Function at 0x1400077b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4f0
mov rax, qword [0x1400748d8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r15, rcx
lea rcx, str.Starting_RunCommandScan._n
call fcn.140006cb0
xor r8d, r8d
lea rdx, str.ScanType
mov rcx, r15
call fcn.14003c688
mov edi, eax
xor r8d, r8d
lea rdx, str.ScanTrigger
mov rcx, r15
call fcn.14003c688
mov dword [rbp - 0x78], eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
movabs r10, 0xcfa9368d54594070
lea rdx, str.DailyScan
mov rcx, r15
call qword [0x14004a4e8]
test rax, rax
setne r14b
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
movabs r10, 0xcfa9368d54594070
lea rdx, str.Reinvoke
mov rcx, r15
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x7d]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.DisableRemediation
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne r12b
mov byte [rbp - 0x7f], r12b
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.Sense
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x7e]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.DropRemediation
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x7a]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.BootSectorScan
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x80]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, [0x1400515e8]
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x7b]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.IdleScheduledJob
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
setne byte [rbp - 0x7c]
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.Cancel
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
mov rbx, rax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
movabs r10, 0xcfa9368d54594070
lea rdx, str.ReturnHR
mov rcx, r15
call qword [0x14004a4e8]
test rax, rax
setne r13b
mov byte [rbp - 0x79], r13b
xor r8d, r8d
lea rdx, str.File
mov rcx, r15
call fcn.14003c658
mov rsi, rax
lea r8, [0x140051e44]
lea rdx, [0x140051e48]
mov rcx, r15
call fcn.14003c658
mov qword [rbp - 0x18], rax
test rbx, rbx
je 0x140007a62
lea rcx, str.Argument__cancel_detected._Trying_to_cancel_any_quick_full_scan_in_progress..._n
call fcn.140005ef4
xor edi, edi
mov qword [rbp - 0x60], rdi
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov ebx, eax
test eax, eax
js 0x140008a51
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.mpclient.dll_MpScanControl]
mov ebx, eax
test eax, eax
js 0x140008a67
test eax, eax
lea rcx, str.Scan_cancelled_successfully._n
je 0x140007a37
lea rcx, str.No_on_going_quick_or_full_scan_found._n
call fcn.140005ef4
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140007a4c
call qword [sym.imp.mpclient.dll_MpHandleClose]
test r13b, r13b
je 0x140008988
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140008988
mov ecx, 1
test r14b, r14b
je 0x140007a76
xor r14d, r14d
test edi, edi
cmove edi, ecx
jmp 0x140007a79
xor r14d, r14d
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x38]
call fcn.14002d3bc
mov ebx, eax
lea rax, str.___a_
test ebx, ebx
jns 0x140007ac9
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140007ac4
test byte [rcx + 0x1c], 2
je 0x140007ac4
mov edx, 0x16
mov r9d, ebx
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
mov rcx, qword [str.___a_]
mov ebx, r14d
jmp 0x140007ad0
mov rcx, qword [str.___a_]
test edi, edi
jne 0x140007b03
mov dword [rbp - 0x68], r14d
lea rcx, [rbp - 0x68]
call fcn.14000953c
mov ebx, eax
test eax, eax
js 0x140008a7d
mov edi, dword [rbp - 0x68]
mov edx, edi
lea rcx, str.RunCommandScan_is_using_default_scan_type:__u._n
call fcn.140006cb0
mov rcx, qword [str.___a_]
mov eax, edi
sub eax, 1
je 0x140007b31
sub eax, 1
je 0x140007b29
cmp eax, 1
jne 0x140008ac4
xor edi, edi
lea r14d, [rax + 2]
test rsi, rsi
je 0x1400089db
jmp 0x140007b39
mov r14d, 2
jmp 0x140007b37
mov r14d, 1
xor edi, edi
cmp byte [rbp - 0x7d], dil
jne 0x140007ba1
mov rcx, r15
call fcn.140009828
test al, al
je 0x140007b61
test r13b, r13b
je 0x140008979
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140008979
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.RestrictPrivilegesScan
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
je 0x140007ba1
xor edx, edx
xor ecx, ecx
call fcn.14000c030
test eax, eax
js 0x140007ba1
test r13b, r13b
je 0x140008979
mov ecx, eax
jmp 0x140007b56
call fcn.140009638
test al, al
je 0x140008b07
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov r13d, eax
lea ecx, [rax - 1]
cmp ecx, 0x1d
jbe 0x140007bd4
mov eax, 7
lea r13d, [rax - 6]
cmp r14d, 2
cmove r13d, eax
imul ebx, r13d, 0x521c820
mov dword [rbp - 0x48], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp - 0x48]
mov edx, ebx
lea rcx, str.MpCmdRun_ScanTerminationTimeOut
mov rax, qword [rax + 0xa0]
call qword [0x14004a4e8]
nop
test eax, eax
js 0x140008b1e
mov qword [rbp + 0x48], rdi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, dword [rbp - 0x48]
lea rcx, [rbp + 0x48]
call fcn.14003c5d0
test eax, eax
js 0x140008b26
cmp r14d, 2
sete byte [0x140075242]
call fcn.14000cc28
test al, al
jne 0x140007c4f
mov rbx, rdi
mov qword [rbp - 0x20], rbx
jmp 0x140007c8e
lea rax, str.0F05C8FF_0B18_43E3_BDFB_9A0C84B0E5DA
lea rbx, str.421CFC91_A93E_42AB_A35C_F06F127FCC44
cmp r14d, 2
cmove rbx, rax
mov ecx, 0x18
call fcn.1400407e0
mov qword [rbp + 0x58], rax
mov rdx, rbx
mov rcx, rax
call fcn.14000c9fc
mov rbx, rax
test rax, rax
je 0x140007c8a
lock inc dword [rax + 8]
mov qword [rbp - 0x20], rax
mov rcx, r15
call fcn.140009398
mov qword [rbp - 0x28], rdi
lea rdx, [rbp - 0x28]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov edi, eax
test eax, eax
js 0x140008b2e
lea rcx, [rbp + 0x138]
call fcn.1400073a0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
lea rax, [0x140008e50]
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0x138]
mov qword [rbp + 0x100], rax
cmp r14d, 3
jne 0x140007d07
cmp byte [rbp - 0x7e], cl
je 0x140007cfb
mov edi, 0x8000021
test r12b, r12b
jne 0x140007d12
mov edi, 0x18000021
jmp 0x140007d12
test r12b, r12b
je 0x140007d07
mov edi, 0x2001021
jmp 0x140007d12
mov edi, 0x4001
cmp r14d, 3
jne 0x140007d1b
cmp byte [rbp - 0x80], cl
je 0x140007d1b
bts edi, 9
cmp byte [0x140075242], cl
jne 0x140007d49
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.ScanProgress
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
je 0x140007d4c
or edi, 2
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.CpuThrottling
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
xor ecx, ecx
test rax, rax
je 0x140007d78
bts edi, 0x11
cmp byte [rbp - 0x7c], cl
je 0x140007da9
mov dword [rbp - 0x44], ecx
lea r8, str.DisableCpuThrottleOnIdleScans
lea rdx, str.Scan
lea rcx, [rbp - 0x44]
call fcn.14002c5f4
test eax, eax
js 0x140007da9
cmp dword [rbp - 0x44], 1
jne 0x140007da9
btr edi, 0x11
bts edi, 0x12
mov rax, qword [r15]
movabs r10, 0xcfa9368d54594070
lea rdx, str.NoToast
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
test rax, rax
je 0x140007dd3
bts edi, 0x1d
test rsi, rsi
je 0x140007dfc
mov rcx, rsi
call fcn.14003c194
test eax, eax
js 0x140007ded
lea r15, str.folder
jmp 0x140007e03
mov r15d, 0x80070002
cmp eax, r15d
je 0x140008b75
lea r15, str.file
mov qword [rbp - 0x18], r15
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140007e3d
test byte [rcx + 0x1c], 4
je 0x140007e3d
mov edx, 0x1b
mov qword [rsp + 0x20], rsi
mov r9, r15
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140003500
mov r8, rsi
mov rdx, r15
lea rcx, str.Scanning_path_as__ls:__ls._n
call fcn.140006cb0
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x120], rsi
xor eax, eax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov qword [rbp + 0xe8], 1
lea rax, [rbp + 0x118]
mov qword [rbp + 0xf0], rax
mov edx, edi
cmp r14d, 3
jne 0x140007eb0
movzx eax, byte [rbp - 0x80]
movzx r9d, r12b
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r8, rsi
lea rcx, str.Start:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_u__path__ls__DisableRemediation___u__BootSectorScan___u__Timeout_in_days___u__n
call fcn.140006cb0
jmp 0x140007ebf
mov r8d, r13d
lea rcx, str.Start:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_u__Timeout_in_days___u__n
call fcn.140006cb0
lea rcx, [rbp + 0x200]
call fcn.140009d3c
mov r15, qword [0x140075388]
xor r12d, r12d
test r15, r15
je 0x1400080d0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140072140], 5
jbe 0x1400080c1
movabs rdx, 0x400000000000
test qword [0x140072150], rdx
je 0x140007f1c
mov rax, qword [0x140072158]
and rax, rdx
cmp rax, qword [0x140072158]
mov al, 1
je 0x140007f1f
mov al, r12b
test al, al
je 0x1400080c1
mov r12d, dword [rbp - 0x78]
mov dword [rbp + 0x24], r12d
mov dword [rbp + 0x28], r14d
movzx eax, byte [rbp - 0x7b]
mov dword [rbp + 0x2c], eax
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x80], rax
xor eax, eax
mov edx, eax
lock xadd qword [rbp + 0x288], rdx
lea r8, [rbp + 0x290]
lea rcx, [rbp + 0x200]
call fcn.140009c58
lea rax, [rbp + 0x290]
mov qword [rbp + 0x88], rax
mov rcx, qword [0x140075380]
mov eax, dword [rcx + 0x38]
mov dword [rbp + 0x30], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp + 0x34], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp + 0x38], eax
movzx eax, byte [rcx + 0x2c]
mov dword [rbp + 0x3c], eax
movzx eax, byte [rcx + 0x2b]
mov dword [rbp + 0x50], eax
movzx eax, byte [rcx + 0x2a]
mov dword [rbp - 0x10], eax
movzx eax, byte [rcx + 0x29]
mov dword [rbp - 0xc], eax
movzx eax, byte [rcx + 0x28]
mov dword [rbp - 8], eax
mov rax, qword [rcx + 0x20]
mov qword [rbp + 0x90], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0x98], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0xa0], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 0x2000000
lea rax, [rbp + 0x24]
mov qword [rsp + 0xa8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0xa0], rax
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x98], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x90], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x88], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x34]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
lea rdx, [0x140068c47]
call section..text
mov rbx, qword [rbp - 0x20]
jmp 0x1400080c5
mov r12d, dword [rbp - 0x78]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400080d4
mov r12d, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
xor r15d, r15d
test rcx, rcx
je 0x1400080ea
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0xe8]
cmp r14d, 3
cmovne rax, r15
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8d, edi
mov edx, r14d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.mpclient.dll_MpScanStartEx]
mov r15d, eax
test eax, eax
js 0x140008bc6
lea rcx, str.Scan_starting..._n
call fcn.140005ef4
or edx, 0xffffffff
mov rcx, qword [rbp + 0x138]
call fcn.14003bc2c
mov r12d, dword [rbp + 0x140]
lea rcx, [rbp + 0x200]
call fcn.140009b08
mov rax, qword [0x140075388]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140008333
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140072140], 5
jbe 0x140008329
movabs rdx, 0x400000000000
test qword [0x140072150], rdx
je 0x1400081b3
mov rax, qword [0x140072158]
and rax, rdx
cmp rax, qword [0x140072158]
jne 0x1400081b3
mov al, 1
jmp 0x1400081b5
xor eax, eax
test al, al
je 0x140008329
mov dword [rbp - 4], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp], eax
xor eax, eax
mov edx, eax
lock xadd qword [rbp + 0x288], rdx
lea r8, [rbp + 0x320]
lea rcx, [rbp + 0x200]
call fcn.140009c58
lea rax, [rbp + 0x320]
mov qword [rbp + 0xb8], rax
mov rcx, qword [0x140075380]
mov eax, dword [rcx + 0x38]
mov dword [rbp + 4], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp + 0x20], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp + 8], eax
movzx eax, byte [rcx + 0x2c]
mov dword [rbp + 0xc], eax
movzx eax, byte [rcx + 0x2b]
mov dword [rbp + 0x10], eax
movzx eax, byte [rcx + 0x2a]
mov dword [rbp + 0x14], eax
movzx eax, byte [rcx + 0x29]
mov dword [rbp + 0x18], eax
movzx eax, byte [rcx + 0x28]
mov dword [rbp + 0x1c], eax
mov rax, qword [rcx + 0x20]
mov qword [rbp + 0xc0], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0xc8], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0xd0], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 0x2000000
lea rax, [rbp - 4]
mov qword [rsp + 0x98], rax
lea rax, [rbp]
mov qword [rsp + 0x90], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x88], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x14]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea rdx, [0x140068b61]
call fcn.1400012b8
mov rbx, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12d, r12d
js 0x140008c16
lea rcx, str.Scan_finished._n
call fcn.140005ef4
mov edx, edi
lea rcx, str.Finish:_MpScanStart_MP_FEATURE_SUPPORTED__dwOptions_u__n
call fcn.140006cb0
mov edx, edi
cmp r14d, 3
jne 0x140008384
movzx eax, byte [rbp - 0x80]
movzx r12d, byte [rbp - 0x7f]
mov r9d, r12d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r8, rsi
lea rcx, str.Finish:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_u__path__ls__DisableRemediation___u__BootSectorScan___u__Timeout_in_days___u__n
call fcn.140006cb0
jmp 0x140008397
mov r8d, r13d
lea rcx, str.Finish:_MpScan_MP_FEATURE_SUPPORTED__dwOptions_u__Timeout_in_days___u__n
call fcn.140006cb0
mov r12b, byte [rbp - 0x7f]
mov r13, qword [rbp - 0x70]
xor eax, eax
mov byte [rbp + 0x1f0], al
lea rdx, [rbp + 0x160]
mov rcx, r13
call qword [sym.imp.mpclient.dll_MpScanResult]
mov edi, eax
xor eax, eax
test edi, edi
js 0x140008c66
test r12b, r12b
jne 0x140008440
mov qword [rbp - 0x30], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.mpclient.dll_MpThreatOpen]
mov edi, eax
xor r13d, r13d
test eax, eax
js 0x140008cad
mov qword [rbp - 0x40], r13
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.mpclient.dll_MpThreatEnumerate]
mov rcx, qword [rbp - 0x40]
test eax, eax
jne 0x140008424
test byte [rcx + 0x108], 1
jne 0x140008416
cmp dword [rcx + 0x38], r13d
je 0x140008416
cmp dword [rcx + 0x3c], 8
jne 0x14000841d
call fcn.1400070d8
jmp 0x1400083e7
mov byte [rbp + 0x1f0], 1
test rcx, rcx
je 0x14000842f
call fcn.1400070d8
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140008443
call qword [sym.imp.mpclient.dll_MpHandleClose]
jmp 0x140008443
xor r13d, r13d
cmp r14d, 3
jne 0x14000867a
mov edi, dword [rbp + 0x188]
test edi, edi
je 0x14000847d
mov r8d, edi
mov rdx, rsi
lea rcx, [0x140052660]
call fcn.140006cb0
mov r8d, edi
mov rdx, rsi
lea rcx, str.Scanning__ls_found__u_threats._n
call fcn.140005ef4
jmp 0x1400084d1
cmp qword [rbp + 0x1b0], r13
jne 0x1400084b3
lea rdx, str.folder
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400084b3
mov rdx, rsi
lea rcx, [0x1400526c0]
call fcn.140006cb0
lea rcx, str.Scanning__ls_was_skipped._n
jmp 0x1400084c9
mov rdx, rsi
lea rcx, [0x140052720]
call fcn.140006cb0
lea rcx, str.Scanning__ls_found_no_threats._n
mov rdx, rsi
call fcn.140005ef4
test r12b, r12b
je 0x14000867a
mov rcx, qword [str.___a_]
lea rdi, str.___a_
cmp rcx, rdi
je 0x140008508
test byte [rcx + 0x1c], 4
je 0x140008508
mov edx, 0x1e
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002150
lea rcx, str.Skipping_clean_as_this_is_a_custom_scan_with_no_remediation._n
call fcn.140006cb0
cmp dword [rbp + 0x188], r13d
je 0x1400088ed
mov qword [rbp - 0x60], r13
lea r9, [rbp - 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.mpclient.dll_MpThreatOpen]
mov ebx, eax
test eax, eax
jns 0x14000857b
mov rcx, qword [str.___a_]
cmp rcx, rdi
je 0x140008568
test byte [rcx + 0x1c], 1
je 0x140008568
mov edx, 0xa
mov r9d, eax
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_Could_not_open_threat_list._Failed_with__X_n
call fcn.140006cb0
jmp 0x140008a37
mov r14b, 1
mov qword [rbp - 0x68], r13
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.mpclient.dll_MpThreatEnumerate]
mov ebx, eax
test eax, eax
jne 0x1400089ed
test r14b, r14b
je 0x1400085ae
lea rcx, str._n_LIST_OF_DETECTED_THREATS__n
call fcn.140005f98
mov r14b, r13b
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x14000865d
lea rcx, str.______________________________Threat_information________________________________n
call fcn.140005f98
mov r8, qword [rbx + 0x18]
lea rdx, str.Threat
lea rcx, str.__24ws:__ws_n
call fcn.140005f98
mov r8d, dword [rbx + 0x54]
test r8d, r8d
je 0x14000863f
lea rdx, str.Resources
lea rcx, str.__24ws:__u_total_n
call fcn.140005f98
mov rdi, r13
cmp dword [rbx + 0x54], r13d
jbe 0x14000863f
mov rax, qword [rbx + 0x58]
mov rsi, qword [rax + rdi*8]
test rsi, rsi
je 0x140008634
mov rdx, qword [rsi]
lea rcx, str.______20ws:
call fcn.140005f98
mov rcx, qword [rsi + 8]
call fcn.140005f98
lea rcx, [0x140051388]
call fcn.140005f98
inc rdi
mov eax, dword [rbx + 0x54]
cmp rdi, rax
jb 0x140008603
lea rcx, str.________________________________________________________________________________n
call fcn.140005f98
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000865d
call fcn.1400070d8
mov qword [rbp - 0x68], r13
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.mpclient.dll_MpThreatEnumerate]
mov ebx, eax
test eax, eax
jne 0x1400089e6
jmp 0x14000859a
movzx esi, byte [rbp - 0x7e]
test sil, sil
je 0x1400086ab
cmp dword [rbp + 0x188], r13d
je 0x1400088ed
cmp byte [rbp - 0x7a], r13b
je 0x140008789
lea rcx, str.Option__DropRemediation_specified__skipping_cleaning._n
call fcn.140005ef4
jmp 0x1400088ed
mov qword [rbp - 0x58], r13
mov edi, dword [rbp + 0x188]
mov rcx, qword [str.___a_]
lea r14, str.___a_
cmp rcx, r14
je 0x1400086e6
test byte [rcx + 0x1c], 4
je 0x1400086e6
mov edx, 0x31
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
mov edx, edi
lea rcx, str.MpScan___has_detected__u_threats._n
call fcn.140006cb0
test edi, edi
jne 0x140008710
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400088ed
call qword [sym.imp.mpclient.dll_MpConfigClose]
jmp 0x1400088ed
cmp byte [rbp + 0x1f0], r13b
je 0x1400086f8
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000872c
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov qword [rbp - 0x58], r13
lea rdx, [rbp - 0x58]
lea rcx, [0x14004f714]
call qword [sym.imp.mpclient.dll_MpConfigOpen]
test eax, eax
js 0x140008cf4
mov dword [rbp - 0x78], r13d
lea r8, [rbp - 0x78]
lea rdx, str.DisableRoutinelyTakingAction
mov rcx, qword [rbp - 0x58]
call fcn.140009a84
test eax, eax
js 0x140008cfc
mov edi, r13d
cmp dword [rbp - 0x78], r13d
sete dil
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000877f
call qword [sym.imp.mpclient.dll_MpConfigClose]
test edi, edi
je 0x1400088ed
jmp 0x140008790
lea r14, str.___a_
lea rcx, str.Cleaning_started..._n
call fcn.140005ef4
mov qword [rbp + 0x40], r13
mov r9d, esi
add r9d, r9d
mov r8, qword [rbp - 0x70]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x40]
call fcn.14000747c
mov edi, eax
test eax, eax
js 0x140008d04
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x70]
test sil, sil
jne 0x1400087f7
test rcx, rcx
je 0x1400087f3
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x70], r13
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400087f3
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x28]
mov rdi, qword [rbp + 0x40]
lea r8, [rbp - 0x50]
mov rdx, rdi
call qword [sym.imp.mpclient.dll_MpCleanOpen]
mov esi, eax
test eax, eax
js 0x140008d44
lea rcx, [rbp + 0x60]
call fcn.1400073a0
mov dword [rbp + 0x78], r13d
mov byte [rbp + 0x7c], r13b
lea rax, [0x140009120]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x60]
mov qword [rbp + 0x110], rax
lea rcx, str.Start:_MpCleanStart___n
call fcn.140006cb0
lea r8, [rbp + 0x108]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.mpclient.dll_MpCleanStart]
mov esi, eax
test eax, eax
js 0x140008d84
or edx, 0xffffffff
mov rcx, qword [rbp + 0x60]
call fcn.14003bc2c
mov r15d, dword [rbp + 0x68]
test r15d, r15d
js 0x140008dc4
cmp byte [rbp + 0x7c], r13b
jne 0x1400089b8
lea rcx, str.Cleaning_finished._n
call fcn.140005ef4
lea rcx, str.Finish:_MpCleanThreats___n
call fcn.140006cb0
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400088b1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400088c1
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rdi, rdi
je 0x1400088ed
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400088d5
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400088e4
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
cmp byte [rbp - 0x79], r13b
je 0x1400088fd
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000890d
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x140008920
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140008930
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
or rdi, 0xffffffffffffffff
test rbx, rbx
je 0x140008964
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
test eax, eax
jg 0x140008964
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
lea edx, [rdi + 2]
mov rax, qword [rax]
call qword [0x14004a4e8]
nop
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x140008979
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140008988
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140040760
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, str.Additional_Actions_Required
call fcn.140006cb0
lea rcx, str.Additonal_Actions_Required._n
call fcn.140005ef4
mov ecx, 0x80501001
call fcn.14003b6a4
nop
mov ecx, 0x80070667
call fcn.14003b6a4
nop
lea rdi, str.___a_
test ebx, ebx
jns 0x140008a29
mov rcx, qword [str.___a_]
cmp rcx, rdi
je 0x140008a1b
test byte [rcx + 0x1c], 1
je 0x140008a1b
mov edx, 0xb
mov r9d, ebx
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_Could_not_enumerate_threats._Failed_with__X_n
call fcn.140006cb0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140008a37
call fcn.1400070d8
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140008a46
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov ecx, 0x80501003
call fcn.14003b6a4
nop
mov edx, ebx
lea rcx, str.ERROR:_MpManagerOpen_Failed__X_n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpScanControl_Failed__X_n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008aae
test byte [rcx + 0x1c], 1
je 0x140008aae
mov edx, 0x17
mov r9d, ebx
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, ebx
lea rcx, str.ERROR:_MpConfigLoadScanParameters_Failed__X_n
call fcn.140006cb0
mov ecx, ebx
call fcn.14003b6a4
int3
lea rax, str.___a_
cmp rcx, rax
je 0x140008aee
test byte [rcx + 0x1c], 1
je 0x140008aee
mov edx, 0x18
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
mov edx, edi
lea rcx, str.ERROR:_Unsupported_type__u_n
call fcn.140006cb0
mov ecx, 0x80070667
call fcn.14003b6a4
int3
lea rcx, str.WARN:_Product_Feature_disabled_n
call fcn.140006cb0
mov ecx, 0x80004005
call fcn.14003b6a4
int3
mov ecx, eax
call fcn.14003b6a4
nop
mov ecx, eax
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008b5f
test byte [rcx + 0x1c], 1
je 0x140008b5f
mov edx, 0x19
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_MpManagerOpen_Failed__X_n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008bab
test byte [rcx + 0x1c], 1
je 0x140008bab
mov edx, 0x1a
mov dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, r15d
mov rdx, rsi
lea rcx, str.Invalid_path_to_scan:__ls._hr___X_n
call fcn.140006cb0
mov ecx, r15d
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008bfc
test byte [rcx + 0x1c], 1
je 0x140008bfc
mov edx, 0x1c
mov dword [rsp + 0x20], r15d
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002268
mov r8d, r15d
mov edx, edi
lea rcx, str.ERROR:_MpScanStart_dwOptions_u__Failed__X_n
call fcn.140006cb0
mov ecx, r15d
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008c4c
test byte [rcx + 0x1c], 1
je 0x140008c4c
mov edx, 0x1d
mov dword [rsp + 0x20], r12d
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002268
mov r8d, r12d
mov edx, edi
lea rcx, str.ERROR:_MpScan_dwOptions_u__Completion_Failed__X_n
call fcn.140006cb0
mov ecx, r12d
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008c97
test byte [rcx + 0x1c], 1
je 0x140008c97
mov edx, 0xc
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_MpScanResult___Failed__X_n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x140008cde
test byte [rcx + 0x1c], 1
je 0x140008cde
mov edx, 0xd
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ERROR:_MpThreatOpen___Failed__X_n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
nop
mov ecx, eax
call fcn.14003b6a4
int3
mov ecx, eax
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140008d2e
test byte [rcx + 0x1c], 1
je 0x140008d2e
mov edx, 0x1f
mov r9d, edi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, edi
lea rcx, str.ConstructCleanInfo_Failed__X_n
call fcn.140006cb0
mov ecx, edi
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140008d6e
test byte [rcx + 0x1c], 1
je 0x140008d6e
mov edx, 0x20
mov r9d, esi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.ERROR:_MpCleanOpen___Failed__X_n
call fcn.140006cb0
mov ecx, esi
call fcn.14003b6a4
nop
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140008dae
test byte [rcx + 0x1c], 1
je 0x140008dae
mov edx, 0x21
mov r9d, esi
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, esi
lea rcx, str.ERROR:_MpCleanStart___Failed__X_n
call fcn.140006cb0
mov ecx, esi
call fcn.14003b6a4
int3
mov rcx, qword [str.___a_]
cmp rcx, r14
je 0x140008dee
test byte [rcx + 0x1c], 1
je 0x140008dee
mov edx, 0x22
mov r9d, r15d
lea r8, [0x140053340]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, r15d
lea rcx, str.ERROR:_MpCleanThreats___Completion_Failed__X_n
call fcn.140006cb0
lea rcx, str.Cleaning_failed._n
call fcn.140005ef4
cmp byte [rbp + 0x7c], r13b
je 0x140008e27
lea rcx, str.Additional_Actions_Required
call fcn.140006cb0
lea rcx, str.Additonal_Actions_Required._n
call fcn.140005ef4
mov ecx, r15d
call fcn.14003b6a4
int3