bde
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140143598], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
mov r8d, 0x8000004
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x140143598], rax
mov dword [rbp + 0xf0], 0x40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf4], xmm0
movups xmmword [rbp + 0x104], xmm0
movups xmmword [rbp + 0x114], xmm0
mov qword [rbp + 0x124], rax
mov dword [rbp + 0x12c], eax
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xf8]
lea rcx, [rax*2 - 0x3b9aca00]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
mov qword [0x140143538], rdx
cmp rdx, 0x800000
jge 0x1400a0c84
mov qword [0x140143538], 0x800000
mov edx, 0x800000
lea rax, [rdx + 0x2000000]
mov qword [0x140143540], rax
lea rcx, str.SeDebugPrivilege
call fcn.140027800
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov byte [rsp + 0x20], 1
lea r9, str.ProcMon_Log_File
lea r8, str.ProcMon.Logfile.1
lea rdx, [0x1400f74f8]
movzx ecx, sil
call fcn.1400704a0
xor edx, edx
mov r8d, 0x198
lea rcx, [rbp + 0x270]
call fcn.1400b88a0
mov ecx, 0x202
lea rdx, [rbp + 0x270]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [fcn.140099df0]
call fcn.1400d3490
mov ecx, r15d
call fcn.1400d398c
mov edx, r15d
lea rcx, [0x140093670]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, r15d
mov ecx, 0x1ff
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea rax, str.SoftwareSysinternalsProcess_Monitor32
lea rdx, str.SoftwareSysinternalsProcess_Monitor
cmp byte [0x140143309], bl
cmovne rdx, rax
mov qword [0x1401430e0], rdx
mov qword [rsp + 0x40], rbx
lea rax, [0x1401430d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdx, qword [0x1401430d8]
lea rcx, [rbp - 0x78]
call fcn.1400a8c60
lea rcx, [rbp - 0x78]
call fcn.1400a95f0
lea rcx, [rbp - 0x78]
call fcn.1400061c0
mov edx, dword [0x14013ca70]
lea rcx, [0x1401424a0]
call fcn.140033310
mov rsi, qword [rbp + 8]
test rsi, rsi
je 0x1400a0e6f
lea rcx, [rbp + 0x410]
call fcn.140092eb0
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
lea rcx, [rbp + 0x410]
call fcn.14006b090
test al, al
jne 0x1400a0e26
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.The_selected_configuration_file_cannot_be_opened
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp + 0x410]
call fcn.14006b8a0
lea rcx, [rbp + 0x550]
call fcn.140005110
lea rcx, [rbp + 0x528]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov r15d, r12d
jmp 0x1400a08ac
lea rdx, [rbp + 0x410]
lea rcx, [rbp - 0x78]
call fcn.1400a8c50
lea rcx, [rbp - 0x78]
call fcn.1400a95f0
lea rcx, [rbp - 0x78]
call fcn.1400061c0
nop
lea rcx, [rbp + 0x410]
call fcn.14006b8a0
lea rcx, [rbp + 0x550]
call fcn.140005110
lea rcx, [rbp + 0x528]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
cmp qword [rbp + 0x10], 0
je 0x1400a0ef1
mov byte [0x14013cea0], 1
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x1400a0ea9
mov rcx, rax
call fcn.1400c7bc8
lea edx, [rax - 0x64]
mov r8d, dword [0x14013cea4]
cmp edx, 0xf3c
cmovbe r8d, eax
mov dword [0x14013cea4], r8d
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x1400a0ed1
mov rcx, rax
call fcn.1400c7bc8
lea ecx, [rax - 1]
mov edx, dword [0x14013cea8]
cmp ecx, 0xe
cmovbe edx, eax
mov dword [0x14013cea8], edx
jmp 0x1400a0ed7
mov edx, dword [0x14013cea8]
test edx, edx
jne 0x1400a0ef1
movzx eax, byte [0x14013cea0]
cmp dword [0x14013cea4], edx
cmove eax, ebx
mov byte [0x14013cea0], al
cmp qword [rbp + 0x28], 0
je 0x1400a0eff
or dword [reloc.OLEAUT32.dll_VariantInit], 0x10
cmp qword [rbp + 0x30], 0
je 0x1400a0fa9
lea rcx, [0x1401425a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r14, qword [0x1401425d0]
mov rsi, qword [0x1401425c8]
cmp rsi, r14
je 0x1400a0f56
nop word [rax + rax]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400a0f3f
call fcn.1400b0810
nop
add rsi, 0x20
cmp rsi, r14
jne 0x1400a0f30
mov rax, qword [0x1401425c8]
mov qword [0x1401425d0], rax
mov dword [0x1401425e4], ebx
xor edx, edx
lea rcx, [0x1401425a0]
call fcn.14002dbf0
cmp byte [0x1401425e0], 0
je 0x1400a0f97
mov r9, qword [0x1401422b0]
mov byte [rsp + 0x20], 0
mov r9, qword [r9 + 0x20]
xor r8d, r8d
mov edx, 0x9c92
lea rcx, [0x1401425a0]
call fcn.14002c210
lea rcx, [0x1401425a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x68]
lea r8, [0x140143558]
lea rdx, str.DeviceNameMap
mov rcx, qword [0x1401430d8]
call fcn.140072c40
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x1400a0ffe
xor r9d, r9d
lea r8, [0x14013cc98]
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea r8, [0x1400f74f8]
mov edx, 0x104
lea rcx, [0x14013cc98]
call fcn.140071bc0
jmp 0x1400a100a
test r14, r14
je 0x1400a100a
mov word [0x14013cc98], bx
call fcn.140072b10
test al, al
je 0x1400a1021
mov byte [0x14014330b], 1
or dword [reloc.OLEAUT32.dll_VariantInit], 0x40
mov eax, dword [0x14013ca6c]
cmp qword [rbp + 0x38], 0
cmovne eax, r15d
mov dword [0x14013ca6c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.1400b2d90
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x1400a12a1
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400a12a1
mov edx, 0x2e
mov rcx, rax
call fcn.1400ba6f8
test rax, rax
je 0x1400a127d
mov rcx, rax
call fcn.1400a7750
movsxd r15, eax
test eax, eax
js 0x1400a1277
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call fcn.140099890
test al, al
je 0x1400a126c
cmp r13d, 1
setae r14b
cmp r13d, 2
setae sil
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.140031cf0
mov rax, r15
add rax, rax
lea r15, [0x140000000]
mov r9d, ebx
cmp qword [rsp + 0x70], r9
setne r9b
mov byte [rsp + 0x38], sil
mov byte [rsp + 0x30], r14b
mov byte [rsp + 0x28], 1
mov eax, dword [r15 + rax*8 + 0x13c890]
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x78]
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.14003a4b0
movsxd rsi, eax
test eax, eax
je 0x1400a08a9
lea rcx, str.The_file_was_not_saved.
call fcn.1400b0640
mov rdx, rax
lea rcx, str.The_file_was_not_saved.
call fcn.1400b0780
mov qword [rsp + 0x68], rax
cmp esi, 5
ja case.default.0x1400a114b
mov ecx, dword [r15 + rsi*4 + 0xa1b6c]
add rcx, r15
jmp rcx
lea rcx, str.:_The_operation_was_cancelled
call fcn.1400b0640
lea rcx, str.:_The_operation_was_cancelled
jmp 0x1400a120c
lea rcx, str.:_There_are_no_items_to_be_saved
call fcn.1400b0640
lea rcx, str.:_There_are_no_items_to_be_saved
jmp 0x1400a120c
lea rcx, str.:_The_selected_file_is_not_writable
call fcn.1400b0640
lea rcx, str.:_The_selected_file_is_not_writable
jmp 0x1400a120c
lea rcx, str.:_The_disk_is_full__or_an_internal_size_limit_was_exceeded
call fcn.1400b0640
lea rcx, str.:_The_disk_is_full__or_an_internal_size_limit_was_exceeded
jmp 0x1400a120c
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140071f90
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], rcx
test rcx, rcx
je 0x1400a11d7
call fcn.1400b04e0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400a11e2
call fcn.1400b0810
nop
jmp 0x1400a1219
lea rcx, str.:_The_operation_was_successful
call fcn.1400b0640
lea rcx, str.:_The_operation_was_successful
jmp 0x1400a120c
lea rcx, str.:_An_error_occurred_saving_the_data
call fcn.1400b0640
lea rcx, str.:_An_error_occurred_saving_the_data
mov rdx, rax
call fcn.1400b0780
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400b03c0
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400a1239
call fcn.1400b0810
nop
lea rcx, [rsp + 0x68]
call fcn.1400b0200
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a126c
call fcn.1400b0810
nop
mov r15d, 1
jmp 0x1400a08ac
mov r15d, 1
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Invalid_file_extension_in__SaveAs_option
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r12d, r15d
jmp 0x1400a08ac
cmp qword [rbp - 0x58], 0
jne 0x1400a199e
lea rcx, str.commdlg_FindReplace
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140142ec4], eax
mov dword [rbp - 0x58], 8
mov dword [rbp - 0x54], reloc.WS2_32.dll_ntohs
lea rcx, [rbp - 0x58]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.140015a60
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rax
mov rcx, rsi
call fcn.140016da0
xor r9d, r9d
mov r8, qword [rbp - 0x30]
xor edx, edx
lea rcx, [0x140142800]
call fcn.140097280
lea r13, vtable.WTL::CMessageLoop.0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x110], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
mov r15, qword [0x140141f20]
lea rcx, [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [0x140142858]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
mov ecx, dword [rsi + 0x10]
inc ecx
movsxd rdx, ecx
mov r8d, 4
mov rcx, qword [rsi]
call fcn.1400ce630
test rax, rax
je 0x1400a13d3
mov qword [rsi], rax
mov eax, dword [rsi + 0x10]
inc eax
movsxd rdx, eax
mov r8d, 8
mov rcx, qword [rsi + 8]
call fcn.1400ce630
test rax, rax
je 0x1400a13d3
mov qword [rsi + 8], rax
movsxd rdx, dword [rsi + 0x10]
mov rax, qword [rsi]
lea rcx, [rax + rdx*4]
test rcx, rcx
je 0x1400a13b9
mov dword [rcx], r14d
mov rax, qword [rsi + 8]
lea rdx, [rax + rdx*8]
test rdx, rdx
je 0x1400a13d0
lea rax, [rbp + 0xf0]
mov qword [rdx], rax
inc dword [rsi + 0x10]
lea rcx, [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rbp + 0x418], rbx
mov qword [rbp + 0x438], rbx
mov qword [rbp + 0x440], rbx
mov dword [rbp + 0x448], ebx
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x458], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x470], rbx
lea rcx, [rbp + 0x490]
call fcn.140092d20
lea rax, vtable.CMainFrame.0
mov qword [rbp + 0x410], rax
lea rax, vtable.CMainFrame.1.0
mov qword [rbp + 0x478], rax
lea rax, vtable.CMainFrame.2.0
mov qword [rbp + 0x480], rax
lea rax, vtable.CMainFrame.3.0
mov qword [rbp + 0x488], rax
lea rcx, [rbp + 0x4d8]
call fcn.140092b40
lea rax, vtable.CCustomCommandBar.0
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 0x620], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x640], xmm0
mov dword [rbp + 0x650], ebx
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rbp + 0x658], rax
mov dword [rbp + 0x660], ebx
mov qword [rbp + 0x668], rbx
lea rax, vtable.WTL::CMultiPaneStatusBarCtrl.0
mov qword [rbp + 0x618], rax
movdqa xmmword [rbp + 0x670], xmm0
mov qword [rbp + 0x46c0], rbx
mov dword [rbp + 0x46c8], 0xffffffff
mov dword [rbp + 0x46d0], 0x50
xor eax, eax
movups xmmword [rbp + 0x46d8], xmm0
movups xmmword [rbp + 0x46e8], xmm0
movups xmmword [rbp + 0x46f8], xmm0
movups xmmword [rbp + 0x4708], xmm0
mov qword [rbp + 0x4718], rax
mov r15d, 1
mov dword [rbp + 0x4720], r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4724]
call fcn.1400b88a0
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x410]
call fcn.140093960
test rax, rax
je 0x1400a18f2
mov rsi, qword [rbp + 0x70]
test rsi, rsi
je 0x1400a155b
mov eax, r12d
jmp 0x1400a1569
mov edx, 5
mov eax, dword [rbp - 0x64]
cmp eax, r15d
cmove eax, edx
mov edx, eax
mov rcx, qword [rbp + 0x418]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp + 0x418]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, [0x1401425a0]
call fcn.14002db30
test al, al
jne 0x1400a16d3
test rsi, rsi
jne 0x1400a16d3
cmp qword [rbp - 0x50], rsi
jne 0x1400a16d3
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0xb0], rbx
mov dword [rbp + 0xb8], ebx
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
mov byte [rbp + 0xe0], sil
movdqa xmm0, xmmword [0x1400f9d50]
movdqa xmmword [rbp + 0xd0], xmm0
lea rax, vtable.CFilterDlg.0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0xe8], reloc.OLEAUT32.dll_UnRegisterTypeLib
mov rsi, qword [0x140143518]
call fcn.1400b6d28
mov qword [rbp + 0xa8], rax
test rax, rax
jne 0x1400a1623
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400a16a3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rax, [rbp + 0x80]
mov qword [rbp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x98], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x90]
mov qword [0x14013c370], rax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx edx, word [rbp + 0xe8]
mov qword [rsp + 0x20], r15
lea r9, [0x140048560]
mov r8, rsi
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x1400a16bb
call fcn.1400c5a78
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x1400a16d3
call fcn.1400b6df8
lea rcx, [rbp + 0x410]
call fcn.140067810
xor edx, edx
mov rcx, qword [0x140143518]
call fcn.1400936a0
test al, al
je 0x1400a1704
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.140031cf0
jmp 0x1400a178a
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x1400a1746
cmp byte [0x14013ca65], 0
je 0x1400a1732
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c53
mov rcx, qword [0x140143518]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [0x140143518]
call fcn.140099890
jmp 0x1400a178a
cmp qword [rbp - 0x48], 0
jne 0x1400a178a
cmp byte [0x140143309], 0
jne 0x1400a178a
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
cmp qword [rbp - 0x38], 0
setne byte [rbp - 0x78]
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x70], rax
lea r9, [rbp - 0x78]
mov edx, VarUI4FromDisp
mov r8d, 0x9c87
mov rcx, qword [0x140143518]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x60]
cmp eax, 0xffffffff
je 0x1400a17ad
imul r8d, eax, 0x3e8
xor r9d, r9d
mov rdx, r12
mov rcx, qword [0x140143518]
call qword [sym.imp.USER32.dll_SetTimer]
mov esi, ebx
mov r14d, r15d
test r14d, r14d
je 0x1400a17f9
nop word [rax + rax]
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x118]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400a17f9
mov rax, qword [rbp + 0xf0]
mov edx, esi
inc esi
lea rcx, [rbp + 0xf0]
call qword [rax + reloc.WS2_32.dll_recv]
test eax, eax
jne 0x1400a17c0
mov r14d, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x118]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x1400a17b2
test eax, eax
je 0x1400a1872
mov rax, qword [rbp + 0xf0]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xf0]
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1400a184d
lea rcx, [rbp + 0x118]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x118]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [rbp + 0xf0]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xf0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x1400a17b2
jmp 0x1400a17ad
mov r15d, dword [rbp + 0x128]
mov r14, qword [0x140141f20]
lea rcx, [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [0x140142858]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, ebx
movsxd rcx, dword [rsi + 0x10]
test ecx, ecx
jle 0x1400a18d6
mov r9, rcx
mov rdx, rbx
mov rcx, qword [rsi]
nop dword [rax + rax]
cmp dword [rcx], eax
je 0x1400a18c5
inc r8d
inc rdx
add rcx, 4
cmp rdx, r9
jl 0x1400a18b0
jmp 0x1400a18d6
cmp r8d, 0xffffffff
je 0x1400a18d6
mov edx, r8d
mov rcx, rsi
call fcn.14009c6b0
lea rcx, [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140142800]
call fcn.14009ded0
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, qword [rbp + 0x46c0]
test rcx, rcx
je 0x1400a1918
call qword [sym.imp.USER32.dll_DestroyMenu]
mov rcx, qword [rbp + 0x46c0]
test eax, eax
cmovne rcx, rbx
mov qword [rbp + 0x46c0], rcx
mov rcx, qword [rbp + 0x668]
call fcn.1400b56bc
mov rcx, qword [rbp + 0x640]
test rcx, rcx
je 0x1400a1935
call fcn.1400b6df8
lea rcx, [rbp + 0x4d8]
call fcn.140092f60
lea rcx, [rbp + 0x490]
call fcn.1400930c0
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x1400a195e
call fcn.1400b6df8
mov qword [rbp + 0xf0], r13
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400a197d
call fcn.1400c5a78
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x110], rbx
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x1400a08ac
call fcn.1400c5a78
jmp 0x1400a08ac
call fcn.140077840
xor ecx, ecx
call fcn.1400780d0
lea r8, [0x140143558]
lea rdx, str.DeviceNameMap
mov rcx, qword [0x1401430d8]
call fcn.140074100
jmp 0x1400a08a9
lea rcx, str.Invalid_argument:
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Invalid_argument:
call fcn.1400b0780
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x80]
mov rsi, qword [rax]
mov rcx, rsi
call fcn.1400b0640
mov rdx, rax
mov rcx, rsi
call fcn.1400b0780
mov qword [rbp - 0x40], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.1400b0290
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400a1a27
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400a1a36
call fcn.1400b0810
nop
lea rcx, [rbp - 0x50]
call fcn.1400b0200
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400a1a67
call fcn.1400b0810
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x1400200e0]
xor r8d, r8d
lea rdx, [0x140101198]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x1400a08a6
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rsi, rax
test rax, rax
je 0x1400a1b60
mov qword [rax + 8], rbx
mov r12d, 1
mov dword [rax + 0x10], r12d
mov r13, qword [rbp - 0x78]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x1400a1ace
test r13, r13
jne 0x1400a1b60
movzx r9d, r15b
movzx r8d, r14b
mov rdx, rax
mov ecx, dword [rbp - 0x64]
call fcn.140073cc0
test al, al
sete r14b
mov rax, 0xffffffffffffffff
lock xadd dword [rsi + 0x10], eax
cmp eax, r12d
jne 0x1400a1b28
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400a1b09
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rbx
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400a1b1b
call fcn.1400b56bc
mov qword [rsi + 8], rbx
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400b56bc
test r14b, r14b
je 0x1400a08a3
lea rcx, str.Unable_to_extract_x64_image._Run_Process_Monitor_from_a_writable_directory.
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Unable_to_extract_x64_image._Run_Process_Monitor_from_a_writable_directory.
call fcn.1400b0780
mov qword [rbp - 0x78], rax
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.1400746d0
jmp 0x1400a08a0
mov ecx, 0x8007000e
call fcn.1400b6f00
int3