Function at 0x10000b6a4
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.100017930
sub rsp, rax
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov rdi, rcx
lea rax, [rsp + 0x108]
lea rcx, [rsp + 0x770]
mov r12d, 1
mov dword [rsp + 0x770], 0x11c
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x100], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x10001db35]
xor r14d, r14d
mov r13d, 0x104
cmp eax, r14d
mov rax, qword [0x10001c050]
cmovne edx, r12d
mov byte [0x10001db35], dl
mov word [rax], r14w
mov rax, qword [0x10001c860]
mov word [rax], r14w
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r13d
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r12 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x10000b77c
add rbx, 2
jmp 0x10000b77f
mov cx, si
mov ax, word [rbx]
cmp ax, r14w
je 0x10000b7a4
cmp ax, cx
je 0x10000b79a
add rbx, 2
mov ax, word [rbx]
cmp ax, r14w
jne 0x10000b788
cmp word [rbx], r14w
je 0x10000b7a4
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x10001db10], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x10001e050], rax
cmp rax, 0xffffffffffffffff
je 0x10000b7d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r14d
jne 0x10000b7d8
mov qword [0x10001e050], r14
mov edi, 0x7fe
lea rcx, [rsp + 0xca2]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xb4], r14d
mov word [rsp + 0xca0], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x14a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x14a0], r14w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0xca0]
lea r15, [rsp + 0x14a0]
mov qword [rsp + 0x80], r11
mov dword [rsp + 0x88], r14d
mov dword [0x10001db28], r14d
mov ebp, 9
cmp word [rbx], si
je 0x10000b851
cmp word [rbx], bp
jne 0x10000b857
add rbx, 2
jmp 0x10000b847
cmp word [rbx], 0x2f
je 0x10000b867
cmp word [rbx], 0x2d
jne 0x10000bb22
lea rax, [rbx + 2]
cmp rax, r14
je 0x10000bb22
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x10000bb22
add rbx, 4
mov qword [rsp + 0x60], rbx
cmp word [rbx], si
je 0x10000b897
cmp word [rbx], bp
jne 0x10000b89d
add rbx, 2
jmp 0x10000b888
lea rax, [rsp + 0xca0]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x78], rax
call fcn.10000b2f8
cmp al, r14b
jne 0x10000b91f
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
cmp dword [rsp + 0x118], r13d
jle 0x10000b8e5
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r13d
mov qword [rsp + 0x110], rax
jle 0x10000b915
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x10000dbd1
mov eax, dword [rsp + 0x118]
lea rdx, [0x100002b50]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x9c], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10000bad3
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x10000ba3c
mov ebx, dword [rsp + 0x98]
shr ebx, 1
cmp ebx, r13d
jle 0x10000b9cf
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000b9d7
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000ba81
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000b9fb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x118], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r14d
jne 0x10000bad3
cmp dword [rsp + 0x9c], r12d
jne 0x10000bad3
mov rbx, qword [rsp + 0x110]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, dx
je 0x10000ba7b
cmp di, bp
jne 0x10000c179
add rbx, 2
jmp 0x10000ba65
cmp dword [rsp + 0x118], r13d
jle 0x10000ba99
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bac9
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x10000dbd1
cmp dword [rsp + 0x118], r13d
jle 0x10000baeb
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bb1b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10000dbd1
mov ebp, 0x7fffffff
mov rax, rbx
mov rcx, rbp
cmp word [rax], r14w
je 0x10000bb3c
add rax, 2
sub rcx, r12
jne 0x10000bb2d
cmp rcx, r14
je 0x10000db84
mov rsi, rbp
sub rsi, rcx
inc esi
cmp esi, r13d
jle 0x10000bb68
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000bb70
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000ba81
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000bb94
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [0x100000000]
lea rax, [0x100002bd8]
lea rcx, [rsp + 0xab0]
mov qword [rsp + 0xb00], rax
lea rax, [0x100002be8]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0xb18], rax
lea rax, [0x100002c10]
mov dword [rsp + 0x118], esi
mov qword [rsp + 0xb38], rax
mov word [rdi], r14w
lea rax, [0x100002c18]
mov qword [rsp + 0xb48], rax
lea rax, [0x100002c24]
lea rdi, [0x100002c00]
mov qword [rsp + 0xb50], rax
lea rax, [0x100002c30]
mov r8d, 0x20
mov qword [rsp + 0xb60], rax
lea rax, [0x100002c40]
mov qword [rsp + 0xb08], r14
mov qword [rsp + 0xb68], rax
lea rax, [0x100002c48]
mov byte [rsp + 0xb10], r14b
mov qword [rsp + 0xb78], rax
lea rax, [0x100002c58]
mov qword [rsp + 0xb20], r14
mov qword [rsp + 0xb80], rax
lea rax, [0x100002c88]
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb90], rax
lea rax, [0x100002ca0]
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb98], rax
lea rax, [0x100002cd0]
mov byte [rsp + 0xb40], r12b
mov qword [rsp + 0xba8], rax
lea rax, [0x100002cf0]
mov byte [rsp + 0xb58], r12b
mov qword [rsp + 0xbb0], rax
lea rax, [0x100002d10]
mov byte [rsp + 0xb70], r12b
mov qword [rsp + 0xbc0], rax
lea rax, [0x100002d30]
mov byte [rsp + 0xb88], r12b
mov qword [rsp + 0xbc8], rax
lea rax, [0x100002d50]
mov byte [rsp + 0xba0], r12b
mov qword [rsp + 0xbd8], rax
lea rax, [0x100002d58]
mov byte [rsp + 0xbb8], r12b
mov qword [rsp + 0xbe0], rax
mov eax, dword [rdx + 0x2d60]
mov byte [rsp + 0xbd0], r12b
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d64]
mov byte [rsp + 0xbe8], r12b
mov word [rcx + 4], ax
mov eax, dword [rdx + 0x2d68]
lea rcx, [rsp + 0xab8]
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d6c]
mov word [rcx + 4], ax
mov rax, qword [rdx + 0x2d70]
lea rcx, [rsp + 0xad0]
mov qword [rcx], rax
mov eax, dword [rdx + 0x2d78]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x2d7c]
lea rdx, [0x100002d80]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0xae0]
call sub.msvcrt.dll_memcpy
mov r11, rbp
mov rax, rdi
cmp word [rax], r14w
je 0x10000bda7
add rax, 2
sub r11, r12
jne 0x10000bd98
cmp r11, r14
je 0x10000db84
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
sub rbp, r11
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007abc
mov rdi, rax
cmp rax, r14
je 0x10000be9b
mov rsi, qword [rsp + 0x68]
cmp word [rdi], r14w
je 0x10000be9b
cmp word [rdi], 0x2d
je 0x10000bdf3
cmp word [rdi], 0x2f
jne 0x10000be67
lea r12, [rsi - 1]
cmp r12, 1
jne 0x10000be2d
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100002da0]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf82
cmp rbp, r12
mov r12d, 1
jne 0x10000be67
lea rax, [0x100002c00]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf88
mov rsi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000be8f
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007abc
mov rsi, qword [rsp + 0x68]
mov rdi, rax
jmp 0x10000be92
mov rdi, r14
cmp rdi, r14
jne 0x10000bddd
lea rax, [rsp + 0xab8]
mov byte [rsp + 0xb10], r12b
mov byte [rsp + 0xb28], r12b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xab0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0xb20], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007abc
mov rbx, rax
cmp rax, r14
je 0x10000c071
mov rdi, qword [rsp + 0x68]
cmp word [rbx], r14w
je 0x10000c071
cmp word [rbx], 0x2d
je 0x10000bf0b
cmp word [rbx], 0x2f
jne 0x10000bf5f
mov ebp, r14d
mov rsi, r14
lea r12, [rsp + 0xb00]
mov rax, qword [r12]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bfb5
inc ebp
inc rsi
add r12, 0x18
cmp ebp, 0xa
jb 0x10000bf19
xor r14d, r14d
mov r13d, 0x104
lea r12d, [r14 + 1]
lea rcx, [rsp + 0x110]
mov r9b, r12b
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x11c], r13d
call fcn.100007bbc
jmp 0x10000c02d
mov r12d, 1
lea rax, [rsp + 0xad0]
mov byte [rsp + 0xb10], r14b
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xae0]
jmp 0x10000bec3
lea rax, [rsi + rsi*2]
xor r14d, r14d
mov r13d, 0x104
mov r10, qword [rsp + rax*8 + 0xb08]
mov r9b, byte [rsp + rax*8 + 0xb10]
mov dword [rsp + 0x11c], r13d
mov r8, r14
cmp r10, r14
je 0x10000c009
mov r8d, 0x7fffffff
mov rcx, r10
mov edx, r14d
mov rax, r8
cmp word [rcx], r14w
je 0x10000c001
add rcx, 2
sub rax, 1
jne 0x10000bff1
cmp rax, r14
jne 0x10000c060
mov r8, r14
mov edx, 0x80070057
cmp edx, r14d
jl 0x10000c0c7
lea rcx, [rsp + 0x110]
mov rdx, r10
call fcn.100007bbc
mov r12d, 1
mov ebx, eax
cmp eax, r14d
jne 0x10000c0cc
mov rdi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000c065
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007abc
mov rdi, qword [rsp + 0x68]
mov rbx, rax
jmp 0x10000c068
sub r8, rax
jmp 0x10000c00e
mov rbx, r14
cmp rbx, r14
jne 0x10000bef5
mov rbx, qword [rsp + 0x110]
mov rax, r14
cmp rbx, r14
je 0x10000c0a7
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r14d
mov rcx, r8
cmp word [rax], r14w
je 0x10000c09f
add rax, 2
sub rcx, r12
jne 0x10000c090
cmp rcx, r14
jne 0x10000c11b
mov rax, r14
mov edx, 0x80070057
cmp edx, r14d
jge 0x10000c123
cmp dword [rsp + 0x118], r13d
jle 0x10000db9c
mov rcx, rbx
jmp 0x10000db96
mov ebx, 0x65b
cmp dword [rsp + 0x118], r13d
jle 0x10000c0e4
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], r13d
cmp dword [rsp + 0x100], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000c114
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x10000dbd1
mov rax, r8
sub rax, rcx
jmp 0x10000c0ac
mov edx, 0x20
cmp rax, r14
jbe 0x10000c156
lea rcx, [rbx + rax*2 - 2]
lea eax, [rdx - 0x17]
cmp word [rcx], dx
je 0x10000c13f
cmp word [rcx], ax
jne 0x10000c16b
cmp rcx, rbx
jb 0x10000c16b
mov word [rcx], r14w
mov rbx, qword [rsp + 0x110]
sub rcx, 2
jmp 0x10000c135
mov eax, 9
jmp 0x10000c16b
cmp di, dx
je 0x10000c167
cmp di, ax
jne 0x10000c179
add rbx, 2
mov di, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, r14w
jne 0x10000c15d
mov r12, qword [0x10001e058]
mov eax, 0x45
mov esi, r14d
mov ebp, 0x667
lea r8, [0x100001a30]
lea r9d, [rax + 0xd]
cmp di, r14w
je 0x10000c825
cmp di, 0x2f
je 0x10000c2eb
cmp di, 0x2d
je 0x10000c2eb
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x8a0]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x898], r13d
mov dword [rsp + 0x89c], r13d
call fcn.10000b3c8
cmp eax, r14d
je 0x10000c762
mov r12, qword [rsp + 0x890]
cmp r12, r14
je 0x10000c28e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10001db44]
lea edx, [rax + rcx + 2]
lea rcx, [0x10001c050]
mov edi, eax
call fcn.10000efe0
cmp al, r14b
je 0x10000c286
mov rax, qword [0x10001c050]
movsxd rbx, dword [0x10001db44]
mov r8d, 0x20
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x10001c050]
mov r8, r12
lea rcx, [rax + rcx*2]
mov dword [0x10001db44], ebx
call fcn.100004d68
cmp eax, r14d
jl 0x10000c286
add ebx, edi
mov dword [0x10001db44], ebx
mov r12, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
lea r14d, [rdx - 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c2aa
cmp di, r14w
jne 0x10000c2b5
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c29c
cmp dword [rsp + 0x898], r13d
mov r14d, 0
jle 0x10000c2df
cmp r12, r14
je 0x10000c2df
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [0x10001e058]
jmp 0x10000c741
mov r12, qword [0x10001e058]
jmp 0x10000c746
add rbx, 2
mov qword [rsp + 0x60], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r14w, ax
je 0x10000c30a
add rbx, 2
mov qword [rsp + 0x60], rbx
mov r13, r8
mov eax, r9d
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x10000c328
add r13, 2
mov ax, word [r13]
cmp ax, r14w
jne 0x10000c310
cmp word [r13], r14w
je 0x10000c606
mov ecx, 9
cmp word [rbx], dx
je 0x10000c356
cmp word [rbx], r14w
je 0x10000c34c
cmp word [rbx], cx
je 0x10000c34c
lea r14d, [rcx - 8]
cmp word [rbx], dx
je 0x10000c356
cmp word [rbx], cx
jne 0x10000c361
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c34c
lea rax, [rsp + 0xca0]
mov qword [rsp + 0x78], rax
xor eax, eax
cmp word [r13], 0x63
jne 0x10000c381
cmp r14d, eax
jne 0x10000c794
cmp word [r13], 0x50
jne 0x10000c421
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 0xa]
cmp edi, 1
jle 0x10000c3b4
movsxd rdx, edi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
jmp 0x10000c3bc
lea r12, [rsp + 0x108]
xor eax, eax
cmp r12, rax
je 0x10000c803
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x108]
cmp rcx, rax
je 0x10000c3e2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0xf8], r12
mov dword [rsp + 0x100], edi
mov qword [rsp + 0xa8], r12
call fcn.10000b2f8
xor ecx, ecx
cmp al, cl
je 0x10000c7a7
mov r12, qword [0x10001e058]
jmp 0x10000c455
cmp word [r13], 0x71
je 0x10000c431
cmp word [r13], 0x63
jne 0x10000c436
cmp r14d, eax
je 0x10000c464
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2f8
xor ecx, ecx
cmp al, cl
je 0x10000c7a7
mov rbx, qword [rsp + 0x60]
mov ecx, 9
xor eax, eax
lea edx, [rcx + 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c471
cmp di, cx
jne 0x10000c47c
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c464
cmp word [r13], 0x46
je 0x10000c49c
cmp word [r13], 0x71
je 0x10000c49c
cmp word [r13], 0x4a
je 0x10000c49c
cmp word [r13], 0x6c
jne 0x10000c516
cmp r14d, eax
je 0x10000c516
cmp word [r13], 0x71
lea rax, [rsp + 0x14a0]
lea rdx, [rsp + 0x14a0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
lea r15, [rsp + 0xca0]
je 0x10000c51e
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2f8
xor r14d, r14d
cmp al, r14b
je 0x10000c80a
mov rbx, qword [rsp + 0x60]
lea r8d, [r14 + 0x20]
lea r14d, [r8 - 0x17]
mov di, word [rbx]
cmp di, r8w
je 0x10000c50b
cmp di, r14w
jne 0x10000c516
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c4fc
mov rdx, qword [rsp + 0x80]
xor r14d, r14d
cmp word [r13], 0x61
jb 0x10000c565
cmp word [r13], 0x7a
ja 0x10000c565
lea rax, [0x100001a30]
mov rcx, r15
lea r15, [0x100000000]
sub r13, rax
sar r13, 1
call qword [r15 + r13*8 + 0x1bf80]
cmp eax, r14d
jne 0x10000c810
mov r12, qword [0x10001e058]
jmp 0x10000c711
cmp r12, r14
je 0x10000c65c
cmp word [r13], 0x50
mov eax, 0x41
jne 0x10000c5e7
cmp word [r12], ax
jne 0x10000c5e7
lea rdx, [rsp + 0x1ca0]
mov ecx, eax
call fcn.1000099fc
cmp eax, r14d
jne 0x10000c606
lea rdx, [rsp + 0xc00]
mov r12, r13
mov qword [0x10001e058], r13
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r14
je 0x10000c5da
movzx edx, word [rax + r15]
cmp dx, r14w
je 0x10000c5d5
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c5b8
cmp rcx, r14
jne 0x10000c5de
sub rax, 2
mov word [rax], r14w
jmp 0x10000c711
cmp word [r12], 0x50
jne 0x10000c606
cmp word [r13], ax
jne 0x10000c606
mov ecx, eax
call fcn.1000099fc
cmp eax, r14d
je 0x10000c711
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
lea r15, [0x100000000]
call fcn.10000b650
cmp esi, r14d
jne 0x10000c8e5
cmp qword [0x10001e058], r14
jne 0x10000c9b5
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
mov edi, dword [rsp + 0x88]
cmp esi, r14d
jne 0x10000c8e5
cmp edi, r14d
jne 0x10000c9c9
jmp 0x10000c9bc
cmp word [r13], 0x50
mov r12, r13
mov qword [0x10001e058], r13
je 0x10000c6bf
lea r8, [rsp + 0x1ca0]
mov ecx, 0x400
lea rax, [rsp + 0x1ca0]
sub rdx, r8
mov qword [rsp + 0x80], rdx
cmp rcx, r14
je 0x10000c6b7
movzx edx, word [rdx + rax]
cmp dx, r14w
je 0x10000c6b2
mov word [rax], dx
mov rdx, qword [rsp + 0x80]
add rax, 2
sub rcx, 1
jne 0x10000c68e
cmp rcx, r14
jne 0x10000c6bb
sub rax, 2
mov word [rax], r14w
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r14
je 0x10000c6f9
movzx edx, word [r15 + rax]
cmp dx, r14w
je 0x10000c6f4
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c6d7
cmp rcx, r14
jne 0x10000c6fd
sub rax, 2
mov word [rax], r14w
mov eax, 0x45
cmp word [r13], ax
je 0x10000c825
lea r11, [rsp + 0xca0]
mov word [rsp + 0xca0], r14w
lea r15, [rsp + 0x14a0]
mov word [rsp + 0x14a0], r14w
mov r13d, 0x104
mov qword [rsp + 0x80], r11
mov edx, 0x20
cmp di, r14w
je 0x10000c820
lea r8, [0x100001a30]
mov r9d, 0x52
jmp 0x10000c1a2
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
cmp dword [rsp + 0x898], r13d
mov esi, ebp
jle 0x10000c78a
mov rcx, qword [rsp + 0x890]
cmp rcx, r14
je 0x10000c78a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x60]
jmp 0x10000c611
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
xor r14d, r14d
jmp 0x10000c611
xor edx, edx
call fcn.100007d2c
cmp dword [rsp + 0x118], 0x104
jle 0x10000c7c9
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c7fc
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
jmp 0x10000dbd1
mov esi, 0xe
jmp 0x10000c79f
xor edx, edx
xor ecx, ecx
jmp 0x10000c7a9
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
jmp 0x10000c618
mov eax, 0x45
cmp r12, r14
je 0x10000c611
mov ebp, 0x59
lea edi, [rbp + 1]
cmp ax, word [r12]
je 0x10000c857
cmp bp, word [r12]
je 0x10000c857
cmp di, word [r12]
je 0x10000c857
call fcn.10000b650
mov r12, qword [0x10001e058]
cmp word [r12], 0x50
lea rax, [0x100001a30]
lea rdx, [rsp + 0x1ca0]
cmove rdx, qword [rsp + 0xf8]
sub r12, rax
lea r15, [0x100000000]
lea rcx, [rsp + 0xc00]
sar r12, 1
call qword [r15 + r12*8 + 0x1bf80]
mov rcx, qword [0x10001e058]
mov esi, eax
cmp word [rcx], bp
je 0x10000c8e5
cmp word [rcx], di
je 0x10000c8e5
cmp eax, r14d
jne 0x10000c8d4
mov eax, 0x45
cmp word [rcx], ax
jne 0x10000c8c3
mov dword [0x10001db28], 1
jmp 0x10000c63e
mov edi, 1
mov dword [rsp + 0x88], edi
jmp 0x10000c645
cmp eax, 0x8000
jne 0x10000c93a
mov dword [0x10001db28], r14d
mov esi, r14d
cmp dword [rsp + 0x118], 0x104
jle 0x10000c900
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c933
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x10000dbd1
mov eax, 0x52
cmp word [rcx], ax
je 0x10000c9a9
cmp word [rcx], 0x55
je 0x10000c9a9
mov eax, 0x4eb
cmp esi, eax
jg 0x10000c97d
je 0x10000c63e
cmp esi, 0xfffffffe
jl 0x10000c9a9
cmp esi, r14d
jl 0x10000c63e
cmp esi, 1
jle 0x10000c9a9
cmp esi, 3
jle 0x10000c976
cmp esi, 0x7b
jne 0x10000c9a9
mov esi, 0x653
jmp 0x10000c9a9
cmp esi, 0x642
jl 0x10000c9a9
cmp esi, 0x644
jle 0x10000c63e
cmp esi, 0x669
je 0x10000c63e
cmp esi, 0xbc2
je 0x10000c63e
mov ecx, esi
call fcn.10000ae1c
jmp 0x10000c63e
mov edi, dword [rsp + 0x88]
cmp dword [0x10001db28], r14d
je 0x10000c8e5
xor ecx, ecx
cmp dword [0x10001db28], r14d
je 0x10000c9de
xor edx, edx
call qword [0x10001a420]
jmp 0x10000c9f0
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x100002da8]
call fcn.100016ba4
cmp edi, r14d
je 0x10000ca50
cmp dword [0x10001db28], r14d
jne 0x10000ca5d
mov edi, r14d
movsxd rcx, edi
lea r8, [0x1000019a8]
mov r9d, 1
lea rax, [r15 + rcx*4 + 0x1d8d8]
lea rdx, [r15 + rcx*8 + 0x1c038]
shl rcx, 4
add rcx, r8
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
cmp eax, r14d
jne 0x10000ca45
inc edi
cmp edi, 1
jl 0x10000ca01
jmp 0x10000ca50
mov dword [rsp + 0xb4], 1
cmp dword [0x10001db28], r14d
je 0x10000db27
xor eax, eax
mov r9d, r14d
lea r10d, [rax + 0x30]
lea r11d, [rax + 0x20]
mov qword [rsp + 0xac0], rax
mov qword [rsp + 0xac8], rax
cmp word [rbx], r10w
jb 0x10000ca9e
cmp word [rbx], 0x39
ja 0x10000ca9e
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, r10d
jmp 0x10000cacc
mov eax, 0x41
cmp word [rbx], ax
jb 0x10000cb51
cmp word [rbx], 0x46
ja 0x10000cb51
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r9d, r11d
jge 0x10000caf9
mov eax, r9d
inc r9d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rsp + rcx + 0xac0], r8b
add rbx, 2
jmp 0x10000ca7a
cmp dword [rsp + 0x118], 0x104
jle 0x10000cb14
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
cmp dword [rsp + 0x100], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000cb47
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x10000dbd1
cmp r9d, r11d
jne 0x10000caf9
xor ebp, ebp
mov r15b, r14b
mov r12b, bpl
mov r13b, bpl
mov byte [rsp + 0x70], bpl
cmp word [rbx], bp
je 0x10000cb6f
add rbx, 2
cmp word [rbx], 0x43
jne 0x10000cc4e
mov r15b, 1
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x90], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x90]
lea edx, [rbx + 3]
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, ebp
jne 0x10000cbc3
mov qword [rsp + 0x90], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x10000caf9
cmp r14b, bpl
jne 0x10000cbce
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp r14b, bpl
je 0x10000cbfa
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xad0]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea ebp, [rdi + 4]
cmp eax, ecx
je 0x10000cd55
cmp byte [0x10001e27a], cl
jne 0x10000ccde
lea rcx, [rsp + 0xa8]
call fcn.100005380
mov rbx, qword [rsp + 0xa8]
xor ecx, ecx
jmp 0x10000cce7
cmp word [rbx], 0x55
jne 0x10000cc5f
mov r15b, 1
mov r12b, r15b
jmp 0x10000cb7c
cmp word [rbx], ax
jne 0x10000cc71
mov r13b, 1
mov byte [rsp + 0x70], r13b
jmp 0x10000cb7c
cmp word [rbx], 0x4d
je 0x10000cc87
mov eax, 0x45
cmp word [rbx], ax
jne 0x10000cb7c
jmp 0x10000cc8a
mov r14b, 1
lea r8, [rbx + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, rbp
je 0x10000db0e
cmp rax, 0xffffffffffffffff
je 0x10000db0e
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebp
je 0x10000cb7c
mov edx, edi
lea rcx, [0x100002e40]
jmp 0x10000db1d
lea rbx, [0x10001e280]
mov eax, ecx
cmp eax, ecx
jne 0x10000cd40
mov rcx, qword [rsp + 0xad0]
lea rax, [rsp + 0xab8]
lea r8, [rsp + 0xc40]
mov r9d, 0x58
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ecx, ecx
cmp eax, ecx
je 0x10000cd40
mov rcx, qword [rsp + 0xc40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov cl, r14b
neg cl
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffe
add edx, ebp
cmp eax, ecx
cmovne edi, edx
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x10000cd9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x892]
xor edx, edx
mov ebx, eax
xor eax, eax
mov r8d, 0x206
mov word [rsp + 0x890], ax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x100002eb0]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100004f90
xor eax, eax
cmp r12b, al
je 0x10000cdb7
cmp edi, 1
jne 0x10000cdae
lea ecx, [rax + 9]
mov edi, ecx
jmp 0x10000cdbc
cmp edi, eax
jne 0x10000cdcc
mov edi, 8
mov ecx, 9
cmp r13b, al
je 0x10000ce07
cmp edi, eax
jne 0x10000cdfd
mov edi, 6
jmp 0x10000ce07
lea rcx, [0x100002ef0]
xor edx, edx
call fcn.10000a84c
cmp dword [rsp + 0x118], ebx
jle 0x10000cdf1
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], ebx
jmp 0x10000cb1f
cmp edi, 1
jne 0x10000cdda
mov edi, 7
mov r13d, 0x100
mov dword [rsp + 0xb0], r13d
cmp edi, eax
je 0x10000ce31
cmp edi, 1
je 0x10000ce31
cmp edi, 6
je 0x10000ce31
cmp edi, 7
je 0x10000ce31
cmp edi, 8
je 0x10000ce31
cmp edi, ecx
jne 0x10000ce36
mov ebp, 4
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb00]
xor r9d, r9d
mov r8d, ebp
call fcn.100005490
xor ebp, ebp
mov ebx, eax
cmp eax, ebp
je 0x10000ce98
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000ce6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x118], 0x104
jle 0x10000ce88
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
jmp 0x10000c0ec
movsxd rbx, dword [rsp + 0xb0]
cmp ebx, r13d
mov dword [rsp + 0xab0], ebx
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xc0], ebx
mov dword [rsp + 0xbc], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0x338], ebx
jle 0x10000cef7
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rsp + 0x9c]
mov qword [rsp + 0x330], rax
cmp rax, rbp
jne 0x10000cf19
mov dword [rsp + 0x338], ebp
jmp 0x10000cf19
lea rcx, [rsp + 0x340]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x340]
mov qword [rsp + 0x330], r11
cmp ebx, r13d
mov dword [rsp + 0x558], ebx
jle 0x10000cf46
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x550], rax
cmp rax, rbp
jne 0x10000cf68
mov dword [rsp + 0x558], ebp
jmp 0x10000cf68
lea rcx, [rsp + 0x560]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x560]
mov qword [rsp + 0x550], r11
movsxd rax, dword [rsp + 0xc0]
cmp eax, r13d
mov dword [rsp + 0x668], eax
jle 0x10000cf9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x660], rax
cmp rax, rbp
jne 0x10000cfbf
mov dword [rsp + 0x668], ebp
jmp 0x10000cfbf
lea rcx, [rsp + 0x670]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x670]
mov qword [rsp + 0x660], r11
movsxd rax, dword [rsp + 0xbc]
cmp eax, r13d
mov dword [rsp + 0x448], eax
jle 0x10000cff7
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0x440], rax
cmp rax, rbp
jne 0x10000d019
mov dword [rsp + 0x448], ebp
jmp 0x10000d019
lea rcx, [rsp + 0x450]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x440], rbx
movsxd rax, dword [rsp + 0xb8]
cmp eax, r13d
mov dword [rsp + 0x778], eax
jle 0x10000d056
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rsp + 0x440]
mov qword [rsp + 0x770], rax
cmp rax, rbp
jne 0x10000d078
mov dword [rsp + 0x778], ebp
jmp 0x10000d078
lea rcx, [rsp + 0x780]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x780]
mov qword [rsp + 0x770], rax
mov r9, qword [rsp + 0x550]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x660]
lea r8, [rsp + 0xab0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9c]
lea rcx, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
cmp eax, ebp
jne 0x10000d1ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d10d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], r13d
jle 0x10000d12a
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d12a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d147
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d147
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d164
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d164
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d181
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d181
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000ce6d
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000ce6d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000ce6d
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x10001a488]
mov ebx, eax
cmp eax, ebp
je 0x10000d2aa
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d1fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100002fc0]
mov edx, ebx
call fcn.10000a84c
cmp dword [rsp + 0x778], r13d
jle 0x10000d229
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d229
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d246
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d246
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d263
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d263
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d280
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d280
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000caf9
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000caf9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000caf9
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
cmp rax, rbp
jne 0x10000d2e1
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d20c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000d20c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
cmp rax, rbp
jne 0x10000d392
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d311
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d332
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d332
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d34e
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d34e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d36a
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d36a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d386
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d386
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jmp 0x10000d288
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x80], rbp
call fcn.10000b570
mov rbx, rax
cmp rax, rbp
jne 0x10000d3ff
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d3c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003020]
xor edx, edx
call fcn.10000a84c
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x10000d3e6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x10000d311
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000d311
mov rax, qword [0x10001db38]
mov dword [rsp + 0xa0], ebp
mov dword [rsp + 0xc4], ebp
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x60], rbp
cmp rax, rbp
jne 0x10000d443
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db38], rax
cmp rax, rbp
je 0x10000daec
lea rdx, [0x100001cd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x10000daec
lea r8, [rsp + 0x60]
lea rdx, [0x100001988]
lea rcx, [0x1000019e8]
call rax
cmp eax, ebp
jne 0x10000daec
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0xa8]
lea r8, [0x1000019e8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0xa8]
xor eax, eax
cmp rbp, rax
je 0x10000daea
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x10000d4c5
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x68], rax
mov rax, qword [rbp]
lea r8, [rsp + 0x68]
lea rdx, [0x1000019d8]
mov rcx, rbp
call qword [rax]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebp, ebp
mov dword [rsp + 0x98], edi
cmp rcx, rbp
je 0x10000d506
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x80], rbp
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
lea r8, [rsp + 0xac0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
cmp eax, ebp
je 0x10000d594
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d577
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003080]
xor edx, edx
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000d3d3
mov r8d, dword [rsp + 0xa0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x10000d6a0
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d5cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebx, ebx
cmp rcx, rbx
je 0x10000d5fe
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10000d60e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d62f
mov rcx, qword [rsp + 0x770]
cmp rcx, rbx
je 0x10000d62f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d64b
mov rcx, qword [rsp + 0x440]
cmp rcx, rbx
je 0x10000d64b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d667
mov rcx, qword [rsp + 0x660]
cmp rcx, rbx
je 0x10000d667
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d683
mov rcx, qword [rsp + 0x550]
cmp rcx, rbx
je 0x10000d683
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000caf9
mov rcx, qword [rsp + 0x330]
cmp rcx, rbx
jmp 0x10000d299
mov rcx, qword [rsp + 0x80]
call qword [0x10001a4c0]
xor ecx, ecx
cmp eax, ecx
jne 0x10000d6d6
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d6c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d5e9
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rdx, [0x1000019f8]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov rdx, rax
cmp edi, dword [rsp + 0x98]
jne 0x10000d706
cmp edi, 8
je 0x10000d706
lea eax, [rdx + 9]
cmp edi, eax
jne 0x10000d70e
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0xac0]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x78]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
mov r10, qword [rcx]
mov r9b, byte [rsp + 0x70]
mov edx, dword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc4]
mov r8b, r15b
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], r14b
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x90]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d7a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x90], 0xffffffffffffffff
xor r14d, r14d
cmp edi, r14d
je 0x10000d879
lea rcx, [0x100003160]
xor edx, edx
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000d7d7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d7e7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d808
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000d808
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d824
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000d824
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d840
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000d840
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d85c
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000d85c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000caf9
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
jmp 0x10000d299
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000d8ac
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d8bc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, 3
mov qword [rsp + 0xaf0], r13
mov bl, r14b
mov qword [rsp + 0xae0], rbp
mov qword [rsp + 0xae8], r12
mov edi, 0x4ff
mov dword [0x10001db20], r15d
or r13d, 0xffffffff
lea rdx, [rsp + 0xae0]
mov r9d, r13d
xor r8d, r8d
mov ecx, r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, r14d
je 0x10000d9fc
cmp eax, 1
je 0x10000d9f3
cmp eax, 2
jne 0x10000d964
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x60], r14d
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x160]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, r14
je 0x10000d9c6
mov qword [rsp + 0xae0], rax
jmp 0x10000d8ed
cmp eax, r15d
jne 0x10000d9fc
jmp 0x10000d995
cmp dword [rsp + 0xd0], 0x12
je 0x10000d9ba
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r14d
jne 0x10000d96f
jmp 0x10000d9bc
mov bl, 1
cmp bl, r14b
jne 0x10000d9fc
jmp 0x10000d8ed
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d9da
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a84c
jmp 0x10000d7e7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000da31
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000da31
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000da4d
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000da4d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000da69
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000da69
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da85
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000da85
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000daa1
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
je 0x10000daa1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x88]
cmp eax, r14d
je 0x10000dac7
cmp dword [0x10001db28], r14d
jne 0x10000dac7
mov ecx, dword [0x10001d8d8]
cmp ecx, r14d
je 0x10000dac7
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rsp + 0xb4], r14d
je 0x10000c8e5
mov ecx, 0x641
call fcn.10000ae1c
jmp 0x10000caf9
xor ebp, ebp
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000db00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d3d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002dd0]
mov edx, eax
call fcn.10000a84c
jmp 0x10000caf9
mov dword [0x10001db20], 1
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x10000db66
cmp dword [0x10001db40], r14d
je 0x10000daa1
cmp dword [0x10001db18], r14d
je 0x10000daa1
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10000db31
cmp dword [rsp + 0x118], r13d
jle 0x10000db9c
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r13d
mov qword [rsp + 0x110], rax
jle 0x10000dbcc
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.1000171d0
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret