Function at 0x140077a00
Capabilities:
Acquire debug privileges
Delete registry value
Execute command
Self delete
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x140232f80]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
xor esi, esi
mov dword [rsp + 0x30], esi
cmp byte [0x14023d0ef], sil
je 0x1400793b6
lea rcx, [rsp + 0x2b0]
call fcn.140076820
nop
lea rcx, str.FSUTIL_USN_DELETEJOURNAL__D_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__f__q__s_C:Users_username_AppDataLocalMicrosoftCLR_v4.0UsageLogs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__f__q__s_C:Users_username_AppDataLocalMicrosoftCLR_v4.0_32UsageLogs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x7fffffffffffffff
mov r15, rax
mov rdx, qword [rsp + 0x2c0]
sub r15, rdx
cmp r15, 0x22
jb 0x1400793e8
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0x10
cmovae r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x150], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
lea r13, [rdx + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0xd8]
lea r12d, [rbx + 7]
cmp r13, rbx
jbe 0x140077bd8
mov rbx, r13
or rbx, 0xf
cmp rbx, rax
jbe 0x140077b2e
mov rbx, rax
movabs r14, 0x8000000000000000
lea rax, [r14 + 0x27]
jmp 0x140077b59
cmp rbx, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140077b90
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400793ee
movabs r14, 0x8000000000000000
mov rcx, rax
call fcn.1401203d0
test rax, rax
je 0x140077d15
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x2c0]
mov r9, qword [rsp + 0x150]
mov qword [rsp + 0xd8], rdi
jmp 0x140077be2
test rcx, rcx
je 0x140077bc1
call fcn.1401203d0
mov rdi, rax
mov rdx, qword [rsp + 0x2c0]
mov r9, qword [rsp + 0x150]
movabs r14, 0x8000000000000000
mov qword [rsp + 0xd8], rax
jmp 0x140077be2
mov rdi, rsi
movabs r14, 0x8000000000000000
mov qword [rsp + 0xd8], rsi
jmp 0x140077be2
movabs r14, 0x8000000000000000
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0xf0], rbx
movups xmm0, xmmword [str.del__f__q__s_C:WindowsPrefetch]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1401ed310]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1401ed320]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r13], 0
mov r8d, 1
lea rdx, [0x1401ea21c]
lea rcx, [rsp + 0xd8]
call fcn.14007edd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140077cc8
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140077cc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
movdqa xmm0, xmmword [0x1401ef820]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0x10
jb 0x140077d21
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077d1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140077d1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r15, 0x35
jb 0x1400793f4
lea rdx, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0x10
cmovae rdx, qword [rsp + 0x2b0]
mov qword [rsp + 0x150], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r13, qword [rsp + 0x2c0]
lea r15, [r13 + 0x35]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x60]
cmp r15, rbx
jbe 0x140077e0f
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140077dcc
mov rbx, rcx
add r14, 0x27
mov rcx, r14
call fcn.1401203d0
test rax, rax
je 0x140077f6f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x150]
jmp 0x140077e0a
cmp rbx, 0x16
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140077df0
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x1400793fa
jmp 0x140077da5
test rcx, rcx
je 0x140077e07
call fcn.1401203d0
mov rdi, rax
mov rdx, qword [rsp + 0x150]
jmp 0x140077e0a
mov rdi, rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str.del__f__q__s_C:Users_username_AppDataLocalTemp]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1401ed338]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x1401ed348]
movups xmmword [rdi + 0x20], xmm0
mov eax, dword [0x1401ed358]
mov dword [rdi + 0x30], eax
movzx eax, byte [0x1401ed35c]
mov byte [rdi + 0x34], al
lea rcx, [rdi + 0x35]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 1
lea rdx, [0x1401ea21c]
lea rcx, [rsp + 0x60]
call fcn.14007edd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x260], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x260], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r12d, 0xf0000
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x250]
cmp qword [rsp + 0x268], 0x10
cmovae rcx, qword [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x268]
cmp rdx, 0x10
jb 0x140077f22
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077f1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140077f1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
movdqa xmm0, xmmword [0x1401ef820]
movdqu xmmword [rsp + 0x260], xmm0
mov byte [rsp + 0x250], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140077f7b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077f76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140077f76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x2e0], rdx
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov r15d, dword [rax + 0x14]
add r15d, 0x76c
mov dword [rsp + 0x198], r15d
mov r13d, dword [rax + 0x10]
inc r13d
mov dword [rsp + 0x150], r13d
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x378]
call fcn.140066510
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x180], xmm0
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x180]
call fcn.14007f9c0
test eax, eax
jne 0x140079400
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
mov rdi, qword [rsp + 0x188]
test rdi, rdi
je 0x14007804c
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x290], xmm0
test rdi, rdi
je 0x140078073
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x308], xmm1
mov r14, 0xffffffffffffffff
test rdi, rdi
je 0x1400780d5
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400780c8
mov rbx, qword [rsp + 0x188]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400780c8
mov rdi, qword [rsp + 0x188]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400780d0
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
nop word [rax + rax]
mov rbx, qword [rsp + 0x290]
cmp rbx, qword [rsp + 0x308]
je 0x14007844c
add rbx, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x130]
call fcn.140066220
movsd xmm0, qword [rax]
movsd qword [rsp + 0xc8], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0xc8]
test edx, edx
je 0x140078133
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x140079417
cmp ecx, 3
jne 0x140078432
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140078149
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.140064e40
cmp rax, r11
je 0x14007819b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140078170
cmp cx, 0x2f
jne 0x140078179
add rax, 2
cmp rax, r11
jne 0x140078161
cmp rax, r11
je 0x14007819b
nop
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14007819b
cmp cx, 0x2f
je 0x14007819b
mov r10, rdx
cmp rax, rdx
jne 0x140078180
sub r11, r10
sar r11, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov r8, r11
mov rdx, r10
lea rcx, [rsp + 0xa8]
call fcn.140080ee0
or r12d, 0x1c00
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x108], rax
call fcn.14011f784
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x120], xmm0
lea r8, [rsp + 0x120]
mov edx, eax
lea rcx, [rsp + 0x318]
call fcn.14007f700
or r12d, 0xe000
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x14007828c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140078287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], 7
mov word [rsp + 0xa8], si
lea rcx, [rsp + 0x318]
cmp qword [rsp + 0x330], 0x10
cmovae rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x194]
lea r8, [rsp + 0x1a8]
lea rdx, str._02d__02d__04d
call fcn.14000b700
cmp eax, 3
jne 0x1400783ec
cmp dword [rsp + 0x190], r15d
jne 0x1400783ec
cmp dword [rsp + 0x194], r13d
jne 0x1400783ec
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x1a8], eax
jne 0x1400783ec
mov qword [rsp + 0x2a0], 0
lea rax, [0x1402332d0]
mov qword [rsp + 0x2a8], rax
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140078349
mov rcx, qword [rbx]
call fcn.14011febc
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x1a0], rcx
mov dword [rsp + 0x110], edx
lea rax, [0x1402332d0]
mov qword [rsp + 0x118], rax
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x2a0], xmm0
cmp edx, 0x91
jne 0x1400783a7
lea r8, [rsp + 0x1a0]
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call fcn.140066300
mov eax, dword [rsp + 0x2a0]
test eax, eax
setne cl
test eax, eax
je 0x1400783bf
mov qword [rsp + 0x1a0], r14
test cl, cl
jne 0x140079427
jmp 0x1400783ec
mov rdx, qword [rsp + 0x330]
cmp rdx, 0x10
jb 0x140078432
inc rdx
mov rcx, qword [rsp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007842d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007842d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
lea rcx, [rsp + 0x290]
call fcn.140065d70
test eax, eax
jne 0x14007943f
jmp 0x1400780e0
mov rcx, qword [rsp + 0x298]
test rcx, rcx
je 0x14007849e
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140078491
mov rbx, qword [rsp + 0x298]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140078491
mov rcx, qword [rsp + 0x298]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x188]
test rdi, rdi
je 0x1400784e0
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400784db
mov rbx, qword [rsp + 0x188]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400784db
mov rcx, qword [rsp + 0x188]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, dword [rsp + 0x30]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x338]
call fcn.14007f010
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], rsi
mov r8d, 0x5b
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rsp + 0x270]
call fcn.140080ee0
nop
lea rdx, [rsp + 0x338]
cmp qword [rsp + 0x350], 0x10
cmovae rdx, qword [rsp + 0x338]
mov r15, qword [rsp + 0x348]
add r15, rdx
lea rdi, [rsp + 0x338]
cmp qword [rsp + 0x350], 0x10
cmovae rdi, qword [rsp + 0x338]
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
cmp rdi, r15
jne 0x1400785a8
mov qword [rsp + 0x168], rsi
mov eax, 7
mov qword [rsp + 0x170], rax
mov word [rsp + 0x158], si
jmp 0x1400786f7
mov rax, r15
sub rax, rdi
mov rdx, rsi
mov qword [rsp + 0x168], rdx
mov ebx, 7
mov qword [rsp + 0x170], rbx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140079447
cmp rax, 8
jb 0x140078690
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x1400785f4
mov rbx, rcx
jmp 0x140078600
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rax, rbx
add rax, 1
cmovb rax, r14
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14007944d
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140078665
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007944d
mov rcx, rax
call fcn.1401203d0
mov rcx, rax
test rax, rax
je 0x14007865e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x168]
jmp 0x14007867c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140078679
call fcn.1401203d0
mov rdx, qword [rsp + 0x168]
jmp 0x14007867c
mov rax, rsi
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x170], rbx
nop dword [rax]
lea rcx, [rsp + 0x158]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x158]
movsx eax, byte [rdi]
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x168]
inc rdx
mov qword [rsp + 0x168], rdx
inc rdi
cmp rdi, r15
je 0x1400786d1
mov rbx, qword [rsp + 0x170]
jmp 0x140078690
lea rax, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rax, qword [rsp + 0x158]
mov word [rax + rdx*2], si
mov rax, qword [rsp + 0x170]
lea r8, [rsp + 0x158]
cmp rax, 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rdx, qword [rsp + 0x270]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078747
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078755
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
mov r8, qword [rsp + 0x280]
cmovae rdx, qword [rsp + 0x270]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_79
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rsp + 0x1b0]
call fcn.140080ee0
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
cmovae rdx, qword [rsp + 0x1b0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078858
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078866
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
mov r8, qword [rsp + 0x1c0]
cmovae rdx, qword [rsp + 0x1b0]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rsi
mov r8d, 0x59
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU
lea rcx, [rsp + 0x1d0]
call fcn.140080ee0
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae rdx, qword [rsp + 0x1d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078969
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078977
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
mov r8, qword [rsp + 0x1e0]
cmovae rdx, qword [rsp + 0x1d0]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rsi
mov r8d, 0x5b
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rsp + 0x1f0]
call fcn.140080ee0
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rdx, qword [rsp + 0x1f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078a7a
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078a88
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
mov r8, qword [rsp + 0x200]
cmovae rdx, qword [rsp + 0x1f0]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShell
lea rcx, [rsp + 0x210]
call fcn.140080ee0
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
cmovae rdx, qword [rsp + 0x210]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078b8b
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078b99
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
mov r8, qword [rsp + 0x220]
cmovae rdx, qword [rsp + 0x210]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rsi
mov r8d, 0x5d
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rsp + 0x230]
call fcn.140080ee0
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae rdx, qword [rsp + 0x230]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140078c9c
lea rdx, [0x1401ed1b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140078caa
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14007fd10
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
mov r8, qword [rsp + 0x240]
cmovae rdx, qword [rsp + 0x230]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x1401ed1ac]
mov rcx, rax
call fcn.14007fd10
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.1400825e0
lea rdx, [0x14007fef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rsp + 0x3a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x3a0]
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140078d60
call fcn.14011f784
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov rcx, rsi
mov qword [rsp + 0x98], rcx
mov edx, 7
mov qword [rsp + 0xa0], rdx
mov word [rsp + 0x88], si
or r12d, 0x40
mov dword [rsp + 0x30], r12d
test r14, r14
je 0x140078e42
cmp r14, 0x7fffffff
ja 0x140079453
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
lea rdx, [rsp + 0x3a0]
mov ecx, edi
call fcn.14011f7ac
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140079459
movsxd rdx, ebx
lea rcx, [rsp + 0x88]
call fcn.14007eb80
lea r9, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae r9, qword [rsp + 0x88]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
lea rdx, [rsp + 0x3a0]
mov ecx, edi
call fcn.14011f7ac
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140079465
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
and r12d, 0xffffffbf
or r12d, 0x30
lea r10, [rsp + 0x88]
cmp rdx, 8
cmovae r10, qword [rsp + 0x88]
lea rdx, [r10 + rcx*2]
mov rcx, r10
call fcn.140064e40
cmp rax, rdx
je 0x140078edc
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140078e7f
cmp cx, 0x2f
jne 0x140078e88
add rax, 2
cmp rax, rdx
jne 0x140078e70
cmp rax, rdx
je 0x140078edc
nop dword [rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140078eae
cmp cx, 0x2f
je 0x140078eae
mov rdx, r8
cmp rax, r8
jne 0x140078e90
jmp 0x140078edc
cmp rax, rdx
je 0x140078edc
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140078ed4
cmp cx, 0x2f
jne 0x140078edc
mov rdx, r8
cmp rax, r8
jne 0x140078ec0
sub rdx, r10
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x358], xmm0
mov qword [rsp + 0x368], rsi
mov qword [rsp + 0x370], rsi
mov r8, rdx
mov rdx, r10
lea rcx, [rsp + 0x358]
call fcn.140080ee0
or r12d, 0x380
mov rdx, qword [rsp + 0xa0]
cmp rdx, 8
jb 0x140078f62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078f5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140078f5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x80], rax
call fcn.14011f784
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
or r12d, 4
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 0xb]
lea rdx, str.reshade.ini
mov ecx, eax
call fcn.14011f7ac
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14007946f
movsxd rdx, ebx
lea rcx, [rsp + 0x38]
call fcn.14007eb80
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], ebx
mov r8d, listen
lea rdx, str.reshade.ini
mov ecx, edi
call fcn.14011f7ac
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14007947b
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x2e8]
call fcn.1400651e0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140079067
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079062
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
movdqa xmm0, xmmword [0x1401ef810]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x180]
call fcn.140066220
movsd xmm0, qword [rax]
movsd qword [rsp + 0xc8], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x2d0], ecx
lea rax, [0x1402332d0]
mov qword [rsp + 0x2d8], rax
movaps xmm0, xmmword [rsp + 0x2d0]
movdqa xmmword [rsp + 0x2d0], xmm0
mov eax, dword [rsp + 0xc8]
test eax, eax
je 0x140079106
cmp eax, 1
je 0x14007910e
lea rcx, [rsp + 0x2e8]
cmp qword [rsp + 0x300], 8
cmovae rcx, qword [rsp + 0x2e8]
call fcn.14011febc
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140079485
jmp 0x14007910e
test ecx, ecx
jne 0x14007949e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x150]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400791a5
lea r8, [rsp + 0x198]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x150]
test eax, eax
je 0x14007919f
mov dword [rsp + 0x250], 1
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x254], rax
mov dword [rsp + 0x25c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x250]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1401ebf30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400793ad
lea rcx, str.FiveM.exe
call fcn.140077930
mov edi, eax
lea rdx, str.Cleaning_Started_Stage_1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140080320
lea rdx, [0x1400804f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test edi, edi
je 0x1400792be
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400792be
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 7
lea rdx, [0x1401ebf30]
lea rcx, [rsp + 0x60]
call fcn.14000ae20
nop
mov r8, rbx
lea rdx, [rsp + 0x60]
mov ecx, edi
call fcn.140077470
movzx edi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14007928d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079288
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079288
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
test dil, dil
je 0x1400792b5
lea rdx, str.E_Traces_Cleaned
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140080320
lea rdx, [0x1400804f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.lsass.exe
call fcn.140077930
mov ebx, eax
lea rdx, str.Cleaning_Started_Stage_2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140080320
lea rdx, [0x1400804f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test ebx, ebx
je 0x140079388
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140079388
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.fifateambuy.online
lea rcx, [rsp + 0x60]
call fcn.14000ae20
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140077470
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140079388
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079383
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079383
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012065c
mov r9d, 0x40
lea r8, str.Traces_Cleaned
lea rdx, str.Good_Luck_to_Screensharers
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.140120290
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140006070
nop
call fcn.140005fb0
int3
call fcn.140006070
int3
call fcn.140005fb0
nop
lea r8, [rsp + 0x378]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140065b40
nop
mov r8, rbx
lea rcx, str.status
call fcn.140065b40
nop
mov r8, rbx
lea rdx, [rsp + 0x2a0]
lea rcx, str.remove_all
call fcn.140065bb0
nop
mov edx, eax
call fcn.140065a50
nop
call fcn.140006070
int3
call fcn.140005fb0
nop
call fcn.140054300
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.1400545d0
int3
shr rcx, 0x20
call fcn.1400545d0
nop
shr rbx, 0x20
mov ecx, ebx
call fcn.1400545d0
int3
shr rcx, 0x20
call fcn.1400545d0
nop
shr rdx, 0x20
lea r8, [rsp + 0x2e8]
lea rcx, str.remove
call fcn.140065b40
int3
lea r8, [rsp + 0x2e8]
lea rdx, [rsp + 0x2d0]
lea rcx, str.exists
call fcn.140065bb0
int3