Function at 0x14001c7e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov r12, rcx
lea r8, str.SoftwareMicrosoftWindows_Defender
xor ebx, ebx
lea rcx, [rbp + 0x50]
mov r9d, 0x20019
mov qword [rbp + 0x50], rbx
mov rdx, 0xffffffff80000002
call fcn.1400a3eb0
mov r14, qword [rbp + 0x50]
mov r15d, eax
test eax, eax
jns 0x14001c868
mov rcx, qword [0x1400df278]
lea r13, [0x1400df278]
cmp rcx, r13
je 0x14001df05
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001df05
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xa]
mov r9d, eax
lea r8, [0x1400b90e8]
call fcn.14000a9b0
jmp 0x14001df05
lea r8, [rbp + 0x50]
mov qword [rbp + 0x50], rbx
lea rdx, str.InstallLocation
mov rcx, r14
call fcn.1400a45a4
lea r13, [0x1400df278]
lea rdi, [0x1400b90e8]
test eax, eax
jns 0x14001c916
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001c8bb
test byte [rcx + 0x1c], 2
je 0x14001c8bb
mov rcx, qword [rcx + 0x10]
mov edx, 0xb
mov r9d, eax
mov r8, rdi
call fcn.14000a9b0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14001c8cd
call fcn.1400ac0d0
mov qword [rbp + 0x50], rbx
lea rdx, str._ProgramFiles_Windows_Defender
lea rcx, [rbp + 0x50]
call fcn.1400a7a5c
mov r15d, eax
test eax, eax
jns 0x14001c916
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001c90d
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001c90d
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, rdi
call fcn.14000a9b0
mov rsi, qword [rbp + 0x50]
jmp 0x14001def8
mov rsi, qword [rbp + 0x50]
lea rcx, [rbp + 0x58]
mov rdx, rsi
mov qword [rbp + 0x58], rbx
call fcn.1400a35bc
mov rbx, qword [rbp + 0x58]
xor ecx, ecx
mov r15d, eax
test eax, eax
jns 0x14001c96d
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001deeb
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001deeb
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetElemsize
mov r9d, eax
mov r8, rdi
call fcn.14000a9b0
jmp 0x14001deeb
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14001c971
test rax, rax
je 0x14001c98c
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x14001c98c
mov word [rbx + rax*2 - 2], cx
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001c9b2
test byte [rcx + 0x1c], 4
je 0x14001c9b2
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetElemsize
mov r9, rbx
mov r8, rdi
call fcn.14001c770
and qword [rbp + 0x60], 0
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x60]
call fcn.14000bb0c
mov r15d, eax
test eax, eax
jns 0x14001ca01
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001decb
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001decb
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetLBound
mov r9d, eax
mov r8, rdi
call fcn.14000a9b0
jmp 0x14001decb
and qword [rbp + 0x50], 0
lea rdx, str._lsMpClient.dll
mov r8, rbx
lea rcx, [rbp + 0x50]
call fcn.1400a3c2c
mov rdi, qword [rbp + 0x50]
mov r15d, eax
test eax, eax
jns 0x14001ca4b
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayGetLBound
jmp 0x14001dc75
mov rcx, qword [r12 + 0x1c8]
test rcx, rcx
je 0x14001ca6d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
and qword [r12 + 0x1c8], 0
mov r8d, 0x1000
lea rcx, [r12 + 0x1c8]
mov rdx, rdi
call fcn.1400a2ae4
mov r15d, eax
test eax, eax
jns 0x14001cac8
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
mov r12b, 1
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b90e8]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.140010d3c
jmp 0x14001debe
mov rcx, qword [r12 + 0x1c8]
lea rdx, str.MpManagerOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov r12b, 1
mov qword [rcx + 0x10], rax
test rax, rax
jne 0x14001cb0b
mov dl, r12b
lea rcx, str.MpManagerOpen
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cb0e
xor r15d, r15d
test r15d, r15d
jns 0x14001cb37
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayGetLBound
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpNotificationRegister
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x18], rax
test rax, rax
jne 0x14001cb76
mov dl, r12b
lea rcx, str.MpNotificationRegister
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cb79
xor r15d, r15d
test r15d, r15d
jns 0x14001cba2
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, reloc.OLEAUT32.dll_SafeArrayGetLBound
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpQuarantineRequest
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x20], rax
test rax, rax
jne 0x14001cbe1
mov dl, r12b
lea rcx, str.MpQuarantineRequest
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cbe4
xor r15d, r15d
test r15d, r15d
jns 0x14001cc0d
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpThreatQuery
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x28], rax
test rax, rax
jne 0x14001cc4c
mov dl, r12b
lea rcx, str.MpThreatQuery
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cc4f
xor r15d, r15d
test r15d, r15d
jns 0x14001cc78
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayPutElement
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpThreatOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x30], rax
test rax, rax
jne 0x14001ccb7
mov dl, r12b
lea rcx, str.MpThreatOpen
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001ccba
xor r15d, r15d
test r15d, r15d
jns 0x14001cce3
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayPutElement
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpThreatEnumerate
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x38], rax
test rax, rax
jne 0x14001cd22
mov dl, r12b
lea rcx, str.MpThreatEnumerate
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cd25
xor r15d, r15d
test r15d, r15d
jns 0x14001cd4e
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayPutElement
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpThreatHistoryRequest
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x40], rax
test rax, rax
jne 0x14001cd8d
mov dl, r12b
lea rcx, str.MpThreatHistoryRequest
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cd90
xor r15d, r15d
test r15d, r15d
jns 0x14001cdb9
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, SafeArrayPutElement
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpManagerStatusQueryEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x48], rax
test rax, rax
jne 0x14001cdf8
mov dl, r12b
lea rcx, str.MpManagerStatusQueryEx
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cdfb
xor r15d, r15d
test r15d, r15d
jns 0x14001ce24
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, reloc.OLEAUT32.dll_SafeArrayPutElement
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpManagerVersionQuery
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0x50], rax
test rax, rax
jne 0x14001ce63
mov dl, r12b
lea rcx, str.MpManagerVersionQuery
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001ce66
xor r15d, r15d
test r15d, r15d
jns 0x14001ce8f
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1a
jmp 0x14001dcdf
lea rcx, [rdx + 0x58]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpOfflineScanInstall
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001ced1
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1b
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpGetCallistoDetections
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0x60], rax
test rax, rax
jne 0x14001cf13
mov dl, r12b
lea rcx, str.MpGetCallistoDetections
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cf16
xor r15d, r15d
test r15d, r15d
jns 0x14001cf3f
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1c
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpGetRunningMode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x68], rax
test rax, rax
jne 0x14001cf7e
mov dl, r12b
lea rcx, str.MpGetRunningMode
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cf81
xor r15d, r15d
test r15d, r15d
jns 0x14001cfaa
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1d
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpIsGivenRunningModeSupported
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0x70], rax
test rax, rax
jne 0x14001cfe9
mov dl, r12b
lea rcx, str.MpIsGivenRunningModeSupported
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001cfec
xor r15d, r15d
test r15d, r15d
jns 0x14001d015
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1e
jmp 0x14001dcdf
lea rcx, [rdx + 0x78]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpManagerEnable
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d057
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x1f
jmp 0x14001dc75
mov rax, qword [rbp + 0x48]
lea r8, str.MpManagerDisable
mov rdx, qword [rax + 0x1c8]
lea rcx, [rax + 0x80]
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d0a0
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x20
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpOfflineScanStatusQuery
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0x88], rax
test rax, rax
jne 0x14001d0e5
mov dl, r12b
lea rcx, str.MpOfflineScanStatusQuery
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d0e8
xor r15d, r15d
test r15d, r15d
jns 0x14001d111
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x21
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConveyUserChoiceForSampleList
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x90], rax
test rax, rax
jne 0x14001d153
mov dl, r12b
lea rcx, str.MpConveyUserChoiceForSampleList
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d156
xor r15d, r15d
test r15d, r15d
jns 0x14001d17f
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x22
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpGetSampleListRequiringConsent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x98], rax
test rax, rax
jne 0x14001d1c1
mov dl, r12b
lea rcx, str.MpGetSampleListRequiringConsent
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d1c4
xor r15d, r15d
test r15d, r15d
jns 0x14001d1ed
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x23
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpUpdateStartEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0xa0], rax
test rax, rax
jne 0x14001d22f
mov dl, r12b
lea rcx, str.MpUpdateStartEx
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d232
xor r15d, r15d
test r15d, r15d
jns 0x14001d25b
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x24
jmp 0x14001dcdf
lea rcx, [rdx + 0xa8]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpUpdateControl
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d2a0
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x25
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpScanStart
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, r15
mov qword [rdx + 0xb0], rax
test rax, rax
jne 0x14001d2e5
mov dl, r12b
lea rcx, str.MpScanStart
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d2e8
xor r15d, r15d
test r15d, r15d
jns 0x14001d311
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x26
jmp 0x14001dcdf
lea rcx, [rdx + 0xb8]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpScanControl
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d356
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x27
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpScanResult
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0xc0], rax
test rax, rax
jne 0x14001d39b
mov dl, r12b
lea rcx, str.MpScanResult
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d39e
xor r15d, r15d
test r15d, r15d
jns 0x14001d3c7
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x28
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpCleanOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0xc8], rax
test rax, rax
jne 0x14001d409
mov dl, r12b
lea rcx, str.MpCleanOpen
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d40c
xor r15d, r15d
test r15d, r15d
jns 0x14001d435
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x29
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpCleanStart
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0xd0], rax
test rax, rax
jne 0x14001d477
mov dl, r12b
lea rcx, str.MpCleanStart
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d47a
xor r15d, r15d
test r15d, r15d
jns 0x14001d4a3
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2a
jmp 0x14001dcdf
lea rcx, [rdx + 0xd8]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpCleanControl
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d4e8
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2b
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpErrorMessageFormat
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0xe0], rax
test rax, rax
jne 0x14001d52d
mov dl, r12b
lea rcx, str.MpErrorMessageFormat
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d530
xor r15d, r15d
test r15d, r15d
jns 0x14001d559
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2c
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpFreeMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0xe8], rax
test rax, rax
jne 0x14001d59b
mov dl, r12b
lea rcx, str.MpFreeMemory
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d59e
xor r15d, r15d
test r15d, r15d
jns 0x14001d5c7
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2d
jmp 0x14001dcdf
lea rcx, [rdx + 0xf0]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpHandleClose
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001d60c
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2e
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpAllocMemory
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0xf8], rax
test rax, rax
jne 0x14001d651
mov dl, r12b
lea rcx, str.MpAllocMemory
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d654
xor r15d, r15d
test r15d, r15d
jns 0x14001d67d
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x2f
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigSetValue
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x100], rax
test rax, rax
jne 0x14001d6bf
mov dl, r12b
lea rcx, str.MpConfigSetValue
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d6c2
xor r15d, r15d
test r15d, r15d
jns 0x14001d6eb
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x30
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigDelValue
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x108], rax
test rax, rax
jne 0x14001d72d
mov dl, r12b
lea rcx, str.MpConfigDelValue
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d730
xor r15d, r15d
test r15d, r15d
jns 0x14001d759
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x31
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x110], rax
test rax, rax
jne 0x14001d79b
mov dl, r12b
lea rcx, str.MpConfigOpen
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d79e
xor r15d, r15d
test r15d, r15d
jns 0x14001d7c7
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x32
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x118], rax
test rax, rax
jne 0x14001d809
mov dl, r12b
lea rcx, str.MpConfigClose
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d80c
xor r15d, r15d
test r15d, r15d
jns 0x14001d835
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x33
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigIteratorOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x120], rax
test rax, rax
jne 0x14001d877
mov dl, r12b
lea rcx, str.MpConfigIteratorOpen
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d87a
xor r15d, r15d
test r15d, r15d
jns 0x14001d8a3
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x34
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigIteratorEnum
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x128], rax
test rax, rax
jne 0x14001d8e5
mov dl, r12b
lea rcx, str.MpConfigIteratorEnum
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d8e8
xor r15d, r15d
test r15d, r15d
jns 0x14001d911
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x35
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigIteratorClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x130], rax
test rax, rax
jne 0x14001d953
mov dl, r12b
lea rcx, str.MpConfigIteratorClose
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d956
xor r15d, r15d
test r15d, r15d
jns 0x14001d97f
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x36
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigGetValue
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
mov qword [rcx + 0x138], rax
test rax, rax
jne 0x14001d9c1
mov dl, r12b
lea rcx, str.MpConfigGetValue
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001d9c4
xor r15d, r15d
test r15d, r15d
jns 0x14001d9ed
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x37
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpConfigGetValueAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0x140], rax
test rax, rax
jne 0x14001da2f
mov dl, r12b
lea rcx, str.MpConfigGetValueAlloc
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001da32
xor r15d, r15d
test r15d, r15d
jns 0x14001da5b
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x38
jmp 0x14001dcdf
lea rcx, [rdx + 0x148]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpTriggerStatusRefreshNotification
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001daa0
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x39
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpQueryDefaultFolderGuardList
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, r15
mov qword [rdx + 0x150], rax
test rax, rax
jne 0x14001dae5
mov dl, r12b
lea rcx, str.MpQueryDefaultFolderGuardList
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001dae8
xor r15d, r15d
test r15d, r15d
jns 0x14001db11
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3a
jmp 0x14001dcdf
lea rcx, [rdx + 0x158]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpForcedReboot
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001db56
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3b
jmp 0x14001dc75
mov r15, qword [rbp + 0x48]
lea rdx, str.MpGetAsrBlockedProcesses
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, r15
mov qword [rcx + 0x160], rax
test rax, rax
jne 0x14001db9b
mov dl, r12b
lea rcx, str.MpGetAsrBlockedProcesses
call fcn.1400a2d48
mov rcx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001db9e
xor r15d, r15d
test r15d, r15d
jns 0x14001dbc7
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3c
jmp 0x14001dcdf
mov rcx, qword [rcx + 0x1c8]
lea rdx, str.MpGetAsrBlockedActions
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x48]
mov qword [rdx + 0x168], rax
test rax, rax
jne 0x14001dc09
mov dl, r12b
lea rcx, str.MpGetAsrBlockedActions
call fcn.1400a2d48
mov rdx, qword [rbp + 0x48]
mov r15d, eax
jmp 0x14001dc0c
xor r15d, r15d
test r15d, r15d
jns 0x14001dc35
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3d
jmp 0x14001dcdf
lea rcx, [rdx + 0x170]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.MpDeleteAsrHistory
call fcn.1400206f4
mov r15d, eax
test eax, eax
jns 0x14001dc7a
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3e
mov r9d, eax
jmp 0x14001dce2
mov r15, qword [rbp + 0x48]
lea rdx, str.MpQueryEngineConfigDword
mov rcx, qword [r15 + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r15 + 0x178], rax
test rax, rax
jne 0x14001dcb8
mov dl, r12b
lea rcx, str.MpQueryEngineConfigDword
call fcn.1400a2d48
mov r15d, eax
jmp 0x14001dcbb
xor r15d, r15d
test r15d, r15d
jns 0x14001dcf7
mov rcx, qword [0x1400df278]
cmp rcx, r13
je 0x14001debe
test byte [rcx + 0x1c], r12b
je 0x14001debe
mov edx, 0x3f
mov r9d, r15d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b90e8]
call fcn.14000a9b0
jmp 0x14001debe
mov r13, qword [rbp + 0x48]
lea rdx, str.MpGetAsrBlockedActionInfos
lea r15, [r13 + 0x1c8]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x180], rax
test rax, rax
jne 0x14001dd33
mov dl, r12b
lea rcx, str.MpGetAsrBlockedActionInfos
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpGetTPStateInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x188], rax
test rax, rax
jne 0x14001dd64
mov dl, r12b
lea rcx, str.MpGetTPStateInfo
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpSetTPState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x190], rax
test rax, rax
jne 0x14001dd95
mov dl, r12b
lea rcx, str.MpSetTPState
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpSetBreakTheGlassStatus
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x198], rax
test rax, rax
jne 0x14001ddc6
mov dl, r12b
lea rcx, str.MpSetBreakTheGlassStatus
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpConveyDlpBypass
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x1a0], rax
test rax, rax
jne 0x14001ddf7
mov dl, r12b
lea rcx, str.MpConveyDlpBypass
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpShowDlpDetailsDialog
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x1a8], rax
test rax, rax
jne 0x14001de28
mov dl, r12b
lea rcx, str.MpShowDlpDetailsDialog
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpConveyUserChoiceForDlpNotification
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x1b0], rax
test rax, rax
jne 0x14001de59
mov dl, r12b
lea rcx, str.MpConveyUserChoiceForDlpNotification
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpChangeCapability
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x1b8], rax
test rax, rax
jne 0x14001de8a
mov dl, r12b
lea rcx, str.MpChangeCapability
call fcn.1400a2d48
mov rcx, qword [r15]
lea rdx, str.MpGetThreatExecutionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [r13 + 0x1c0], rax
test rax, rax
jne 0x14001debb
mov dl, r12b
lea rcx, str.MpGetThreatExecutionInfo
call fcn.1400a2d48
xor r15d, r15d
test rdi, rdi
je 0x14001decb
mov rcx, rdi
call fcn.1400ac0d0
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x14001deeb
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ad4ce.0]
test rbx, rbx
je 0x14001def8
mov rcx, rbx
call fcn.1400ac0d0
test rsi, rsi
je 0x14001df05
mov rcx, rsi
call fcn.1400ac0d0
test r14, r14
je 0x14001df19
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, r15d
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret