Function at 0x140024f70
Capabilities:
Acquire debug privileges
Create process on windows
Get common file path

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1110]
mov eax, 0x1210
call fcn.1400755f0
sub rsp, rax
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0x1240], rbx
mov qword [rsp + 0x1250], rsi
mov qword [rsp + 0x1258], rdi
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x1100], rax
mov rsi, rdx
movsxd rdi, ecx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
lea rcx, [rbp + 0x360]
call fcn.1400271c0
nop
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov r13d, r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x78], eax
mov qword [rbp + 0x7e8], r15
mov qword [rbp + 0x7f0], r15
mov qword [rbp + 0x7f8], r15
mov qword [rbp + 0x800], r15
mov qword [rbp + 0x808], r15
mov qword [rbp + 0x810], r15
mov dword [rbp + 0x818], r15d
mov ebx, r15d
mov r12, rdi
or rcx, 0xffffffffffffffff
test edi, edi
jle 0x140025c5c
nop dword [rax]
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0040]
test rdi, rdi
je 0x140025161
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14002514d
add rcx, 2
add rdx, 2
dec rdi
jne 0x140025136
jmp 0x140025161
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x140025168
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x140025183
cmp r8, 2
jae 0x140025179
mov eax, ecx
jmp 0x140025183
mov eax, r15d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025197
mov rcx, r10
call fcn.140063290
test dil, dil
je 0x1400251ab
mov dword [rbp + 0x80c], 1
jmp 0x140025765
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0048]
test rdi, rdi
je 0x140025250
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14002523c
add rcx, 2
add rdx, 2
dec rdi
jne 0x140025225
jmp 0x140025250
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x140025257
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x140025272
cmp r8, 2
jae 0x140025268
mov eax, ecx
jmp 0x140025272
mov eax, r15d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025286
mov rcx, r10
call fcn.140063290
test dil, dil
je 0x14002529a
mov dword [rbp + 0x810], 1
jmp 0x140025765
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0050]
test rdi, rdi
je 0x14002533f
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14002532b
add rcx, 2
add rdx, 2
dec rdi
jne 0x140025314
jmp 0x14002533f
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x140025346
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x140025361
cmp r8, 2
jae 0x140025357
mov eax, ecx
jmp 0x140025361
mov eax, r15d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025375
mov rcx, r10
call fcn.140063290
test dil, dil
jne 0x140025b2a
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0058]
test rdi, rdi
je 0x140025423
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14002540f
add rcx, 2
add rdx, 2
dec rdi
jne 0x1400253f8
jmp 0x140025423
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x14002542a
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x140025445
cmp r8, 2
jae 0x14002543b
mov eax, ecx
jmp 0x140025445
mov eax, r15d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025459
mov rcx, r10
call fcn.140063290
test dil, dil
jne 0x1400259f8
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 3
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0060]
test rdi, rdi
je 0x14002550b
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400254f7
add rcx, 2
add rdx, 2
dec rdi
jne 0x1400254e0
jmp 0x14002550b
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x140025512
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x14002552d
cmp r8, 3
jae 0x140025523
mov eax, ecx
jmp 0x14002552d
mov eax, r15d
cmp r8, 3
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025541
mov rcx, r10
call fcn.140063290
test dil, dil
je 0x140025551
mov r13d, 1
jmp 0x140025765
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
lea rcx, [rbp + 0x820]
mov r10, qword [rbp + 0x820]
mov r9, qword [rbp + 0x838]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rbp + 0x830]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1400a0068]
test rdi, rdi
je 0x1400255fb
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400255e7
add rcx, 2
add rdx, 2
dec rdi
jne 0x1400255d0
jmp 0x1400255fb
mov edi, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edi, ecx
jmp 0x140025602
mov edi, r15d
or rcx, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x14002561d
cmp r8, 2
jae 0x140025613
mov eax, ecx
jmp 0x14002561d
mov eax, r15d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x140025631
mov rcx, r10
call fcn.140063290
test dil, dil
je 0x140025674
mov dword [rbp + 0x818], 1
inc rbx
cmp rbx, r12
jge 0x14002577a
mov rdx, qword [rsi + rbx*8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x898]
call fcn.140001780
jmp 0x140025765
mov rdx, qword [rsi + rbx*8]
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
nop
mov r9d, 2
lea r8, [0x1400a00c0]
mov rdx, qword [rbp + 0x830]
lea rcx, [rbp + 0x820]
call fcn.1400139e0
test eax, eax
sete dil
cmp qword [rbp + 0x838], 8
jb 0x1400256ee
mov rcx, qword [rbp + 0x820]
call fcn.140063290
test dil, dil
je 0x140025724
inc rbx
cmp rbx, r12
jge 0x1400258b9
mov rdx, qword [rsi + rbx*8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x8c0]
call fcn.140001780
jmp 0x140025765
test rbx, rbx
jle 0x140025765
mov rdx, qword [rsi + rbx*8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x8e8]
call fcn.140015a00
mov r8d, 1
lea rdx, [0x1400a0108]
lea rcx, [rbp + 0x910]
call fcn.140015a00
inc rbx
or rcx, 0xffffffffffffffff
cmp rbx, r12
jge 0x140025c5c
jmp 0x1400250c0
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r8d, 0x26
lea rdx, str.You_did_not_specify_a_White_List_file.
lea rcx, [rbp + 0x848]
call fcn.140001780
lea rcx, [rbp + 0x848]
call fcn.140027ac0
nop
lea rcx, [rbp - 0x80]
call fcn.140013b90
nop
cmp qword [rbp + 0x8b0], 8
jb 0x1400257da
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x14002580a
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x14002583a
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x14002586a
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x14002589a
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r8d, 0x1e
lea rdx, str.You_did_not_specify_a_logfile.
lea rcx, [rbp + 0x848]
call fcn.140001780
lea rcx, [rbp + 0x848]
call fcn.140027ac0
nop
lea rcx, [rbp - 0x80]
call fcn.140013b90
nop
cmp qword [rbp + 0x8b0], 8
jb 0x140025919
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x140025949
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x140025979
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x1400259a9
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x1400259d9
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp + 0x848]
call fcn.140001780
lea rcx, [rbp + 0x848]
call fcn.140027ac0
nop
cmp qword [rbp + 0x8b0], 8
jb 0x140025a4b
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x140025a7b
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x140025aab
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x140025adb
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x140025b0b
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp + 0x848]
call fcn.140001780
lea rcx, [rbp + 0x848]
call fcn.140027ac0
nop
cmp qword [rbp + 0x8b0], 8
jb 0x140025b7d
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x140025bad
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x140025bdd
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x140025c0d
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x140025c3d
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
mov rbx, r15
test r12, r12
jle 0x140025cb0
test rbx, rbx
jle 0x140025ca1
mov rdx, qword [rsi + rbx*8]
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x910]
call fcn.140015a00
mov r8d, 1
lea rdx, [0x1400a0108]
lea rcx, [rbp + 0x910]
call fcn.140015a00
inc rbx
cmp rbx, r12
mov rcx, 0xffffffffffffffff
jl 0x140025c64
call fcn.1400420e8
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
jae 0x140025ce2
inc rcx
mov qword [rbx + 8], rcx
lea rcx, [rsp + 0x50]
call fcn.140041e1c
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140024f10
mov rdx, rax
lea rcx, [rbp + 0x910]
call fcn.140039d80
nop
test rdi, rdi
je 0x140025d5a
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rax, qword [rdi + 8]
test rax, rax
je 0x140025d33
cmp rax, 0xffffffffffffffff
jae 0x140025d33
dec rax
mov qword [rdi + 8], rax
mov rbx, r15
cmp qword [rdi + 8], rbx
cmove rbx, rdi
lea rcx, [rsp + 0x50]
call fcn.140041e1c
test rbx, rbx
je 0x140025d5a
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
call fcn.1400420e8
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
jae 0x140025d8c
inc rcx
mov qword [rbx + 8], rcx
lea rcx, [rsp + 0x50]
call fcn.140041e1c
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140024f10
mov rdx, rax
lea rcx, [rbp + 0x8e8]
call fcn.140039d80
nop
test rdi, rdi
je 0x140025e04
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rax, qword [rdi + 8]
test rax, rax
je 0x140025ddd
cmp rax, 0xffffffffffffffff
jae 0x140025ddd
dec rax
mov qword [rdi + 8], rax
mov rbx, r15
cmp qword [rdi + 8], rbx
cmove rbx, rdi
lea rcx, [rsp + 0x50]
call fcn.140041e1c
test rbx, rbx
je 0x140025e04
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
lea rax, [rbp + 0xbe0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140027153
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [rbp + 0xbe0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0x4c8]
call fcn.140001780
lea r9d, [rbx + 2]
lea r8, str.WinDir
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x848]
call fcn.1400323f0
nop
mov rdx, rax
lea rcx, [rbp + 0x870]
call fcn.140001540
nop
cmp qword [rbp + 0x860], 8
jb 0x140025e9a
mov rcx, qword [rbp + 0x848]
call fcn.140063290
mov r8d, 0x15
lea rdx, str.System32Notepad.exe
lea rcx, [rbp + 0x870]
call fcn.140015a00
call fcn.140065688
lea rcx, [rax + 0x30]
call fcn.140066b0c
mov ecx, eax
mov edx, 0x20000
call fcn.140066a10
cmp qword [rbp + 0x8d0], 0
jne 0x140025fb2
lea r8, [0x14008ef9c]
lea rdx, [rbp + 0x4c8]
lea rcx, [rbp + 0x938]
call fcn.140018a10
nop
lea r8, [0x1400a01e8]
mov rdx, rax
lea rcx, [rbp + 0x848]
call fcn.140018c70
nop
lea r8, str..txt
mov rdx, rax
lea rcx, [rbp + 0x820]
call fcn.140018c70
nop
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x4f0]
call fcn.1400158d0
nop
cmp qword [rbp + 0x838], 8
jb 0x140025f50
mov rcx, qword [rbp + 0x820]
call fcn.140063290
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
cmp qword [rbp + 0x860], 8
jb 0x140025f80
mov rcx, qword [rbp + 0x848]
call fcn.140063290
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
cmp qword [rbp + 0x950], 8
jb 0x140025fcb
mov rcx, qword [rbp + 0x938]
call fcn.140063290
jmp 0x140025fcb
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x8c0]
lea rcx, [rbp + 0x4f0]
call fcn.1400015e0
xor edx, edx
lea rcx, [rbp + 0xb0]
call fcn.140013f70
nop
lea rdx, [rbp + 0x4f0]
cmp qword [rbp + 0x508], 8
cmovae rdx, qword [rbp + 0x4f0]
mov r8d, 0x32
lea rcx, [rbp + 0xb0]
call fcn.140014020
cmp qword [rbp + 0x148], 0
je 0x140026f82
mov eax, 0xff
mov word [rsp + 0x50], ax
mov eax, 0xfe
mov word [rsp + 0x52], ax
mov r8d, 2
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb0]
mov rax, qword [rbp + 0xb0]
call qword [rax + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.140014180
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x848]
call fcn.1400015e0
lea rcx, [rbp + 0x848]
call fcn.1400339b0
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x1e0]
call fcn.140035a90
nop
mov r8d, 0x80
lea rdx, [rbp + 0x1000]
lea rcx, [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e8]
call qword [rax + 0x60]
mov rdx, qword [0x1400bf260]
movsxd r8, dword [rdx + 4]
lea rcx, [0x1400bf260]
mov r8, qword [r8 + rcx + 0x48]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x150]
call fcn.140035bb0
nop
lea rax, [0x140093bf0]
mov qword [rbp + 0x10], rax
mov dword [rsp + 0x50], 1
lea rdi, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x18], rdi
lea rcx, [rbp + 0x18]
call fcn.1400032b0
lea rdx, [rbp + 0x150]
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x68], r15
mov dl, 0x20
lea rcx, [rbp + 0x18]
call fcn.140017350
mov word [rbp + 0x70], ax
cmp qword [rbp + 0x60], 0
jne 0x140026148
mov edx, dword [rbp + 0x28]
or edx, 4
xor r8d, r8d
lea rcx, [rbp + 0x18]
call fcn.140003090
nop
lea r12, [rbp + 0x1e0]
lea rax, [rbp + 0x10]
cmp dword [rbp + 0x810], 0
cmove r12, rax
lea rcx, [rbp + 0x360]
call fcn.140001050
cmp eax, 1
jne 0x14002622b
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x8e8]
lea rcx, [rbp + 0x848]
call fcn.1400015e0
lea r8, [rbp + 0x848]
lea rdx, [rbp + 0x360]
mov rcx, r12
call fcn.140028570
lea rdx, str._r_nYour_processor_type_could_not_be_determined._Program_terminating._r_n
mov rcx, r12
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rcx, [rbp + 0x150]
mov rax, qword [rbp + 0x150]
call qword [rax + 0x68]
lea rcx, [rbp + 0x1e8]
call fcn.140014180
test rax, rax
jne 0x140026220
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx + 0x1e0]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140026218
or edx, 4
xor r8d, r8d
call fcn.140003090
mov ecx, 1
call fcn.1400668b0
int3
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.140033a40
test eax, eax
jne 0x140026257
lea rdx, str._r_nCould_not_gain_required_privileges._Program_may_run_with_reduced_functionality._r_n
mov rcx, r12
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rcx, [rbp + 0x360]
call fcn.140032870
cmp r13d, 1
jne 0x1400263ea
lea rcx, [rbp + 0x360]
call fcn.140027dc0
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x10], rdi
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.14004814c
nop
lea rax, vtable.basic_teebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x150]
call qword [0x1400a9870]
mov rcx, qword [rbp + 0x1d0]
call fcn.1400639dc
nop
lea rcx, [rbp + 0x150]
call fcn.140011420
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400279c0
nop
lea rcx, [rbp + 0xb0]
call fcn.1400125b0
nop
lea rcx, [rbp - 0x80]
call fcn.140013b90
nop
cmp qword [rbp + 0x8b0], 8
jb 0x14002630b
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x14002633b
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x14002636b
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x14002639b
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x1400263cb
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
or r13, 0xffffffffffffffff
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x8e8]
lea rcx, [rbp + 0x848]
call fcn.1400015e0
lea r8, [rbp + 0x848]
lea rdx, [rbp + 0x360]
mov rcx, r12
call fcn.140028570
mov rcx, r12
cmp dword [rbp + 0x800], 0
jne 0x140026503
lea rdx, str._r_nYour_operating_system_
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x360]
call fcn.1400187c0
mov rcx, rax
lea rdx, str.__is_not_supported._r_n
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x770]
call fcn.1400187c0
mov rcx, rax
call fcn.140003410
cmp dword [rbp + 0x810], 0
jne 0x1400264ab
lea r9d, [r13 + 0x41]
lea r8, str.Rkill_Error
lea rdx, str.Your_operating_system_is_not_supported._r_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x150]
mov rax, qword [rbp + 0x150]
call qword [rax + 0x68]
lea rcx, [rbp + 0x1e8]
call fcn.140014180
test rax, rax
jne 0x1400264f8
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx + 0x1e0]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x1400264f0
or edx, 4
xor r8d, r8d
call fcn.140003090
mov ecx, 1
call fcn.1400668b0
int3
lea rdx, str.Windows_Version:
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x388]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x1400a0108]
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x7c0]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x1400a0544]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
cmp dword [rbp + 0x818], 0
je 0x140026618
lea r8, [rbp + 0x898]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x360]
call fcn.140033db0
test eax, eax
je 0x1400265dc
dec eax
je 0x1400265b5
dec eax
jne 0x140026618
mov dword [rbp + 0x818], r15d
lea rdx, str.Whitelist_file:
mov rcx, r12
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x898]
call fcn.1400187c0
lea rdx, str._is_not_properly_encoded._r_nWhiteList_file_should_be_saved_as_Ansi_or_UTF_8._r_n_r_n
jmp 0x140026608
lea rdx, str.Whitelist_Mode:
mov rcx, r12
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x898]
call fcn.1400187c0
lea rdx, str._r_n_r_n
jmp 0x140026608
mov dword [rbp + 0x818], r15d
lea rdx, str.Whitelist_file:
mov rcx, r12
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x898]
call fcn.1400187c0
lea rdx, str._not_found._r_nOperating_without_a_whitelist._r_n_r_n
mov rcx, rax
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rcx, [rbp - 0x18]
call fcn.140037890
nop
lea rcx, [rbp - 0x58]
call fcn.140037890
nop
lea rcx, [rbp - 0x38]
call fcn.140037890
nop
lea rbx, str.explorer.exe
mov esi, 0x19
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
mov rdx, qword [rbx + 8]
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
call fcn.1400420e8
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rdi, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x1400266ad
inc rcx
mov qword [rdi + 8], rcx
lea rcx, [rsp + 0x50]
call fcn.140041e1c
nop
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x608]
lea rdx, str._WinDir_
lea rcx, [rbp + 0x820]
call fcn.1400391c0
nop
lea rcx, [rsp + 0x58]
call fcn.1400020b0
call fcn.1400420e8
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rdi, rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x140026711
inc rcx
mov qword [rdi + 8], rcx
lea rcx, [rsp + 0x60]
call fcn.140041e1c
nop
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x5e0]
lea rdx, str._System_
lea rcx, [rbp + 0x820]
call fcn.1400391c0
nop
lea rcx, [rsp + 0x58]
call fcn.1400020b0
lea r8, [rbp + 0x820]
mov rdx, rbx
lea rcx, [rbp + 0x938]
call fcn.140039170
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140039ea0
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x18]
call fcn.140039740
nop
cmp qword [rbp + 0x958], 8
jb 0x140026792
mov rcx, qword [rbp + 0x940]
call fcn.140063290
nop
cmp qword [rbp + 0x838], 8
jb 0x1400267a8
mov rcx, qword [rbp + 0x820]
call fcn.140063290
add rbx, 0x10
dec rsi
jne 0x140026642
mov rbx, r15
lea r14, [0x140000000]
nop
mov qword [rbp + 0x838], 7
mov qword [rbp + 0x830], r15
mov word [rbp + 0x820], r15w
mov rdx, qword [rbx + r14 + 0xc2020]
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x820]
call fcn.140001780
call fcn.1400420e8
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x140026832
inc rcx
mov qword [rsi + 8], rcx
lea rcx, [rsp + 0x60]
call fcn.140041e1c
nop
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x608]
lea rdx, str._WinDir_
lea rcx, [rbp + 0x820]
call fcn.1400391c0
nop
test rdi, rdi
je 0x14002687c
mov rcx, rdi
call fcn.140001dd0
mov rcx, rax
test rax, rax
je 0x14002687c
mov rax, qword [rax]
mov edx, 1
call qword [rax]
call fcn.1400420e8
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x1400268ae
inc rcx
mov qword [rsi + 8], rcx
lea rcx, [rsp + 0x50]
call fcn.140041e1c
nop
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x5e0]
lea rdx, str._System_
lea rcx, [rbp + 0x820]
call fcn.1400391c0
nop
test rdi, rdi
je 0x1400268f8
mov rcx, rdi
call fcn.140001dd0
mov rcx, rax
test rax, rax
je 0x1400268f8
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov rax, qword [rbx + r14 + 0xc2020]
mov qword [rsp + 0x68], rax
mov rax, qword [rbx + r14 + 0xc2028]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x58]
call fcn.140039ef0
mov r8, rax
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x58]
call fcn.140039740
nop
cmp qword [rbp + 0x838], 8
jb 0x14002694a
mov rcx, qword [rbp + 0x820]
call fcn.140063290
add rbx, 0x10
cmp rbx, 0x1e80
jb 0x1400267c0
mov rdi, r15
mov r14d, dword [rsp + 0x78]
lea rbx, [0x140000000]
nop word [rax + rax]
mov rax, qword [rdi + rbx + 0xc3ea0]
mov qword [rsp + 0x68], rax
mov rax, qword [rdi + rbx + 0xc3ea8]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140039ef0
mov r8, rax
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x38]
call fcn.140039740
add rdi, 0x10
cmp rdi, 0x2550
jb 0x140026970
lea rdx, [rbp - 0x38]
mov rcx, r12
call fcn.140033660
mov edi, eax
mov rcx, r12
cmp eax, 1
jne 0x1400269f0
lea rdx, [0x14008dd90]
call fcn.140018560
mov rcx, rax
mov edx, edi
call fcn.140010f90
mov rcx, rax
lea rdx, str._service_stopped__r_n_r_n
jmp 0x140026a1b
jbe 0x140026a14
lea rdx, [0x14008dd90]
call fcn.140018560
mov rcx, rax
mov edx, edi
call fcn.140010f90
mov rcx, rax
lea rdx, str._services_stopped__r_n_r_n
jmp 0x140026a1b
lea rdx, str.__No_malware_services_found_to_stop._r_n_r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x18]
mov rdx, r12
lea rcx, [rbp + 0x360]
call fcn.1400287e0
mov rdx, r12
lea rcx, [rbp + 0x360]
call fcn.14002beb0
mov rdx, r12
lea rcx, [rbp + 0x360]
call fcn.14001e5a0
mov rdx, r12
lea rcx, [rbp + 0x360]
call fcn.1400041e0
xor ecx, ecx
call fcn.1400663d8
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x968]
call fcn.1400660bc
lea r9, [rbp + 0x968]
lea r8, str._m__d__Y__I:_M:_S__p
mov edx, 0x3f
lea rcx, [rbp + 0x990]
call fcn.140067a50
lea rdx, str._r_nProgram_finished_at:
mov rcx, r12
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x990]
call fcn.140018560
mov rcx, rax
lea rdx, [0x1400a07c4]
call fcn.140018f30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, r14d
mov eax, 0x95217cb1
mul edi
mov esi, edx
shr esi, 0x15
mov ecx, esi
imul ecx, ecx, 0x36ee80
sub edi, ecx
mov eax, 0x45e7b273
mul edi
mov ebx, edx
shr ebx, 0xe
mov eax, ebx
imul eax, eax, 0xea60
sub edi, eax
mov eax, 0x10624dd3
mul edi
mov edi, edx
shr edi, 6
lea rdx, str.Execution_time:
mov rcx, r12
call fcn.140018560
mov rcx, rax
mov edx, esi
call fcn.140010f90
mov rcx, rax
lea rdx, str._hours_s__
call fcn.140018560
mov rcx, rax
mov edx, ebx
call fcn.140010f90
mov rcx, rax
lea rdx, str._minute_s___and
call fcn.140018560
mov rcx, rax
mov edx, edi
call fcn.140010f90
mov rcx, rax
lea rdx, str._seconds_s__r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rcx, [rbp + 0x150]
mov rax, qword [rbp + 0x150]
call qword [rax + 0x68]
lea rcx, [rbp + 0x1e8]
call fcn.140014180
test rax, rax
jne 0x140026bce
mov rax, qword [rbp + 0x1e0]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx + 0x1e0]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140026bc6
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x848]
call fcn.1400015e0
lea rcx, [rbp + 0x848]
call fcn.1400339b0
cmp dword [rbp + 0x810], 0
jne 0x140026da2
mov r9d, 0x40
lea r8, str.Rkill_Finished
lea rdx, str.You_should_now_be_able_to_run_your_normal_security_programs_so_that_you_can_scan_for_computer_infections._r_n_r_nA_log_file_called_Rkill.txt_has_been_created_on_your_desktop_and_will_be_shown_automatically.__This_file_contains_information_on_what_actions_were_performed_on_your_computer_by_Rkill.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp + 0x2f0]
call fcn.140069f00
mov dword [rbp + 0x2f0], 0x68
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x860], 7
mov qword [rbp + 0x858], r15
mov word [rbp + 0x848], r15w
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x870]
lea rcx, [rbp + 0x848]
call fcn.1400015e0
lea rdx, [rbp + 0x848]
lea rcx, [rbp + 0x938]
call fcn.140032f50
cmp qword [rax + 0x18], 8
jb 0x140026cb9
mov rax, qword [rax]
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x9d0]
call fcn.140063700
cmp qword [rbp + 0x950], 8
jb 0x140026ce3
mov rcx, qword [rbp + 0x938]
call fcn.140063290
mov r9d, 1
lea r8, [0x1400a0108]
mov edx, 0x104
lea rcx, [rbp + 0x9d0]
call fcn.140066b34
lea r8, [rbp + 0x4f0]
cmp qword [rbp + 0x508], 8
cmovae r8, qword [rbp + 0x4f0]
mov r9, qword [rbp + 0x500]
mov edx, 0x104
lea rcx, [rbp + 0x9d0]
call fcn.140066b34
lea r8, [rbp + 0x870]
cmp qword [rbp + 0x888], 8
cmovae r8, qword [rbp + 0x870]
mov edx, 0x104
lea rcx, [rbp + 0xdf0]
call fcn.140063700
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x48], rdx
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0xdf0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
mov r8, qword [rbp - 0x30]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x38]
call fcn.140038a40
nop
mov rcx, qword [rbp - 0x30]
call fcn.140063290
nop
mov r8, qword [rbp - 0x50]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.140038a40
nop
mov rcx, qword [rbp - 0x50]
call fcn.140063290
nop
mov r8, qword [rbp - 0x10]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x18]
call fcn.140038a40
nop
mov rcx, qword [rbp - 0x10]
call fcn.140063290
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0x10], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.14004814c
nop
lea rax, vtable.basic_teebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x150]
call qword [0x1400a9870]
mov rcx, qword [rbp + 0x1d0]
call fcn.1400639dc
nop
lea rcx, [rbp + 0x150]
call fcn.140011420
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400279c0
nop
lea rcx, [rbp + 0xb0]
call fcn.1400125b0
nop
lea rcx, [rbp - 0x80]
call fcn.140013b90
nop
cmp qword [rbp + 0x8b0], 8
jb 0x140026ea3
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x140026ed3
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x140026f03
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x140026f33
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x140026f63
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
lea r8, [rbp + 0x8c0]
lea rdx, str.You_did_not_specify_a_valid_logfile:
lea rcx, [rbp + 0x938]
call fcn.140018b90
nop
lea r8, str.._r_n_______Please_check_if_the_location_exists_or_if_you_have_permissions.
mov rdx, rax
lea rcx, [rbp + 0x848]
call fcn.140018c70
mov rcx, rax
call fcn.140027ac0
nop
cmp qword [rbp + 0x950], 8
jb 0x140026fd2
mov rcx, qword [rbp + 0x938]
call fcn.140063290
lea rcx, [rbp + 0xb0]
call fcn.140014180
nop
lea rax, vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0xb0], rax
cmp qword [rbp + 0x148], 0
je 0x140027034
mov rdx, qword [rbp + 0xd0]
lea rax, [rbp + 0x138]
cmp qword [rdx], rax
jne 0x140027034
mov rcx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x120]
mov qword [rdx], rax
mov rax, qword [rbp + 0xf0]
mov qword [rax], rcx
sub rcx, rcx
sar rcx, 1
mov rax, qword [rbp + 0x108]
mov dword [rax], ecx
cmp byte [rbp + 0x140], 0
je 0x14002704a
lea rcx, [rbp + 0xb0]
call fcn.140014180
nop
lea rcx, [rbp + 0xb0]
call fcn.140011420
nop
lea rcx, [rbp - 0x80]
call fcn.140013b90
nop
cmp qword [rbp + 0x8b0], 8
jb 0x140027077
mov rcx, qword [rbp + 0x898]
call fcn.140063290
mov qword [rbp + 0x8b0], 7
mov qword [rbp + 0x8a8], r15
mov word [rbp + 0x898], r15w
cmp qword [rbp + 0x8d8], 8
jb 0x1400270a7
mov rcx, qword [rbp + 0x8c0]
call fcn.140063290
mov qword [rbp + 0x8d8], 7
mov qword [rbp + 0x8d0], r15
mov word [rbp + 0x8c0], r15w
cmp qword [rbp + 0x900], 8
jb 0x1400270d7
mov rcx, qword [rbp + 0x8e8]
call fcn.140063290
mov qword [rbp + 0x900], 7
mov qword [rbp + 0x8f8], r15
mov word [rbp + 0x8e8], r15w
cmp qword [rbp + 0x928], 8
jb 0x140027107
mov rcx, qword [rbp + 0x910]
call fcn.140063290
mov qword [rbp + 0x928], 7
mov qword [rbp + 0x920], r15
mov word [rbp + 0x910], r15w
cmp qword [rbp + 0x888], 8
jb 0x140027137
mov rcx, qword [rbp + 0x870]
call fcn.140063290
mov qword [rbp + 0x888], 7
mov qword [rbp + 0x880], r15
mov word [rbp + 0x870], r15w
jmp 0x140027179
lea rdx, str._r_nCould_not_retrieve_the_path_to_the_Desktop._Program_aborting._r_n
lea rcx, [0x1400bf260]
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov ecx, 1
call fcn.1400668b0
nop
lea rcx, [rbp + 0x360]
call fcn.140027480
xor eax, eax
mov rcx, qword [rbp + 0x1100]
xor rcx, rsp
call fcn.140063080
lea r11, [rsp + 0x1210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret