Function at 0x14000eb50
Capabilities:
Check for sandbox username or hostname
Copy file
Create directory
Get session user name
Parse pe header

Disassembly:
mov byte [rsp + 8], cl
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8a0
mov rax, qword [0x1400748d8]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov byte [rsp + 0x60], dl
mov byte [rsp + 0x80], dl
mov qword [rsp + 0xd0], r8
and qword [rsp + 0x58], 0
and qword [r11 - 0x818], 0
and qword [r11 - 0x820], 0
and qword [r11 - 0x7f8], 0
and dword [rsp + 0x90], 0
lea rcx, [r11 - 0x7f8]
call fcn.14003e934
mov ebx, eax
test eax, eax
js 0x140011357
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
js 0x14001139e
and dword [rsp + 0xa8], 0
and dword [rsp + 0xc8], 0
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xad552e1c32580270
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
mov rax, qword [rax + 0x178]
call qword [0x14004a4e8]
mov ebx, eax
jmp 0x14000ec51
test ebx, ebx
jns 0x14000ec96
lea r14, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ec86
test byte [rcx + 0x1c], 1
je 0x14000ec86
mov edx, 0x2f
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_ValidateMapsConnection_failed___X__n
call fcn.140006cd8
jmp 0x14000ecd2
mov edx, dword [rsp + 0xa8]
test edx, edx
jne 0x14000ecaf
lea rcx, str.ValidateMapsConnection_successfully_established_a_connection_to_MAPS_n
call fcn.140006cd8
jmp 0x14000eccb
mov r8d, dword [rsp + 0xc8]
lea rcx, str.ValidateMapsConnection_failed_to_establish_a_connection_to_MAPS__hr_X_httpcode_d__n
call fcn.140006cd8
and dword [rsp + 0xa8], 0
lea r14, str.___a_
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb255becf52df5370
lea rcx, [rsp + 0x90]
mov rax, qword [rax + 0x30]
call qword [0x14004a4e8]
mov ebx, eax
jmp 0x14000ed13
test ebx, ebx
js 0x1400113e5
cmp dword [rsp + 0x90], 0
je 0x140011425
lea rcx, [rsp + 0x58]
call fcn.14000d798
mov ebx, eax
jmp 0x14000ed52
test ebx, ebx
js 0x140011467
and qword [rsp + 0x68], 0
and qword [rsp + 0xc0], 0
lea r9, str.....Microsoft_Security_ClientSupport
mov r8, qword [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rsp + 0x68]
call fcn.14003b888
mov edi, eax
test eax, eax
jns 0x14000edcb
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000edb6
test byte [rcx + 0x1c], 1
je 0x14000edb6
mov edx, 0xf
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___X__n
call fcn.140006cb0
mov rbx, qword [rsp + 0x68]
jmp 0x14000ee3e
xor edx, edx
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000ee31
call fcn.140038cd4
mov edi, eax
cmp eax, 0x800700b7
je 0x14000ee2f
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ee1b
test byte [rcx + 0x1c], 1
je 0x14000ee1b
mov edx, 0x10
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, edi
mov rdx, rbx
lea rcx, str.ERROR:_CreateDirectoryW__ls__failed___X__n
call fcn.140006cb0
jmp 0x14000ee3e
xor edi, edi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xc0], rax
test rbx, rbx
je 0x14000ee4c
mov rcx, rbx
call fcn.140040784
nop
jmp 0x14000ee66
test edi, edi
jns 0x14000eebd
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ee94
test byte [rcx + 0x1c], 2
je 0x14000ee94
mov edx, 0x33
mov r9d, edi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.WARNING:_GetAppLayerLogsDir___failed___X__n
call fcn.140006cb0
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000eebd
call fcn.140040784
and qword [rsp + 0xc0], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xb8], 0
lea r8, str._windir_Microsoft_AntimalwareSupport
lea rdx, [0x140055080]
lea rcx, [rsp + 0x68]
call fcn.14003b888
mov esi, eax
test eax, eax
jns 0x14000ef35
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ef1d
test byte [rcx + 0x1c], 1
je 0x14000ef1d
mov edx, 0x11
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___X__n
call fcn.140006cb0
mov rdi, qword [rsp + 0x68]
jmp 0x14000f015
mov rdi, qword [rsp + 0x68]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.14003c4c0
mov esi, eax
test eax, eax
jns 0x14000ef92
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ef7a
test byte [rcx + 0x1c], 1
je 0x14000ef7a
mov edx, 0x12
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___X__n
call fcn.140006cb0
mov rbx, qword [rsp + 0xa0]
jmp 0x14000f008
xor edx, edx
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000effb
call fcn.140038cd4
mov esi, eax
cmp eax, 0x800700b7
je 0x14000eff9
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000efe5
test byte [rcx + 0x1c], 4
je 0x14000efe5
mov edx, 0x13
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, esi
mov rdx, rbx
lea rcx, str.INFO:_CreateDirectoryW__ls__failed___X_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.140006cb0
jmp 0x14000f008
xor esi, esi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xb8], rax
test rbx, rbx
je 0x14000f015
mov rcx, rbx
call fcn.140040784
test rdi, rdi
je 0x14000f023
mov rcx, rdi
call fcn.140040784
nop
jmp 0x14000f03d
test esi, esi
jns 0x14000f094
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f06b
test byte [rcx + 0x1c], 4
je 0x14000f06b
mov edx, 0x34
mov r9d, esi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.GetOfflineScannerSupportDir___failed___X_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.140006cb0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000f094
call fcn.140040784
and qword [rsp + 0xb8], 0
xor ecx, ecx
call fcn.140030080
nop
jmp 0x14000f0b2
test eax, eax
jns 0x14000f0e9
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f0dd
test byte [rcx + 0x1c], 1
je 0x14000f0dd
mov edx, 0x35
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002150
lea rcx, str.ERROR:_Dumping_Log_Failed
call fcn.140006cb0
cmp dword [rsp + 0x90], 2
jne 0x14000f429
lea rcx, str.Collecting_events_from_Operational_Event_Log..._n
call fcn.140006cd8
nop
and qword [rsp + 0x490], 0
and qword [rsp + 0x498], 0
and qword [rsp + 0x4a0], 0
and qword [rsp + 0x4a8], 0
and qword [rsp + 0x4b0], 0
and qword [rsp + 0x4b8], 0
and qword [rsp + 0x4c0], 0
and qword [rsp + 0x4c8], 0
and qword [rsp + 0x4d0], 0
mov r9, qword [rsp + 0x58]
lea r8, str.OperationalEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_Operational
lea rcx, [rsp + 0x490]
call fcn.14001de24
mov ebx, eax
lea rcx, [rsp + 0x490]
call fcn.14001cdc0
nop
jmp 0x14000f192
test ebx, ebx
js 0x14000f1a3
jmp 0x14000f1db
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f1cd
test byte [rcx + 0x1c], 1
je 0x14000f1cd
mov edx, 0x36
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___X__n
call fcn.140006cb0
lea rcx, str.Collecting_events_from_WHC_Event_Log..._n
call fcn.140006cd8
nop
and qword [rsp + 0x490], 0
and qword [rsp + 0x498], 0
and qword [rsp + 0x4a0], 0
and qword [rsp + 0x4a8], 0
and qword [rsp + 0x4b0], 0
and qword [rsp + 0x4b8], 0
and qword [rsp + 0x4c0], 0
and qword [rsp + 0x4c8], 0
and qword [rsp + 0x4d0], 0
mov r9, qword [rsp + 0x58]
lea r8, str.WHCEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_WHC
lea rcx, [rsp + 0x490]
call fcn.14001de24
mov ebx, eax
lea rcx, [rsp + 0x490]
call fcn.14001cdc0
nop
jmp 0x14000f276
test ebx, ebx
jns 0x14000f2bf
jmp 0x14000f287
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f2b1
test byte [rcx + 0x1c], 1
je 0x14000f2b1
mov edx, 0x37
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___X__n
call fcn.140006cb0
lea rax, str._windir_logscbs
mov qword [rsp + 0x490], rax
lea rax, str.cbs.log
mov qword [rsp + 0x498], rax
lea rax, str.CBS_Log
mov qword [rsp + 0x4a0], rax
lea rcx, str._windir__system32winevtlogs
mov qword [rsp + 0x4a8], rcx
lea rax, str.application.evtx
mov qword [rsp + 0x4b0], rax
lea rax, str.Application_Event_Log
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x4c0], rcx
lea rax, str.system.evtx
mov qword [rsp + 0x4c8], rax
lea rax, str.System_Event_Log
mov qword [rsp + 0x4d0], rax
and qword [rsp + 0x4d8], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x4e0], xmm0
xor ebx, ebx
mov dword [rsp + 0x78], ebx
movsxd rax, ebx
lea rsi, [rax + rax*2]
mov r15, qword [rsp + rsi*8 + 0x490]
test r15, r15
je 0x14000f4a9
mov rdi, qword [rsp + rsi*8 + 0x4a0]
mov qword [rsp + 0x228], rdi
mov rdx, rdi
lea rcx, str.Getting__ls_..._n
call fcn.140006cd8
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + rsi*8 + 0x498]
mov rcx, r15
call fcn.140011ce0
mov esi, eax
jmp 0x14000f3de
test esi, esi
jns 0x14000f422
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f410
test byte [rcx + 0x1c], 1
je 0x14000f410
mov edx, 0x38
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, esi
mov rdx, rdi
lea rcx, str.ERROR:_GetLogFile__ls__failed___X__n
call fcn.140006cb0
inc ebx
jmp 0x14000f356
cmp dword [rsp + 0x90], 4
je 0x14000f4a9
lea rcx, str.Collecting_events_from_System_Event_Log..._n
call fcn.140006cd8
nop
mov rdx, qword [rsp + 0x58]
lea rcx, str.System
call fcn.140015098
mov ebx, eax
jmp 0x14000f460
test ebx, ebx
jns 0x14000f4a9
jmp 0x14000f471
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f49b
test byte [rcx + 0x1c], 1
je 0x14000f49b
mov edx, 0x39
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___X__n
call fcn.140006cb0
lea rcx, str.Collecting_configuration_information..._n
call fcn.140006cd8
nop
call fcn.140015d64
mov ebx, eax
jmp 0x14000f4ca
test ebx, ebx
jns 0x14000f513
jmp 0x14000f4db
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f505
test byte [rcx + 0x1c], 1
je 0x14000f505
mov edx, 0x3a
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandConfigDump___failed__X_n
call fcn.140006cb0
and qword [rsp + 0x218], 0
lea rax, [rsp + 0x208]
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x208], rax
cmp dword [rsp + 0x90], 4
je 0x14000f6c8
xor edx, edx
mov ecx, 0xa0000
call fcn.14003ab78
test eax, eax
js 0x14000f648
lea rcx, str.Collecting_Windows_Update_logs..._n
call fcn.140006cd8
and qword [rsp + 0x68], 0
lea rdx, str._windir_LogsWindowsUpdate
lea rcx, [rsp + 0x68]
call fcn.14003c4c0
mov ebx, eax
test eax, eax
js 0x14000f5f8
lea r9, [rsp + 0x208]
lea r8, str..etl
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
call fcn.14000d9d4
mov ebx, eax
jmp 0x14000f5c1
test ebx, ebx
jns 0x14000f630
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f5ef
test byte [rcx + 0x1c], 1
je 0x14000f5ef
mov edx, 0x3b
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
jmp 0x14000f629
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f622
test byte [rcx + 0x1c], 1
je 0x14000f622
mov edx, 0x3c
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___X__n
mov edx, ebx
call fcn.140006cb0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000f6c8
call fcn.140040784
jmp 0x14000f6c8
lea rcx, str.Getting_Windows_Update_log..._n
call fcn.140006cd8
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.WindowsUpdate.log
lea rcx, str._windir_
call fcn.140011ce0
mov ebx, eax
jmp 0x14000f68c
test ebx, ebx
jns 0x14000f6c8
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000f6ba
test byte [rcx + 0x1c], 1
je 0x14000f6ba
mov edx, 0x3d
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_GetLogFile_WINDOWS_UPDATE_LOG_FILENAME__failed___X__n
call fcn.140006cb0
lea rcx, str.Dumping_cache_filenames_to_log..._n
call fcn.140006cd8
nop
mov dword [rsp + 0x228], 0xf17c75d5
mov dword [rsp + 0x22c], 0x455fbe59
mov dword [rsp + 0x230], 0x94bf508d
mov dword [rsp + 0x234], 0x5888a325
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
and dword [rsp + 0x78], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
mov edx, 4
lea rcx, [rsp + 0x228]
call fcn.14003001c
mov esi, eax
test eax, eax
jns 0x14000f785
mov rax, qword [str.___a_]
cmp rax, r14
je 0x14000f773
test byte [rax + 0x1c], 1
je 0x14000f773
mov edx, 0x12
mov r9d, esi
lea r8, [0x1400645c0]
mov rcx, qword [rax + 0x10]
call fcn.140002534
mov rax, qword [str.___a_]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000f79e
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x14000f797
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000f795
call qword [sym.imp.mpclient.dll_MpFreeMemory]
xor esi, esi
mov rax, qword [str.___a_]
jmp 0x14000f7c6
test esi, esi
jns 0x14000f7fd
cmp rax, r14
je 0x14000f7ed
test byte [rax + 0x1c], 1
je 0x14000f7ed
mov edx, 0x3e
mov r9d, esi
lea r8, [0x140059a88]
mov rcx, qword [rax + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.ERROR:_MpDumpCache_failed___X__n
call fcn.140006cb0
xor esi, esi
and dword [rsp + 0x78], 0
lea r12, str.MOAC_file_dump
movsxd r15, dword [rsp + 0x78]
mov qword [rsp + 0x88], r15
lea rbx, [r15 + r15*4]
mov rdx, qword [r12 + rbx*8]
test rdx, rdx
je 0x14000f9bb
lea rcx, str.Getting__ls_..._n
call fcn.140006cd8
nop
mov r9, qword [r12 + rbx*8 + 0x20]
mov r8, qword [rsp + 0x58]
mov rdx, qword [r12 + rbx*8 + 0x18]
mov rcx, qword [r12 + rbx*8 + 0x10]
call fcn.140011ce0
test eax, eax
js 0x1400114a7
jmp 0x14000f88d
test esi, esi
jns 0x14000f8aa
lea rax, [r15 + r15*4]
mov r8d, esi
mov rdx, qword [r12 + rax*8]
lea rcx, str.ERROR:__ls_failed___X__n
call fcn.140006cd8
xor esi, esi
lea r13, [r15 + r15*4]
test byte [r12 + r13*8 + 8], 1
je 0x14000f9b2
and qword [rsp + 0xb0], 0
mov r8, qword [r12 + r13*8 + 0x18]
lea rdx, str._ls.bak
lea rcx, [rsp + 0xb0]
call fcn.14003b888
test eax, eax
js 0x1400114af
xor ebx, ebx
mov qword [rsp + 0x228], rbx
mov r8, qword [r12 + r13*8 + 0x20]
test r8, r8
je 0x14000f91c
lea rdx, str._ls.bak
lea rcx, [rsp + 0x228]
call fcn.14003b888
test eax, eax
js 0x1400114b7
mov rbx, qword [rsp + 0x228]
mov r9, rbx
mov r8, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xb0]
mov rdx, rdi
mov rcx, qword [r12 + r13*8 + 0x10]
call fcn.140011ce0
test eax, eax
js 0x1400114be
test rbx, rbx
je 0x14000f94f
mov rcx, rbx
call fcn.140040784
nop
test rdi, rdi
je 0x14000f95d
mov rcx, rdi
call fcn.140040784
nop
jmp 0x14000f995
test esi, esi
jns 0x14000f9b2
lea rdx, [r15 + r15*4]
mov r8d, esi
mov rdx, qword [r12 + rdx*8]
lea rcx, str.ERROR:__ls_failed___X__n
call fcn.140006cd8
xor esi, esi
inc dword [rsp + 0x78]
jmp 0x14000f809
and qword [rsp + 0x1f8], 0
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x1e8], rax
lea rcx, str.Getting_Dynamic_Signatures..._n
call fcn.140006cd8
nop
and qword [rsp + 0x88], 0
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rdi, str.Scan
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov ebx, eax
test eax, eax
jns 0x14000fa60
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fa49
test byte [rcx + 0x1c], 1
je 0x14000fa49
mov edx, 0x14
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, ebx
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigOpen__ls__failed___X__n
call fcn.140006cb0
jmp 0x14000faf1
mov dword [rsp + 0x50], 2
and dword [rsp + 0x78], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
lea rsi, str.DynamicSignatureLocation
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov ebx, eax
test eax, eax
jns 0x14000fb3e
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fadc
test byte [rcx + 0x1c], 1
je 0x14000fadc
mov edx, 0x15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.14000d5f0
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigGetValueString__ls_ls__failed___X__n
call fcn.140006cb0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000fb01
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov rax, qword [str.___a_]
cmp rax, r14
je 0x14000fb2f
test byte [rax + 0x1c], 1
je 0x14000fb2f
mov edx, 0x19
lea r8, [0x140059a88]
mov rcx, qword [rax + 0x10]
call fcn.140002150
mov rax, qword [str.___a_]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000fb8b
jmp 0x14000fb7e
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000fb4e
call qword [sym.imp.mpclient.dll_MpConfigClose]
lea r9, [rsp + 0x1e8]
lea r8, [0x140055200]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call fcn.14000d9d4
mov ebx, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000fb84
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rax, qword [str.___a_]
jmp 0x14000fbb3
test ebx, ebx
jns 0x14000fbe8
cmp rax, r14
je 0x14000fbda
test byte [rax + 0x1c], 1
je 0x14000fbda
mov edx, 0x3f
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rax + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_GetFastPathSignatureBlobs_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_product_service_s__registration_information..._n
call fcn.140006cd8
nop
call fcn.14001b3dc
mov ebx, eax
jmp 0x14000fc09
test ebx, ebx
jns 0x14000fc52
jmp 0x14000fc1a
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fc44
test byte [rcx + 0x1c], 1
je 0x14000fc44
mov edx, 0x40
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectServiceInfo__MsMpSvc___failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_filter_manager_information..._n
call fcn.140006cd8
nop
call fcn.140021528
mov ebx, eax
jmp 0x14000fc73
test ebx, ebx
jns 0x14000fcbc
jmp 0x14000fc84
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fcae
test byte [rcx + 0x1c], 1
je 0x14000fcae
mov edx, 0x41
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFltmcInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_system_information..._n
call fcn.140006cd8
nop
call fcn.140020ad8
mov ebx, eax
jmp 0x14000fcdd
test ebx, ebx
jns 0x14000fd26
jmp 0x14000fcee
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fd18
test byte [rcx + 0x1c], 1
je 0x14000fd18
mov edx, 0x42
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSystemInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_ACPI_information..._n
call fcn.140006cd8
nop
call fcn.14002b510
mov ebx, eax
jmp 0x14000fd47
test ebx, ebx
jns 0x14000fd90
jmp 0x14000fd58
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fd82
test byte [rcx + 0x1c], 1
je 0x14000fd82
mov edx, 0x43
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectAcpiInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_file_list_and_version_information..._n
call fcn.140006cd8
nop
call fcn.140021040
mov ebx, eax
jmp 0x14000fdb1
test ebx, ebx
jns 0x14000fdfa
jmp 0x14000fdc2
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fdec
test byte [rcx + 0x1c], 1
je 0x14000fdec
mov edx, 0x44
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFileVersions_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_threat_information..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14001252c
mov ebx, eax
jmp 0x14000fe20
test ebx, ebx
jns 0x14000fe69
jmp 0x14000fe31
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fe5b
test byte [rcx + 0x1c], 1
je 0x14000fe5b
mov edx, 0x45
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectStats_failed___X__n
call fcn.140006cb0
and qword [rsp + 0x88], 0
mov edx, 0x3fab
call fcn.14003abd8
test eax, eax
js 0x140010206
mov edx, 0xc8
call fcn.14000dc40
mov ebx, eax
jmp 0x14000feaa
test ebx, ebx
jns 0x14000fee6
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000fed8
test byte [rcx + 0x1c], 2
je 0x14000fed8
mov edx, 0x46
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.Flushing_current_session_logs_for_Windows_Security_Service_failed___X__n
call fcn.140006cb0
lea rdx, str._programdata_MicrosoftWindows_Security_HealthLogs
lea rcx, [rsp + 0x88]
call fcn.14003c4c0
mov ebx, eax
test eax, eax
jns 0x14000ff53
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ff2a
test byte [rcx + 0x1c], 2
je 0x14000ff2a
mov edx, 0x47
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.Getting_WDSP_log_location_failed___X_._n
call fcn.140006cb0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000ff53
call fcn.140040784
and qword [rsp + 0x88], 0
lea rcx, str.Getting_security_health_service_related_registry_keys..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000e144
mov ebx, eax
jmp 0x14000ff86
test ebx, ebx
jns 0x14000ffc2
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14000ffb4
test byte [rcx + 0x1c], 1
je 0x14000ffb4
mov edx, 0x48
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectWdspRegistryKeys_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_security_health_service_registration_info..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000e308
mov ebx, eax
jmp 0x14000fff5
test ebx, ebx
jns 0x140010031
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010023
test byte [rcx + 0x1c], 1
je 0x140010023
mov edx, 0x49
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectWdspServiceInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_Image_File_Execution_Option_state..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000e4c0
mov ebx, eax
jmp 0x140010064
test ebx, ebx
jns 0x1400100a1
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010092
test byte [rcx + 0x1c], 1
je 0x140010092
mov edx, 0x4a
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_DumpIFEOKeys_failed___X__n
call fcn.140006cb0
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000de00
mov ebx, eax
jmp 0x1400100c7
test ebx, ebx
jns 0x140010104
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400100f5
test byte [rcx + 0x1c], 2
je 0x1400100f5
mov edx, 0x4b
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.Exporting_Exploit_Mitigation_Policies_failed___X__n
call fcn.140006cb0
nop
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4KernelMode.evtx
lea rcx, [rsp + 0x70]
call fcn.14003c4c0
test eax, eax
js 0x14001016e
and qword [rsp + 0x68], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4KernelMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x1400551f0]
lea rcx, [rsp + 0x68]
call fcn.14003b888
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
test eax, eax
js 0x14001015f
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rbx, rbx
je 0x140010173
mov rcx, rbx
call fcn.140040784
jmp 0x140010173
mov rdi, qword [rsp + 0x70]
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4UserMode.evtx
lea rcx, [rsp + 0x70]
call fcn.14003c4c0
test eax, eax
js 0x1400101dd
and qword [rsp + 0x68], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4UserMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x1400551f0]
lea rcx, [rsp + 0x68]
call fcn.14003b888
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
test eax, eax
js 0x1400101ce
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rsi, rsi
je 0x1400101e2
mov rcx, rsi
call fcn.140040784
jmp 0x1400101e2
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x1400101ef
mov rcx, rbx
call fcn.140040784
test rdi, rdi
je 0x1400101fd
mov rcx, rdi
call fcn.140040784
nop
jmp 0x140010206
lea rcx, str.Getting_WSC_information..._n
call fcn.140006cd8
nop
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.14001ad4c
mov ebx, eax
jmp 0x14001023b
test ebx, ebx
jns 0x140010277
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010269
test byte [rcx + 0x1c], 1
je 0x140010269
mov edx, 0x4c
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_WSC_related_registry_keys_and_service_registration..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14001b0e0
mov ebx, eax
jmp 0x1400102aa
test ebx, ebx
jns 0x1400102e6
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400102d8
test byte [rcx + 0x1c], 1
je 0x1400102d8
mov edx, 0x4d
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscRegistryKeys_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_Windows_Task_Scheduler_registrations..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000e664
mov ebx, eax
jmp 0x140010319
test ebx, ebx
jns 0x140010355
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010347
test byte [rcx + 0x1c], 1
je 0x140010347
mov edx, 0x4e
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_GetWinTaskSchedulerEntries_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_the_contents_of_the_internal_task_scheduler..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14000e90c
mov ebx, eax
jmp 0x140010388
test ebx, ebx
jns 0x1400103c4
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400103b6
test byte [rcx + 0x1c], 1
je 0x1400103b6
mov edx, 0x4f
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_GetInternalSchedulerEntries_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_Network_Protection_remote_data_n
call fcn.140006cd8
and qword [rsp + 0x1d8], 0
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x1d0], rax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x1c8], rax
and qword [rsp + 0x68], 0
and qword [rsp + 0x228], 0
mov edx, 0x4268
call fcn.14003abd8
test eax, eax
js 0x140010430
mov edx, 0x44f5
call fcn.14003abd8
test eax, eax
jns 0x140010430
lea rdi, str.NetworkService
mov r9, rdi
jmp 0x14001043e
lea r9, str.LocalService
lea rdi, str.NetworkService
lea rax, str.remote
mov qword [rsp + 0x28], rax
lea r15, str.AppDataLocalMicrosoftWindowsSafetyNetwork
mov qword [rsp + 0x20], r15
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0x68]
call fcn.14003b888
mov ebx, eax
test eax, eax
jns 0x1400104aa
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14001049e
test byte [rcx + 0x1c], 2
je 0x14001049e
mov edx, 0x50
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.Building_remote_NP_dir_path_failed___X_._n
jmp 0x14001059a
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x228]
call fcn.14003c4c0
mov esi, eax
test eax, eax
jns 0x14001050c
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400104f3
test byte [rcx + 0x1c], 2
je 0x1400104f3
mov edx, 0x51
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, esi
mov rdx, qword [rsp + 0x68]
lea rcx, str.Expanding__ls_failed___X_._n
call fcn.140006cb0
jmp 0x1400105a1
lea r9, [rsp + 0x1c8]
lea r8, [0x140055200]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x228]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010565
test ebx, ebx
jns 0x1400105a1
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010593
test byte [rcx + 0x1c], 1
je 0x140010593
mov edx, 0x52
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.140006cb0
lea rcx, str.Getting_Network_Protection_local_data_n
call fcn.140006cd8
and qword [rsp + 0x1b8], 0
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x1a8], rax
and qword [rsp + 0xa0], 0
and qword [rsp + 0xb0], 0
mov edx, 0x4268
call fcn.14003abd8
test eax, eax
js 0x140010604
mov edx, 0x44f5
call fcn.14003abd8
test eax, eax
js 0x14001060b
lea rdi, str.LocalService
lea rax, str.Locallocal
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rdi
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0xa0]
call fcn.14003b888
mov ebx, eax
test eax, eax
jns 0x140010676
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14001066a
test byte [rcx + 0x1c], 2
je 0x14001066a
mov edx, 0x53
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.Building_local_NP_dir_path_failed___X_._n
jmp 0x14001074d
mov rbx, qword [rsp + 0xa0]
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.14003c4c0
mov edi, eax
test eax, eax
jns 0x1400106db
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400106c2
test byte [rcx + 0x1c], 2
je 0x1400106c2
mov edx, 0x54
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, edi
mov rdx, qword [rsp + 0xa0]
lea rcx, str.Expanding__ls_failed___X_._n
call fcn.140006cb0
jmp 0x140010754
lea r9, [rsp + 0x1a8]
lea r8, [0x140055200]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010718
test ebx, ebx
jns 0x140010754
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010746
test byte [rcx + 0x1c], 1
je 0x140010746
mov edx, 0x55
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.140006cb0
lea rcx, str.Getting_WDATP_information..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.14002993c
mov ebx, eax
jmp 0x140010787
test ebx, ebx
jns 0x1400107c3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400107b5
test byte [rcx + 0x1c], 1
je 0x1400107b5
mov edx, 0x56
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSenseInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Getting_Printer_information..._n
call fcn.140006cd8
nop
mov rcx, qword [rsp + 0x58]
call fcn.140029b7c
mov ebx, eax
jmp 0x1400107f6
test ebx, ebx
jns 0x140010832
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010824
test byte [rcx + 0x1c], 1
je 0x140010824
mov edx, 0x57
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectPrinterInfo_failed___X__n
call fcn.140006cb0
lea rcx, str.Collecting_WinRE_logs..._n
call fcn.140006cd8
and qword [rsp + 0x198], 0
lea rax, [rsp + 0x188]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x188], rax
and qword [rsp + 0x178], 0
lea rax, [rsp + 0x168]
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x168], rax
and qword [rsp + 0x158], 0
lea rax, [rsp + 0x148]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x148], rax
and qword [rsp + 0x138], 0
lea rax, [rsp + 0x128]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x128], rax
and qword [rsp + 0x118], 0
lea rax, [rsp + 0x108]
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x108], rax
and qword [rsp + 0xf8], 0
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xe8], rax
xor edx, edx
mov ecx, 0xa0000
call fcn.14003ab78
test eax, eax
js 0x140010d64
and qword [rsp + 0x98], 0
lea rdx, str._windir_LogsReagent
lea rcx, [rsp + 0x98]
call fcn.14003c4c0
mov ebx, eax
test eax, eax
jns 0x1400109a1
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010995
test byte [rcx + 0x1c], 2
je 0x140010995
mov edx, 0x58
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.Getting_windirLogsReagent_failed___X_._n
jmp 0x140010a8d
lea r9, [rsp + 0x188]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
call fcn.14000d9d4
mov ebx, eax
jmp 0x1400109de
test ebx, ebx
jns 0x140010a1b
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010a0c
test byte [rcx + 0x1c], 1
je 0x140010a0c
mov edx, 0x59
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
call fcn.140006cb0
nop
lea r9, [rsp + 0x168]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010a58
test ebx, ebx
jns 0x140010a94
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010a86
test byte [rcx + 0x1c], 1
je 0x140010a86
mov edx, 0x5a
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
mov edx, ebx
call fcn.140006cb0
and qword [rsp + 0x78], 0
lea rdx, str._windir_PantherUnattendGC
lea rcx, [rsp + 0x78]
call fcn.14003c4c0
mov ebx, eax
test eax, eax
jns 0x140010b07
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010adb
test byte [rcx + 0x1c], 2
je 0x140010adb
mov edx, 0x5b
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.Getting_windirPantherUnattendGC_failed___X_._n
call fcn.140006cb0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140010bf4
call fcn.140040784
and qword [rsp + 0x78], 0
jmp 0x140010bf4
lea r9, [rsp + 0x148]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010b41
test ebx, ebx
jns 0x140010b7e
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010b6f
test byte [rcx + 0x1c], 1
je 0x140010b6f
mov edx, 0x5c
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
call fcn.140006cb0
nop
lea r9, [rsp + 0x128]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010bb8
test ebx, ebx
jns 0x140010bf4
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010be6
test byte [rcx + 0x1c], 1
je 0x140010be6
mov edx, 0x5d
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
call fcn.140006cb0
and qword [rsp + 0x70], 0
lea rdx, str._windir_System32_recovery
lea rcx, [rsp + 0x70]
call fcn.14003c4c0
mov ebx, eax
test eax, eax
jns 0x140010c47
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010c3b
test byte [rcx + 0x1c], 2
je 0x140010c3b
mov edx, 0x5e
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.Getting_windir_system32_recovery_failed___X_._n
jmp 0x140010d2d
lea r9, [rsp + 0x108]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010c81
test ebx, ebx
jns 0x140010cbe
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010caf
test byte [rcx + 0x1c], 1
je 0x140010caf
mov edx, 0x5f
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
call fcn.140006cb0
nop
lea r9, [rsp + 0xe8]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.14000d9d4
mov ebx, eax
jmp 0x140010cf8
test ebx, ebx
jns 0x140010d34
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010d26
test byte [rcx + 0x1c], 1
je 0x140010d26
mov edx, 0x60
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___X__n
mov edx, ebx
call fcn.140006cb0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140010d43
call fcn.140040784
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140010d52
call fcn.140040784
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140010d64
call fcn.140040784
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x510], 1
mov byte [rsp + 0x514], 0
lea rcx, str.Creating_CAB_file..._n
call fcn.140006cd8
xor ebx, ebx
mov qword [rsp + 0x98], rbx
cmp byte [rsp + 0x8e0], bl
je 0x140010e6c
lea r8, str.DiagOutputDir
lea rdx, [rsp + 0x98]
lea rcx, [0x14003ade0]
call fcn.14003aec0
mov ebx, eax
test eax, eax
js 0x1400114c6
mov rbx, qword [rsp + 0x98]
mov rcx, rbx
call fcn.14003c264
mov edi, eax
test eax, eax
js 0x140011506
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x240]
call fcn.1400428c0
lea rdx, [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140011546
test dword [rsp + 0x240], 0x400
je 0x140010e64
cmp dword [rsp + 0x264], 0xa0000003
je 0x140011589
mov rcx, rbx
mov rsi, rbx
jmp 0x140010e73
mov rcx, qword [rsp + 0x58]
xor esi, esi
mov r9d, 4
lea r8, [rsp + 0x510]
lea rdx, [rsp + 0x4f0]
call fcn.140011f08
mov edi, eax
test eax, eax
js 0x1400115ce
mov rdx, qword [rsp + 0x58]
cmp byte [rsp + 0x8e0], 0
cmovne rdx, rsi
lea r8, str.SupportFiles.cab
lea rcx, str.Files_successfully_created_in__lsMp_ls_n
call fcn.140006cd8
xor edx, edx
mov r8d, 0x202
lea rcx, [rsp + 0x520]
call fcn.1400428c0
mov dword [rsp + 0xcc], 0x101
lea rdx, [rsp + 0xcc]
lea rcx, [rsp + 0x520]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne r15b
test eax, eax
jne 0x140010f3b
call fcn.140038cd4
mov edi, eax
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140010f2d
test byte [rcx + 0x1c], 1
je 0x140010f2d
mov edx, 0x66
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_GetUserNameW___failed___X__n
call fcn.140006cb0
and qword [rsp + 0xd8], 0
cmp qword [rsp + 0xd0], 0
jne 0x1400110fc
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x14004f714]
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov edi, eax
test eax, eax
jns 0x140010fbb
mov r10, qword [str.___a_]
cmp r10, r14
je 0x140010fab
test byte [r10 + 0x1c], 1
je 0x140010fab
mov edx, 0x72
mov dword [rsp + 0x20], eax
lea r9, [0x14004f714]
lea r8, [0x140059a88]
mov rcx, qword [r10 + 0x10]
call fcn.140002410
mov r10, qword [str.___a_]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001108d
jmp 0x14001101f
mov dword [rsp + 0x50], 2
and dword [rsp + 0x78], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
lea rdx, str.SupportLogLocation
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov esi, eax
mov edi, 0x80070002
cmp eax, edi
jne 0x14001102e
cmp byte [rsp + 0x60], 0
je 0x140011036
lea rcx, str.Error:_Support_Log_Location_is_not_set__n
call fcn.140006cd8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140011025
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov r10, qword [str.___a_]
jmp 0x14001108d
test esi, esi
jns 0x1400110d7
mov r10, qword [str.___a_]
cmp r10, r14
je 0x140011070
test byte [r10 + 0x1c], 1
je 0x140011070
mov edx, 0x73
mov dword [rsp + 0x20], esi
lea r9, str.SupportLogLocation
lea r8, [0x140059a88]
mov rcx, qword [r10 + 0x10]
call fcn.140002410
mov r10, qword [str.___a_]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140011087
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov r10, qword [str.___a_]
mov edi, esi
test esi, esi
jns 0x1400110e7
cmp r10, r14
je 0x1400110b1
test byte [r10 + 0x1c], 1
je 0x1400110b1
mov edx, 0x67
mov r9d, edi
lea r8, [0x140059a88]
mov rcx, qword [r10 + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_GetSupportLogLocationPathFromConfig___failed___X__n
call fcn.140006cb0
mov al, byte [rsp + 0x80]
neg al
sbb ecx, ecx
and ecx, edi
jl 0x14001160e
jmp 0x14001115c
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400110e7
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x14001115c
movzx edx, byte [rsp + 0x60]
mov r8, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call fcn.140011680
mov edi, eax
test eax, eax
jns 0x14001115c
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140011143
test byte [rcx + 0x1c], 1
je 0x140011143
mov edx, 0x68
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.Error:_CopySupportLogs_failed___X__n
call fcn.140006cb0
cmp byte [rsp + 0x60], 0
jne 0x140011614
mov edx, 0x3fab
call fcn.14003abd8
test eax, eax
js 0x1400111dd
mov edx, 0xc9
call fcn.14000dc40
mov edi, eax
jmp 0x1400111a0
test edi, edi
jns 0x1400111dd
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400111ce
test byte [rcx + 0x1c], 2
je 0x1400111ce
mov edx, 0x69
mov r9d, edi
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.Purging_logs_for_Windows_Security_Service_failed___X__n
call fcn.140006cb0
nop
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400111f1
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
test rbx, rbx
je 0x1400111ff
mov rcx, rbx
call fcn.140040784
nop
lea rcx, [rsp + 0xe8]
call fcn.140013238
nop
lea rcx, [rsp + 0x108]
call fcn.140013238
nop
lea rcx, [rsp + 0x128]
call fcn.140013238
nop
lea rcx, [rsp + 0x148]
call fcn.140013238
nop
lea rcx, [rsp + 0x168]
call fcn.140013238
nop
lea rcx, [rsp + 0x188]
call fcn.140013238
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140011266
call fcn.140040784
nop
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14001127c
mov rcx, rbx
call fcn.140040784
nop
lea rcx, [rsp + 0x1a8]
call fcn.140013238
nop
mov rcx, qword [rsp + 0x228]
test rcx, rcx
je 0x14001129d
call fcn.140040784
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400112b0
mov rcx, rbx
call fcn.140040784
nop
lea rcx, [rsp + 0x1c8]
call fcn.140013238
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400112d1
call fcn.140040784
nop
lea rcx, [rsp + 0x1e8]
call fcn.140013238
nop
lea rcx, [rsp + 0x208]
call fcn.140013238
nop
cmp qword [rsp + 0xe0], 0
je 0x1400112ff
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x140011312
call fcn.140040784
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140011325
call fcn.140040784
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140011334
call fcn.140040784
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140040760
add rsp, 0x8a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea r14, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140011388
test byte [rcx + 0x1c], 1
je 0x140011388
mov edx, 0x2d
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_MpSmartCoInitialize_failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
lea r14, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400113cf
test byte [rcx + 0x1c], 1
je 0x1400113cf
mov edx, 0x2e
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CoInitializeSecurity_failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14001140f
test byte [rcx + 0x1c], 1
je 0x14001140f
mov edx, 0x30
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14001144c
test byte [rcx + 0x1c], 1
je 0x14001144c
mov edx, 0x31
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002150
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_return_unknown_product___X_._n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140011491
test byte [rcx + 0x1c], 1
je 0x140011491
mov edx, 0x32
mov r9d, ebx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_GetSupportDir___failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
nop
mov ecx, eax
call fcn.14003b6a4
nop
mov ecx, eax
call fcn.14003b6a4
nop
mov ecx, eax
call fcn.14003b6a4
mov ecx, eax
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400114f0
test byte [rcx + 0x1c], 1
je 0x1400114f0
mov edx, 0x61
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_CreateCab___failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140011530
test byte [rcx + 0x1c], 1
je 0x140011530
mov edx, 0x62
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___X__n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x14001156e
test byte [rcx + 0x1c], 1
je 0x14001156e
lea edx, [rax + 0x64]
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.1400022ac
mov edi, 0x80070002
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___X__n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400115b3
test byte [rcx + 0x1c], 1
je 0x1400115b3
mov edx, 0x64
mov r9, rbx
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.1400022ac
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.Error:_CreateCab___failed___X__n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x1400115f8
test byte [rcx + 0x1c], 1
je 0x1400115f8
mov edx, 0x65
mov r9d, eax
lea r8, [0x140059a88]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___X__n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
nop
call fcn.14003b6a4
int3
lea eax, [rdi + 0x7ff8fffb]
cmp eax, 0x3e
ja 0x14001162f
movabs rcx, 0x4001000000000001
bt rcx, rax
jb 0x140011647
cmp edi, 0x800700a1
je 0x140011647
mov edx, edi
lea rcx, str.Error:_Copy_of_the_Support_Logs_failed___X__n
call fcn.140006cd8
jmp 0x14001166e
test r15b, r15b
je 0x140011662
lea rdx, [rsp + 0x520]
lea rcx, str.Username:__ws_Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.140006cd8
jmp 0x14001166e
lea rcx, str.Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.140006cd8
mov ecx, edi
call fcn.14003b6a4
int3