Function at 0x14004c368
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x500
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r15, rcx
lea rcx, str.Starting_RunCommandScan._n
call fcn.1400ec5f0
xor r8d, r8d
lea rdx, str.ScanType
mov rcx, r15
call fcn.1400f6850
mov esi, eax
xor r8d, r8d
lea rdx, str.ScanTrigger
mov rcx, r15
call fcn.1400f6850
mov dword [rbp - 0x78], eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
lea rdx, str.DailyScan
mov rcx, r15
call fcn.1400fece0
xor edi, edi
test rax, rax
setne r14b
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
lea rdx, str.Reinvoke
mov rcx, r15
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x7d]
mov rax, qword [r15]
lea rdx, str.DisableRemediation
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne r12b
mov byte [rbp - 0x7f], r12b
mov rax, qword [r15]
lea rdx, str.Sense
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x7e]
mov rax, qword [r15]
lea rdx, str.DropRemediation
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x7b]
mov rax, qword [r15]
lea rdx, str.ForceRemediation
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x7a]
mov rax, qword [r15]
lea rdx, str.BootSectorScan
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x80]
mov rax, qword [r15]
lea rdx, str.ScheduleJob
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov ecx, edi
test rax, rax
setne cl
mov dword [rbp - 0x60], ecx
mov rax, qword [r15]
lea rdx, str.IdleScheduledJob
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne byte [rbp - 0x7c]
mov rax, qword [r15]
lea rdx, str.Cancel
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne bl
mov rax, qword [r15]
lea rdx, str.ReturnHR
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne r13b
mov byte [rbp - 0x79], r13b
mov rax, qword [r15]
lea rdx, str.File
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov rdi, rax
mov rax, qword [r15]
lea rdx, [0x140120508]
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
lea rcx, [0x140120504]
test rax, rax
cmovne rcx, rax
mov qword [rbp - 0x38], rcx
test bl, bl
je 0x14004c5e5
lea rcx, str.Argument__cancel_detected._Trying_to_cancel_any_quick_full_scan_in_progress..._n
call fcn.14004a438
xor edi, edi
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x68]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov ebx, eax
test eax, eax
js 0x14004d2b6
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.mpclient.dll_MpScanControl]
mov ebx, eax
test eax, eax
js 0x14004d2cc
lea rcx, str.Scan_cancelled_successfully._n
lea rax, str.No_on_going_quick_or_full_scan_found._n
test ebx, ebx
cmovne rcx, rax
call fcn.14004a438
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004c5cf
call qword [sym.imp.mpclient.dll_MpHandleClose]
test r13b, r13b
je 0x14004d244
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14004d244
mov eax, 1
test r14b, r14b
je 0x14004c5f9
xor r14d, r14d
test esi, esi
cmove esi, eax
jmp 0x14004c5fc
xor r14d, r14d
mov qword [rbp - 0x68], r14
lea rcx, [rbp - 0x68]
call fcn.1400c196c
mov ebx, eax
lea rax, [0x140162280]
test ebx, ebx
jns 0x14004c64c
mov rcx, qword [0x140162280]
cmp rcx, rax
je 0x14004c647
test byte [rcx + 0x1c], 2
je 0x14004c647
mov edx, 0x1b
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov rcx, qword [0x140162280]
mov ebx, r14d
jmp 0x14004c653
mov rcx, qword [0x140162280]
test esi, esi
jne 0x14004c686
mov dword [rbp - 0x50], r14d
lea rcx, [rbp - 0x50]
call fcn.14004ba94
mov ebx, eax
test eax, eax
js 0x14004d2e2
mov esi, dword [rbp - 0x50]
mov edx, esi
lea rcx, str.RunCommandScan_is_using_default_scan_type:__lu._n
call fcn.1400ec5f0
mov rcx, qword [0x140162280]
mov eax, esi
sub eax, 1
je 0x14004c6b4
sub eax, 1
je 0x14004c6ac
cmp eax, 1
jne 0x14004d329
xor esi, esi
lea r14d, [rax + 2]
test rdi, rdi
je 0x14004d297
jmp 0x14004c6bc
mov r14d, 2
jmp 0x14004c6ba
mov r14d, 1
xor esi, esi
cmp byte [rbp - 0x7d], sil
jne 0x14004c719
mov rcx, r15
call fcn.14004b558
test al, al
je 0x14004c6e4
test r13b, r13b
je 0x14004d235
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14004d235
mov rax, qword [r15]
lea rdx, str.RestrictPrivilegesScan
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004c719
xor edx, edx
xor ecx, ecx
call fcn.140050378
test eax, eax
js 0x14004c719
test r13b, r13b
je 0x14004d235
mov ecx, eax
jmp 0x14004c6d9
call fcn.14004b51c
test al, al
je 0x14004d36c
mov rcx, qword [rbp - 0x38]
call fcn.14000e0a0
mov r13d, eax
lea ecx, [rax - 1]
cmp ecx, 0x1d
jbe 0x14004c74b
mov eax, 7
lea r13d, [rax - 6]
cmp r14d, 2
cmove r13d, eax
imul ebx, r13d, 0x521c820
mov dword [rbp - 0x4c], esi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp - 0x4c]
mov edx, ebx
lea rcx, str.MpCmdRun_ScanTerminationTimeOut
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
test eax, eax
js 0x14004d383
mov qword [rbp + 0x20], rsi
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov edx, dword [rbp - 0x4c]
lea rcx, [rbp + 0x20]
call fcn.1400f15e4
test eax, eax
js 0x14004d38b
cmp r14d, 2
sete dl
mov byte [0x14016a106], dl
lea rcx, [rbp - 0x38]
call fcn.14004b3b8
nop
mov rcx, r15
call fcn.14004ddd8
mov qword [rbp - 0x40], rsi
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov ebx, eax
test eax, eax
js 0x14004d393
lea rcx, [rbp + 0x130]
call fcn.14004ad54
nop
mov qword [rbp - 0x70], rsi
lea rax, [0x14004bb60]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0xf8], rax
cmp r14d, 3
jne 0x14004c82e
cmp byte [rbp - 0x7e], sil
je 0x14004c822
movzx ebx, r12b
xor ebx, 1
shl ebx, 0x1c
add ebx, 0x8000021
jmp 0x14004c839
test r12b, r12b
je 0x14004c82e
mov ebx, 0x2001021
jmp 0x14004c839
mov ebx, 0x4001
cmp r14d, 3
jne 0x14004c84b
mov sil, byte [rbp - 0x80]
xor r12d, r12d
test sil, sil
je 0x14004c852
bts ebx, 9
jmp 0x14004c852
mov sil, byte [rbp - 0x80]
xor r12d, r12d
cmp byte [0x14016a106], r12b
jne 0x14004c876
mov rax, qword [r15]
lea rdx, str.ScanProgress
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004c879
or ebx, 2
mov rax, qword [r15]
lea rdx, str.CpuThrottling
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004c898
bts ebx, 0x11
cmp byte [rbp - 0x7c], r12b
je 0x14004c8cb
mov dword [rbp - 0x48], r12d
lea r8, str.DisableCpuThrottleOnIdleScans
lea rdx, str.Scan
lea rcx, [rbp - 0x48]
call fcn.1400c0928
test eax, eax
js 0x14004c8cb
cmp dword [rbp - 0x48], 1
jne 0x14004c8cb
btr ebx, 0x11
bts ebx, 0x12
mov rax, qword [r15]
lea rdx, str.NoToast
mov rcx, r15
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004c8ea
bts ebx, 0x1d
test rdi, rdi
je 0x14004c904
mov rcx, rdi
call fcn.1400f18e0
test eax, eax
js 0x14004c909
lea r12, str.folder
jmp 0x14004c91f
mov eax, 0x80004005
mov r15d, 0x80070002
cmp eax, r15d
je 0x14004d3da
lea r12, str.file
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004c955
test byte [rcx + 0x1c], 4
je 0x14004c955
mov edx, 0x20
mov qword [rsp + 0x20], rdi
mov r9, r12
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.14004a308
mov r8, rdi
mov rdx, r12
lea rcx, str.Scanning_path_as__ls:__ls._n
call fcn.1400ec5f0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], rdi
xor r15d, r15d
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
mov qword [rbp + 0xe0], 1
lea rax, [rbp + 0x110]
mov qword [rbp + 0xe8], rax
mov edx, ebx
cmp r14d, 3
jne 0x14004c9ca
movzx eax, sil
movzx r9d, byte [rbp - 0x7f]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r8, rdi
lea rcx, str.Start:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_lu__path__ls__DisableRemediation___u__BootSectorScan___u__Timeout_in_days___lu__n
call fcn.1400ec5f0
jmp 0x14004c9d9
mov r8d, r13d
lea rcx, str.Start:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_lu__Timeout_in_days___lu__n
call fcn.1400ec5f0
lea rcx, [rbp + 0x160]
call fcn.14004ae0c
mov rsi, qword [0x14016b890]
test rsi, rsi
je 0x14004cbed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140162450], 5
jbe 0x14004cbde
movabs rdx, 0x400000000000
test qword [0x140162460], rdx
je 0x14004cbde
mov rax, qword [0x140162468]
and rax, rdx
cmp rax, qword [0x140162468]
jne 0x14004cbde
mov r15d, dword [rbp - 0x78]
mov dword [rbp - 0x78], r15d
mov dword [rbp + 0x10], r14d
mov eax, dword [rbp - 0x60]
mov dword [rbp - 0x60], eax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x50], rax
xor ecx, ecx
mov edx, ecx
lock xadd qword [rbp + 0x1e8], rdx
lea r8, [rbp + 0x290]
lea rcx, [rbp + 0x160]
call fcn.14004dce8
lea rax, [rbp + 0x290]
mov qword [rbp + 0x58], rax
mov rcx, qword [0x14016b888]
mov eax, dword [rcx + 0x48]
mov dword [rbp + 0x14], eax
mov eax, dword [rcx + 0x44]
mov dword [rbp + 0x28], eax
mov eax, dword [rcx + 0x40]
mov dword [rbp - 0x30], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rbp - 0x2c], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rbp - 0x28], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rbp - 0x24], eax
movzx eax, byte [rcx + 0x39]
mov dword [rbp - 0x20], eax
movzx eax, byte [rcx + 0x38]
mov dword [rbp - 0x1c], eax
mov rax, qword [rcx + 0x30]
mov qword [rbp + 0x60], rax
mov rax, qword [rcx + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rcx + 0x20]
mov qword [rbp + 0x70], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0x78], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0x80], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], 0x2000000
lea rax, [rbp - 0x78]
mov qword [rsp + 0xb8], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0xb0], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0xa8], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0xa0], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x98], rax
lea rax, [rbp + 0x14]
mov qword [rsp + 0x90], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x88], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x80], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x24]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea rdx, [0x14014dbd6]
call fcn.140001320
jmp 0x14004cbe2
mov r15d, dword [rbp - 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14004cbf1
mov r15d, dword [rbp - 0x78]
lea rcx, str.Scan_starting..._n
call fcn.14004a438
mov ecx, 1
call fcn.1400062f0
mov rcx, rax
call fcn.14000e664
mov rcx, qword [rbp - 0x70]
xor esi, esi
test rcx, rcx
je 0x14004cc24
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x70], rsi
lea rax, [rbp + 0xe0]
cmp r14d, 3
cmovne rax, rsi
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, ebx
mov edx, r14d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.mpclient.dll_MpScanStartEx]
mov esi, eax
test eax, eax
js 0x14004d42b
or edx, 0xffffffff
mov rcx, qword [rbp + 0x130]
call fcn.1400f1e80
mov r15d, dword [rbp + 0x138]
lea rcx, [rbp + 0x160]
call fcn.14004b42c
mov rax, qword [0x14016b890]
mov qword [rbp + 0xd8], rax
test rax, rax
je 0x14004ce90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140162450], 5
jbe 0x14004ce83
movabs rdx, 0x400000000000
test qword [0x140162460], rdx
je 0x14004ce83
mov rax, qword [0x140162468]
and rax, rdx
cmp rax, qword [0x140162468]
jne 0x14004ce83
mov dword [rbp - 0x18], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp - 0x14], eax
xor eax, eax
mov edx, eax
lock xadd qword [rbp + 0x1e8], rdx
lea r8, [rbp + 0x320]
lea rcx, [rbp + 0x160]
call fcn.14004dce8
lea rax, [rbp + 0x320]
mov qword [rbp + 0x98], rax
mov rcx, qword [0x14016b888]
mov eax, dword [rcx + 0x48]
mov dword [rbp - 0x10], eax
mov eax, dword [rcx + 0x44]
mov dword [rbp + 0xc], eax
mov eax, dword [rcx + 0x40]
mov dword [rbp - 0xc], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rbp - 8], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rbp - 4], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rbp], eax
movzx eax, byte [rcx + 0x39]
mov dword [rbp + 4], eax
movzx eax, byte [rcx + 0x38]
mov dword [rbp + 8], eax
mov rax, qword [rcx + 0x30]
mov qword [rbp + 0xa0], rax
mov rax, qword [rcx + 0x28]
mov qword [rbp + 0xa8], rax
mov rax, qword [rcx + 0x20]
mov qword [rbp + 0xb0], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0xb8], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0xc0], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], 0x2000000
lea rax, [rbp - 0x18]
mov qword [rsp + 0xa8], rax
lea rax, [rbp - 0x14]
mov qword [rsp + 0xa0], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x98], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x90], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x88], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x80], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x70], rax
lea rax, [rbp]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea rdx, [0x14014dadc]
call fcn.140001654
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15d, r15d
js 0x14004d479
lea rcx, str.Scan_finished._n
call fcn.14004a438
mov ecx, 1
call fcn.1400062f0
mov rcx, rax
call fcn.14000e664
mov edx, ebx
lea rcx, str.Finish:_MpScanStart_MP_FEATURE_SUPPORTED__dwOptions_lu__n
call fcn.1400ec5f0
mov edx, ebx
cmp r14d, 3
jne 0x14004cef0
movzx eax, byte [rbp - 0x80]
movzx r9d, byte [rbp - 0x7f]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r8, rdi
lea rcx, str.Finish:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_lu__path__ls__DisableRemediation___u__BootSectorScan___u__Timeout_in_days___lu__n
call fcn.1400ec5f0
jmp 0x14004ceff
mov r8d, r13d
lea rcx, str.Finish:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_lu__Timeout_in_days___lu__n
call fcn.1400ec5f0
mov bl, byte [rbp - 0x7f]
mov r8b, bl
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x1f0]
call fcn.14004ab44
xor r15d, r15d
cmp r14d, 3
jne 0x14004cff6
mov r14d, dword [rbp + 0x218]
test r14d, r14d
je 0x14004cf54
mov r8d, r14d
mov rdx, rdi
lea rcx, str.Scanning__ls_found__lu_threats._n
call fcn.1400ec5f0
mov r8d, r14d
mov rdx, rdi
lea rcx, str.Scanning__ls_found__lu_threats._n
call fcn.14004aaf4
jmp 0x14004cfa6
cmp qword [rbp + 0x240], r15
jne 0x14004cf88
lea rdx, str.folder
mov rcx, r12
call fcn.140005abc
test eax, eax
je 0x14004cf88
mov rdx, rdi
lea rcx, str.Scanning__ls_was_skipped._n
call fcn.1400ec5f0
lea rcx, str.Scanning__ls_was_skipped._n
jmp 0x14004cf9e
mov rdx, rdi
lea rcx, str.Scanning__ls_found_no_threats._n
call fcn.1400ec5f0
lea rcx, str.Scanning__ls_found_no_threats._n
mov rdx, rdi
call fcn.14004aaf4
test bl, bl
je 0x14004cff6
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004cfd8
test byte [rcx + 0x1c], 4
je 0x14004cfd8
mov edx, 0x23
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.Skipping_clean_as_this_is_a_custom_scan_with_no_remediation._n
call fcn.1400ec5f0
cmp dword [rbp + 0x218], r15d
jne 0x14004d2a2
jmp 0x14004d1b1
movzx edi, byte [rbp - 0x7e]
test dil, dil
je 0x14004d023
cmp dword [rbp + 0x218], r15d
je 0x14004d1b1
cmp byte [rbp - 0x7b], r15b
je 0x14004d056
lea rcx, str.Option__DropRemediation_specified__skipping_cleaning._n
call fcn.14004a438
jmp 0x14004d1b1
lea rcx, [rbp + 0x1f0]
call fcn.14004dbb8
test eax, eax
jne 0x14004d056
cmp dword [rbp + 0x218], r15d
je 0x14004d1b1
cmp byte [rbp - 0x7a], r15b
je 0x14004d1b1
lea rcx, str.ForceRemediation_option_set__forcing_cleaning_detected_threats_...
call fcn.1400ec5f0
lea rcx, str.Cleaning_started..._n
call fcn.14004a438
mov qword [rbp + 0x18], r15
mov r9d, edi
add r9d, r9d
mov r8, qword [rbp - 0x70]
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x18]
call fcn.14004affc
mov ebx, eax
test eax, eax
js 0x14004d4c9
mov qword [rbp - 0x58], r15
mov rcx, qword [rbp - 0x70]
test dil, dil
jne 0x14004d0bd
test rcx, rcx
je 0x14004d0b9
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004d0b9
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x58], r15
mov rcx, qword [rbp - 0x40]
mov rbx, qword [rbp + 0x18]
lea r8, [rbp - 0x58]
mov rdx, rbx
call qword [sym.imp.mpclient.dll_MpCleanOpen]
mov edi, eax
test eax, eax
js 0x14004d510
lea rcx, [rbp + 0x30]
call fcn.14004ad54
mov dword [rbp + 0x48], r15d
mov byte [rbp + 0x4c], r15b
lea rax, [0x14004b820]
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x108], rax
lea rcx, str.Start:_MpCleanStart___n
call fcn.1400ec5f0
lea r8, [rbp + 0x100]
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.mpclient.dll_MpCleanStart]
mov edi, eax
test eax, eax
js 0x14004d557
or edx, 0xffffffff
mov rcx, qword [rbp + 0x30]
call fcn.1400f1e80
mov esi, dword [rbp + 0x38]
test esi, esi
js 0x14004d59e
cmp byte [rbp + 0x4c], r15b
jne 0x14004d274
lea rcx, str.Cleaning_finished._n
call fcn.14004a438
lea rcx, str.Finish:_MpCleanThreats___n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14004d175
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004d185
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rbx, rbx
je 0x14004d1b1
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004d199
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004d1a8
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpFreeMemory]
cmp byte [rbp - 0x79], r15b
je 0x14004d1c0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14004d1d0
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
mov rcx, qword [rbp + 0x130]
test rcx, rcx
je 0x14004d1e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14004d1f3
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
or rbx, 0xffffffffffffffff
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14004d220
mov ecx, ebx
lock xadd dword [rax + 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x14004d220
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
lea edx, [rbx + 2]
mov rax, qword [rax]
call fcn.1400fece0
nop
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x14004d235
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004d244
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140030c40
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, str.Additional_Actions_Required
call fcn.1400ec5f0
lea rcx, str.Additonal_Actions_Required._n
call fcn.14004a438
mov ecx, 0x80501001
call fcn.1400f10c4
nop
mov ecx, 0x80070667
call fcn.1400f10c4
nop
mov rcx, qword [rbp - 0x70]
call fcn.14004be1c
mov ecx, 0x80501003
call fcn.1400f10c4
nop
mov edx, ebx
lea rcx, str.ERROR:_MpManagerOpen_Failed__lx_n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpScanControl_Failed__lx_n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d313
test byte [rcx + 0x1c], 1
je 0x14004d313
mov edx, 0x1c
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_MpConfigLoadScanParameters_Failed__lx_n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d353
test byte [rcx + 0x1c], 1
je 0x14004d353
mov edx, 0x1d
mov r9d, esi
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.ERROR:_Unsupported_type__lu_n
call fcn.1400ec5f0
mov ecx, 0x80070667
call fcn.1400f10c4
int3
lea rcx, str.WARN:_Product_Feature_disabled_n
call fcn.1400ec5f0
mov ecx, 0x80004005
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d3c4
test byte [rcx + 0x1c], 1
je 0x14004d3c4
mov edx, 0x1e
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_MpManagerOpen_Failed__lx_n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d410
test byte [rcx + 0x1c], 1
je 0x14004d410
mov edx, 0x1f
mov dword [rsp + 0x20], r15d
mov r9, rdi
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r15d
mov rdx, rdi
lea rcx, str.Invalid_path_to_scan:__ls._hr___lx_n
call fcn.1400ec5f0
mov ecx, r15d
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d460
test byte [rcx + 0x1c], 1
je 0x14004d460
mov edx, 0x21
mov dword [rsp + 0x20], esi
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044484
mov r8d, esi
mov edx, ebx
lea rcx, str.ERROR:_MpScanStart_dwOptions_lu__Failed__lx_n
call fcn.1400ec5f0
mov ecx, esi
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d4af
test byte [rcx + 0x1c], 1
je 0x14004d4af
mov edx, 0x22
mov dword [rsp + 0x20], r15d
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044484
mov r8d, r15d
mov edx, ebx
lea rcx, str.ERROR:_MpScan_dwOptions_lu__Completion_Failed__lx_n
call fcn.1400ec5f0
mov ecx, r15d
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d4fa
test byte [rcx + 0x1c], 1
je 0x14004d4fa
mov edx, 0x24
mov r9d, ebx
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ConstructCleanInfo_Failed__lx_n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d541
test byte [rcx + 0x1c], 1
je 0x14004d541
mov edx, 0x25
mov r9d, edi
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_MpCleanOpen___Failed__lx_n
call fcn.1400ec5f0
mov ecx, edi
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d588
test byte [rcx + 0x1c], 1
je 0x14004d588
mov edx, 0x26
mov r9d, edi
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_MpCleanStart___Failed__lx_n
call fcn.1400ec5f0
mov ecx, edi
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x14004d5cf
test byte [rcx + 0x1c], 1
je 0x14004d5cf
mov edx, 0x27
mov r9d, esi
lea r8, [0x140121de0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.ERROR:_MpCleanThreats___Completion_Failed__lx_n
call fcn.1400ec5f0
lea rcx, str.Cleaning_failed._n
call fcn.14004a438
cmp byte [rbp + 0x4c], r15b
je 0x14004d607
lea rcx, str.Additional_Actions_Required
call fcn.1400ec5f0
lea rcx, str.Additonal_Actions_Required._n
call fcn.14004a438
mov ecx, esi
call fcn.1400f10c4
int3