Function at 0x10000b664
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.100017790
sub rsp, rax
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov rdi, rcx
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0x770]
mov r12d, 1
mov dword [rsp + 0x770], 0x11c
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x10001daf5]
xor r13d, r13d
mov r14d, 0x104
cmp eax, r13d
mov rax, qword [0x10001c010]
cmovne edx, r12d
mov byte [0x10001daf5], dl
mov word [rax], r13w
mov rax, qword [0x10001c820]
mov word [rax], r13w
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r12 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x10000b73c
add rbx, 2
jmp 0x10000b73f
mov cx, si
mov ax, word [rbx]
cmp ax, r13w
je 0x10000b764
cmp ax, cx
je 0x10000b75a
add rbx, 2
mov ax, word [rbx]
cmp ax, r13w
jne 0x10000b748
cmp word [rbx], r13w
je 0x10000b764
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x10001dad0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x10001e010], rax
cmp rax, 0xffffffffffffffff
je 0x10000b791
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r13d
jne 0x10000b798
mov qword [0x10001e010], r13
mov edi, 0x7fe
lea rcx, [rsp + 0xca2]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xac], r13d
mov word [rsp + 0xca0], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x14a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x14a0], r13w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0xca0]
lea r15, [rsp + 0x14a0]
mov qword [rsp + 0x78], r11
mov dword [rsp + 0x80], r13d
mov dword [0x10001dae8], r13d
cmp word [rbx], si
je 0x10000b80a
cmp word [rbx], 9
jne 0x10000b810
add rbx, 2
jmp 0x10000b7ff
cmp word [rbx], 0x2f
je 0x10000b820
cmp word [rbx], 0x2d
jne 0x10000badd
lea rax, [rbx + 2]
cmp rax, r13
je 0x10000badd
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x10000badd
add rbx, 4
mov qword [rsp + 0x60], rbx
cmp word [rbx], si
je 0x10000b851
cmp word [rbx], 9
jne 0x10000b857
add rbx, 2
jmp 0x10000b841
lea rax, [rsp + 0xca0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x70], rax
call fcn.10000b2b8
cmp al, r13b
jne 0x10000b8d9
xor edx, edx
xor ecx, ecx
call fcn.100007cec
cmp dword [rsp + 0x118], r14d
jle 0x10000b89f
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000b8cf
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x10000dbea
mov eax, dword [rsp + 0x118]
lea rdx, [0x100002b50]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x94], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10000ba8e
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x94]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x10000b9f6
mov ebx, dword [rsp + 0x90]
shr ebx, 1
cmp ebx, r14d
jle 0x10000b989
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000b991
lea rdi, [rsp + 0x120]
cmp rdi, r13
je 0x10000ba3c
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000b9b5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x94]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x118], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r13d
jne 0x10000ba8e
cmp dword [rsp + 0x94], r12d
jne 0x10000ba8e
mov rbx, qword [rsp + 0x110]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, dx
je 0x10000ba36
cmp di, 9
jne 0x10000c12c
add rbx, 2
jmp 0x10000ba1f
cmp dword [rsp + 0x118], r14d
jle 0x10000ba54
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000ba84
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x10000dbea
cmp dword [rsp + 0x118], r14d
jle 0x10000baa6
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000bad6
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10000dbea
mov ebp, 0x7fffffff
mov rax, rbx
mov rcx, rbp
cmp word [rax], r13w
je 0x10000baf7
add rax, 2
sub rcx, r12
jne 0x10000bae8
cmp rcx, r13
je 0x10000db9d
mov rsi, rbp
sub rsi, rcx
inc esi
cmp esi, r14d
jle 0x10000bb23
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000bb2b
lea rdi, [rsp + 0x120]
cmp rdi, r13
je 0x10000ba3c
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000bb4f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [0x100000000]
lea rax, [0x100002bd8]
lea rcx, [rsp + 0xab0]
mov qword [rsp + 0xb00], rax
lea rax, [0x100002be8]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0xb18], rax
lea rax, [0x100002c10]
mov dword [rsp + 0x118], esi
mov qword [rsp + 0xb38], rax
mov word [rdi], r13w
lea rax, [0x100002c18]
mov qword [rsp + 0xb48], rax
lea rax, [0x100002c24]
lea rdi, [0x100002c00]
mov qword [rsp + 0xb50], rax
lea rax, [0x100002c30]
mov r8d, 0x20
mov qword [rsp + 0xb60], rax
lea rax, [0x100002c40]
mov qword [rsp + 0xb08], r13
mov qword [rsp + 0xb68], rax
lea rax, [0x100002c48]
mov byte [rsp + 0xb10], r13b
mov qword [rsp + 0xb78], rax
lea rax, [0x100002c58]
mov qword [rsp + 0xb20], r13
mov qword [rsp + 0xb80], rax
lea rax, [0x100002c88]
mov byte [rsp + 0xb28], r13b
mov qword [rsp + 0xb90], rax
lea rax, [0x100002ca0]
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb98], rax
lea rax, [0x100002cd0]
mov byte [rsp + 0xb40], r12b
mov qword [rsp + 0xba8], rax
lea rax, [0x100002cf0]
mov byte [rsp + 0xb58], r12b
mov qword [rsp + 0xbb0], rax
lea rax, [0x100002d10]
mov byte [rsp + 0xb70], r12b
mov qword [rsp + 0xbc0], rax
lea rax, [0x100002d30]
mov byte [rsp + 0xb88], r12b
mov qword [rsp + 0xbc8], rax
lea rax, [0x100002d50]
mov byte [rsp + 0xba0], r12b
mov qword [rsp + 0xbd8], rax
lea rax, [0x100002d58]
mov byte [rsp + 0xbb8], r12b
mov qword [rsp + 0xbe0], rax
mov eax, dword [rdx + 0x2d60]
mov byte [rsp + 0xbd0], r12b
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d64]
mov byte [rsp + 0xbe8], r12b
mov word [rcx + 4], ax
mov eax, dword [rdx + 0x2d68]
lea rcx, [rsp + 0xab8]
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d6c]
mov word [rcx + 4], ax
mov rax, qword [rdx + 0x2d70]
lea rcx, [rsp + 0xad0]
mov qword [rcx], rax
mov eax, dword [rdx + 0x2d78]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x2d7c]
lea rdx, [0x100002d80]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0xae0]
call sub.msvcrt.dll_memcpy
mov r11, rbp
mov rax, rdi
cmp word [rax], r13w
je 0x10000bd62
add rax, 2
sub r11, r12
jne 0x10000bd53
cmp r11, r13
je 0x10000db9d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
sub rbp, r11
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r13
call fcn.100007a7c
mov rdi, rax
cmp rax, r13
je 0x10000be56
mov rsi, qword [rsp + 0x68]
cmp word [rdi], r13w
je 0x10000be56
cmp word [rdi], 0x2d
je 0x10000bdae
cmp word [rdi], 0x2f
jne 0x10000be22
lea r12, [rsi - 1]
cmp r12, 1
jne 0x10000bde8
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100002da0]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf3d
cmp rbp, r12
mov r12d, 1
jne 0x10000be22
lea rax, [0x100002c00]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf43
mov rsi, r13
mov qword [rsp + 0x68], r13
cmp qword [rsp + 0x70], r13
je 0x10000be4a
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.100007a7c
mov rsi, qword [rsp + 0x68]
mov rdi, rax
jmp 0x10000be4d
mov rdi, r13
cmp rdi, r13
jne 0x10000bd98
lea rax, [rsp + 0xab8]
mov byte [rsp + 0xb10], r12b
mov byte [rsp + 0xb28], r12b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xab0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb20], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r13
call fcn.100007a7c
mov rbx, rax
cmp rax, r13
je 0x10000c02c
mov rdi, qword [rsp + 0x68]
cmp word [rbx], r13w
je 0x10000c02c
cmp word [rbx], 0x2d
je 0x10000bec6
cmp word [rbx], 0x2f
jne 0x10000bf1a
mov ebp, r13d
mov rsi, r13
lea r12, [rsp + 0xb00]
mov rax, qword [r12]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf70
inc ebp
inc rsi
add r12, 0x18
cmp ebp, 0xa
jb 0x10000bed4
xor r13d, r13d
mov r14d, 0x104
lea r12d, [r13 + 1]
lea rcx, [rsp + 0x110]
mov r9b, r12b
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x11c], r14d
call fcn.100007b7c
jmp 0x10000bfe8
mov r12d, 1
lea rax, [rsp + 0xad0]
mov byte [rsp + 0xb10], r13b
mov byte [rsp + 0xb28], r13b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xae0]
jmp 0x10000be7e
lea rax, [rsi + rsi*2]
xor r13d, r13d
mov r14d, 0x104
mov r10, qword [rsp + rax*8 + 0xb08]
mov r9b, byte [rsp + rax*8 + 0xb10]
mov dword [rsp + 0x11c], r14d
mov r8, r13
cmp r10, r13
je 0x10000bfc4
mov r8d, 0x7fffffff
mov rcx, r10
mov edx, r13d
mov rax, r8
cmp word [rcx], r13w
je 0x10000bfbc
add rcx, 2
sub rax, 1
jne 0x10000bfac
cmp rax, r13
jne 0x10000c01b
mov r8, r13
mov edx, 0x80070057
cmp edx, r13d
jl 0x10000c082
lea rcx, [rsp + 0x110]
mov rdx, r10
call fcn.100007b7c
mov r12d, 1
mov ebx, eax
cmp eax, r13d
jne 0x10000c087
mov rdi, r13
mov qword [rsp + 0x68], r13
cmp qword [rsp + 0x70], r13
je 0x10000c020
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.100007a7c
mov rdi, qword [rsp + 0x68]
mov rbx, rax
jmp 0x10000c023
sub r8, rax
jmp 0x10000bfc9
mov rbx, r13
cmp rbx, r13
jne 0x10000beb0
mov rbx, qword [rsp + 0x110]
mov rax, r13
cmp rbx, r13
je 0x10000c062
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r13d
mov rcx, r8
cmp word [rax], r13w
je 0x10000c05a
add rax, 2
sub rcx, r12
jne 0x10000c04b
cmp rcx, r13
jne 0x10000c0d6
mov rax, r13
mov edx, 0x80070057
cmp edx, r13d
jge 0x10000c0de
cmp dword [rsp + 0x118], r14d
jle 0x10000dbb5
mov rcx, rbx
jmp 0x10000dbaf
mov ebx, 0x65b
cmp dword [rsp + 0x118], r14d
jle 0x10000c09f
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], r14d
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000c0cf
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x10000dbea
mov rax, r8
sub rax, rcx
jmp 0x10000c067
mov edx, 0x20
cmp rax, r13
jbe 0x10000c11e
lea rcx, [rbx + rax*2 - 2]
cmp word [rcx], dx
je 0x10000c0f8
cmp word [rcx], 9
jne 0x10000c11e
cmp rcx, rbx
jb 0x10000c11e
mov word [rcx], r13w
mov rbx, qword [rsp + 0x110]
sub rcx, 2
jmp 0x10000c0ed
cmp di, dx
je 0x10000c11a
cmp di, 9
jne 0x10000c12c
add rbx, 2
mov di, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, r13w
jne 0x10000c10f
mov r12, qword [0x10001e018]
mov eax, 0x45
mov esi, r13d
mov ebp, 0x667
lea r8, [0x100001a30]
lea r9d, [rax + 0xd]
cmp di, r13w
je 0x10000c7d1
cmp di, 0x2f
je 0x10000c294
cmp di, 0x2d
je 0x10000c294
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x8a0]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x898], r14d
mov dword [rsp + 0x89c], r14d
call fcn.10000b388
cmp eax, r13d
je 0x10000c70d
mov r12, qword [rsp + 0x890]
cmp r12, r13
je 0x10000c241
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10001db04]
lea edx, [rax + rcx + 2]
lea rcx, [0x10001c010]
mov edi, eax
call fcn.10000effc
cmp al, r13b
je 0x10000c239
mov rax, qword [0x10001c010]
movsxd rbx, dword [0x10001db04]
mov r8d, 0x20
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x10001c010]
mov r8, r12
lea rcx, [rax + rcx*2]
mov dword [0x10001db04], ebx
call fcn.100004d28
cmp eax, r13d
jl 0x10000c239
add ebx, edi
mov dword [0x10001db04], ebx
mov r12, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
mov di, word [rbx]
cmp di, dx
je 0x10000c259
cmp di, 9
jne 0x10000c264
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c24b
cmp dword [rsp + 0x898], r14d
jle 0x10000c288
cmp r12, r13
je 0x10000c288
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [0x10001e018]
jmp 0x10000c6ec
mov r12, qword [0x10001e018]
jmp 0x10000c6f1
add rbx, 2
mov qword [rsp + 0x60], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r13w, ax
je 0x10000c2b3
add rbx, 2
mov qword [rsp + 0x60], rbx
mov r13, r8
mov eax, r9d
xor r10d, r10d
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x10000c2d4
add r13, 2
mov ax, word [r13]
cmp ax, r10w
jne 0x10000c2bc
cmp word [r13], r10w
je 0x10000c73f
cmp word [rbx], dx
je 0x10000c2f6
cmp word [rbx], r10w
je 0x10000c2f6
cmp word [rbx], 9
mov r14d, 1
jne 0x10000c2f9
mov r14d, r10d
cmp word [rbx], dx
je 0x10000c304
cmp word [rbx], 9
jne 0x10000c30f
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c2f9
cmp word [r13], 0x63
lea rax, [rsp + 0xca0]
mov qword [rsp + 0x70], rax
jne 0x10000c32d
cmp r14d, r10d
jne 0x10000c73f
cmp word [r13], 0x50
jne 0x10000c3cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 0xa]
cmp edi, 1
jle 0x10000c360
movsxd rdx, edi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
jmp 0x10000c368
lea r12, [rsp + 0x100]
xor ecx, ecx
cmp r12, rcx
je 0x10000c7b0
mov rcx, qword [rsp + 0xf0]
lea rax, [rsp + 0x100]
cmp rcx, rax
je 0x10000c38e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0xf8], edi
mov qword [rsp + 0xa0], r12
call fcn.10000b2b8
xor r10d, r10d
cmp al, r10b
je 0x10000c752
mov r12, qword [0x10001e018]
jmp 0x10000c405
cmp word [r13], 0x71
je 0x10000c3df
cmp word [r13], 0x63
jne 0x10000c3e4
cmp r14d, r10d
je 0x10000c40f
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2b8
xor r10d, r10d
cmp al, r10b
je 0x10000c752
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
mov di, word [rbx]
cmp di, dx
je 0x10000c41d
cmp di, 9
jne 0x10000c428
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c40f
cmp word [r13], 0x46
je 0x10000c448
cmp word [r13], 0x71
je 0x10000c448
cmp word [r13], 0x4a
je 0x10000c448
cmp word [r13], 0x6c
jne 0x10000c4bb
cmp r14d, r10d
je 0x10000c4bb
cmp word [r13], 0x71
lea rax, [rsp + 0x14a0]
lea rdx, [rsp + 0x14a0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
lea r15, [rsp + 0xca0]
je 0x10000c4c0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2b8
xor r10d, r10d
cmp al, r10b
je 0x10000c752
mov rbx, qword [rsp + 0x60]
lea r8d, [r10 + 0x20]
mov di, word [rbx]
cmp di, r8w
je 0x10000c4b0
cmp di, 9
jne 0x10000c4bb
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c4a1
mov rdx, qword [rsp + 0x78]
cmp word [r13], 0x61
jb 0x10000c507
cmp word [r13], 0x7a
ja 0x10000c507
lea rax, [0x100001a30]
lea r14, [0x100000000]
mov rcx, r15
sub r13, rax
sar r13, 1
call qword [r14 + r13*8 + 0x1bf40]
xor r13d, r13d
cmp eax, r13d
jne 0x10000c7b7
mov r12, qword [0x10001e018]
jmp 0x10000c6bf
cmp r12, r10
je 0x10000c60d
cmp word [r13], 0x50
mov eax, 0x41
jne 0x10000c58d
cmp word [r12], ax
jne 0x10000c58d
lea rdx, [rsp + 0x1ca0]
mov ecx, eax
call fcn.1000099bc
cmp eax, r10d
jne 0x10000c73f
lea rdx, [rsp + 0xc00]
mov r12, r13
mov qword [0x10001e018], r13
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r10
je 0x10000c580
movzx edx, word [rax + r15]
cmp dx, r10w
je 0x10000c57b
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c55e
cmp rcx, r10
jne 0x10000c584
sub rax, 2
mov word [rax], r10w
jmp 0x10000c6bc
cmp word [r12], 0x50
jne 0x10000c73f
cmp word [r13], ax
jne 0x10000c73f
mov ecx, eax
call fcn.1000099bc
xor r13d, r13d
cmp eax, r13d
je 0x10000c6bf
xor edx, edx
xor ecx, ecx
call fcn.100007cec
mov esi, ebp
lea r14, [0x100000000]
call fcn.10000b610
cmp esi, r13d
jne 0x10000c891
cmp qword [0x10001e018], r13
jne 0x10000c961
xor edx, edx
xor ecx, ecx
call fcn.100007cec
mov esi, ebp
mov edi, dword [rsp + 0x80]
cmp esi, r13d
jne 0x10000c891
cmp edi, r13d
jne 0x10000c975
jmp 0x10000c968
cmp word [r13], 0x50
mov r12, r13
mov qword [0x10001e018], r13
je 0x10000c66a
lea r8, [rsp + 0x1ca0]
mov ecx, 0x400
lea rax, [rsp + 0x1ca0]
sub rdx, r8
mov qword [rsp + 0x78], rdx
cmp rcx, r10
je 0x10000c662
movzx edx, word [rdx + rax]
cmp dx, r10w
je 0x10000c65d
mov word [rax], dx
mov rdx, qword [rsp + 0x78]
add rax, 2
sub rcx, 1
jne 0x10000c63c
cmp rcx, r10
jne 0x10000c666
sub rax, 2
mov word [rax], r10w
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r10
je 0x10000c6a4
movzx edx, word [r15 + rax]
cmp dx, r10w
je 0x10000c69f
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c682
cmp rcx, r10
jne 0x10000c6a8
sub rax, 2
mov word [rax], r10w
mov eax, 0x45
cmp word [r13], ax
je 0x10000c7c7
xor r13d, r13d
lea r11, [rsp + 0xca0]
mov word [rsp + 0xca0], r13w
lea r15, [rsp + 0x14a0]
mov word [rsp + 0x14a0], r13w
mov r14d, 0x104
mov qword [rsp + 0x78], r11
mov edx, 0x20
cmp di, r13w
je 0x10000c7cc
lea r8, [0x100001a30]
mov r9d, 0x52
jmp 0x10000c155
xor edx, edx
xor ecx, ecx
call fcn.100007cec
cmp dword [rsp + 0x898], r14d
mov esi, ebp
jle 0x10000c735
mov rcx, qword [rsp + 0x890]
cmp rcx, r13
je 0x10000c735
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x60]
jmp 0x10000c5c2
xor edx, edx
xor ecx, ecx
call fcn.100007cec
mov esi, ebp
xor r13d, r13d
jmp 0x10000c5c2
xor edx, edx
xor ecx, ecx
call fcn.100007cec
cmp dword [rsp + 0x118], 0x104
jle 0x10000c776
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c7a9
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
jmp 0x10000dbea
mov esi, 0xe
jmp 0x10000c74a
xor edx, edx
xor ecx, ecx
call fcn.100007cec
mov esi, ebp
jmp 0x10000c5c9
xor r13d, r13d
jmp 0x10000c7d1
mov eax, 0x45
cmp r12, r13
je 0x10000c5c2
mov ebp, 0x59
lea edi, [rbp + 1]
cmp ax, word [r12]
je 0x10000c803
cmp bp, word [r12]
je 0x10000c803
cmp di, word [r12]
je 0x10000c803
call fcn.10000b610
mov r12, qword [0x10001e018]
cmp word [r12], 0x50
lea rax, [0x100001a30]
lea rdx, [rsp + 0x1ca0]
cmove rdx, qword [rsp + 0xf0]
sub r12, rax
lea r14, [0x100000000]
lea rcx, [rsp + 0xc00]
sar r12, 1
call qword [r14 + r12*8 + 0x1bf40]
mov rcx, qword [0x10001e018]
mov esi, eax
cmp word [rcx], bp
je 0x10000c891
cmp word [rcx], di
je 0x10000c891
cmp eax, r13d
jne 0x10000c880
mov eax, 0x45
cmp word [rcx], ax
jne 0x10000c86f
mov dword [0x10001dae8], 1
jmp 0x10000c5ef
mov edi, 1
mov dword [rsp + 0x80], edi
jmp 0x10000c5f6
cmp eax, 0x8000
jne 0x10000c8e6
mov dword [0x10001dae8], r13d
mov esi, r13d
cmp dword [rsp + 0x118], 0x104
jle 0x10000c8ac
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c8df
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x10000dbea
mov eax, 0x52
cmp word [rcx], ax
je 0x10000c955
cmp word [rcx], 0x55
je 0x10000c955
mov eax, 0x4eb
cmp esi, eax
jg 0x10000c929
je 0x10000c5ef
cmp esi, 0xfffffffe
jl 0x10000c955
cmp esi, r13d
jl 0x10000c5ef
cmp esi, 1
jle 0x10000c955
cmp esi, 3
jle 0x10000c922
cmp esi, 0x7b
jne 0x10000c955
mov esi, 0x653
jmp 0x10000c955
cmp esi, 0x642
jl 0x10000c955
cmp esi, 0x644
jle 0x10000c5ef
cmp esi, 0x669
je 0x10000c5ef
cmp esi, 0xbc2
je 0x10000c5ef
mov ecx, esi
call fcn.10000addc
jmp 0x10000c5ef
mov edi, dword [rsp + 0x80]
cmp dword [0x10001dae8], r13d
je 0x10000c891
xor ecx, ecx
cmp dword [0x10001dae8], r13d
je 0x10000c98a
xor edx, edx
call qword [0x10001a420]
jmp 0x10000c99c
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x100002da8]
call fcn.100016a18
cmp edi, r13d
je 0x10000c9fc
cmp dword [0x10001dae8], r13d
jne 0x10000ca09
mov edi, r13d
movsxd rcx, edi
lea r8, [0x1000019a8]
mov r9d, 1
lea rax, [r14 + rcx*4 + 0x1d898]
lea rdx, [r14 + rcx*8 + 0x1bff8]
shl rcx, 4
add rcx, r8
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
cmp eax, r13d
jne 0x10000c9f1
inc edi
cmp edi, 1
jl 0x10000c9ad
jmp 0x10000c9fc
mov dword [rsp + 0xac], 1
cmp dword [0x10001dae8], r13d
je 0x10000db40
xor eax, eax
mov r9d, r13d
lea r10d, [rax + 0x30]
lea r11d, [rax + 0x20]
mov qword [rsp + 0xac0], rax
mov qword [rsp + 0xac8], rax
cmp word [rbx], r10w
jb 0x10000ca4a
cmp word [rbx], 0x39
ja 0x10000ca4a
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, r10d
jmp 0x10000ca78
mov eax, 0x41
cmp word [rbx], ax
jb 0x10000cafd
cmp word [rbx], 0x46
ja 0x10000cafd
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r9d, r11d
jge 0x10000caa5
mov eax, r9d
inc r9d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rsp + rcx + 0xac0], r8b
add rbx, 2
jmp 0x10000ca26
cmp dword [rsp + 0x118], 0x104
jle 0x10000cac0
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000caf3
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x10000dbea
cmp r9d, r11d
jne 0x10000caa5
mov r14b, r13b
mov bpl, r13b
mov r12b, r13b
mov r15b, r13b
cmp word [rbx], r13w
je 0x10000cb18
add rbx, 2
cmp word [rbx], 0x43
jne 0x10000cbf3
mov r14b, 1
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x88]
lea edx, [rbx + 3]
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, r13d
jne 0x10000cb6d
mov qword [rsp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x10000caa5
cmp bpl, r13b
jne 0x10000cb78
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp bpl, r13b
je 0x10000cba4
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xad0]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x10000cced
cmp byte [0x10001e23a], r13b
jne 0x10000cc7f
lea rcx, [rsp + 0xa0]
call fcn.100005340
mov rbx, qword [rsp + 0xa0]
jmp 0x10000cc89
cmp word [rbx], 0x55
jne 0x10000cc04
mov r14b, 1
mov r12b, r14b
jmp 0x10000cb25
cmp word [rbx], ax
jne 0x10000cc11
mov r15b, 1
jmp 0x10000cb25
cmp word [rbx], 0x4d
je 0x10000cc27
mov eax, 0x45
cmp word [rbx], ax
jne 0x10000cb25
jmp 0x10000cc2a
mov bpl, 1
lea r8, [rbx + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, r13
je 0x10000db27
cmp rax, 0xffffffffffffffff
je 0x10000db27
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, r13d
je 0x10000cb25
mov edx, edi
lea rcx, [0x100002e40]
jmp 0x10000db36
lea rbx, [0x10001e240]
mov eax, r13d
cmp eax, r13d
jne 0x10000ccd8
mov rcx, qword [rsp + 0xad0]
lea rax, [rsp + 0xab8]
lea r8, [rsp + 0xc40]
mov r9d, 0x58
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x10000ccd8
mov rcx, qword [rsp + 0xc40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
and edi, 2
inc edi
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x10000cd32
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x892]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x890], r13w
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x100002eb0]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100004f50
cmp r12b, r13b
je 0x10000cd41
cmp edi, 1
jne 0x10000cd57
mov edi, 7
mov r8d, 5
cmp r15b, r13b
je 0x10000cd9c
cmp edi, r13d
jne 0x10000cd94
lea edi, [r8 - 1]
jmp 0x10000cd9c
cmp edi, r13d
jne 0x10000cd63
mov edi, 6
jmp 0x10000cd41
lea rcx, [0x100002ef0]
xor edx, edx
call fcn.10000a80c
cmp dword [rsp + 0x118], ebx
jle 0x10000cd88
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], ebx
jmp 0x10000cacb
cmp edi, 1
jne 0x10000cd71
mov edi, r8d
mov ebp, 0x100
mov dword [rsp + 0xa8], ebp
cmp edi, r13d
je 0x10000cdc6
cmp edi, 1
je 0x10000cdc6
cmp edi, 4
je 0x10000cdc6
cmp edi, r8d
je 0x10000cdc6
cmp edi, 6
je 0x10000cdc6
cmp edi, 7
jne 0x10000cdcc
mov r8d, 4
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xb00]
xor r9d, r9d
call fcn.100005450
mov ebx, eax
cmp eax, r13d
je 0x10000ce2a
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000cdff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x118], 0x104
jle 0x10000ce1a
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
jmp 0x10000c0a7
movsxd rbx, dword [rsp + 0xa8]
cmp ebx, ebp
mov dword [rsp + 0xab0], ebx
mov dword [rsp + 0x94], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xb4], ebx
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0x338], ebx
jle 0x10000ce89
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rsp + 0x94]
mov qword [rsp + 0x330], rax
cmp rax, r13
jne 0x10000ceab
mov dword [rsp + 0x338], r13d
jmp 0x10000ceab
lea rcx, [rsp + 0x340]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x340]
mov qword [rsp + 0x330], r11
cmp ebx, ebp
mov dword [rsp + 0x558], ebx
jle 0x10000ced8
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x550], rax
cmp rax, r13
jne 0x10000cefa
mov dword [rsp + 0x558], r13d
jmp 0x10000cefa
lea rcx, [rsp + 0x560]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x560]
mov qword [rsp + 0x550], r11
movsxd rax, dword [rsp + 0xb8]
cmp eax, ebp
mov dword [rsp + 0x668], eax
jle 0x10000cf2f
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x660], rax
cmp rax, r13
jne 0x10000cf51
mov dword [rsp + 0x668], r13d
jmp 0x10000cf51
lea rcx, [rsp + 0x670]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x670]
mov qword [rsp + 0x660], r11
movsxd rax, dword [rsp + 0xb4]
cmp eax, ebp
mov dword [rsp + 0x448], eax
jle 0x10000cf89
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0x440], rax
cmp rax, r13
jne 0x10000cfab
mov dword [rsp + 0x448], r13d
jmp 0x10000cfab
lea rcx, [rsp + 0x450]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x440], rbx
movsxd rax, dword [rsp + 0xb0]
cmp eax, ebp
mov dword [rsp + 0x778], eax
jle 0x10000cfe8
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rsp + 0x440]
mov qword [rsp + 0x770], rax
cmp rax, r13
jne 0x10000d00a
mov dword [rsp + 0x778], r13d
jmp 0x10000d00a
lea rcx, [rsp + 0x780]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x780]
mov qword [rsp + 0x770], rax
mov r9, qword [rsp + 0x550]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x660]
lea r8, [rsp + 0xab0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x94]
lea rcx, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
cmp eax, r13d
jne 0x10000d139
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x88]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d0a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], ebp
jle 0x10000d0bc
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d0bc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], ebp
jle 0x10000d0d8
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d0d8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], ebp
jle 0x10000d0f4
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d0f4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], ebp
jle 0x10000d110
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000d110
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], ebp
jle 0x10000cdff
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000cdff
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cdff
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x10001a488]
mov ebx, eax
cmp eax, r13d
je 0x10000d235
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d18e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100002fc0]
mov edx, ebx
call fcn.10000a80c
cmp dword [rsp + 0x778], ebp
jle 0x10000d1b8
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d1b8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], ebp
jle 0x10000d1d4
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d1d4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], ebp
jle 0x10000d1f0
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d1f0
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], ebp
jle 0x10000d20c
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000d20c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], ebp
jle 0x10000caa5
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000caa5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000caa5
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
cmp rax, r13
jne 0x10000d26c
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d19c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000d19c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebp, ebp
mov r13, rax
cmp rax, rbp
jne 0x10000d330
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d29e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d2bf
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d2bf
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d2db
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d2db
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d2f7
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d2f7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d313
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d313
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000caa5
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
jmp 0x10000d224
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rbp
call fcn.10000b530
mov rbx, rax
cmp rax, rbp
jne 0x10000d397
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d360
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003020]
xor edx, edx
call fcn.10000a80c
mov rcx, qword [rsp + 0x78]
cmp rcx, rbp
je 0x10000d37e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x10000d29e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000d29e
mov rax, qword [0x10001daf8]
mov dword [rsp + 0x98], ebp
mov dword [rsp + 0xbc], ebp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0x60], rbp
cmp rax, rbp
jne 0x10000d3db
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001daf8], rax
cmp rax, rbp
je 0x10000db05
lea rdx, [0x100001cd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x10000db05
lea r8, [rsp + 0x60]
lea rdx, [0x100001988]
lea rcx, [0x1000019e8]
call rax
cmp eax, ebp
jne 0x10000db05
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0xa0]
lea r8, [0x1000019e8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0xa0]
xor eax, eax
cmp rbp, rax
je 0x10000db03
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x10000d45d
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x68], rax
mov rax, qword [rbp]
lea r8, [rsp + 0x68]
lea rdx, [0x1000019d8]
mov rcx, rbp
call qword [rax]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
xor ebp, ebp
mov dword [rsp + 0x90], edi
cmp rcx, rbp
je 0x10000d49b
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x78], rbp
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
lea r8, [rsp + 0xac0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
cmp eax, ebp
je 0x10000d523
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d506
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003080]
xor edx, edx
call fcn.10000a80c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000d36e
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x10000d62c
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d55a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a80c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
xor ebx, ebx
cmp rcx, rbx
je 0x10000d58a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10000d59a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d5bb
mov rcx, qword [rsp + 0x770]
cmp rcx, rbx
je 0x10000d5bb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d5d7
mov rcx, qword [rsp + 0x440]
cmp rcx, rbx
je 0x10000d5d7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d5f3
mov rcx, qword [rsp + 0x660]
cmp rcx, rbx
je 0x10000d5f3
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d60f
mov rcx, qword [rsp + 0x550]
cmp rcx, rbx
je 0x10000d60f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000caa5
mov rcx, qword [rsp + 0x330]
cmp rcx, rbx
jmp 0x10000d224
mov rcx, qword [rsp + 0x78]
call qword [0x10001a4c0]
xor ecx, ecx
cmp eax, ecx
jne 0x10000d65f
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d651
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d578
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [0x1000019f8]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov rdx, rax
cmp edi, dword [rsp + 0x90]
jne 0x10000d68d
cmp edi, 6
je 0x10000d68d
cmp edi, 7
jne 0x10000d695
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0xac0]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rsp + 0x70]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x70]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
mov r10, qword [rcx]
mov edx, dword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xbc]
mov r9b, r15b
mov r8b, r14b
mov dword [rsp + 0x20], eax
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x88]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d720
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x88], 0xffffffffffffffff
xor r14d, r14d
cmp edi, r14d
je 0x10000d7f6
lea rcx, [0x100003160]
xor edx, edx
call fcn.10000a80c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
cmp rcx, r14
je 0x10000d754
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d764
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d785
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000d785
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d7a1
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000d7a1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d7bd
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000d7bd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d7d9
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000d7d9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000caa5
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
jmp 0x10000d224
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
cmp rcx, r14
je 0x10000d823
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d833
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, 3
mov bl, r14b
or r14d, 0xffffffff
lea rdx, [rsp + 0xae0]
mov edi, 0x4ff
xor r8d, r8d
mov r9d, r14d
mov ecx, r15d
mov dword [0x10001dae0], r15d
mov qword [rsp + 0xae0], rbp
mov qword [rsp + 0xae8], r12
mov qword [rsp + 0xaf0], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor r13d, r13d
cmp eax, r13d
je 0x10000da15
cmp eax, 1
je 0x10000da0c
cmp eax, 2
jne 0x10000d8e2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], r13d
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x160]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, r13
je 0x10000d963
mov qword [rsp + 0xae0], rax
jmp 0x10000d943
cmp eax, r15d
jne 0x10000da15
jmp 0x10000d913
cmp dword [rsp + 0xc8], 0x12
je 0x10000d938
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r13d
jne 0x10000d8ed
jmp 0x10000d93a
mov bl, 1
cmp bl, r13b
jne 0x10000da15
lea rdx, [rsp + 0xae0]
mov r9d, r14d
xor r8d, r8d
mov ecx, r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x10000d882
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d977
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a80c
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d9ac
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d9ac
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d9c8
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d9c8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d9e4
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d9e4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da00
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000da00
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jmp 0x10000d213
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000da4a
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000da4a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000da66
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000da66
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000da82
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000da82
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da9e
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000da9e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000daba
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000daba
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x80]
cmp eax, r13d
je 0x10000dae0
cmp dword [0x10001dae8], r13d
jne 0x10000dae0
mov ecx, dword [0x10001d898]
cmp ecx, r13d
je 0x10000dae0
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rsp + 0xac], r13d
je 0x10000c891
mov ecx, 0x641
call fcn.10000addc
jmp 0x10000caa5
xor ebp, ebp
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000db19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d36e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002dd0]
mov edx, eax
call fcn.10000a80c
jmp 0x10000caa5
mov dword [0x10001dae0], 1
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r13d
jne 0x10000db7f
cmp dword [0x10001db00], r13d
je 0x10000daba
cmp dword [0x10001dad8], r13d
je 0x10000daba
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10000db4a
cmp dword [rsp + 0x118], r14d
jle 0x10000dbb5
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000dbe5
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.100017040
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret