Function at 0x180023f60
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create process on windows
Get common file path
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x710], rbx
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov esi, edx
mov dword [rsp + 0x60], edx
mov r14, rcx
mov qword [rbp - 0x38], rcx
cmp dword [0x1801340b0], 0
je 0x180023fd1
lea r9, str.CMonitorThread::RestoreFiles________
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
xor edi, edi
mov ebx, edi
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.songxia_zd
lea rcx, [rsp + 0x58]
call fcn.18002bea0
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x18002401c
lea rcx, [rbp - 0x80]
call fcn.180019440
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.180018d40
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.server_speedup
lea rcx, [rsp + 0x58]
call fcn.18002bea0
mov r9d, r12d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x180024066
lea rcx, [rbp - 0x80]
call fcn.180019440
or ebx, eax
lea rcx, [rbp - 0x80]
call fcn.180018d40
test ebx, ebx
je 0x180024096
test esi, esi
jne 0x180024096
cmp dword [0x1801340b0], esi
je 0x18002528a
lea r9, str.CMonitorThread::RestoreFiles_1
lea r8, str.SXDebug
jmp 0x180025279
cmp dword [r14 + 0x58], 0
je 0x18002528a
cmp dword [r14 + 0x8c], 0
jne 0x1800240be
mov rcx, r14
call fcn.1800225d0
test eax, eax
je 0x1800240be
mov dword [r14 + 0x8c], r12d
mov r13d, edi
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x74], edi
test esi, esi
jne 0x1800240ed
cmp dword [r14 + 0x90], edi
je 0x1800240f5
cmp dword [r14 + 0x8c], edi
jne 0x1800240f5
call fcn.18001c580
test eax, eax
je 0x1800240f5
mov dword [rsp + 0x74], r12d
mov dword [rsp + 0x54], r12d
mov r13d, r12d
cmp dword [0x1801340b0], 0
je 0x18002413c
mov dword [rsp + 0x38], r13d
mov eax, dword [r14 + 0x8c]
mov dword [rsp + 0x30], eax
mov eax, dword [r14 + 0x90]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
lea r9, str.CMonitorThread::RestoreFiles_1_1___d____d____d____d_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov ebx, edi
cmp dword [r14 + 0x90], ebx
je 0x180024199
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.watchdog_updatefile_firstcheck
lea rcx, [rsp + 0x58]
call fcn.18002bea0
mov r9d, r12d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x18002418e
lea rcx, [rbp - 0x80]
call fcn.180019440
cmp eax, 1
mov ebx, r12d
je 0x180024190
mov ebx, edi
lea rcx, [rbp - 0x80]
call fcn.180018d40
cmp dword [r14 + 0x90], 0
jne 0x180024202
test r13d, r13d
jne 0x180024202
call fcn.18001c710
test eax, eax
je 0x180024202
mov r13d, 2
mov dword [rsp + 0x54], r13d
cmp dword [0x1801340b0], 0
je 0x180024202
mov dword [rsp + 0x38], r13d
mov eax, dword [r14 + 0x8c]
mov dword [rsp + 0x30], eax
mov eax, dword [r14 + 0x90]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
lea r9, str.CMonitorThread::RestoreFiles_1_1_1___d____d____d____d_
lea r8, str.WatchDog
lea edx, [r13 + 0xd]
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov r15d, edi
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x70]
call fcn.18001c8a0
cmp dword [rsp + 0x70], edi
je 0x180024220
mov dword [r14 + 0x98], r12d
test ebx, ebx
jne 0x1800242bd
test esi, esi
jne 0x1800242bd
test r13d, r13d
je 0x18002423d
test eax, eax
je 0x1800242bd
cmp dword [r14 + 0x90], r15d
je 0x18002425b
mov dword [r14 + 0x90], edi
mov r15d, edi
test eax, eax
setne r15b
inc r15d
jmp 0x1800242bd
test r13d, r13d
jne 0x1800242bd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
cmp dword [r14 + 0x8c], r15d
je 0x1800242bd
mov eax, dword [r14 + 0x94]
cmp r11d, eax
jb 0x1800242bd
add eax, 0x493e0
cmp r11d, eax
jae 0x1800242bd
cmp dword [0x1801340b0], r15d
je 0x18002528a
mov dword [rsp + 0x20], r11d
lea r9, str.CMonitorThread::RestoreFiles_1_1_2___d_
lea r8, str.WatchDog
lea edx, [r13 + 0xf]
lea rcx, [0x180133ff8]
call fcn.18001ab50
jmp 0x18002528a
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.watchdog_updatefile_OnlyCheckKeyPE
lea rcx, [rsp + 0x58]
call fcn.18002bea0
mov r9d, r12d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x180024301
lea rcx, [rbp - 0x80]
call fcn.180019440
cmp eax, 1
je 0x180024304
mov r12d, edi
lea rcx, [rbp - 0x80]
call fcn.180018d40
cmp dword [0x1801340b0], 0
je 0x180024362
mov dword [rsp + 0x20], r12d
lea r9, str.CMonitorThread::RestoreFiles_1_2___d_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
cmp dword [0x1801340b0], 0
je 0x180024362
lea r9, str.CMonitorThread::RestoreFiles_1
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
call fcn.180036ec0
test eax, eax
je 0x180024396
lea rdx, str.winhadnt.dll
mov rcx, qword [str.winhadnt.dll]
call fcn.1800473c4
lea rcx, str.bakhadntv.sys
test eax, eax
cmovne rcx, qword [str.bakhadnt.sys]
mov qword [str.bakhadnt.sys], rcx
cmp dword [0x18013f370], 0
jne 0x180024432
mov esi, 1
mov dword [0x18013f370], esi
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.phah_cycle_lengthen
lea rcx, [rsp + 0x58]
call fcn.18002bea0
mov r9d, esi
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
lea rcx, [rbp - 0x80]
call fcn.180019440
mov ebx, eax
cmp dword [0x1801340b0], 0
je 0x180024417
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
lea r9, str.phah_cycle_lengthen___d____08x_
lea r8, str.WatchDog
lea edx, [rsi + 0xe]
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov eax, dword [0x18013f36c]
cmp ebx, 1
cmove eax, esi
mov dword [0x18013f36c], eax
lea rcx, [rbp - 0x80]
call fcn.180018d40
mov ebx, 5
mov eax, 0x3c
cmp dword [0x18013f36c], 0
cmovne ebx, eax
cmp dword [0x1801340b0], 0
je 0x18002446c
lea r9, str.CMonitorThread::RestoreFiles_2
lea r8, str.WatchDog
lea edx, [rax - 0x2d]
lea rcx, [0x180133ff8]
call fcn.18001ab50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp dword [rsp + 0x60], 0
jne 0x18002449f
cmp r13d, 2
je 0x18002449f
mov eax, dword [0x18013f368]
test eax, eax
je 0x18002449f
cmp esi, eax
jb 0x18002449f
imul ebx, ebx, 0xea60
add ebx, eax
cmp esi, ebx
jbe 0x18002528a
mov r13d, edi
test r15d, r15d
jne 0x1800244f3
mov ecx, dword [0x18013f364]
test ecx, ecx
je 0x1800244c0
cmp esi, ecx
jb 0x1800244c0
mov eax, esi
sub eax, ecx
cmp eax, 0x1b7740
jb 0x1800244f3
mov r13d, 1
cmp dword [0x1801340b0], 0
je 0x1800244ed
lea r9, [0x1800db800]
lea r8, str.WatchDog
lea edx, [r13 + 0xe]
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov dword [0x18013f364], esi
mov dword [r14 + 0x90], edi
mov byte [rbp + 0x4a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x4a1]
call fcn.180043ef0
mov byte [rbp + 0x390], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x391]
call fcn.180043ef0
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.180036cf0
test eax, eax
je 0x1800248b2
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x61]
call fcn.180043ef0
mov byte [rbp + 0x170], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x171]
call fcn.180043ef0
lea rsi, str.bakrdlv3.sys
call fcn.180007640
lea rcx, [0x1800d3f38]
cmp rax, rcx
jne 0x1800245b2
lea rbx, str.bakingress_sdm.sys
jmp 0x1800245e6
call fcn.180007640
lea rcx, [0x1800d3f30]
cmp rax, rcx
jne 0x1800245cc
lea rbx, str.bakist.sys
jmp 0x1800245e6
call fcn.180007640
lea rbx, str.bakOGuard.sys
lea rcx, [0x1800d3f20]
cmp rax, rcx
cmovne rbx, rsi
call fcn.180002e10
mov r8, rax
mov r9, rbx
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x60]
call fcn.180043b88
call fcn.180007640
mov rbx, rax
call fcn.180002e10
mov r8, rax
mov r9, rbx
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x170]
call fcn.180043b88
cmp dword [0x1801340b0], 0
je 0x18002464f
lea r9, str.CMonitorThread::RestoreFiles_200
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov qword [rbp - 0x30], rdi
mov qword [rsp + 0x68], rdi
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.18002be20
nop
lea rdx, [rbp + 0x170]
lea rcx, [rbp - 0x40]
call fcn.18002be20
nop
cmp dword [0x1801340b0], 0
je 0x1800246a0
lea r9, str.CMonitorThread::RestoreFiles_2011
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, qword [rsp + 0x58]
call fcn.18000ac90
cmp dword [0x1801340b0], 0
je 0x1800246dc
lea r9, str.CMonitorThread::RestoreFiles_2012
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [rbp - 0x40]
call fcn.18000ac90
cmp dword [0x1801340b0], 0
je 0x180024718
lea r9, str.CMonitorThread::RestoreFiles_2013
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.180035da0
or r8d, 0xffffffff
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x28]
call fcn.180035da0
lea rcx, [rbp - 0x20]
call fcn.180035b90
lea rcx, [rbp - 0x28]
call fcn.180035b90
lea rcx, [rbp - 0x20]
call fcn.180035790
mov rbx, rax
lea rcx, [rbp - 0x28]
call fcn.180035790
cmp dword [rsp + 0x60], 0
jne 0x18002476d
cmp ebx, eax
je 0x180024788
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x60]
call fcn.180015b00
test eax, eax
jne 0x18002489e
cmp dword [0x1801340b0], 0
je 0x1800247b0
lea r9, str.CMonitorThread::RestoreFiles_201
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov dword [rsp + 0x50], edi
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x60]
call fcn.18001f770
mov r11d, dword [0x1801340b0]
test r11d, r11d
je 0x180024801
lea r9, str.CMonitorThread::RestoreFiles_202
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov r11d, dword [0x1801340b0]
cmp dword [rsp + 0x50], 0
je 0x18002489e
cmp dword [0x18013f360], 0
jne 0x18002489e
test r11d, r11d
je 0x18002483d
lea r9, str.CMonitorThread::RestoreFiles_203
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x240
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupInstallFileA]
mov eax, 1
mov dword [0x18013f360], eax
cmp dword [0x1801340b0], 0
je 0x18002489e
lea r9, str.CMonitorThread::RestoreFiles_204
lea r8, str.WatchDog
lea edx, [rax + 0xe]
lea rcx, [0x180133ff8]
call fcn.18001ab50
nop
lea rcx, [rbp - 0x40]
call fcn.180029530
nop
lea rcx, [rsp + 0x58]
call fcn.180029530
xor edx, edx
mov rcx, r14
call fcn.1800225b0
mov r14d, edi
mov dword [rsp + 0x50], edi
movsxd rax, r12d
mov qword [rsp + 0x58], rax
movsxd r13, r13d
mov qword [rsp + 0x68], r13
lea rbx, [0x180118a08]
mov r12d, edi
nop dword [rax]
cmp dword [0x1801340b0], 0
je 0x180024908
lea r9, str.CMonitorThread::RestoreFiles_3
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov byte [rbp + 0x170], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x171]
call fcn.180043ef0
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x61]
call fcn.180043ef0
mov rsi, qword [rbx - 8]
test rsi, rsi
je 0x18002495f
call fcn.180002e10
mov r8, rax
mov r9, rsi
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x170]
call fcn.180043b88
cmp qword [rbx], 0
je 0x1800249b8
call fcn.180001570
mov rsi, rax
lea rdx, str.oeaviewer.e32
mov rcx, qword [rbx]
call fcn.1800451e8
test eax, eax
jne 0x180024987
call fcn.180001600
jmp 0x18002499f
lea rdx, str.TSDDrv32.sys
mov rcx, qword [rbx]
call fcn.1800451e8
test eax, eax
jne 0x1800249a2
call fcn.1800018a0
mov rsi, rax
mov r9, qword [rbx]
mov r8, rsi
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x60]
call fcn.180043b88
cmp qword [rbx - 8], 0
je 0x180024ad3
mov rcx, qword [rbx]
test rcx, rcx
je 0x180024ad3
mov eax, 1
mov r12d, eax
cmp qword [rsp + 0x58], 0
je 0x1800249e7
cmp dword [rbx + 0x10], 0
cmove r12d, edi
test r15d, r15d
je 0x180024a18
cmp dword [rbx + 0x10], 0
je 0x180024dc3
cmp r15d, 2
jne 0x180024a18
lea r8d, [r15 + 9]
lea rdx, [0x1801189a0]
call fcn.18001c460
test eax, eax
je 0x180024dc3
lea eax, [r15 - 1]
test r13, r13
je 0x180024a25
cmp dword [rbx + 0x10], 0
mov esi, eax
jne 0x180024a27
mov esi, edi
mov r8d, 5
lea rdx, str.dtframe32.dll
mov rcx, qword [rbx]
call fcn.18001c460
mov r13d, edi
test eax, eax
mov eax, 1
cmovne r13d, eax
mov eax, edi
cmp r15d, 1
sete al
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
mov r9d, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x60]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x170]
call fcn.18001e1c0
mov r14d, eax
mov r12d, dword [rsp + 0x50]
cmp dword [0x1801340b0], 0
je 0x180024ace
mov dword [rsp + 0x48], r13d
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.CMonitorThread::RestoreFiles__3_3___lu____lu___fast_lu____lu____lu____lu_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov r13, qword [rsp + 0x68]
mov esi, edi
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.disfunc_all
lea rcx, [rbp - 0x40]
call fcn.18002bea0
mov r9d, 1
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x180024b18
lea rcx, [rbp - 0x80]
call fcn.180019440
mov esi, eax
lea rcx, [rbp - 0x80]
call fcn.180018d40
test esi, esi
jne 0x180024b73
lea rcx, [rbp - 0x80]
call fcn.180019050
nop
lea rdx, str.disfunc_astacomdll
lea rcx, [rbp - 0x28]
call fcn.18002bea0
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800196a0
cmp dword [rbp - 0x48], 0xf0000001
jne 0x180024b66
lea rcx, [rbp - 0x80]
call fcn.180019440
mov esi, eax
lea rcx, [rbp - 0x80]
call fcn.180018d40
test esi, esi
je 0x180024b76
mov dword [rbx + 8], edi
cmp dword [0x1801340b0], 0
je 0x180024bac
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.CMonitorThread::RestoreFiles_4___lu____lu____lu_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
test r15d, r15d
jne 0x180024d99
cmp dword [rbx + 8], r15d
je 0x180024d99
cmp dword [0x1801340b0], r15d
je 0x180024bf2
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
lea r9, str.CMonitorThread::RestoreFiles_5___lu____lu_
lea r8, str.WatchDog
lea edx, [r15 + 0xf]
lea rcx, [0x180133ff8]
call fcn.18001ab50
test r14d, r14d
jne 0x180024cb2
cmp dword [rbx + 0xc], r14d
jne 0x180024cb2
mov dword [rsp + 0x50], edi
lea r9, [rsp + 0x50]
lea r8d, [r14 + 2]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x170]
call fcn.18001f770
mov esi, dword [rsp + 0x50]
cmp dword [0x1801340b0], r14d
je 0x180024c51
mov dword [rsp + 0x20], esi
lea r9, str.CMonitorThread::RestoreFiles_6___lu_
lea r8, str.WatchDog
lea edx, [r14 + 0xf]
lea rcx, [0x180133ff8]
call fcn.18001ab50
test esi, esi
je 0x180024cb2
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x240
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupInstallFileA]
mov eax, 1
mov dword [rbx + 0xc], eax
cmp dword [0x1801340b0], 0
je 0x180024cb2
lea r9, str.CMonitorThread::RestoreFiles_7
lea r8, str.WatchDog
lea edx, [rax + 0xe]
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov byte [rbp + 0x280], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x281]
call fcn.180043ef0
call fcn.180001570
mov r8, rax
lea r9, [rbp + 0x60]
lea rdx, str._s_regsvr32__s___s_
lea rcx, [rbp + 0x280]
call fcn.180043b88
mov dword [rbp - 0x10], edi
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 8]
call fcn.180043ef0
mov qword [rbp - 0x80], rdi
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
call fcn.180001570
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp dword [0x1801340b0], 0
je 0x180024d81
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
lea r9, str.CMonitorThread::RestoreFiles_8___lu____lu_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
test esi, esi
je 0x180024d99
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1801340b0], 0
je 0x180024dc8
lea r9, str.CMonitorThread::RestoreFiles_9
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
jmp 0x180024dc8
mov r12d, dword [rsp + 0x50]
inc r12d
mov dword [rsp + 0x50], r12d
add rbx, 0x20
cmp r12d, 0x92
jb 0x1800248e0
test r15d, r15d
mov r14, qword [rbp - 0x38]
jne 0x180024ed8
call fcn.180036ec0
test eax, eax
je 0x180024ed8
mov byte [rbp + 0x170], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x171]
call fcn.180043ef0
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x61]
call fcn.180043ef0
lea r9, str.baksas.sys
lea r8, [rbp + 0x390]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x170]
call fcn.180043b88
lea r9, str.sas.dll
lea r8, [rbp + 0x4a0]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x60]
call fcn.180043b88
mov ebx, edi
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180024e93
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, eax
cmp dword [0x1801340b0], 0
je 0x180024ed8
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
lea r9, str.RestoreFils__SAS____d__08x____S__S_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
call fcn.180036c90
test eax, eax
je 0x180025216
lea rcx, [rbp - 0x80]
call fcn.180009bc0
nop
xor edx, edx
mov rcx, r14
call fcn.1800225b0
mov r14d, edi
lea rbx, str.winoauv364.dll
cmp dword [0x1801340b0], 0
je 0x180024f2b
lea r9, str.CMonitorThread::RestoreFiles_10
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x61]
call fcn.180043ef0
mov byte [rbp + 0x280], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x281]
call fcn.180043ef0
mov rsi, qword [rbx - 8]
test rsi, rsi
je 0x180024f7f
call fcn.180002e10
mov r8, rax
mov r9, rsi
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x60]
call fcn.180043b88
cmp qword [rbx], 0
je 0x180024fc1
call fcn.180001000
mov rsi, rax
lea rdx, str.TSDDrv64.sys
mov rcx, qword [rbx]
call fcn.1800451e8
test eax, eax
jne 0x180024fa8
call fcn.180001050
mov rsi, rax
mov r9, qword [rbx]
mov r8, rsi
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x280]
call fcn.180043b88
cmp qword [rbx - 8], 0
je 0x1800250d3
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800250d3
mov eax, 1
mov esi, eax
cmp qword [rsp + 0x58], 0
je 0x180024fee
cmp dword [rbx + 0x10], 0
cmove esi, edi
test r15d, r15d
je 0x18002501f
cmp dword [rbx + 0x10], 0
je 0x1800250d3
cmp r15d, 2
jne 0x18002501f
lea r8d, [r15 + 6]
lea rdx, str.winoauv364.dll
call fcn.18001c460
test eax, eax
je 0x1800250d3
lea eax, [r15 - 1]
test r13, r13
je 0x18002502d
cmp dword [rbx + 0x10], 0
mov r12d, eax
jne 0x180025030
mov r12d, edi
mov r8d, 3
lea rdx, str.dtframe64.dll
mov rcx, qword [rbx]
call fcn.18001c460
mov r13d, edi
test eax, eax
mov eax, 1
cmovne r13d, eax
mov eax, edi
cmp r15d, 1
sete al
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
mov r9d, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x60]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x60]
call fcn.18001e1c0
mov r11d, eax
cmp dword [0x1801340b0], 0
je 0x1800250d3
mov dword [rsp + 0x48], r13d
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r11d
lea r9, str.CMonitorThread::RestoreFiles_x64_11___lu____lu___fast_lu____lu____lu____lu_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
inc r14d
add rbx, 0x20
cmp r14d, 0x48
mov r13, qword [rsp + 0x68]
jb 0x180024f03
test r15d, r15d
jne 0x18002520d
call fcn.180036ec0
test eax, eax
je 0x18002520d
mov byte [rbp + 0x170], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x171]
call fcn.180043ef0
mov byte [rbp + 0x60], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x61]
call fcn.180043ef0
lea r9, str.baksas64.sys
lea r8, [rbp + 0x390]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x170]
call fcn.180043b88
lea r9, str.sas.dll
lea r8, [rbp + 0x4a0]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x60]
call fcn.180043b88
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180025195
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
cmp dword [0x1801340b0], 0
je 0x18002520d
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.18002be20
mov rbx, rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp - 0x38]
call fcn.18002be20
nop
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
lea r9, str.RestoreFils__SAS64____d__08x____s__s_
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
nop
lea rcx, [rbp - 0x38]
call fcn.180029530
nop
lea rcx, [rsp + 0x58]
call fcn.180029530
nop
lea rcx, [rbp - 0x80]
call fcn.180009b80
xor r9d, r9d
mov r8d, dword [rsp + 0x74]
mov ebx, dword [rsp + 0x54]
mov edx, ebx
mov ecx, dword [rsp + 0x60]
call fcn.18001d750
cmp ebx, 1
jne 0x18002523b
xor ecx, ecx
call fcn.18001c650
jmp 0x180025247
cmp ebx, 2
jne 0x180025247
xor ecx, ecx
call fcn.18001c7e0
cmp r15d, 2
jne 0x180025256
xor edx, edx
xor ecx, ecx
call fcn.18001ddb0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x18013f368], eax
cmp dword [0x1801340b0], 0
je 0x18002528a
lea r9, str.CMonitorThread::RestoreFiles___
lea r8, str.WatchDog
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x710]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret