Function at 0x108e0f8
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x580
mov rax, qword [0x010d71a0]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov r14, rcx
mov qword [0x010e4a78], rcx
xor ebp, ebp
lea rcx, [0x010e5060]
mov dword [rsp + 0x50], ebp
mov r15d, ebp
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [0x010e4e48], 0xffffffffffffffff
lea r8, [0x01084608]
lea rcx, [0x010e4e50]
mov edx, 0x104
mov qword [0x010e5088], r14
mov dword [0x010e4ca4], 0x1f
mov byte [0x010e53dc], bpl
call fcn.010a6eb8
mov rcx, qword [0x010e5088]
mov edi, 0x200
lea rdx, [rsp + 0x170]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x170]
mov dx, 0x5c
call fcn.010a7adc
cmp rax, rbp
jne 0x108e1be
lea rax, [rsp + 0x170]
jmp 0x108e1c2
add rax, 2
lea rbx, [0x010e5090]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r9, [0x01084640]
lea r8, [0x01084668]
lea rcx, [rsp + 0x170]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.010a7ab8
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
mov r13d, 1
jne 0x108e35f
mov ecx, dword [0x010e4ca4]
mov r12, qword [rsp + 0x60]
call fcn.010a691c
cmp rax, rbp
mov qword [0x010e5058], rax
je 0x108e34a
cmp dword [0x010e4ca4], ebp
lea rbx, [0x01080e50]
mov edi, ebp
mov qword [0x010e53e0], rbx
mov rsi, rbp
jbe 0x108e34a
mov r13d, dword [rbx]
lea rax, [0x01080e54]
mov ebp, edi
imul rbp, rbp, 0x84
add rbp, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x108e2e1
cmp dword [rsp + 0x54], 4
jne 0x108e2e1
mov ecx, dword [rsp + 0x58]
xor ebp, ebp
jmp 0x108e31c
lea rax, [rsp + 0x58]
mov r9d, 4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], r13d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [rsp + 0x58]
xor ebp, ebp
cmp eax, ebp
cmovne ecx, ebp
mov dword [rsp + 0x58], ecx
mov rax, qword [0x010e5058]
cmp ecx, ebp
mov r13d, 1
setne cl
add edi, r13d
add rbx, 0x84
mov byte [rsi + rax], cl
add rsi, r13
cmp edi, dword [0x010e4ca4]
jb 0x108e280
mov rcx, qword [rsp + 0x60]
call fcn.010922b8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.WINMM.dll_timeGetTime]
lea rdx, [0x01082258]
mov ecx, 0x1d
mov dword [0x010e4a74], eax
mov byte [0x010e53dd], r13b
call fcn.01091f4c
lea rcx, [0x01081e88]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov ebx, ebp
cmp rax, rbp
mov rsi, rax
cmovne ebx, r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebp
mov edi, eax
je 0x108e3ea
mov ecx, eax
call fcn.010b7690
lea rcx, [0x01082270]
mov r9d, 0x208
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x010822a0]
lea rdx, [0x01082320]
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.01091f4c
jmp 0x108ece2
mov edi, 0x64
lea r8, [0x01081e60]
lea rcx, [0x010e4d80]
mov rdx, rdi
call fcn.010a6eb8
lea r12, [0x010e4cb0]
lea r8, [0x01081e88]
mov rcx, r12
mov rdx, rdi
call fcn.010a6eb8
lea rcx, [rsp + 0x50]
call fcn.0108fdb4
cmp eax, ebp
mov edi, eax
je 0x108e447
mov ecx, eax
call fcn.010b7690
lea rcx, [0x01082370]
mov r9d, 0x210
jmp 0x108e3c2
lea rcx, [rsp + 0x50]
call fcn.010901e4
cmp eax, ebp
mov edi, eax
je 0x108e470
mov ecx, eax
call fcn.010b7690
lea rcx, [0x010823a0]
mov r9d, 0x215
jmp 0x108e3c2
call fcn.0108fbf0
cmp eax, 4
jge 0x108e484
mov edi, 0x800700d8
jmp 0x108ece2
cmp dword [0x010e53b8], ebp
je 0x108e496
call fcn.010a0d04
jmp 0x108ece2
mov ecx, dword [rsp + 0x50]
mov edx, ebx
call fcn.010909d4
cmp eax, ebp
je 0x108ece2
lea rax, [0x0108f3ec]
mov edx, 0x6b
mov rcx, r14
mov dword [rsp + 0xa0], 0x50
mov dword [rsp + 0xa4], 3
mov dword [rsp + 0xb0], ebp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb4], ebp
mov qword [rsp + 0xb8], r14
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xc0], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, qword [rsp + 0xb8]
mov edx, 0x6c
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 6
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xe0], r12
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xe8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov edx, dword [rsp + 0x50]
mov rcx, r14
call fcn.0108ef60
cmp eax, ebp
je 0x108ece2
cmp dword [0x010e53cc], ebp
je 0x108e5a3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xbb80
mov r8d, 0x18
mov ecx, r13d
call fcn.0109cc20
xor ecx, ecx
mov edx, 0xac44
lea r8d, [rcx + 0x18]
call fcn.0109cc20
jmp 0x108ece2
mov rcx, qword [0x010e5310]
call fcn.010a04c4
cmp dword [0x010e537c], ebp
je 0x108e8fd
lea r12, [0x010823e8]
mov rbx, 0xffffffff80000001
lea r8, [rsp + 0x70]
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x70], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x70]
lea r14, [0x0108b498]
cmp rcx, rbp
jne 0x108e6ad
cmp dword [0x010e5334], 6
mov qword [rsp + 0x60], rbp
jne 0x108e610
cmp dword [0x010e5338], 3
mov dword [rsp + 0x54], r13d
je 0x108e614
mov dword [rsp + 0x54], ebp
lea r8, [0x010821ec]
lea rcx, [rsp + 0x170]
mov r9, r12
mov edx, 0x200
call fcn.010a7ab8
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x108e6b3
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x108e6ad
mov edx, 4
lea rax, [rsp + 0x54]
xor r8d, r8d
mov dword [rsp + 0x28], edx
mov r9d, edx
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, 0xffffffff80000001
mov ebx, ebp
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x108e773
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x108e760
cmp dword [rsp + 0x50], ebp
jne 0x108e760
cmp dword [0x010e5334], 6
jne 0x108e760
cmp dword [0x010e5338], 3
jne 0x108e760
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, r13d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jne 0x108e48c
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x108e8fd
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x68]
lea rdx, [0x0108b4b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x108e7e7
mov ebx, ebp
lea rdx, [0x0108b4d0]
jmp 0x108e823
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x0108b4b0]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, r13d
lea rdx, [0x0108b510]
mov ecx, 0x1d
call fcn.01091f4c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
je 0x108e8fd
mov ebx, 0x68
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rbx
call fcn.010a84b0
lea rax, [rsp + 0x78]
lea rcx, [0x0108b550]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [0x0108b5d0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xdc], 0x80
mov dword [rsp + 0x20], ebp
mov word [rsp + 0xe0], bp
mov dword [rsp + 0x68], 0xff
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebp
je 0x108e8fd
mov rcx, qword [rsp + 0x78]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01091288
cmp eax, ebp
je 0x108e991
cmp dword [0x010e537c], ebp
je 0x108ece2
mov rcx, qword [0x010e5310]
call fcn.010a15e0
cmp dword [0x010e5334], 6
jne 0x108e939
cmp dword [0x010e5338], 3
jne 0x108e939
call fcn.0109c390
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x010d7100]
lea rcx, [0x010d7100]
call qword [rax + 0x18]
lea rdx, [0x01082418]
lea rcx, [rsp + 0x60]
add rax, 0x18
test rdx, 0xffffffffffff0000
mov qword [rsp + 0x60], rax
jne 0x108e97d
movzx edx, dx
call fcn.010919cc
jmp 0x108e982
call fcn.010918c0
lea rcx, [rsp + 0x60]
call fcn.01091644
jmp 0x108ece2
cmp dword [0x010e53a0], ebp
je 0x108e9a5
cmp dword [0x010e53b0], ebp
jne 0x108ece2
cmp dword [0x010e53d4], ebp
mov rcx, qword [0x010e5310]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x110], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x118], rax
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x120], rax
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x128], rax
mov rax, qword [rcx + 0x48]
mov qword [rsp + 0x130], rax
je 0x108ea13
lea r8, [0x01090d68]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call fcn.010a7078
mov qword [0x010e5350], rax
mov r14d, 0x40
lea r12d, [r14 - 0x34]
xor r8d, r8d
lea rdx, [rsp + 0x110]
or r9d, 0xffffffff
lea ecx, [r8 + 5]
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebp
jne 0x108ea5c
mov rcx, qword [0x010e5310]
cmp rcx, rbp
je 0x108ec7e
call fcn.0109e53c
jmp 0x108ec7e
cmp eax, r13d
jne 0x108ea83
mov rcx, qword [0x010e5310]
cmp rcx, rbp
je 0x108ec7e
mov rcx, qword [rcx + 0x68]
cmp rcx, rbp
je 0x108ec7e
jmp 0x108ec47
cmp eax, 2
jne 0x108ebf6
mov rbx, qword [0x010e5310]
cmp rbx, rbp
je 0x108ec7e
lea rdx, [0x0108a3a0]
mov ecx, r12d
call fcn.01091f4c
cmp dword [0x010e5378], ebp
jne 0x108eacf
cmp dword [0x010e5398], ebp
jne 0x108eacf
cmp dword [0x010e53b4], ebp
jne 0x108eacf
cmp dword [0x010e537c], ebp
je 0x108ec7e
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2206b8
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x78], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebp
je 0x108ec7e
cmp dword [rsp + 0x78], ebp
mov ecx, r12d
je 0x108eb30
lea rdx, [0x0108a3d0]
call fcn.01091f4c
mov dword [rbx + 0x50], r13d
jmp 0x108eb3f
lea rdx, [0x0108a3f0]
call fcn.01091f4c
mov dword [rbx + 0x50], ebp
cmp dword [0x010e5378], ebp
jne 0x108eb6f
cmp dword [0x010e537c], ebp
jne 0x108eb6f
cmp dword [0x010e5398], ebp
je 0x108ebdd
mov rcx, qword [rbx + 0x68]
cmp rcx, rbp
je 0x108ebdd
mov rax, qword [rcx]
mov edx, dword [rbx + 0x50]
call qword [rax + 0x20]
jmp 0x108ebdd
cmp dword [0x010e5334], 6
jne 0x108ebbf
mov eax, dword [0x010e5338]
cmp eax, r13d
jne 0x108ebad
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.0109ea00
cmp dword [0x010e53d8], ebp
je 0x108ebdd
mov r8d, dword [rbx + 0x50]
lea rdx, [0x0108b668]
mov ecx, 0x1d
call fcn.01091f4c
jmp 0x108ebdd
cmp eax, 3
jne 0x108ebbf
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.0109ed0c
jmp 0x108ebca
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.0109eb28
cmp dword [0x010e53d8], ebp
je 0x108ebdd
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.010a16d8
cmp dword [0x010e53b4], ebp
je 0x108ec7e
mov rcx, rbx
call fcn.010a0678
jmp 0x108ec7e
cmp eax, 3
jne 0x108ec23
mov rbx, qword [0x010e5310]
cmp rbx, rbp
je 0x108ec7e
cmp qword [rbx + 0x68], rbp
je 0x108ec7e
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x108ec7e
cmp eax, 4
jne 0x108ec7e
mov rbx, qword [0x010e5310]
cmp rbx, rbp
je 0x108ec7e
mov rcx, qword [rbx + 0x68]
cmp rcx, rbp
je 0x108ec7e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
call qword [rax + 0x28]
jmp 0x108ec7e
cmp dword [rsp + 0x140], 0x12
je 0x108ec9f
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x138]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebp
jne 0x108ec58
jmp 0x108ecd9
lea rdx, [0x01082430]
mov ecx, 0x1d
mov r15d, r13d
call fcn.01091f4c
cmp rsi, rbp
mov dword [0x010e5304], r13d
je 0x108ecc7
mov rcx, rsi
call fcn.01091554
mov rcx, qword [0x010e4ca8]
cmp rcx, rbp
je 0x108ece2
call qword [sym.imp.KERNEL32.dll_ResetEvent]
cmp r15d, ebp
je 0x108ea1d
mov ebx, 0x1d
lea rdx, [0x01082490]
mov ecx, ebx
call fcn.01091f4c
cmp dword [0x010e53d4], ebp
je 0x108ed0f
mov rcx, qword [0x010e5350]
cmp rcx, rbp
je 0x108ed0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x010e5360], ebp
je 0x108ed68
mov rcx, qword [0x010e5348]
cmp rcx, rbp
je 0x108ed29
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x0108c4a8]
mov ecx, ebx
call fcn.01091f4c
lea rdx, [0x0108bee8]
mov ecx, ebx
call fcn.01091f4c
mov rcx, qword [0x010e5400]
cmp rcx, rbp
je 0x108ed56
call fcn.010a7704
mov rcx, qword [0x010e52a8]
cmp rcx, rbp
je 0x108ed68
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x01081e88]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rbp
je 0x108ed84
mov rcx, rax
call fcn.01091554
mov rbx, qword [0x010e5308]
cmp rbx, rbp
je 0x108edb1
mov rcx, qword [rbx + 8]
cmp rcx, rbp
je 0x108eda2
call fcn.010a67f8
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.010a67f8
mov qword [0x010e5308], rbp
mov rbx, qword [0x010e5310]
cmp rbx, rbp
je 0x108ee8a
mov rcx, qword [rbx + 0x68]
cmp rcx, rbp
je 0x108edd7
mov rax, qword [rcx]
mov edx, r13d
call qword [rax + 0x30]
mov qword [rbx + 0x68], rbp
mov rcx, rbx
call fcn.0109fa48
mov rcx, rbx
call fcn.0109f794
mov rcx, qword [rbx + 0x30]
cmp rcx, rbp
je 0x108ee00
cmp rcx, 0xffffffffffffffff
je 0x108ee00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], rbp
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x108ee19
cmp rcx, 0xffffffffffffffff
je 0x108ee19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rbp
mov rcx, qword [rbx + 0x28]
cmp rcx, rbp
je 0x108ee32
cmp rcx, 0xffffffffffffffff
je 0x108ee32
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], rbp
mov rcx, qword [rbx + 0x40]
cmp rcx, rbp
je 0x108ee4b
cmp rcx, 0xffffffffffffffff
je 0x108ee4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], rbp
mov rcx, qword [rbx + 0x48]
cmp rcx, rbp
je 0x108ee64
cmp rcx, 0xffffffffffffffff
je 0x108ee64
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call fcn.010a67f8
mov qword [0x010e5310], rbp
mov rcx, qword [0x010e5320]
cmp rcx, rbp
je 0x108eea6
mov rax, qword [rcx]
mov edx, r13d
call qword [rax + 0x30]
mov qword [0x010e5320], rbp
mov rbx, qword [0x010e5318]
cmp rbx, rbp
je 0x108eec9
mov rcx, rbx
call fcn.0109ab2c
mov rcx, rbx
call fcn.010a67f8
mov qword [0x010e5318], rbp
mov rcx, qword [0x010e5328]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x010e52e8]
cmp rcx, rbp
je 0x108eeee
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x010e5060]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x010e5058]
call fcn.010a67f8
cmp byte [0x010e53dc], bpl
je 0x108ef1d
mov rcx, qword [0x010e4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x010e53dd], bpl
mov eax, edi
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.010a6e90
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret