Function at 0x1800010b0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x700]
sub rsp, 0x800
mov rax, qword [0x18030a008]
xor rax, rsp
mov qword [rbp + 0x6f0], rax
mov ebx, edx
mov r13, rcx
mov byte [rsp + 0x31], 1
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov esi, 0x10
mov r8d, esi
lea rdx, [0x1800c2cc0]
lea rcx, [rsp + 0x48]
call fcn.180003590
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x100], r14
test rax, rax
je 0x180001171
cmp qword [rsp + 0x58], r14
je 0x180001171
lea r8, [rbp + 0x100]
lea edx, [rsi + 0x1a]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000115f
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x100]
call fcn.180008a40
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x180001171
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1800011b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800011ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002060
call fcn.180044ed0
mov byte [rsp + 0x32], 1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov r8d, 0x16
lea rdx, [0x1800c2ce8]
lea rcx, [rsp + 0x68]
call fcn.180003590
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x108], r14
test rax, rax
je 0x18000123c
cmp qword [rsp + 0x78], 0
je 0x18000123c
lea r8, [rbp + 0x108]
mov edx, 0x2a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000122a
lea r8, [rsp + 0x32]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x108]
call fcn.180008a40
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x18000123c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x18000127d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002066
call fcn.180044ed0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test r13, r13
je 0x180001ed7
test ebx, ebx
je 0x180001ed7
mov qword [rbp + 0x118], r14
mov ecx, 0x48
call fcn.180044ed8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 0xf
mov rdi, rbx
mov qword [rsp + 0x40], rbx
mov r8, rbx
mov rdx, r13
lea rcx, [rbp + 0x18]
call fcn.1800043d0
mov rbx, qword [rbp + 0x110]
mov r8, qword [rbx + 8]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x110]
call fcn.180003e80
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp + 0x118], r14
mov rax, qword [rbp + 0x30]
cmp qword [rbp + 0x28], 0
je 0x1800014b4
lea r15, [rbp + 0x18]
cmp rax, 0x10
cmovae r15, qword [rbp + 0x18]
cmp dword [r15], 0xfeff
jne 0x1800014b4
cmp dword [r15 + 0xc], 0x200b
jne 0x1800014b4
mov r12d, r14d
cmp dword [r15 + 4], r14d
jbe 0x1800014b4
nop dword [rax + rax]
mov ebx, esi
add rbx, r15
add esi, 0xc
mov r8d, dword [rbx + 8]
mov qword [rbp - 8], r14
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 0xf
mov edx, esi
add rdx, r15
lea rcx, [rbp - 8]
call fcn.1800043d0
mov r14, qword [rbp + 0x110]
mov rax, qword [r14 + 8]
mov qword [rbp - 0x20], rax
xor edi, edi
mov dword [rbp - 0x18], edi
mov rcx, r14
cmp byte [rax + 0x19], dil
jne 0x1800013d5
mov edx, dword [rbx]
nop dword [rax]
mov qword [rbp - 0x20], rax
cmp dword [rax + 0x20], edx
jae 0x1800013c2
mov dword [rbp - 0x18], edi
mov rax, qword [rax + 0x10]
jmp 0x1800013cf
mov dword [rbp - 0x18], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], dil
je 0x1800013b0
cmp byte [rcx + 0x19], dil
jne 0x1800013e8
mov eax, dword [rcx + 0x20]
cmp dword [rbx], eax
jb 0x1800013e8
mov rdi, qword [rbp + 0x10]
jmp 0x18000145d
movabs rax, 0x38e38e38e38e38e
cmp qword [rbp + 0x118], rax
je 0x180002072
mov ecx, 0x48
call fcn.180044ed8
mov ecx, dword [rbx]
mov dword [rax + 0x20], ecx
movups xmm0, xmmword [rbp - 8]
movups xmmword [rax + 0x28], xmm0
movups xmm1, xmmword [rbp + 8]
movups xmmword [rax + 0x38], xmm1
mov edi, 0xf
mov qword [rbp + 0x10], rdi
mov byte [rbp - 8], 0
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov word [rax + 0x18], 0
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0xa0], xmm0
mov r8, rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x110]
call fcn.180002d70
cmp rdi, 0x10
jb 0x180001495
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000206c
call fcn.180044ed0
add esi, dword [rbx + 8]
inc r12d
cmp r12d, dword [r15 + 4]
mov r14d, 0
jb 0x180001360
mov rax, qword [rbp + 0x30]
mov rdi, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x1800014ec
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800014e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000206c
call fcn.180044ed0
cmp qword [rbp + 0x118], 2
jae 0x18000184d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 0xf
xor r8d, r8d
lea rdx, [0x1800c2ce4]
lea rcx, [rsp + 0x48]
call fcn.1800043d0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
xor r8d, r8d
lea rdx, [0x1800c2ce5]
lea rcx, [rsp + 0x68]
call fcn.1800043d0
mov qword [rbp + 0x108], 1
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x70]
call fcn.18003a370
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1800015a7
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800015a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002078
call fcn.180044ed0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800015f2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800015ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002078
call fcn.180044ed0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18000163e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002078
call fcn.180044ed0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000167b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002078
call fcn.180044ed0
mov r8, qword [rbp + 0x110]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x110]
call fcn.180003e80
mov edx, 0x48
mov rcx, qword [rbp + 0x110]
call fcn.180044ed0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 0xf
xor r8d, r8d
lea rdx, [0x1800c2d87]
lea rcx, [rsp + 0x48]
call fcn.1800043d0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
xor r8d, r8d
lea rdx, [0x1800c2d9a]
lea rcx, [rsp + 0x68]
call fcn.1800043d0
mov qword [rsp + 0x38], r14
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.18003a370
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18000174f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000174a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000207e
call fcn.180044ed0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x18000179a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000207e
call fcn.180044ed0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1800017e6
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000207e
call fcn.180044ed0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180001823
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000181e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000207e
call fcn.180044ed0
mov rcx, qword [rbp + 0x6f0]
xor rcx, rsp
call fcn.180044eb0
mov rbx, qword [rsp + 0x850]
add rsp, 0x800
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov r8d, 0x3e8
lea rcx, [rbp + 0x300]
call fcn.180047500
lea rcx, [rbp + 0x300]
call fcn.1800036c0
lea rcx, [rbp + 0x310]
call fcn.18003a6f0
lea rcx, [rbp + 0x6a8]
call fcn.180023210
lea rsi, vtable.shared::container::map_unsigned_long_int__class_protocol::IObject_.0
mov qword [rbp + 0x6a8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x6d0], xmm0
mov qword [rbp + 0x6e0], r14
mov ecx, 0x388
call fcn.180044ed8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x6d8], rax
xor edx, edx
mov r8d, 0x168
lea rcx, [rbp + 0x190]
call fcn.180047500
lea rcx, [rbp + 0x190]
call fcn.180002490
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x40], r14d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x110]
call fcn.180002a50
mov rdx, rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.18003fe10
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.18003b1d0
test al, al
sete bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180001962
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000195d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002054
call fcn.180044ed0
test bl, bl
je 0x180001a89
mov qword [rbp + 0x80], r14
movdqa xmm0, xmmword [0x1802f92c0]
movdqu xmmword [rbp + 0x90], xmm0
xor r8d, r8d
lea rdx, [0x1800c2ce6]
lea rcx, [rbp + 0x80]
call fcn.1800043d0
lea rdx, [0x1800c2ce7]
lea rcx, [rbp - 0x70]
call fcn.180004030
mov qword [rsp + 0x38], 1
lea r9, [rbp + 0x80]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xb0]
call fcn.18003a370
lea rdx, str.Parse_launch_config_failed.
lea rcx, [rbp - 0x20]
call fcn.180003f70
lea rcx, [rbp + 0xb0]
call fcn.180028600
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x80]
call fcn.180004530
lea rcx, [rbp + 0x190]
call fcn.180002610
mov qword [rbp + 0x6a8], rsi
lea rcx, [rbp + 0x6d8]
call fcn.18003fd80
lea rcx, [rbp + 0x6d8]
call fcn.18003fcb0
lea rcx, [rbp + 0x6a8]
call fcn.180023af0
lea rcx, [rbp + 0x310]
call fcn.18003aef0
mov rbx, qword [rbp + 0x308]
test rbx, rbx
je 0x18000167b
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18000167b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18000167b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
jmp 0x18000167b
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x40], 1
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x110]
call fcn.180002a50
mov rdx, rax
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.18003fe10
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.180042d20
movzx ebx, al
lea rcx, [rbp - 0x70]
call fcn.180004530
test bl, bl
jne 0x180001b74
lea rdx, [0x1800c2d16]
lea rcx, [rbp + 0x40]
call fcn.180004030
lea rdx, [0x1800c2d17]
lea rcx, [rbp - 0x70]
call fcn.180004030
mov qword [rsp + 0x38], 1
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xb0]
call fcn.18003a370
lea rdx, str.Parse_developer_config_failed.
lea rcx, [rbp - 0x20]
call fcn.180003f70
lea rcx, [rbp + 0xb0]
call fcn.180028600
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x40]
call fcn.180004530
lea rcx, [rbp + 0x190]
call fcn.180002610
lea rcx, [rbp + 0x300]
call fcn.18003b130
lea rcx, [rbp + 0x110]
call fcn.180003f40
jmp 0x1800016aa
mov r8, rdi
mov rdx, r13
lea rcx, [rbp + 0x170]
call fcn.180004070
mov r8d, 0x210021
lea rdx, str.P_h_L___D_F_ixqMoiJxjdWxT___ZI_F____LO_lH__oGbMhWJny_SPMMHlKEkIhPb_rSD_DQQdO__LaFXArNMUbTMZ__DanFDTAOS_gL__I__h_vGxP_mmekS_qMJMD_NW_Cd_SxUtTqJ__NSwQqSsw_r_ZOaUwczuv__zcHokMPQsYSQqYQQq_WWntRiDD_HKayLg_dCyHl_ipkR__FwCekV_MyBwwqpxVryyGmrS_IIjOHjkJRW_ZVu_rvssssZxlsCVCTUWoKhIYymcNgmycjK_zrzdqwUiO_FCXR_Agyr_IsqkcdIrekLSvzy_CEzAkraXGsgzXwuT__yo_zImyzZN_vuxq_SznFxZz_mY_nwuDH_tVubtXzjEOnK_MChAUxhBqyGZLcVj_XeVKwnI_w_oLp_Zj_nv_kK_UsxSpZxWwefR_SeYXvl_HGi_pPEmyDkpqyQYXUdIVrXLlfRMsdrS_Q__pYEjklMOkllL__cz__SnwCBeyYOIZeCvezo_wIWlyy_clYncxIQ__tMfEixiQ_pLMJLZU_LuruR_bj_u_Of_HozlExB_f_SptCKwK___hbbvwhuwh_qtAyI_fyW_fxZK___iizhrryqs_dDcuvHDU__K_nIO__FwMbvhZn_TtDVa__pATAn_D__pVunkeaxHnP_r_ghDbzKk_lGK_sSE_jcbxRM_bTUsfgfBrAzvwujmnUxrZILsjfs_WPgvXPKcjbC_UHNrm_VameyqQgw_lkyanMKRvZLDIOd_dszwUtzxmjCXYNtO_ZOhB__gJGqCtoKkEI_rmEfkJzkrlSkHy_w_Zgw_txMgGhLqbese_rLiwtn_OjVOQkHWo___Ksgcmjqozc_uGJ_yZqE_kJMrE_nEu_ka_lo__UFtvQL_Wui_L_ivNX__esSLZAxR_az_kW__QssNtR__GiY_sBnRYD__w_LhuHHexpWxGX_Qng_itpQWBwcBs_iandhRpStHarj_JOKETy_ZQOoJWE__JNYniAvRB_uDul_qEoilfjPwgUqpaZWYEh_sZapfGOjJDbIQAXbsgEXcRZbeQCFQq_jjz_w__ihdDFAzEbmlbqIlKyTHyxIqADgyBTjqeEMDc_tC_nQ__Wyn_pvtNoHREWQGHhWn_RDSTRa__kGiTKETs_IhFZCaNhYUBDEv__kChpNFZpv_maYzHBzlKhLQ_hjVPCjdX_HgWDf_t_RJMDQBXBnijFqihGIQMpKr_kU_tXzJczA_yy__YzsqH_rqumzZxGSzEWFeCp_wcKQGhaM_PwxOWs_qyO_q_LDs_wqXLbiVK__dnawXSdhB_MQ___MZnlQbgyOrwqOfA__QckKGhYoCz_jewY_zAJlNuSThs_IX_duHfolmrNgKOgSFsujcs_FuOKc_CkhP_UNRdAexK_Rt__ROl_r_NoEqqrb_rARvPGP_LMqtsHGNM_rNtOnauVBNjEGzT_rmHSaz__to_JIEXxsN_RK_VihBjkvF_lR_vhZ__AVkOO_dZRlEgAsZdERLhk_pk_lfStW_FEBFZQSBQv_JCXGHaKHVKHFCCEYDx_Vm_paluZd_EvR__aGcXXayqJPLwu_cd_d_jcd_msXlTMK_GGjQbwwAAenPTEE_MtD_QPOTD_kmSi_ruAkFIjFQUwwGLdVdyr_pWXLeNUCnlHLEkxBRoJI_rTmNKDMd_sMcFWyQFAJMwwQw_fCHhg_vBRSzydnOF_fxxBzvr_HYHc_GxdZ__XvOxF_JjgAhO_A_wTZ__zgnKE_Y_iKz_g_EucghXriNeZLmhvzq_dXYBTqqGH_LLQz_iDaRhA_dynY_OqHr_GHo_hnoQ___exgg_YFRqCxYEOM__zVC__JxxtCRcSgXM_lpmycqU__YbLkSVRvbhjArB_LMBxOfHvZKRTPotAbZPkHGinl_h_c__OJIejfYZsfxhKXdv_no_birNqcdy_h_y_Gqj_H_bqEccA_qGBNMyFEXRBFvHQEH_EELHNpLSsRvKkGLsvktBzIsLxzskdJRnLfoiBmPZa_OGigGbxIkMDMOxzmAzTpgnyTy_TpUqZ_q_aHhJyEKT_zvLFqtuawlZ_td_JfyJzLQQPbBEDlvBONEQQpijVQvcKsGaEqRu_Ak_C_BygzxoWfdcaBWEDzfizEc_YnaK_NoQVu_f___cKdVEiIxFziTptpAec_EiSkUkdQpzUUK_KA_H_tNarqJKMrUEwMFpmAsmxCLJxJZyrFPCVg__doFccZLEwnrPBBh_hO_yY_sN_eONlp___tpeepNc_hlzkh_LplFOEztgF_NTh_n_gFndJG_LxSOvbk_L_Emm__kTUe_ThuPjwSBuoKv_sndX_ytEtubkLLzTnxJw_vEc_JsF_vbei_mrkCtFy__QsYp_jMnFYFhaTMR_xns_ZVZPFYYezqMm_cTvdz_ZbXUafqAWrJPvBpeNMroBCSKvtB_D_BikXHPt_bDTXLrLrah_z_E_xkxoRpoc_NSc_GBkpynwMLatsuhsxzd_SzM_gVewShal_YRzigS_U_YTkhjuzpWzmQkstZe_SJ_Sz_y_s_Vyy_k_LxvvyOq_wobWiJlVYuyJPKiZtrk_RIWWIGhSpy_INYdI_EboyyQZzm_UPOdw_igsvCpwMQ_oGN_ZWRR__XB_FEbPLJq_qKxcCep_ElCSVA_vu_hLjZ_P_mFOnWqez_i__mhm_SCQJynmBGlhGPhernQrtegl_x_yKhBPXEYhciAHOqdNjWpSSFTqTJA_mjgH_iSf__bM_MH_PuhyHyDnv_LYxjz_fP_GFQoRZxsbEeh_KSTX___bhouiUGTedyJzRxkayhO_AAlIDtEXFR_KBEx_FPsFf_OgMBRWIaldFCBbw_ldaCSCl___P_MnGkBM_tOTxQZqkoyNDmLTx_kSCbe_bHiA_YittnCD_rhNrRLoNcf_Xi_c_OTvSSKzTmHQ__aJpdAYepMAeufaphgI_nyQFmsyhlhXstRgi_mEx_dL_zPNj_z_ZrbVVT__FVtc_Z_GX__NnBRqyj_x_rskn_DRryN_bBXuTfTWyohD_iiiN_ldW_tjGEv_oHHBpDhrFRRSGcRSxwCVw_X_XeuqAXJF_aLOgdj_GfmsIAajgC_pUAZdB_S_M__zfmkgVWuAc_NuhqPyfRVhyIqnZDOELPa_daPMBxfsoBB_i_n_UMrMaLyhJhw_JoZzCXhJds_dqybal_DzELLNo_kvRlaYrNtP_oYVjNgBoSPWXBNGAfYpGKzgePW_iYZkC_B_CaE_ZOjq_vaJDveDs_EygBt_lKT_PRmPDLM_wIBpULEsNnMGEnewOKls_mJxImq_clQuUxIQPyeS_iTQcMKe_PewBOnMKJbUJOt_U_UdBW_nKR_wLMiaNMwiTVqpqNfrRIVaAV_WRF_VSuCpGZIbfRaWy_imhzEmC_Ls_ndhKAlikea_Ej__ph_t_LodPaXfIQbZB_vj_Wj_Y_LOX_yEhMZdriL__IQaYu__tzbBbPHTz__tKGVart_KaBVB_xiHdKh_tzTBkVCCmE__tQKCgt_RIImdByd__vH_j_Um_oLByYKTdNovHNCome_ClRTvKLtCh_HWXrzVsxHmSCzS_Cwkm_B_eKAOtK_qGnJWsvJe_E_nhOYxDYx_YLi_qtSLNoxOnLzjAuKeYMgmHSYdLNwkIfR_K_wUYjPkKNBURlZz__IILRHiLmfxBqj_V_lVNCoOHkAOygC
lea rcx, [rbp + 0x150]
call fcn.180004070
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x70]
call fcn.180040280
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.180003df0
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x130]
call fcn.1800028c0
lea rcx, [rbp + 0x190]
call fcn.180042ce0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.180040370
lea rcx, [rbp + 0x120]
call fcn.1800028c0
lea rcx, [rbp + 0x120]
call fcn.1800029a0
lea rcx, [rbp + 0x140]
call fcn.1800028c0
lea rcx, [rbp + 0x140]
call fcn.180002b50
mov qword [rbp + 0x108], r14
lea rdx, [rbp + 0x108]
lea rcx, [0x1800c2d88]
call fcn.180008570
mov rbx, qword [rbp + 0x108]
test rbx, rbx
jne 0x180001c80
lea rcx, [rbp + 0x140]
call fcn.180002950
lea rcx, [rbp + 0x120]
call fcn.180002860
lea rcx, [rbp + 0x130]
call fcn.180002860
lea rcx, [rbp + 0x150]
call fcn.180004530
lea rcx, [rbp + 0x170]
jmp 0x180001b46
lea rax, [rbp + 0x120]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x150]
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x70]
call fcn.180002460
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180002d00
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x108]
call fcn.180008c90
lea rcx, [rbp + 0x40]
call fcn.180003dc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x128], 0
jne 0x180001d63
lea rdx, [0x1800c2d64]
call fcn.180004030
lea rdx, [0x1800c2d65]
lea rcx, [rbp - 0x70]
call fcn.180004030
mov qword [rsp + 0x38], 1
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xb0]
call fcn.18003a370
lea rdx, str.Not_found_target_acceptor_process__.
lea rcx, [rbp - 0x20]
call fcn.180003f70
lea rcx, [rbp + 0xb0]
call fcn.180028600
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x40]
call fcn.180004530
jmp 0x180001c44
lea rdx, [0x1800c2d66]
call fcn.180004030
lea rdx, [0x1800c2d67]
lea rcx, [rbp - 0x70]
call fcn.180004030
mov qword [rsp + 0x38], r14
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xb0]
call fcn.18003a370
lea rdx, str.Injector_acceptor_process_total__.
lea rcx, [rbp - 0x20]
call fcn.180003f70
lea rcx, [rbp + 0xb0]
call fcn.180028600
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x40]
call fcn.180004530
mov rbx, qword [rbp + 0x130]
mov rbx, qword [rbx]
mov qword [rbp + 0x108], rbx
cmp byte [rbx + 0x19], 0
jne 0x180001c44
nop word [rax + rax]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], 0xb
lea rdx, [rbx + 0x28]
mov r8d, 8
lea rcx, [rbp - 8]
call fcn.180004070
mov rdi, rax
mov edx, dword [rbx + 0x20]
lea rcx, [rsp + 0x48]
call fcn.180004590
mov rbx, rax
lea rdx, str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsAppsSKLaunchAcceptor_
lea rcx, [rsp + 0x68]
call fcn.180004030
mov rdx, rax
lea r8, [0x1800c2d9c]
lea rcx, [rbp + 0x80]
call fcn.180003b50
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.180003da0
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.180008e10
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rax
call fcn.180004640
lea rcx, [rbp - 0x70]
call fcn.180004530
lea rcx, [rbp + 0x40]
call fcn.180004530
lea rcx, [rbp + 0x80]
call fcn.180004530
lea rcx, [rsp + 0x68]
call fcn.180004530
lea rcx, [rsp + 0x48]
call fcn.180004530
lea rcx, [rbp - 8]
call fcn.180004530
lea rcx, [rbp + 0x108]
call fcn.1800028e0
mov rbx, qword [rbp + 0x108]
cmp byte [rbx + 0x19], 0
je 0x180001df0
jmp 0x180001c44
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 0xf
xor r8d, r8d
lea rdx, [0x1800c2ce2]
lea rcx, [rsp + 0x48]
call fcn.1800043d0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
xor r8d, r8d
lea rdx, [0x1800c2ce3]
lea rcx, [rsp + 0x68]
call fcn.1800043d0
mov qword [rsp + 0x38], 1
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.18003a370
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x180001f80
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001f7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000205a
call fcn.180044ed0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x180001fcb
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001fc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000205a
call fcn.180044ed0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x180002013
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000200e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000205a
call fcn.180044ed0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800016aa
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800016a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000205a
jmp 0x1800016a5
call fcn.18004b52c
int3
call fcn.18004b52c
int3
call fcn.18004b52c
int3
call fcn.18004b52c
int3
call fcn.18004b52c
int3
call fcn.180003410
int3
call fcn.18004b52c
int3
call fcn.18004b52c
int3