Function at 0x14009c38c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r13d, r13d
mov r15, rcx
mov qword [rsp + 0x38], r13
mov edi, r13d
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x40], r13
mov qword [rsp + 0x68], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rbp - 0x20], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x30], r13
mov qword [rbp - 0x58], r13
mov qword [rsp + 0x40], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r13
mov rax, qword gs:[0x60]
test byte [rax + 3], 2
je 0x14009d417
cmp qword [rcx + 0x48], r13
jne 0x14009c450
mov r14d, 0x8000ffff
jmp 0x14009d41d
call fcn.1400a53b0
mov rsi, qword [0x14045c758]
test rsi, rsi
je 0x14009c4b5
cmp dword [rsi + 0x18], r13d
jne 0x14009c4a2
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14009c49b
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c4a7
mov dword [rsi + 0x18], 1
mov rsi, qword [rsi]
jmp 0x14009c45c
mov ecx, eax
call fcn.14007ac40
call fcn.1400a4fc8
jmp 0x14009c4b8
mov r14d, r13d
mov ecx, r14d
call fcn.14007ace8
test r14d, r14d
js 0x14009d41d
lea rcx, [rbp + 8]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14009d3f0
lea r9, [rbp + 8]
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, [0x1403e0dc0]
call fcn.14008f0bc
lea rdx, [rsp + 0x30]
lea rcx, [0x1403dd7c0]
call fcn.1401b8abc
mov r14d, eax
test eax, eax
jns 0x14009c520
mov ecx, eax
jmp 0x14009d420
lea rdx, [rsp + 0x48]
call fcn.1400a30bc
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov r8, qword [rsp + 0x48]
lea rdx, str.msft:spp_notifications_common_tokenstorereempty
mov rax, rsi
xor r9d, r9d
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov r8, qword [rsp + 0x48]
lea rdx, str.msft:spp_notifications_common_tokenstorerecorrupted
mov rax, rsi
xor r9d, r9d
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
lea rdx, [rsp + 0x60]
call fcn.1400a2fc4
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, str.msft:spp_notifications_common_sppnotificationgatherlicensingstate
mov r9d, 0x30
mov r8, r12
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c624
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, str.msft:spp_notifications_common_sppnotificationdepositlicensingstate
mov r9d, 0x30
mov r8, r12
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
jns 0x14009c62b
mov ecx, eax
call fcn.14007ac40
mov ecx, r14d
call fcn.14007ace8
test r14d, r14d
js 0x14009d41d
lea rdx, [rsp + 0x58]
call fcn.1400a2804
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov r8, qword [rsp + 0x58]
lea rdx, str.msft:spp_notifications_common_slrearm
mov rax, rsi
xor r9d, r9d
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov eax, 3
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea r9, [0x140093b20]
mov dword [rbp - 0x18], eax
lea r8, [0x140093a00]
mov dword [rbp - 0x14], eax
lea rcx, [rbp - 0x18]
lea r12d, [rax - 2]
mov dword [rbp - 0x10], eax
mov dword [rbp - 0xc], eax
mov edx, r12d
mov dword [rbp - 8], eax
mov dword [rbp], eax
mov dword [rbp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov dword [rbp - 4], r12d
call fcn.14010a400
mov r14d, eax
test eax, eax
jns 0x14009c6e9
mov ecx, eax
call fcn.14007ac40
mov ecx, r14d
call fcn.14007ace8
test r14d, r14d
jns 0x14009c716
mov ecx, r14d
call fcn.14007ac40
lea rdx, [0x140457a9c]
lea rcx, [0x14042a5b8]
call fcn.1400f39cc
jmp 0x14009d425
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rbp - 0x30]
lea rdx, [0x1403dd720]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rbp - 0x38]
lea rdx, [0x1403dd700]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rbp - 0x40]
lea rdx, [0x1403dd6f0]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rsp + 0x68]
lea rdx, [0x1403dd690]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rbp - 0x48]
lea rdx, [0x1403dd6e0]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rsi, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
lea r8, [rbp - 0x50]
lea rdx, [0x1403dd6c0]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x10]
mov r14, qword [rsp + 0x38]
mov qword [rsp + 0x38], r13
test rsi, rsi
je 0x14009c883
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x30]
mov qword [r15 + 0x10], rax
mov rsi, qword [r15 + 0x18]
mov qword [rbp - 0x30], r13
test rsi, rsi
je 0x14009c8bd
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x38]
mov qword [r15 + 0x18], rax
mov rsi, qword [r15 + 0x20]
mov qword [rbp - 0x38], r13
test rsi, rsi
je 0x14009c8f7
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x40]
mov qword [r15 + 0x20], rax
mov rsi, qword [r15 + 0x28]
mov qword [rbp - 0x40], r13
test rsi, rsi
je 0x14009c931
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x48]
mov qword [r15 + 0x28], rax
mov rsi, qword [r15 + 0x30]
mov qword [rbp - 0x48], r13
test rsi, rsi
je 0x14009c96b
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
lea rdx, [0x14045ace8]
mov rax, r13
lea rcx, [0x14043ffc0]
cmovne rax, r14
mov r14, qword [rbp - 0x50]
mov qword [r15 + 0x30], rax
mov rsi, qword [r15 + 0x38]
mov qword [rbp - 0x50], r13
call fcn.1400f43c8
test rsi, rsi
je 0x14009c9cb
lea rdx, [0x140457728]
lea rcx, [0x14043d098]
call fcn.1400f4dac
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
mov rcx, r15
cmovne rax, r14
mov qword [r15 + 0x38], rax
call fcn.14009eafc
lea rcx, [0x14045db10]
call fcn.140070748
mov r14d, eax
test eax, eax
jns 0x14009c9fd
mov ecx, eax
call fcn.14007ac40
jmp 0x14009ca51
xor edx, edx
lea rcx, [0x14045db80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x14009ca1c
mov dword [0x14045dba8], r12d
mov r14d, r13d
jmp 0x14009ca4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009ca31
mov r14d, 0x80004005
mov ecx, r14d
jmp 0x14009c9f6
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov ecx, r14d
test r14d, r14d
js 0x14009c9f6
mov dword [0x14045c7f8], r12d
mov ecx, r14d
call fcn.14007ace8
test r14d, r14d
js 0x14009d41d
lea rcx, [rbp - 0x20]
call fcn.14009b9a8
mov r14d, eax
test eax, eax
js 0x14009c519
mov rax, qword [r15 + 0xb0]
lea rcx, [rsp + 0x50]
mov r8, qword [rbp - 0x20]
mov rdx, qword [r15 + 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400fc008
mov r14d, eax
test eax, eax
js 0x14009c519
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x58]
call fcn.140093b90
mov r14d, eax
test eax, eax
js 0x14009c519
lea rcx, [rsp + 0x40]
call fcn.14009b5c0
mov r14d, eax
test eax, eax
js 0x14009c519
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x158
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14009d3dd
xor eax, eax
lea rcx, [rsi + 8]
mov qword [rsi], rax
xor edx, edx
mov qword [rsi + 0x140], rax
mov qword [rsi + 0x14c], rax
lea edi, [rax + 0x68]
mov r8d, edi
call sub.msvcrt.dll_memset
mov qword [rsi + 0x38], r13
lea rcx, [rsi + 0x70]
mov qword [rsi + 0x40], r13
xor eax, eax
mov qword [rsi + 0x58], rax
mov r8d, edi
xor edx, edx
mov qword [rsi + 0x60], r13
call sub.msvcrt.dll_memset
mov qword [rsi + 0xa0], r13
lea rdx, [0x14045a3a0]
mov qword [rsi + 0xa8], r13
lea rcx, [0x14043612c]
xor eax, eax
mov qword [rsi + 0xc0], rax
mov qword [rsi + 0xc8], r13
mov qword [rsi + 0xd8], r13
call fcn.1400f4710
lea rcx, [rsi + 0xe0]
xor edx, edx
lea r8d, [rdi - 8]
call sub.msvcrt.dll_memset
mov qword [rsi + 0x148], r13
mov rdi, rsi
mov qword [rsi + 0x150], r13
test rsi, rsi
je 0x14009d3dd
mov rcx, rsi
call fcn.1400db628
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x40]
mov r14, qword [rsp + 0x50]
mov qword [rsp + 0x50], r13
test rsi, rsi
je 0x14009cbd9
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rsp + 0x30]
mov qword [r15 + 0x40], rax
mov rsi, qword [r15 + 0x50]
mov qword [rsp + 0x30], r13
test rsi, rsi
je 0x14009cc15
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x58]
mov qword [r15 + 0x50], rax
mov rsi, qword [r15 + 0x58]
mov qword [rbp - 0x58], r13
test rsi, rsi
je 0x14009cc4f
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
mov rsi, rdi
mov rdi, r13
cmovne rax, r14
mov qword [r15 + 0x58], rax
mov rbx, qword [r15]
test rbx, rbx
je 0x14009cc87
mov rcx, rbx
call fcn.1400ba11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rsp + 0x48]
mov qword [r15], rsi
mov rsi, qword [r15 + 0x98]
mov qword [rsp + 0x48], r13
test rsi, rsi
je 0x14009ccce
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
lea rdx, [0x140454c34]
lea rcx, [0x140443640]
call fcn.1400f3670
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rsp + 0x60]
mov qword [r15 + 0x98], rax
mov rsi, qword [r15 + 0xa0]
mov qword [rsp + 0x60], r13
test rsi, rsi
je 0x14009cd10
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rsp + 0x58]
mov qword [r15 + 0xa0], rax
mov rsi, qword [r15 + 0xa8]
mov qword [rsp + 0x58], r13
test rsi, rsi
je 0x14009cd52
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
mov rcx, r15
cmovne rax, r14
mov qword [r15 + 0xa8], rax
call fcn.14009e248
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [0x14045c9c0]
mov rcx, r15
mov rax, qword [r14]
mov rbx, qword [rax + 0x28]
call fcn.14004eaa4
mov rsi, rax
mov rcx, rbx
mov rax, qword [0x1403d25b8]
call rax
lea rcx, [rbp - 0x60]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x1403dd520]
mov rcx, r14
lea r8, str.msft:spp_publishedobject_eventmanager
mov rdx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [0x14045c9c0]
mov rcx, r15
mov rax, qword [r14]
mov rbx, qword [rax + 0x28]
call fcn.14004eaa4
mov rsi, rax
mov rcx, rbx
mov rax, qword [0x1403d25b8]
call rax
lea rcx, [rbp - 0x68]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x1403dd580]
mov rcx, r14
lea r8, str.msft:spp_publishedobject_tokendatabase_query_collection_factory
mov rdx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x20]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rdx, qword [rsp + 0x68]
lea r9, [rbp - 0x70]
mov rax, rsi
lea r8, [0x1403dd590]
mov rcx, rbx
call rax
lea rdx, [0x140456944]
mov r14d, eax
lea rcx, [0x140432f44]
call fcn.1400f3318
test r14d, r14d
js 0x14009d41d
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x28]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rdx, qword [rsp + 0x68]
lea r9, [rbp - 0x78]
mov rax, rsi
lea r8, [0x1403dd590]
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [0x14045c9c0]
mov rcx, r15
mov rax, qword [r14]
mov rbx, qword [rax + 0x28]
call fcn.14004eaa4
mov rsi, rax
mov rcx, rbx
mov rax, qword [0x1403d25b8]
call rax
lea rcx, [rbp - 0x28]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x1403dd5b0]
mov rcx, r14
lea r8, str.msft:spp_publishedobject_genuineinfo_factory
mov rdx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov r8, qword [rsp + 0x68]
lea rcx, [rbp - 0x80]
mov rdx, qword [0x14045c9a0]
lea r9, [0x1403dd5c0]
mov qword [rsp + 0x20], rcx
mov rax, rsi
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [0x14045c9c0]
mov rcx, r15
mov rax, qword [r14]
mov rbx, qword [rax + 0x28]
call fcn.14004eaa4
mov rsi, rax
mov rcx, rbx
mov rax, qword [0x1403d25b8]
call rax
lea rcx, [rsp + 0x78]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x1403dd510]
mov rcx, r14
lea r8, str.msft:spp_publishedobject_cachestoredatabase
mov rdx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x58]
mov rax, qword [rsi]
mov rbx, qword [rax]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rsp + 0x70]
lea rdx, [0x1403dd7b0]
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x60]
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x14009cff0
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r12, r12
mov r14, r13
cmovne r14, r12
mov qword [r15 + 0x60], r14
mov rsi, qword [r15 + 0x50]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, str.msft:spp_notifications_host_service_start
xor r9d, r9d
mov r8, r14
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [r15 + 0x50]
mov rsi, qword [r15 + 0x60]
mov rax, qword [r14]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, str.msft:spp_notifications_host_service_stop
xor r9d, r9d
mov r8, rsi
mov rcx, r14
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov r14, qword [r15 + 0x50]
mov rsi, qword [r15 + 0x60]
mov rax, qword [r14]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, str.msft:spp_notifications_host_pluginregistrationchanged
xor r9d, r9d
mov r8, rsi
mov rcx, r14
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x50]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov r8, qword [rsp + 0x40]
lea rdx, str.msft:spp_notifications_common_systemstatechange
mov rax, rbx
xor r9d, r9d
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x50]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov r8, qword [rsp + 0x40]
lea rdx, str.msft:spp_notifications_common_tokenstoreerrorfound
mov rax, rbx
xor r9d, r9d
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x50]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov r8, qword [rsp + 0x40]
lea rdx, str.msft:spp_notifications_common_hwidcollectionfailed
mov rax, rbx
xor r9d, r9d
mov rcx, rsi
call rax
mov r14d, eax
test eax, eax
js 0x14009c519
mov rsi, qword [r15 + 0x88]
mov r14, qword [rbp - 0x60]
mov qword [rbp - 0x60], r13
test rsi, rsi
je 0x14009d185
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
lea rdx, [0x140455ac8]
mov rax, r13
lea rcx, [0x14043246c]
cmovne rax, r14
mov r14, qword [rbp - 0x70]
mov qword [r15 + 0x88], rax
mov qword [rbp - 0x70], r13
call fcn.1400f3670
mov rsi, qword [r15 + 0x70]
test rsi, rsi
je 0x14009d1d5
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
lea rdx, [0x140458bf4]
mov rax, r13
lea rcx, [0x140434c30]
cmovne rax, r14
mov qword [r15 + 0x70], rax
call fcn.1400f50fc
mov rsi, qword [r15 + 0x78]
mov r14, qword [rbp - 0x78]
mov qword [rbp - 0x78], r13
test rsi, rsi
je 0x14009d222
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rbp - 0x80]
mov qword [r15 + 0x78], rax
mov rsi, qword [r15 + 0x80]
mov qword [rbp - 0x80], r13
test rsi, rsi
je 0x14009d25f
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov r14, qword [rsp + 0x78]
mov qword [r15 + 0x80], rax
mov rsi, qword [r15 + 0x90]
mov qword [rsp + 0x78], r13
test rsi, rsi
je 0x14009d2a1
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
lea rdx, [0x140457e1c]
mov rax, r13
lea rcx, [0x14043d7d0]
cmovne rax, r14
mov r14, qword [rsp + 0x40]
mov qword [r15 + 0x90], rax
call fcn.1400f3d28
mov rsi, qword [r15 + 0x68]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x14009d2f3
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test r14, r14
mov rax, r13
cmovne rax, r14
mov qword [r15 + 0x68], rax
call fcn.1400a53b0
mov rsi, qword [0x14045c708]
test rsi, rsi
je 0x14009d366
cmp dword [rsi + 0x18], r13d
jne 0x14009d353
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14009d34c
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14009d358
mov dword [rsi + 0x18], 1
mov rsi, qword [rsi]
jmp 0x14009d30d
mov ecx, eax
call fcn.14007ac40
call fcn.1400a4d84
jmp 0x14009d369
mov r14d, r13d
mov ecx, r14d
call fcn.14007ace8
test r14d, r14d
js 0x14009d41d
mov edx, dword [r15 + 0xd8]
test edx, edx
jns 0x14009d398
mov rcx, r15
call fcn.14009f4c8
mov r14d, eax
test eax, eax
js 0x14009c519
mov rcx, r15
call fcn.14009d854
xor r9d, r9d
test eax, eax
js 0x14009d3bf
lea ecx, [r9 + 4]
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 0xc000400a
call fcn.14004eeb8
jmp 0x14009d425
mov ecx, 2
mov qword [rsp + 0x28], r13
mov r8d, eax
mov qword [rsp + 0x20], r13
mov edx, 0xc0004009
call fcn.14004ef44
jmp 0x14009d425
mov r14d, 0x8007000e
mov ecx, r14d
call fcn.14007ac40
mov rdi, r13
jmp 0x14009d425
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov r14d, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, r14d
mov r14d, ecx
jmp 0x14009d420
mov r14d, 0x80070005
mov ecx, r14d
call fcn.14007ac40
mov ecx, r14d
call fcn.14007ace8
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14009d457
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rsp + 0x70], r13
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14009d481
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rsp + 0x78], r13
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x14009d4bc
mov rax, qword [rbx]
lea rdx, [0x1404532e8]
lea rcx, [0x14043bccc]
mov rsi, qword [rax + 0x10]
call fcn.1400f4080
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x80], r13
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x14009d4f7
mov rax, qword [rbx]
lea rdx, [0x140452390]
lea rcx, [0x140434d48]
mov rsi, qword [rax + 0x10]
call fcn.1400f4a68
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x28], r13
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14009d51f
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x78], r13
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x14009d547
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x70], r13
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x14009d56f
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x68], r13
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14009d597
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x60], r13
test rdi, rdi
je 0x14009d5b8
mov rcx, rdi
call fcn.1400ba11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14009d5e2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x40], r13
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x14009d60a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x58], r13
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14009d634
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x30], r13
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14009d65e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x50], r13
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x14009d686
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x20], r13
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14009d6b0
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x58], r13
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14009d6da
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x60], r13
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14009d704
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x48], r13
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x14009d72c
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x50], r13
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x14009d754
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x48], r13
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14009d77e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x68], r13
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x14009d7a6
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x40], r13
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14009d7ce
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x38], r13
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x14009d7f6
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x30], r13
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14009d81b
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov eax, r14d
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140388a50
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret