Function at 0x14000b828
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x23d8]
mov eax, 0x24b0
call fcn.1400123e0
sub rsp, rax
mov rax, qword [0x140019200]
xor rax, rsp
mov qword [rbp + 0x23a0], rax
mov rdi, rcx
mov dword [rbp + 0x670], 0x11c
lea rax, [rbp + 8]
mov r15d, 1
lea rcx, [rbp + 0x670]
mov dword [rbp], r15d
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
je 0x14000b8ac
mov byte [0x14001a47c], r15b
mov byte [0x14001a128], r15b
mov rax, qword [0x1400180c0]
mov r12d, 0x104
mov word [rax], r13w
mov rax, qword [0x1400188d0]
mov word [rax], r13w
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], r12d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov esi, 0x20
mov rbx, rax
lea ecx, [rsi + 2]
cmp word [rax], cx
jne 0x14000b8f6
add rbx, 2
jmp 0x14000b8f9
movzx ecx, si
movzx eax, word [rbx]
test ax, ax
je 0x14000b91c
cmp ax, cx
je 0x14000b912
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14000b901
cmp word [rbx], r13w
je 0x14000b91c
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x14001a490], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
nop dword [rax + rax]
mov qword [0x14001a138], rax
cmp rax, 0xffffffffffffffff
je 0x14000b955
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop dword [rax + rax]
cmp eax, 3
je 0x14000b95c
mov qword [0x14001a138], r13
mov edi, 0x800
mov dword [rbp - 0x54], r13d
mov r8d, edi
lea rcx, [rbp + 0xba0]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, edi
lea rcx, [rbp + 0x13a0]
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [0x140019ef4], r13d
mov r14d, 9
cmp word [rbx], si
je 0x14000b99f
cmp word [rbx], r14w
jne 0x14000b9a5
add rbx, 2
jmp 0x14000b994
movzx eax, word [rbx]
mov ecx, 0xfffd
sub ax, 0x2d
test cx, ax
jne 0x14000bba8
lea rax, [rbx + 2]
test rax, rax
je 0x14000bba8
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x14000bba8
add rbx, 4
mov rax, rbx
mov qword [rsp + 0x78], rbx
cmp word [rbx], si
je 0x14000b9ee
cmp word [rbx], r14w
jne 0x14000b9f4
lea rbx, [rax + 2]
jmp 0x14000b9db
lea rax, [rbp + 0xba0]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.140008df0
test al, al
jne 0x14000ba43
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
cmp dword [rbp + 0x18], r12d
jle 0x14000ba36
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
mov dword [rbp + 0x18], r12d
jmp 0x14000c790
mov eax, dword [rbp + 0x18]
mov r9d, 0x20019
add eax, eax
mov dword [rbp - 0x78], r13d
cmp byte [0x14001a47c], r13b
mov dword [rbp - 0x74], eax
jne 0x14000ba6e
cmp byte [0x14001a128], r13b
mov eax, 0x20119
cmovne r9d, eax
lea rax, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000bb69
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov rax, qword [rbp + 0x10]
lea rdx, [rbp + 0xba0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
jne 0x14000bb2d
mov edx, dword [rbp - 0x74]
lea rcx, [rbp + 0x10]
shr edx, 1
call fcn.14000f108
mov rcx, qword [rsp + 0x68]
test al, al
jne 0x14000baff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000bc08
lea rax, [rbp - 0x74]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov rax, qword [rbp + 0x10]
lea rdx, [rbp + 0xba0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000bb69
cmp dword [rbp - 0x78], r15d
jne 0x14000bb69
mov rbx, qword [rbp + 0x10]
movzx edi, word [rbx]
mov qword [rsp + 0x78], rbx
cmp di, si
je 0x14000bb63
cmp di, r14w
jne 0x14000c16b
add rbx, 2
jmp 0x14000bb4c
cmp dword [rbp + 0x18], r12d
jle 0x14000bb7f
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], r12d
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x14000bba1
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000de24
mov edi, 0x7fffffff
mov rax, rbx
mov edx, edi
cmp word [rax], r13w
je 0x14000bbc1
add rax, 2
sub rdx, r15
jne 0x14000bbb2
mov rcx, rdi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
jne 0x14000bbf7
cmp dword [rbp + 0x18], r12d
jle 0x14000bbee
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov dword [rbp + 0x18], r12d
jmp 0x14000de01
lea edx, [r8 + 1]
lea rcx, [rbp + 0x10]
call fcn.14000f108
test al, al
jne 0x14000bc4a
cmp dword [rbp + 0x18], r12d
jle 0x14000bc1e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], r12d
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x14000bc40
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0xe
jmp 0x14000de24
mov rax, qword [rbp + 0x10]
lea rcx, str.package
mov qword [rbp + 0xa30], rcx
mov rdx, rdi
mov byte [rbp + 0xa40], r15b
mov byte [rbp + 0xa58], r15b
mov word [rax], r13w
lea rax, str.update
movsd xmm0, qword [str.PATCH]
movups xmm1, xmmword [0x140014590]
mov qword [rbp + 0xa00], rax
lea rax, str.uninstall
mov qword [rbp + 0xa18], rax
lea rax, [0x140014410]
mov qword [rbp + 0xa38], rax
lea rax, str.help
mov qword [rbp + 0xa48], rax
lea rax, [0x140014424]
mov qword [rbp + 0xa50], rax
lea rax, str.quiet
mov qword [rbp + 0xa60], rax
lea rax, [0x140014440]
mov qword [rbp + 0xa68], rax
lea rax, str.passive
mov qword [rbp + 0xa78], rax
lea rax, str._qb___REBOOTPROMPTS
mov qword [rbp + 0xa80], rax
lea rax, str.norestart
mov qword [rbp + 0xa90], rax
lea rax, str.REBOOTReallySuppress
mov qword [rbp + 0xa98], rax
lea rax, str.forcerestart
mov qword [rbp + 0xaa8], rax
lea rax, str.REBOOTForce
mov qword [rbp + 0xab0], rax
lea rax, str.promptrestart
mov qword [rbp + 0xac0], rax
lea rax, str.REBOOTPROMPT__
mov qword [rbp + 0xac8], rax
lea rax, [0x140014550]
mov qword [rbp + 0xad8], rax
lea rax, [0x140014558]
mov qword [rbp + 0xae0], rax
mov eax, dword [0x140014560]
mov dword [rbp + 0x9b0], eax
movzx eax, word [0x140014564]
mov word [rbp + 0x9b4], ax
mov eax, dword [0x140014568]
mov dword [rbp + 0x9b8], eax
movzx eax, word [0x14001456c]
mov word [rbp + 0x9bc], ax
mov eax, dword [0x140014578]
mov dword [rbp + 0x9c8], eax
movzx eax, word [0x14001457c]
movsd qword [rbp + 0x9c0], xmm0
movups xmm0, xmmword [str.MSIPATCHREMOVE]
mov word [rbp + 0x9cc], ax
mov rax, rcx
mov byte [rbp + 0xa70], r15b
mov byte [rbp + 0xa88], r15b
mov byte [rbp + 0xaa0], r15b
mov byte [rbp + 0xab8], r15b
mov byte [rbp + 0xad0], r15b
mov byte [rbp + 0xae8], r15b
movups xmmword [rbp + 0x9e0], xmm0
movups xmmword [rbp + 0x9f0], xmm1
cmp word [rax], r13w
je 0x14000be15
add rax, 2
sub rdx, r15
jne 0x14000be06
mov rcx, rdi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r14, r14
and r14, rcx
test rdx, rdx
je 0x14000bbd8
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], r13
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.1400066fc
mov rsi, rax
test rax, rax
je 0x14000bf28
movzx eax, word [rax]
test ax, ax
je 0x14000bf28
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x14000be39
mov r15, qword [rbp - 0x80]
mov ecx, 1
lea r12, [r15 - 1]
cmp r12, rcx
jne 0x14000beb0
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x1400145a0]
mov edx, ecx
mov qword [rsp + 0x20], rax
mov ecx, 0x409
lea r9d, [r15 - 1]
lea r8, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14000befd
cmp r14, r12
jne 0x14000bef2
lea r9d, [r15 - 1]
mov dword [rsp + 0x28], r14d
lea rax, str.package
mov r15d, 1
mov edx, r15d
mov qword [rsp + 0x20], rax
lea r8, [rsi + 2]
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14000bf03
jmp 0x14000be39
mov r15d, 1
jmp 0x14000be39
mov r15d, 1
lea rax, [rbp + 0x9c0]
mov byte [rbp + 0xa10], r13b
mov qword [rbp + 0xa08], rax
lea rax, [rbp + 0x9e0]
mov byte [rbp + 0xa28], r13b
jmp 0x14000bf4b
lea rax, [rbp + 0x9b8]
mov byte [rbp + 0xa10], r15b
mov qword [rbp + 0xa08], rax
lea rax, [rbp + 0x9b0]
mov byte [rbp + 0xa28], r15b
mov qword [rbp + 0xa20], rax
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], r13
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.1400066fc
mov rbx, rax
test rax, rax
je 0x14000c0ba
movzx eax, word [rax]
test ax, ax
je 0x14000c0ba
mov r12, qword [rbp - 0x80]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x14000bff3
mov r14d, r13d
lea rcx, [rbx + 2]
mov rsi, r13
lea r15, [rbp + 0xa00]
mov rax, qword [r15]
lea r9d, [r12 - 1]
or dword [rsp + 0x28], 0xffffffff
mov r8, rcx
mov ecx, 0x409
mov qword [rsp + 0x20], rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14000c017
mov eax, 1
lea rcx, [rbx + 2]
add r14d, eax
add rsi, rax
add r15, 0x18
cmp r14d, 0xa
jb 0x14000bfa4
xor r13d, r13d
mov r15d, eax
mov dword [rbp + 0x1c], 0x104
mov r9b, r15b
mov r8, r12
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.14000408c
mov ebx, eax
test eax, eax
jne 0x14000c075
jmp 0x14000bf5b
lea rax, [rsi + rsi*2]
mov dword [rbp + 0x1c], 0x104
mov rdx, qword [rbp + rax*8 + 0xa08]
xor r13d, r13d
mov r9b, byte [rbp + rax*8 + 0xa10]
test rdx, rdx
je 0x14000c06a
mov r10, rdi
lea r15d, [r13 + 1]
mov rax, rdx
cmp word [rax], r13w
je 0x14000c053
add rax, 2
sub r10, r15
jne 0x14000c044
mov rcx, rdi
mov rax, r10
sub rcx, r10
neg rax
sbb r8, r8
and r8, rcx
test r10, r10
jne 0x14000c003
mov ebx, 0x65b
mov r15d, 1
cmp dword [rbp + 0x18], 0x104
jle 0x14000c08e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 0x104
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x14000c0b3
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14000de24
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14000dde2
mov rcx, rdi
mov rax, rbx
cmp word [rax], r13w
je 0x14000c0dc
add rax, 2
sub rcx, r15
jne 0x14000c0cd
sub rdi, rcx
mov rax, rcx
neg rax
sbb rdx, rdx
and rdx, rdi
test rcx, rcx
je 0x14000dde2
mov esi, 0x20
lea r15d, [rsi - 0x17]
test rdx, rdx
je 0x14000c128
lea rax, [rbx - 2]
lea rax, [rax + rdx*2]
cmp word [rax], si
je 0x14000c115
cmp word [rax], r15w
jne 0x14000c128
cmp rax, rbx
jb 0x14000c128
mov word [rax], r13w
sub rax, 2
mov rbx, qword [rbp + 0x10]
jmp 0x14000c10a
movzx edi, word [rbx]
mov qword [rsp + 0x78], rbx
test di, di
je 0x14000c163
cmp di, si
je 0x14000c144
mov eax, 9
cmp di, ax
jne 0x14000c155
add rbx, 2
mov qword [rsp + 0x78], rbx
movzx edi, word [rbx]
test di, di
jne 0x14000c135
mov r12d, 0x104
mov r15d, 9
jmp 0x14000c16e
mov r12d, 0x104
jmp 0x14000c16e
mov r15d, r14d
mov rsi, qword [0x140019d68]
mov r14d, r13d
mov dword [rbp - 0x68], r13d
lea r8, str.RUVEH_IJDqXFAtPYZlgmnc
mov r9d, 0x52
test di, di
je 0x14000c7ba
lea r15d, [r9 - 0x32]
cmp di, 0x2f
je 0x14000c2cc
cmp di, 0x2d
je 0x14000c2cc
xor edx, edx
lea rcx, [rbp + 0x7a0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x7a0]
mov dword [rbp + 0x798], r12d
lea rdx, [rbp + 0x790]
mov qword [rbp + 0x790], rax
lea rcx, [rsp + 0x78]
mov dword [rbp + 0x79c], r12d
call fcn.1400089f4
test eax, eax
je 0x14000c6ed
mov rsi, qword [rbp + 0x790]
test rsi, rsi
je 0x14000c27a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
mov edx, dword [0x14001a010]
lea rcx, [0x1400180c0]
add edx, 2
mov ebx, eax
add edx, eax
call fcn.14000b2fc
test al, al
je 0x14000c273
movsxd rcx, dword [0x14001a010]
mov r8, rsi
mov rax, qword [0x1400180c0]
lea r11d, [rcx + 1]
mov word [rax + rcx*2], r15w
lea eax, [rbx + 1]
movsxd rdx, eax
mov rax, qword [0x1400180c0]
movsxd rcx, r11d
mov dword [0x14001a010], r11d
lea rcx, [rax + rcx*2]
call fcn.14000f884
test eax, eax
js 0x14000c273
lea eax, [rbx + r11]
mov dword [0x14001a010], eax
mov rsi, qword [rbp + 0x790]
mov rbx, qword [rsp + 0x78]
mov r14d, 9
movzx edi, word [rbx]
cmp di, r15w
je 0x14000c294
cmp di, r14w
jne 0x14000c29f
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x14000c285
mov r14d, dword [rbp - 0x68]
cmp dword [rbp + 0x798], r12d
jle 0x14000c2c0
test rsi, rsi
je 0x14000c2c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rsi, qword [0x140019d68]
jmp 0x14000c6d2
lea rax, [rbx + 2]
mov edx, 0x20
movzx ecx, word [rax]
mov rbx, rax
or ecx, edx
cmp r13w, word [rax]
je 0x14000c2e7
add rbx, 2
mov qword [rsp + 0x78], rbx
mov r15, r8
movzx eax, r9w
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x14000c34b
add r15, 2
movzx eax, word [r15]
test ax, ax
jne 0x14000c2f3
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
mov r14d, 0x667
call fcn.140007cb8
cmp dword [rbp + 0x18], 0x104
jle 0x14000c336
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov eax, 1
cmp dword [rbp], eax
jmp 0x14000c914
cmp word [rbx], dx
ja 0x14000c368
movzx eax, word [rbx]
movabs rcx, 0x100000201
bt rcx, rax
jae 0x14000c368
mov r8d, r13d
jmp 0x14000c36e
mov r8d, 1
mov dword [rbp - 0x64], r8d
mov edi, 9
cmp word [rbx], dx
je 0x14000c381
cmp word [rbx], di
jne 0x14000c38c
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x14000c377
cmp word [r15], 0x63
lea rax, [rbp + 0xba0]
mov qword [rbp - 0x80], rax
mov edi, 1
jne 0x14000c3b1
test r8d, r8d
jne 0x14000c309
jmp 0x14000c43f
cmp word [r15], 0x50
jne 0x14000c406
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
lea rcx, [rbp - 8]
lea edx, [rax + 0xa]
call fcn.14000f08c
test al, al
je 0x14000c752
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x40]
mov r8d, dword [rbp]
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x40], rax
call fcn.140008df0
test al, al
je 0x14000c72a
mov rsi, qword [0x140019d68]
jmp 0x14000c435
cmp word [r15], 0x71
je 0x14000c414
cmp word [r15], 0x63
jne 0x14000c419
test r8d, r8d
je 0x14000c43f
mov r8d, 0x400
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.140008df0
test al, al
je 0x14000c72a
mov rbx, qword [rsp + 0x78]
mov edx, 0x20
mov r8d, 9
movzx edi, word [rbx]
cmp di, dx
je 0x14000c453
cmp di, r8w
jne 0x14000c45e
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x14000c445
movzx ecx, word [r15]
mov r8d, dword [rbp - 0x64]
lea eax, [rcx - 0x46]
cmp ax, 0x2b
ja 0x14000c47f
movabs rdx, 0x80000000011
bt rdx, rax
jb 0x14000c49a
lea r13, [rbp + 0xba0]
movzx edx, cx
lea r12, [rbp + 0x13a0]
cmp cx, 0x6c
jne 0x14000c51d
lea r13, [rbp + 0xba0]
movzx edx, cx
lea r12, [rbp + 0x13a0]
test r8d, r8d
je 0x14000c51d
lea rax, [rbp + 0x13a0]
mov qword [rbp - 0x80], rax
lea r12, [rbp + 0xba0]
lea r13, [rbp + 0x13a0]
cmp cx, 0x71
je 0x14000c51d
mov r8d, 0x400
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.140008df0
test al, al
je 0x14000c75d
mov rbx, qword [rsp + 0x78]
mov eax, 0x20
lea r14d, [rax - 0x17]
movzx edi, word [rbx]
cmp di, ax
je 0x14000c507
cmp di, r14w
jne 0x14000c512
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x14000c4f9
movzx ecx, word [r15]
mov r14d, dword [rbp - 0x68]
movzx edx, cx
lea eax, [rdx - 0x61]
cmp ax, 0x19
ja 0x14000c56b
lea rax, str.RUVEH_IJDqXFAtPYZlgmnc
sub r15, rax
sar r15, 1
movabs r10, 0xfec0a6591e564070
lea rax, [0x140013010]
mov rdx, r13
mov rax, qword [rax + r15*8]
mov rcx, r12
call qword [0x140013788]
xor r13d, r13d
test eax, eax
jne 0x14000c309
mov rsi, qword [0x140019d68]
jmp 0x14000c6b6
test rsi, rsi
je 0x14000c616
mov eax, 0x41
cmp dx, 0x50
jne 0x14000c5e9
cmp word [rsi], ax
jne 0x14000c5e9
mov ecx, eax
lea rdx, [rbp + 0x1ba0]
call fcn.14000f030
xor r13d, r13d
test eax, eax
jne 0x14000c309
lea edx, [rax + 0x1e]
mov qword [0x140019d68], r15
lea rax, [rbp + 0xb00]
mov rsi, r15
sub r12, rax
lea rcx, [rbp + 0xb00]
lea r10d, [r13 + 1]
movzx eax, word [rcx + r12]
test ax, ax
je 0x14000c5d5
mov word [rcx], ax
add rcx, 2
sub rdx, r10
jne 0x14000c5bf
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
jmp 0x14000c6b6
cmp word [rsi], 0x50
jne 0x14000c309
cmp dx, ax
jne 0x14000c309
mov ecx, eax
mov rdx, r13
call fcn.14000f030
xor r13d, r13d
test eax, eax
jne 0x14000c309
jmp 0x14000c6b6
mov qword [0x140019d68], r15
mov rsi, r15
mov r10d, 1
cmp dx, 0x50
je 0x14000c66d
lea rax, [rbp + 0x1ba0]
mov r8d, 0x400
sub r13, rax
lea rdx, [rbp + 0x1ba0]
movzx eax, word [rdx + r13]
test ax, ax
je 0x14000c659
mov word [rdx], ax
add rdx, 2
sub r8, r10
jne 0x14000c643
xor r13d, r13d
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r13w
jmp 0x14000c670
xor r13d, r13d
lea rax, [rbp + 0xb00]
mov r8d, 0x1e
sub r12, rax
lea rdx, [rbp + 0xb00]
movzx eax, word [r12 + rdx]
test ax, ax
je 0x14000c69d
mov word [rdx], ax
add rdx, 2
sub r8, r10
jne 0x14000c687
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r13w
cmp cx, 0x45
je 0x14000c7b4
mov word [rbp + 0xba0], r13w
mov r12d, 0x104
mov word [rbp + 0x13a0], r13w
mov r15d, 0x20
test di, di
je 0x14000c7b4
lea r8, str.RUVEH_IJDqXFAtPYZlgmnc
mov r9d, 0x52
jmp 0x14000c196
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
mov r14d, 0x667
cmp dword [rbp + 0x798], r12d
jle 0x14000c935
mov rcx, qword [rbp + 0x790]
test rcx, rcx
je 0x14000c935
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x14000c318
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
cmp dword [rbp + 0x18], r12d
jle 0x14000c749
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], edi
mov dword [rbp + 0x18], r12d
jmp 0x14000c790
mov r14d, 0xe
jmp 0x14000c318
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
cmp dword [rbp + 0x18], 0x104
jle 0x14000c77f
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov r10d, 1
mov dword [rbp + 0x18], 0x104
cmp dword [rbp], r10d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jle 0x14000c7aa
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x667
jmp 0x14000de24
mov r15d, 9
test rsi, rsi
je 0x14000c93b
movzx eax, word [rsi]
mov ebx, 1
cmp ax, 0x45
je 0x14000c7e6
sub ax, 0x59
cmp ax, bx
jbe 0x14000c7e6
call fcn.140007cb8
mov rsi, qword [0x140019d68]
mov rax, rsi
lea rcx, str.RUVEH_IJDqXFAtPYZlgmnc
sub rax, rcx
lea rdx, [rbp + 0x1ba0]
sar rax, 1
cmp word [rsi], 0x50
cmove rdx, qword [rbp - 8]
movabs r10, 0xfec0a6591e564070
lea r8, [0x140013010]
mov rax, qword [r8 + rax*8]
lea rcx, [rbp + 0xb00]
call qword [0x140013788]
mov rcx, qword [0x140019d68]
mov r14d, eax
movzx eax, word [rcx]
lea ecx, [rax - 0x59]
cmp cx, bx
jbe 0x14000c8f0
test r14d, r14d
jne 0x14000c869
cmp ax, 0x45
jne 0x14000c85b
mov dword [0x140019ef4], ebx
mov dword [rbp - 0x74], r13d
jmp 0x14000c986
mov eax, dword [0x140019ef4]
mov dword [rbp - 0x74], ebx
jmp 0x14000c982
cmp r14d, 0x8000
jne 0x14000c881
mov dword [0x140019ef4], r13d
mov r14d, r13d
jmp 0x14000c31d
mov eax, 0x4eb
cmp r14d, eax
jg 0x14000c8b6
je 0x14000c967
cmp r14d, 0xfffffffe
jl 0x14000c8e6
test r14d, r14d
js 0x14000c967
lea eax, [r14 - 2]
cmp eax, ebx
jbe 0x14000c8ae
cmp r14d, 0x7b
jne 0x14000c8e6
mov r14d, 0x653
jmp 0x14000c8e6
cmp r14d, 0x642
jl 0x14000c8e6
cmp r14d, 0x644
jle 0x14000c967
cmp r14d, 0x669
je 0x14000c967
cmp r14d, 0xbc2
je 0x14000c31d
mov ecx, r14d
call fcn.140004e4c
jmp 0x14000c967
cmp dword [rbp + 0x18], 0x104
jle 0x14000c909
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], ebx
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x104
jle 0x14000c92d
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, r14d
jmp 0x14000de24
mov r15d, 9
call fcn.140007cb8
test r14d, r14d
jne 0x14000c962
cmp qword [0x140019d68], r13
jne 0x14000c962
xor edx, edx
xor ecx, ecx
call fcn.14000f2d0
mov r14d, 0x667
jmp 0x14000c31d
mov ebx, 1
mov dword [rbp - 0x74], r13d
test r14d, r14d
jne 0x14000c31d
mov eax, dword [0x140019ef4]
test eax, eax
je 0x14000c31d
test eax, eax
je 0x14000c9a3
movabs r10, 0xe0948e0d50584070
mov rax, qword [0x140018030]
xor edx, edx
xor ecx, ecx
call qword [0x140013788]
jmp 0x14000c9bd
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
nop dword [rax + rax]
lea rcx, str.OLEAUT32.dll
call fcn.140011e30
cmp dword [rbp - 0x74], r13d
je 0x14000ca06
cmp dword [0x140019ef4], r13d
jne 0x14000ca13
lea rax, [0x14001996c]
mov r9d, ebx
mov r8d, 4
mov qword [rsp + 0x20], rax
lea rdx, [0x1400180a8]
lea rcx, [0x1400152a8]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
nop dword [rax + rax]
mov ecx, dword [rbp - 0x54]
test eax, eax
cmovne ecx, ebx
mov dword [rbp - 0x54], ecx
cmp dword [0x140019ef4], r13d
je 0x14000dd8a
mov rax, qword gs:[0x60]
mov edx, 0x20
mov r10, qword [rsp + 0x78]
xorps xmm0, xmm0
mov r8d, r13d
mov rcx, qword [rax + 0x20]
lea r11d, [rdx + 0x21]
bts dword [rcx + 8], 0x13
movups xmmword [rbp + 0x9d0], xmm0
movzx ecx, word [r10]
lea eax, [rcx - 0x30]
cmp ax, r15w
ja 0x14000ca62
mov edx, r8d
lea r9d, [rcx - 0x30]
mov eax, ecx
shl eax, 4
and dl, bl
mov edx, 0x20
jmp 0x14000ca7e
movzx eax, cx
sub ax, r11w
cmp ax, 5
ja 0x14000cae2
lea r9d, [rcx - 0x37]
mov ecx, r8d
mov eax, r9d
shl eax, 4
and cl, bl
cmove r9d, eax
cmp r8d, edx
jge 0x14000caa8
mov eax, r8d
test r8d, r8d
jns 0x14000ca93
lea eax, [rbx + r8]
sar eax, 1
add r8d, ebx
cdqe
or byte [rbp + rax + 0x9d0], r9b
add r10, 2
jmp 0x14000ca40
lea rcx, str.ServerMain__CA_:_Wrong_command_line
mov edx, 0x57
call fcn.14000ab1c
cmp dword [rbp + 0x18], 0x104
jle 0x14000cad2
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], ebx
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x14000dd48
cmp r8d, edx
je 0x14000caf0
lea rcx, str.ServerMain__CA_:_Parsing_command_line_failed
jmp 0x14000caaf
mov byte [rsp + 0x61], r13b
mov sil, r13b
mov byte [rsp + 0x60], r13b
mov dil, r13b
mov byte [rsp + 0x70], r13b
mov r15b, r13b
mov r12b, r13b
test cx, cx
je 0x14000cb18
add r10, 2
movzx ecx, word [r10]
cmp cx, 0x43
jne 0x14000cb27
mov byte [rsp + 0x61], bl
jmp 0x14000cc00
cmp cx, 0x55
jne 0x14000cb39
mov byte [rsp + 0x61], bl
mov r15b, bl
jmp 0x14000cc00
cmp cx, r11w
jne 0x14000cb4b
mov r12b, bl
mov byte [rsp + 0x70], bl
jmp 0x14000cc00
cmp cx, 0x4d
je 0x14000cb67
mov eax, 0x52
cmp cx, ax
je 0x14000cb6a
cmp cx, 0x45
jne 0x14000cc00
jmp 0x14000cb6e
mov sil, bl
mov byte [rsp + 0x60], bl
lea r8, [r10 + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000dd6b
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
je 0x14000cbfb
mov edx, edi
lea rcx, str.ServerMain__CA_:_Wait_on_synchronization_event_failed
call fcn.14000ab1c
cmp dword [rbp + 0x18], 0x104
jle 0x14000cbe4
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov r10d, 1
cmp dword [rbp], r10d
mov qword [rbp + 0x10], rax
jmp 0x14000dd48
mov dil, byte [rsp + 0x60]
or qword [rbp - 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
mov ebx, 1
lea r9, [rbp - 0x70]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x14000cc59
or qword [rbp - 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3f0
je 0x14000cc59
mov edx, eax
lea rcx, str.ServerMain__CA_:_Access_to_token_failed
jmp 0x14000cab4
test sil, sil
jne 0x14000cc6a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
nop dword [rax + rax]
test sil, sil
je 0x14000cca8
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
cmp byte [0x14001a47c], r13b
mov esi, r13d
setne sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r8, [rbp - 0x40]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x14000cd8f
lea rcx, [rsp + 0x68]
call fcn.140006488
test eax, eax
jne 0x14000cd78
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x9b8]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xb40]
lea ebx, [r9 - 0x57]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14000cd78
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp + 0xb40]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14000cd6a
cmp byte [0x14001a47c], r13b
je 0x14000cd5b
movzx eax, dil
xor eax, ebx
lea esi, [rax*2 + 3]
jmp 0x14000cd78
mov al, dil
neg al
sbb esi, esi
and esi, 0xfffffffe
add esi, 4
jmp 0x14000cd78
cmp byte [0x14001a47c], r13b
mov esi, r13d
setne sil
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, 0x104
jmp 0x14000cdce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x790]
mov r8d, 0x208
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
lea r8, str.OpenProcessToken_failed_with__d
mov ebx, 0x104
lea rcx, [rbp + 0x790]
mov edx, ebx
call fcn.14000f96c
test r15b, r15b
mov r15d, 1
je 0x14000cdef
cmp esi, r15d
jne 0x14000cde6
lea ecx, [r15 + 8]
mov esi, ecx
jmp 0x14000cdf4
test esi, esi
jne 0x14000ce0c
mov esi, 8
mov ecx, 9
test r12b, r12b
je 0x14000ce5b
test esi, esi
jne 0x14000ce46
mov esi, 6
mov edi, 0x100
mov dword [rbp - 0x78], edi
jmp 0x14000ce87
lea rcx, str.ServerMain__CA_:_Error:_icacContext_in_CA_server_should_be_EEUI_but_is_not_any_impersonated_type
mov edx, 0x57
call fcn.14000ab1c
cmp dword [rbp + 0x18], ebx
jle 0x14000ce32
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], ebx
jmp 0x14000dd4f
cmp esi, r15d
jne 0x14000ce52
mov esi, 7
jmp 0x14000ce02
lea rcx, str.ServerMain__CA_:_Error:_icacContext_in_CA_server_should_be_AISImpersonated_but_is_not_any_impersonated_type
jmp 0x14000ce13
mov edi, 0x100
mov eax, esi
mov dword [rbp - 0x78], edi
test esi, esi
je 0x14000ce87
cmp eax, r15d
je 0x14000ce87
cmp eax, 6
je 0x14000ce87
cmp eax, 7
je 0x14000ce87
cmp eax, 8
je 0x14000ce87
mov r8d, 3
cmp eax, ecx
jne 0x14000ce8d
mov r8d, 2
xor r9d, r9d
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa00]
call fcn.140006c04
mov ebx, eax
test eax, eax
je 0x14000cecf
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000cebc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_Error:_Access_to_SD
call fcn.14000ab1c
jmp 0x14000c075
movsxd rbx, dword [rbp - 0x78]
mov dword [rbp + 0x9b0], ebx
mov dword [rbp - 0x58], ebx
mov dword [rbp - 0x48], ebx
mov dword [rbp - 0x4c], ebx
mov dword [rbp - 0x50], ebx
mov dword [rbp + 0x348], ebx
cmp ebx, edi
jle 0x14000cf18
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x58]
mov qword [rbp + 0x340], rax
test rax, rax
jne 0x14000cf37
mov dword [rbp + 0x348], r13d
jmp 0x14000cf37
mov r8, rdi
lea rcx, [rbp + 0x350]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x350]
mov qword [rbp + 0x340], rax
mov dword [rbp + 0x568], ebx
cmp ebx, edi
jle 0x14000cf67
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x560], rax
test rax, rax
jne 0x14000cf86
mov dword [rbp + 0x568], r13d
jmp 0x14000cf86
mov r8, rdi
lea rcx, [rbp + 0x570]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x570]
mov qword [rbp + 0x560], rax
movsxd rax, dword [rbp - 0x48]
mov dword [rbp + 0x458], eax
cmp eax, edi
jle 0x14000cfba
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x450], rax
test rax, rax
jne 0x14000cfd9
mov dword [rbp + 0x458], r13d
jmp 0x14000cfd9
mov r8, rdi
lea rcx, [rbp + 0x460]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x460]
mov qword [rbp + 0x450], rax
movsxd rax, dword [rbp - 0x4c]
mov dword [rbp + 0x238], eax
cmp eax, edi
jle 0x14000d010
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x230], rax
mov rbx, rax
test rax, rax
jne 0x14000d02f
mov dword [rbp + 0x238], r13d
jmp 0x14000d02f
mov r8, rdi
lea rcx, [rbp + 0x240]
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rbp + 0x240]
mov qword [rbp + 0x230], rbx
movsxd rax, dword [rbp - 0x50]
mov dword [rbp + 0x678], eax
cmp eax, edi
jle 0x14000d06a
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rbx, qword [rbp + 0x230]
mov qword [rbp + 0x670], rax
test rax, rax
jne 0x14000d089
mov dword [rbp + 0x678], r13d
jmp 0x14000d089
mov r8, rdi
lea rcx, [rbp + 0x680]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x680]
mov qword [rbp + 0x670], rax
mov r9, qword [rbp + 0x560]
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp + 0x340]
lea r8, [rbp + 0x9b0]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0xa00]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
nop dword [rax + rax]
test eax, eax
jne 0x14000d1d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x14000d117
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_Error:_Format_SD
call fcn.14000ab1c
cmp dword [rbp + 0x678], edi
jle 0x14000d145
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000d145
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000d165
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000d165
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000d185
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000d185
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000d1a5
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000d1a5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000c075
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000c075
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x14000c075
movabs r10, 0xb25c1fa67cd7f270
mov rcx, qword [rbp + 0x340]
xor r9d, r9d
mov rax, qword [0x140018038]
xor r8d, r8d
mov qword [rsp + 0x40], r13
or edx, 0xffffffff
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x140013788]
mov ebx, eax
test eax, eax
je 0x14000d310
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d238
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_CoInitializeSecurity_failed
call fcn.14000ab1c
cmp dword [rbp + 0x678], edi
jle 0x14000d266
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000d266
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000d286
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000d286
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000d2a6
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000d2a6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000d2c6
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000d2c6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000d2e6
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000d2e6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x18], 0x104
jle 0x14000d2ff
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x14000dd48
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x14000d35f
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d345
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Error:_Watch_for_the_shutdown_signal
jmp 0x14000d241
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
xor r15d, r15d
mov r13, rax
test rax, rax
jne 0x14000d461
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d39a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Error:_Watch_for_change_of_owning_process_signal
call fcn.14000ab1c
cmp dword [rbp + 0x678], edi
jle 0x14000d3d4
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000d3d4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000d3f4
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000d3f4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000d414
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000d414
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000d434
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000d434
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000cbcb
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000cbcb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x14000cbcb
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x60], r15
call fcn.140004ac0
mov rbx, rax
test rax, rax
jne 0x14000d4ec
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d491
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Connection_to_Service_failed.
call fcn.14000ab1c
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000d4c2
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d3b4
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
jmp 0x14000d3b4
mov dword [rbp - 0x64], r15d
mov dword [rbp - 0x44], r15d
call fcn.14000463c
mov r15, rax
test rax, rax
jne 0x14000d547
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d517
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea rcx, str.ServerMain__CA_:_Create_Custom_Action_Server_failed.
mov edx, 0x641
call fcn.14000ab1c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x140013788]
jmp 0x14000d4a2
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x9c0], rax
test rcx, rcx
je 0x14000d57c
mov rdx, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rdx + 0x10]
call qword [0x140013788]
mov rax, qword [rbp + 0x9c0]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x68]
mov rcx, r15
lea rdx, [0x1400152e8]
call qword [0x140013788]
mov rax, qword [r15]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, r15
call qword [0x140013788]
mov rcx, qword [rbp - 0x60]
mov dword [rbp - 0x68], esi
mov rax, qword [rbx]
mov r15, qword [rax + 0x70]
test rcx, rcx
je 0x14000d5df
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
movabs r10, 0xf9218e5958547970
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x44]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x9d0]
lea rax, [rbp - 0x60]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x68]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x28], rax
mov rax, r15
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [0x140013788]
test eax, eax
je 0x14000d651
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d645
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea rcx, str.ServerMain__CA_:_Process_not_registered_with_service.
jmp 0x14000d51e
mov r8d, dword [rbp - 0x64]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x14000d6a0
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d686
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
jmp 0x14000d523
movabs r10, 0x89713e9c58dc2070
mov rcx, qword [rbp - 0x60]
mov rax, qword [0x140018048]
call qword [0x140013788]
test eax, eax
jne 0x14000d729
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000d6d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Connect_to_remote_object_failed.
call fcn.14000ab1c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x140013788]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000d4c2
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
jmp 0x14000d4c2
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
mov rax, qword [rax]
lea r8, [rbp - 0x80]
lea rdx, [0x140015398]
call qword [0x140013788]
xor edx, edx
cmp esi, dword [rbp - 0x68]
jne 0x14000d762
lea eax, [rsi - 8]
lea r10d, [rdx + 1]
cmp eax, r10d
ja 0x14000d766
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xa5e517ed34589370
mov rax, qword [rax + 0x140]
lea r8, [rbp + 0x9d0]
call qword [0x140013788]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xc088865f3adc0a70
mov rax, qword [rax + 0x150]
mov rdx, r12
call qword [0x140013788]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xb195a7073ed57170
mov rax, qword [rax + 0x158]
mov rdx, r13
call qword [0x140013788]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xd190276570d97270
mov rdx, qword [rbp - 0x70]
mov r9b, byte [rsp + 0x70]
mov r8b, byte [rsp + 0x61]
mov rax, qword [rax + 0x148]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp - 0x44]
mov dword [rsp + 0x28], edx
mov dl, byte [rsp + 0x60]
mov byte [rsp + 0x20], dl
mov edx, dword [rbp - 0x64]
call qword [0x140013788]
mov rcx, qword [rbp - 0x70]
mov esi, eax
cmp rcx, 0xffffffffffffffff
je 0x14000d82d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbp - 0x70], 0xffffffffffffffff
test esi, esi
je 0x14000d967
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Impersonation_token_not_saved.
call fcn.14000ab1c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x140013788]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000d880
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d8a1
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
cmp dword [rbp + 0x678], edi
jle 0x14000d8c1
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000d8c1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000d8e1
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000d8e1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000d901
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000d901
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000d921
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000d921
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000d941
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000d941
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x18], 0x104
jle 0x14000d95a
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x14000dd40
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xab612fba3ad29870
mov rdx, qword [rbp - 0x60]
mov rax, qword [rax + 0x138]
call qword [0x140013788]
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x140013788]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000d9c3
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d9e4
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
xor r8d, r8d
mov qword [rbp + 0x9e0], r15
mov esi, 0x1cff
mov qword [rbp + 0x9e8], r12
or r9d, 0xffffffff
mov qword [rbp + 0x9f0], r13
lea rdx, [rbp + 0x9e0]
mov dword [rsp + 0x20], esi
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
je 0x14000dc10
lea ebx, [r13 + 1]
cmp eax, ebx
je 0x14000dc01
cmp eax, 2
jne 0x14000daa0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
mov dword [rsp + 0x78], r13d
mov rax, qword [rcx]
movabs r10, 0xed5c3ea87c5b3870
mov rax, qword [rax + 0x160]
lea rdx, [rsp + 0x78]
call qword [0x140013788]
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14000db24
mov qword [rbp + 0x9e0], rax
jmp 0x14000daf5
cmp eax, 3
jne 0x14000dc10
jmp 0x14000dad5
cmp dword [rbp - 0x30], 0x12
je 0x14000dc10
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
nop dword [rax + rax]
test eax, eax
jne 0x14000daab
xor r8d, r8d
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
lea rdx, [rbp + 0x9e0]
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [rax + rax]
test eax, eax
je 0x14000dc10
jmp 0x14000da2f
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000db3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
call fcn.14000ab1c
cmp dword [rbp + 0x678], edi
jle 0x14000db74
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000db74
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000db94
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000db94
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000dbb4
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000dbb4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000dbd4
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000dbd4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000cab9
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000cab9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x14000cab9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140013788]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp dword [rbp + 0x678], edi
jle 0x14000dc5a
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000dc5a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x14000dc7a
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x14000dc7a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x14000dc9a
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14000dc9a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x14000dcba
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x14000dcba
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000dcda
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000dcda
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp - 0x74], r13d
je 0x14000dcff
cmp dword [0x140019ef4], r13d
jne 0x14000dcff
mov ecx, dword [0x14001996c]
test ecx, ecx
je 0x14000dcff
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
nop dword [rax + rax]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
cmp dword [rbp - 0x54], r13d
je 0x14000c31d
mov ecx, 0x641
call fcn.140004e4c
cmp dword [rbp + 0x18], 0x104
jle 0x14000dd38
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rcx
mov eax, 1
cmp dword [rbp], eax
mov dword [rbp + 0x18], 0x104
jle 0x14000dd61
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x641
jmp 0x14000de24
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Open_synchronization_event_failed
call fcn.14000ab1c
jmp 0x14000d941
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
nop dword [rax + rax]
test eax, eax
jne 0x14000ddc0
cmp dword [0x14001a230], r13d
je 0x14000dcda
cmp dword [0x140019ef0], r13d
je 0x14000dcda
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [rax + rax]
jmp 0x14000dd8a
cmp dword [rbp + 0x18], 0x104
jle 0x14000ddfa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov dword [rbp + 0x18], 0x104
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x14000de1f
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x65b
mov rcx, qword [rbp + 0x23a0]
xor rcx, rsp
call fcn.1400016e0
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret