Function at 0x140037fe0
Capabilities:
Get session user name
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140098010]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
call fcn.140037380
mov ecx, dword [0x14009c6fc]
test al, al
mov eax, dword [0x14009c6f8]
jne 0x140038102
add ecx, eax
je 0x1400380bb
mov dword [rsp + 0x50], r14d
call fcn.140002930
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x140038075
call fcn.140002930
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x78], 0x20
mov dword [rsp + 0x30], eax
lea rax, str.Controller_pid_lu_will_not_continue_execution.
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ExecuteTask
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x78]
movsx edx, r14w
mov rcx, rbx
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 1
je 0x140039348
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r14
mov eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x1400380f8
call fcn.140002cc0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x1400380e3
lock inc dword [rsp + 0x50]
jmp 0x140039348
lea rdi, str.Controller::ExecuteTask
add ecx, eax
je 0x140038181
mov dword [rsp + 0x60], r14d
call fcn.140002930
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140038142
call fcn.140002930
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x74], 0x20
mov dword [rsp + 0x30], eax
lea rax, str.Controller_pid_lu_continues_execution.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x140000000]
lea r8, [rbp - 0x74]
movsx edx, r14w
mov rcx, rbx
call fcn.140001eb0
nop
mov r15d, dword [rsp + 0x40]
test r15b, 2
je 0x1400381cf
and r15d, 0xfffffffd
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x58], r14
mov eax, 0xffffffff
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x1400381c5
nop word [rax + rax]
call fcn.140002cc0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x1400381b0
lock inc dword [rsp + 0x60]
mov r15d, dword [rsp + 0x40]
mov rax, qword [r13 + 0xe8]
mov r9, qword [r13 + 0xf0]
lea r11, str.type
lea r10, [0x140083950]
cmp rax, r9
je 0x14003826c
lea rsi, str.connect
nop word [rax + rax]
mov r8, qword [rax]
mov rdx, r14
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [r10 + rdx*2 - 2]
jne 0x14003822b
cmp rdx, 7
jne 0x140038210
mov ecx, r14d
jmp 0x140038230
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x140038263
mov r8, qword [rax + 8]
mov rdx, r14
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [rsi + rdx*2 - 2]
jne 0x14003825a
cmp rdx, 8
jne 0x140038240
mov ecx, r14d
jmp 0x14003825f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400382c2
add rax, 0x10
cmp rax, r9
jne 0x140038200
mov rax, qword [r13 + 0xe8]
cmp rax, r9
je 0x140038967
lea rsi, str.epaas
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rax]
mov rdx, r14
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [r10 + rdx*2 - 2]
jne 0x140038918
cmp rdx, 7
jne 0x1400382a0
mov ecx, r14d
jmp 0x14003891d
mov qword [rbp + 0x68], r14
lea rax, [0x1400991b8]
mov qword [rbp + 0x70], rax
mov ecx, 0x20
call fcn.14003edd8
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r9, rsi
mov rcx, rax
call fcn.140035e10
or r15d, 0xf0
mov dword [rsp + 0x40], r15d
mov rdi, qword [r13 + 0xb8]
mov qword [r13 + 0xb8], rbx
test rdi, rdi
je 0x140038363
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140038347
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140038342
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038fd6
mov rcx, r8
call fcn.14003edd0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov edx, 0x20
mov rcx, rdi
call fcn.14003edd0
mov rbx, qword [r13 + 0xe8]
mov r12d, 5
cmp rbx, qword [r13 + 0xf0]
je 0x140038813
lea r9, str.sevents
lea r10, str.cevents
lea r11, str.name
lea r8, str.params.b64
lea rdi, str.timestamp
mov rdx, qword [rbx]
mov rcx, r14
lea rsi, str.type
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [rsi + rcx*2 - 2]
jne 0x1400383c8
cmp rcx, r12
jne 0x1400383b0
mov eax, r14d
jmp 0x1400383cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038469
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x60], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
or r15d, 0xf00
mov dword [rsp + 0x40], r15d
mov rsi, qword [r13 + 0xa0]
mov qword [r13 + 0xa0], rdi
test rsi, rsi
je 0x1400387df
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003844d
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140038448
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038fd6
mov rcx, r8
call fcn.14003edd0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov edx, 0x20
mov rcx, rsi
jmp 0x1400387da
mov rcx, r14
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x14003848a
cmp rcx, 8
jne 0x140038470
mov eax, r14d
jmp 0x14003848f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400384cd
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x58], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
or r15d, 0xf000
mov dword [rsp + 0x40], r15d
mov rsi, qword [r13 + 0xa8]
mov qword [r13 + 0xa8], rdi
jmp 0x14003840a
mov rcx, r14
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x1400384ea
cmp rcx, 8
jne 0x1400384d0
mov eax, r14d
jmp 0x1400384ef
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003852d
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x50], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
or r15d, 0xf0000
mov dword [rsp + 0x40], r15d
mov rsi, qword [r13 + 0xb0]
mov qword [r13 + 0xb0], rdi
jmp 0x14003840a
mov rcx, r14
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r11 + rcx*2 - 2]
jne 0x140038549
cmp rcx, r12
jne 0x140038530
mov eax, r14d
jmp 0x14003854e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003858c
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x68], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
or r15d, 0xf00000
mov dword [rsp + 0x40], r15d
mov rsi, qword [r13 + 0xc0]
mov qword [r13 + 0xc0], rdi
jmp 0x14003840a
cmp word [rdx], 0x69
jne 0x1400385a5
cmp word [rdx + 2], 0x64
jne 0x1400385a5
cmp word [rdx + 4], 0
jne 0x1400385a5
mov eax, r14d
jmp 0x1400385aa
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400385e8
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x38], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
or r15d, 0xf000000
mov dword [rsp + 0x40], r15d
mov rsi, qword [r13 + 0xc8]
mov qword [r13 + 0xc8], rdi
jmp 0x14003840a
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140038616
add rcx, 2
cmp rcx, 0xb
je 0x140038767
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x1400385f0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003876f
mov r9, qword [rbx + 8]
lea rcx, [rbp + 8]
call fcn.140035e10
or r15d, 0xf0000000
mov dword [rsp + 0x40], r15d
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x18]
call fcn.140035dd0
nop
mov ecx, 0x20
call fcn.14003edd8
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x18]
mov rcx, rax
call fcn.14001f250
nop
mov rdi, qword [r13 + 0xd0]
mov qword [r13 + 0xd0], rax
test rdi, rdi
je 0x1400386cf
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400386b2
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400386ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038903
mov rcx, r8
call fcn.14003edd0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov edx, 0x20
mov rcx, rdi
call fcn.14003edd0
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14003870a
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003890a
call fcn.14003edd0
mov qword [rbp - 8], r14
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140038755
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038911
call fcn.14003edd0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
jmp 0x1400387df
mov eax, r14d
jmp 0x14003861b
mov rcx, r14
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
jne 0x140038797
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x140038797
add rcx, 2
cmp rcx, 0xa
jne 0x140038772
mov eax, r14d
jmp 0x14003879c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038802
lea ecx, [rax + 8]
call fcn.14003edd8
mov rdi, rax
mov r8d, 0xa
lea rdx, [rbp - 0x48]
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoull]
mov qword [rdi], rax
mov rcx, qword [r13 + 0xd8]
mov qword [r13 + 0xd8], rdi
test rcx, rcx
je 0x1400387df
mov edx, 8
call fcn.14003edd0
lea r8, str.params.b64
lea r9, str.sevents
lea r10, str.cevents
lea r11, str.name
lea rdi, str.timestamp
add rbx, 0x10
cmp rbx, qword [r13 + 0xf0]
jne 0x1400383a0
mov rcx, qword [r13 + 0xc0]
test rcx, rcx
je 0x140039348
cmp qword [r13 + 0xc8], 0
je 0x140039348
cmp qword [r13 + 0xd8], 0
je 0x140039348
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14003884d
mov rcx, qword [rcx]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x38], rbx
mov r8, rbx
cmp rbx, 5
cmova r8, r12
lea rdx, str.clean
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140039348
cmp rbx, 5
jne 0x140039348
lea rdi, str.Controller::ExecuteTask
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
cmp rcx, rax
je 0x140038fdd
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
lea rbx, str.type
mov rdx, rbx
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140038fe4
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
lea rdx, str.view
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039056
jmp 0x140038fe4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x140038953
mov r8, qword [rax + 8]
mov rdx, r14
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [rsi + rdx*2 - 2]
jne 0x14003894a
cmp rdx, 6
jne 0x140038930
mov ecx, r14d
jmp 0x14003894f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400389b0
add rax, 0x10
cmp rax, r9
jne 0x140038290
mov r9, qword [r13 + 0xf0]
mov rbx, qword [r13 + 0xe8]
cmp rbx, r9
je 0x140038885
mov r12d, 5
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r11 + rcx*2 - 2]
jne 0x140038f2b
cmp rcx, r12
jne 0x140038990
mov eax, r14d
jmp 0x140038f30
mov qword [rbp + 0x78], r14
lea rax, [0x1400991b8]
mov qword [rbp + 0x80], rax
mov ecx, 0x20
call fcn.14003edd8
mov rbx, rax
mov qword [rbp - 0x68], rax
mov r9, rsi
mov rcx, rax
call fcn.140035e10
nop
mov rdi, qword [r13 + 0xb8]
mov qword [r13 + 0xb8], rbx
test rdi, rdi
je 0x140038a48
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140038a2c
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140038a27
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038fd6
mov rcx, r8
call fcn.14003edd0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov edx, 0x20
mov rcx, rdi
call fcn.14003edd0
mov rbx, qword [r13 + 0xe8]
mov r12d, 5
cmp rbx, qword [r13 + 0xf0]
je 0x140038e77
lea r9, str.sevents
lea r10, str.cevents
lea r11, str.name
lea r8, str.params.b64
lea r15, str.user_name
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, r14
lea rdi, str.type
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [rdi + rcx*2 - 2]
jne 0x140038ab8
cmp rcx, r12
jne 0x140038aa0
mov eax, r14d
jmp 0x140038abd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038b53
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x68], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xa0]
mov qword [r13 + 0xa0], rdi
test rsi, rsi
je 0x140038e4a
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140038b32
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140038b2d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038fd6
mov rcx, r8
call fcn.14003edd0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov edx, 0x20
mov rcx, rsi
call fcn.14003edd0
jmp 0x140038e4a
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x140038b7a
cmp rcx, 8
jne 0x140038b60
mov eax, r14d
jmp 0x140038b7f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038bb2
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x50], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xa8]
mov qword [r13 + 0xa8], rdi
jmp 0x140038aef
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x140038bda
cmp rcx, 8
jne 0x140038bc0
mov eax, r14d
jmp 0x140038bdf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038c12
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x58], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xb0]
mov qword [r13 + 0xb0], rdi
jmp 0x140038aef
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r11 + rcx*2 - 2]
jne 0x140038c39
cmp rcx, r12
jne 0x140038c20
mov eax, r14d
jmp 0x140038c3e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038c71
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x60], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xc0]
mov qword [r13 + 0xc0], rdi
jmp 0x140038aef
mov rcx, r14
movzx eax, word [rdx + rcx*2]
cmp ax, word [r15 + rcx*2]
jne 0x140038c9b
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x140038c9b
add rcx, 2
cmp rcx, 0xa
jne 0x140038c74
mov eax, r14d
jmp 0x140038ca0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038cd3
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x28], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xe0]
mov qword [r13 + 0xe0], rdi
jmp 0x140038aef
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140038d06
add rcx, 2
cmp rcx, 0xb
je 0x140038f0e
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140038ce0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038e66
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x48]
call fcn.140035e10
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.140035dd0
nop
mov ecx, 0x20
call fcn.14003edd8
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x28]
mov rcx, rax
call fcn.14001f250
nop
mov rdi, qword [r13 + 0xd0]
mov qword [r13 + 0xd0], rax
test rdi, rdi
je 0x140038db4
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140038d97
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140038d92
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038f16
mov rcx, r8
call fcn.14003edd0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov edx, 0x20
mov rcx, rdi
call fcn.14003edd0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140038def
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038dea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038f1d
call fcn.14003edd0
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140038e3a
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038e35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038f24
call fcn.14003edd0
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
lea r8, str.params.b64
lea r9, str.sevents
lea r10, str.cevents
lea r11, str.name
add rbx, 0x10
cmp rbx, qword [r13 + 0xf0]
jne 0x140038a90
mov rbx, qword [r13 + 0xc0]
test rbx, rbx
je 0x140039348
mov rdi, qword [rbx + 0x10]
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0x10
jb 0x140038e9b
mov rcx, qword [rbx]
mov eax, 4
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rdi
mov r8, rdi
cmp rdi, rax
cmova r8, rax
lea rdx, str.scan
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140038ecc
cmp rdi, 4
je 0x14003887e
cmp rsi, 0x10
jb 0x140038ed5
mov rbx, qword [rbx]
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x90], rdi
mov r8, rdi
cmp rdi, 5
cmova r8, r12
lea rdx, str.clean
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140039348
cmp rdi, 5
jmp 0x140038878
mov eax, r14d
jmp 0x140038d0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038fc0
lea ecx, [rax + 0x20]
call fcn.14003edd8
mov rdi, rax
mov qword [rbp - 0x68], rax
mov r9, qword [rbx + 8]
mov rcx, rax
call fcn.140035e10
nop
mov rsi, qword [r13 + 0xa0]
mov qword [r13 + 0xa0], rdi
test rsi, rsi
je 0x140038fb9
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140038f9d
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140038f98
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038fd6
mov rcx, r8
call fcn.14003edd0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov edx, 0x20
mov rcx, rsi
call fcn.14003edd0
lea r11, str.type
add rbx, 0x10
cmp rbx, qword [r13 + 0xf0]
je 0x14003887e
jmp 0x140038980
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rbx, str.type
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
cmp rcx, rax
je 0x1400391f6
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
mov rdx, rbx
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400391f6
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
lea rdx, str.systray
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400391f6
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x1400390d7
mov dword [rsp + 0x70], r14d
call fcn.140002930
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
or dword [rsp + 0x40], 4
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x140039098
call fcn.140002930
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x70], 0x20
mov dword [rsp + 0x30], eax
lea rax, str.oneclick_View_is_launching_pid_lu
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x140000000]
lea r8, [rbp - 0x70]
movsx edx, r14w
mov rcx, rbx
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x14003911a
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], r14
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x140039115
nop dword [rax + rax]
call fcn.140002cc0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x140039100
lock inc dword [rsp + 0x70]
mov rcx, r13
call fcn.1400365b0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2b0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x40], 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, str.system
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140039335
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x104
lea r8, [rbp + 0xa0]
xor edx, edx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140039348
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rdx, rax
lea r8, [rbp + 0xa0]
call fcn.1400360a0
inc r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x104
lea r8, [rbp + 0xa0]
mov edx, r14d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400391a2
jmp 0x140039348
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
cmp rcx, rax
je 0x140039122
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
mov rdx, rbx
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140039122
mov rcx, qword [r13 + 0xe8]
mov rax, qword [r13 + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140039378
lea rdx, str.model
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140039122
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x1400392e6
mov dword [rbp - 0x80], r14d
call fcn.140002930
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
or dword [rsp + 0x40], 8
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x1400392a7
call fcn.140002930
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x6c], 0x20
mov dword [rsp + 0x30], eax
lea rax, str.oneclick_Model_is_launching_pid_lu
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x140000000]
lea r8, [rbp - 0x6c]
movsx edx, r14w
mov rcx, rbx
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 8
je 0x140039328
and eax, 0xfffffff7
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x78], r14
mov eax, 0xffffffff
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
js 0x140039324
nop dword [rax]
call fcn.140002cc0
mov eax, 0xffffffff
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
jns 0x140039310
lock inc dword [rbp - 0x80]
mov rcx, r13
call fcn.140036430
jmp 0x140039122
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rdx, rax
xor r8d, r8d
call fcn.1400360a0
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14003edb0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400395d0
int3