Function at 0x1400229fc
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x500
mov qword [rax - 0x470], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1400c7228]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rcx, qword [0x1400c7c50]
xor esi, esi
lea rax, [0x140029610]
test rcx, rcx
jne 0x14003e956
mov qword [0x1400c7c50], rax
mov r14d, 1
mov dword [rsp + 0x68], r14d
lea ebx, [r14 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x48], r14d
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea ecx, [rbx + 4]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x60], 2
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea r15d, [r14 + 8]
mov ecx, r15d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x50], r14d
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov r12d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
js 0x14003e982
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.140021828
test al, al
je 0x140022c7d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rcx, 0xffffffff80000002
call fcn.1400140d4
test eax, eax
jne 0x140022c7d
mov r15d, 0xff
mov ebx, esi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xe0]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140022c71
mov rcx, r15
lea rax, [rsp + 0xe0]
cmp word [rax], si
je 0x140022b85
add rax, 2
sub rcx, r14
jne 0x140022b77
test rcx, rcx
je 0x14003e98c
mov rax, r15
sub rax, rcx
test rcx, rcx
je 0x140022bef
mov rdx, r15
sub rdx, rax
lea rcx, [rsp + 0xe0]
lea rcx, [rcx + rax*2]
je 0x140022be1
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x14009648c]
sub rax, rcx
test r8, r8
je 0x140022be1
movzx r9d, word [rcx + rax]
test r9w, r9w
je 0x140022be1
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x140022bc1
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x58]
call fcn.1400140d4
test eax, eax
jne 0x140022c69
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x68], r14d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140022c5e
lea rcx, [rsp + 0x2e0]
call fcn.140022964
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
add ebx, r14d
jmp 0x140022b31
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
cmp dword [0x1400c81c8], esi
jne 0x14003e994
call fcn.140009280
test byte [0x1400c9742], 8
jne 0x140023182
test byte [0x1400c9741], 8
jne 0x14003f17f
call fcn.14000d760
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140025a20]
lea rcx, [0x1400c7f00]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1400c7c78], sil
jne 0x14003f1a1
mov byte [rsp + 0x61], r14b
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.140008488
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a134
nop
lea rcx, [rsp + 0x58]
call fcn.14000b07c
nop
lea rcx, [rsp + 0x70]
call fcn.14000b048
nop
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
js 0x14003f1ac
lea rdx, [rsp + 0x2e0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
je 0x14003f221
lea rcx, [rsp + 0xe0]
call fcn.140007c54
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140007fe0
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140007fe0
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xe0]
call fcn.14000a1a4
mov dword [rsp + 0x88], SafeArrayPutElement
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], esi
mov r15d, esi
cmp r15d, 0xf
jae 0x140022e82
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdx, rax
lea rcx, [0x1400c7f90]
call fcn.140013954
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r13d, eax
mov rcx, qword [0x1400c7f90]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x14003f293
test eax, eax
jne 0x14003f293
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022e9a
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140022eb2
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a388
nop
mov rcx, rbx
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0x68]
call fcn.1400068e0
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14003f372
cmp dword [rsp + 0x68], 2
jne 0x140022f36
mov ebx, r14d
cmp ebx, dword [rsp + 0x68]
jge 0x140022f36
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
jne 0x14003f37f
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14003f38c
add ebx, r14d
jmp 0x140022ef6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r15d, eax
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x14003f399
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140095218]
mov r8d, r14d
xor edx, edx
lea rcx, [0x140097868]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x14003f3d3
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140022fc0
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x1400022d4.0]
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x14003f3ed
call fcn.140009f9c
mov r15d, eax
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x14003f407
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140022fef
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400022d4.0]
test r15d, r15d
js 0x14003f3ad
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x94], xmm0
mov dword [rsp + 0xa4], esi
mov r13d, 3
mov dword [rsp + 0x90], r13d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0xd0], xmm1
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.14002107c
test eax, eax
je 0x14003f3c5
mov dl, bl
call fcn.140008e58
mov rbx, qword [0x1400c9368]
test rbx, rbx
je 0x14003f42a
cmp qword [rbx], rsi
je 0x14003f42a
mov rax, qword [rbx + 0x38]
call qword [case.0x1400022d4.0]
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002af98
test eax, eax
js 0x1400230af
xor ecx, ecx
mov rax, qword [rbx + 8]
call qword [case.0x1400022d4.0]
test eax, eax
jns 0x14003f421
mov rcx, qword [rsp + 0x518]
test eax, eax
jns 0x1400230cf
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x194
call fcn.14002a6ec
mov dword [rsp + 0x50], r13d
lea rcx, [rsp + 0x50]
call fcn.1400299ac
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
mov byte [rsp + 0x40], r14b
lea rdx, [rsp + 0x40]
call fcn.140029564
test byte [0x1400c9741], 8
jne 0x14003f4bb
test byte [0x1400c9742], 8
jne 0x14003f4dd
call fcn.14002b6b4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
cmp byte [rsp + 0x61], sil
je 0x140023137
mov ecx, dword [0x1400c7290]
cmp ecx, 0xffffffff
jne 0x14003f4f6
test rdi, rdi
je 0x14002314d
mov rcx, rdi
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov eax, r12d
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14002c150
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rdx, [0x140094c40]
lea rcx, [0x1400c6a30]
call fcn.14002b390
jmp 0x140022c9b
cmp rcx, rax
je 0x140022a52
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rsp + 0xe0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xe0]
call fcn.1400442b0
int3
mov eax, 0x800401f0
jmp 0x140023150
mov rax, rsi
jmp 0x140022b94
lea r8, [0x1400c67f8]
mov rdx, qword [str.SrchCommon]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6600]
mov rdx, qword [str.SrchCIDSO]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c68e8]
mov rdx, qword [str.SrchCollator]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6870]
mov rdx, qword [str.SrchCollatorAdmin]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6888]
mov rdx, qword [str.SrchCollatorCatalogInfo]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6678]
mov rdx, qword [str.SrchCollatorCommand]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c68a0]
mov rdx, qword [str.SrchCollatorCxnMgr]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6588]
mov rdx, qword [str.SrchCollatorCxn]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6948]
mov rdx, qword [str.SrchCollatorFetch]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c67b0]
mov rdx, qword [str.SrchCollatorProperties]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c65a0]
mov rdx, qword [str.SrchCollatorQuery]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6978]
mov rdx, qword [str.SrchCollatorRowset]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6618]
mov rdx, qword [str.SrchDatasource]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6630]
mov rdx, qword [str.SrchDSSQuery]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6738]
mov rdx, qword [str.SrchDSSConnection]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c66f0]
mov rdx, qword [str.SrchDSSLogin]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6660]
mov rdx, qword [str.SrchDSSConnectionManager]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6930]
mov rdx, qword [str.SrchDSSAdmin]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c67c8]
mov rdx, qword [str.SrchDSSManager]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6690]
mov rdx, qword [str.SrchDSSPortManager]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6720]
mov rdx, qword [str.SrchPHHttp]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c66c0]
mov rdx, qword [str.SrchPHOleDb]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c66a8]
mov rdx, qword [str.SrchPHSts]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6990]
mov rdx, qword [str.SrchPHMatrix]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c66d8]
mov rdx, qword [str.SrchPropertyDefs]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c67e0]
mov rdx, qword [str.SrchPropertyStore]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c68b8]
mov rdx, qword [str.SrchFilterDaemon]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6a08]
mov rdx, qword [str.SrchPHFile]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6540]
mov rdx, qword [str.SrchGatherPI]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c65b8]
mov rdx, qword [str.SrchGatherSvc]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c69a8]
mov rdx, qword [str.SrchGatherStatus]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6828]
mov rdx, qword [str.SrchGatherDestruction]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6570]
mov rdx, qword [str.SrchGatherDirMon]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6708]
mov rdx, qword [str.SrchGatherHistoryHash]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6780]
mov rdx, qword [str.SrchGatherServiceCatalog]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c65e8]
mov rdx, qword [str.SrchSimplePI]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c69d8]
mov rdx, qword [str.SrchSamplePI]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c68d0]
mov rdx, qword [str.SrchGatherPropMapper]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6918]
mov rdx, qword [str.SrchCscorePI]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6858]
mov rdx, qword [str.SrchCIWrapper]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c69c0]
mov rdx, qword [str.SrchIndexerQuery]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6558]
mov rdx, qword [str.SrchIndexerProperties]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c69f0]
mov rdx, qword [str.SrchIndexerPlugin]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6840]
mov rdx, qword [str.SrchIndexerClient]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6960]
mov rdx, qword [str.SrchIndexerSchema]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6798]
mov rdx, qword [str.SrchAdmin]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6750]
mov rdx, qword [str.SrchScriptPI]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6810]
mov rdx, qword [str.SrchXMLFilter]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6900]
mov rdx, qword [str.SrchSTRFilter]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6648]
mov rdx, qword [str.DaemonTest]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6a20]
mov rdx, qword [str.MSSearch_DAV]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c6768]
mov rdx, qword [str.SrchCluster]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
cmp dword [0x1400c81c8], esi
je 0x140022c89
lea r8, [0x1400c65d0]
mov rdx, qword [str.SrchServiceObj]
mov rcx, qword [0x1400c81e8]
call fcn.14005946c
nop
jmp 0x140022c89
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x1400a3c98]
lea rcx, [0x1400c6a30]
call fcn.14004db00
nop
jmp 0x140022ca8
call fcn.1400510c0
nop
jmp 0x140022ce8
mov rcx, qword [rsp + 0x518]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xfa
call fcn.14004b168
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003f1e3
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003f1fb
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a388
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
jmp 0x1400230e6
mov rcx, qword [rsp + 0x518]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x104
call fcn.140051470
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003f255
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003f26d
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a388
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
jmp 0x1400230e6
xor edx, edx
lea rcx, [0x1400c7f90]
call fcn.140013954
cmp r13d, 0xb7
je 0x14003f301
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003f2c5
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003f2dd
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a388
nop
mov rcx, rbx
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
jmp 0x1400230e6
cmp r15d, 0xe
jne 0x14003f35f
lea r12d, [r15 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003f323
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003f33b
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a388
nop
mov rcx, rbx
mov rax, qword [0x14008e038]
call qword [case.0x1400022d4.0]
nop
jmp 0x1400230e6
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
add r15d, r14d
jmp 0x140022e30
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400230e6
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400230e6
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400230e6
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16f
call fcn.14002a6ec
mov r12d, r15d
mov dword [rsp + 0x48], r15d
test ebx, ebx
js 0x14003f3c0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x1400230e6
mov bl, r14b
call fcn.140051048
nop
jmp 0x140023062
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x176
call fcn.14002a6ec
nop
jmp 0x140022f91
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x179
call fcn.14002a6ec
nop
jmp 0x140022fc0
mov r9d, r15d
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17d
call fcn.14002a6ec
nop
jmp 0x140022fd8
add rbx, 0x48
jmp 0x140023079
mov rax, qword [0x1400c9800]
test rax, rax
je 0x14003f444
call qword [case.0x1400022d4.0]
test eax, eax
js 0x1400230af
mov eax, esi
mov rbx, qword [0x1400c9610]
mov rcx, qword [0x1400c9618]
jmp 0x14003f49a
mov r15, qword [rbx]
test r15, r15
je 0x14003f496
mov rax, qword [r15 + 0x38]
call qword [case.0x1400022d4.0]
mov rdx, rax
mov rcx, qword [r15]
call fcn.14002af98
test eax, eax
js 0x1400230af
xor ecx, ecx
mov rax, qword [r15 + 8]
call qword [case.0x1400022d4.0]
test eax, eax
js 0x1400230af
mov rcx, qword [0x1400c9618]
add rbx, 8
cmp rbx, rcx
jb 0x14003f456
jmp 0x1400230af
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x1400a42a8]
lea rcx, [0x1400c6a30]
call fcn.14004db00
nop
jmp 0x140023108
lea rdx, [0x1400a3c28]
lea rcx, [0x1400c6a30]
call fcn.14002b390
nop
jmp 0x140023115
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop
jmp 0x140023137