Function at 0x140064340
Capabilities:
Acquire debug privileges
Delete registry value
Execute command
Self delete
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x140189f70]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
xor esi, esi
mov dword [rsp + 0x30], esi
cmp byte [0x140193d59], sil
je 0x140065cf6
lea rcx, [rsp + 0x2b0]
call fcn.140063160
nop
lea rcx, str.FSUTIL_USN_DELETEJOURNAL__D_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__f__q__s_C:Users_username_AppDataLocalMicrosoftCLR_v4.0UsageLogs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__f__q__s_C:Users_username_AppDataLocalMicrosoftCLR_v4.0_32UsageLogs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x7fffffffffffffff
mov r15, rax
mov rdx, qword [rsp + 0x2c0]
sub r15, rdx
cmp r15, 0x22
jb 0x140065d28
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0x10
cmovae r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x150], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
lea r13, [rdx + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0xd8]
lea r12d, [rbx + 7]
cmp r13, rbx
jbe 0x140064518
mov rbx, r13
or rbx, 0xf
cmp rbx, rax
jbe 0x14006446e
mov rbx, rax
movabs r14, 0x8000000000000000
lea rax, [r14 + 0x27]
jmp 0x140064499
cmp rbx, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400644d0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140065d2e
movabs r14, 0x8000000000000000
mov rcx, rax
call fcn.14010b98c
test rax, rax
je 0x140064655
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x2c0]
mov r9, qword [rsp + 0x150]
mov qword [rsp + 0xd8], rdi
jmp 0x140064522
test rcx, rcx
je 0x140064501
call fcn.14010b98c
mov rdi, rax
mov rdx, qword [rsp + 0x2c0]
mov r9, qword [rsp + 0x150]
movabs r14, 0x8000000000000000
mov qword [rsp + 0xd8], rax
jmp 0x140064522
mov rdi, rsi
movabs r14, 0x8000000000000000
mov qword [rsp + 0xd8], rsi
jmp 0x140064522
movabs r14, 0x8000000000000000
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0xf0], rbx
movups xmm0, xmmword [str.del__f__q__s_C:WindowsPrefetch]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140146780]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x140146790]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r13], 0
mov r8d, 1
lea rdx, [0x140143b0c]
lea rcx, [rsp + 0xd8]
call fcn.14006b0d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140064608
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
movdqa xmm0, xmmword [0x140148b80]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0x10
jb 0x140064661
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006465c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006465c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r15, 0x35
jb 0x140065d34
lea rdx, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0x10
cmovae rdx, qword [rsp + 0x2b0]
mov qword [rsp + 0x150], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r13, qword [rsp + 0x2c0]
lea r15, [r13 + 0x35]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x60]
cmp r15, rbx
jbe 0x14006474f
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x14006470c
mov rbx, rcx
add r14, 0x27
mov rcx, r14
call fcn.14010b98c
test rax, rax
je 0x1400648af
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rsp + 0x150]
jmp 0x14006474a
cmp rbx, 0x16
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140064730
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140065d3a
jmp 0x1400646e5
test rcx, rcx
je 0x140064747
call fcn.14010b98c
mov rdi, rax
mov rdx, qword [rsp + 0x150]
jmp 0x14006474a
mov rdi, rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str.del__f__q__s_C:Users_username_AppDataLocalTemp]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1401467a8]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x1401467b8]
movups xmmword [rdi + 0x20], xmm0
mov eax, dword [0x1401467c8]
mov dword [rdi + 0x30], eax
movzx eax, byte [0x1401467cc]
mov byte [rdi + 0x34], al
lea rcx, [rdi + 0x35]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 1
lea rdx, [0x140143b0c]
lea rcx, [rsp + 0x60]
call fcn.14006b0d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x260], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x260], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r12d, 0xf0000
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x250]
cmp qword [rsp + 0x268], 0x10
cmovae rcx, qword [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x268]
cmp rdx, 0x10
jb 0x140064862
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006485d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006485d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
movdqa xmm0, xmmword [0x140148b80]
movdqu xmmword [rsp + 0x260], xmm0
mov byte [rsp + 0x250], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400648bb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400648b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400648b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x2e0], rdx
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov r15d, dword [rax + 0x14]
add r15d, 0x76c
mov dword [rsp + 0x198], r15d
mov r13d, dword [rax + 0x10]
inc r13d
mov dword [rsp + 0x150], r13d
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x378]
call fcn.14005d690
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x180], xmm0
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x180]
call fcn.14006bd60
test eax, eax
jne 0x140065d40
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
mov rdi, qword [rsp + 0x188]
test rdi, rdi
je 0x14006498c
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x290], xmm0
test rdi, rdi
je 0x1400649b3
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x308], xmm1
mov r14, 0xffffffffffffffff
test rdi, rdi
je 0x140064a15
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140064a08
mov rbx, qword [rsp + 0x188]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140064a08
mov rdi, qword [rsp + 0x188]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140064a10
mov rdi, qword [rsp + 0x188]
mov r12d, dword [rsp + 0x30]
nop word [rax + rax]
mov rbx, qword [rsp + 0x290]
cmp rbx, qword [rsp + 0x308]
je 0x140064d8c
add rbx, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x130]
call fcn.14005d3a0
movsd xmm0, qword [rax]
movsd qword [rsp + 0xc8], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0xc8]
test edx, edx
je 0x140064a73
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x140065d57
cmp ecx, 3
jne 0x140064d72
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140064a89
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.14005bfc0
cmp rax, r11
je 0x140064adb
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140064ab0
cmp cx, 0x2f
jne 0x140064ab9
add rax, 2
cmp rax, r11
jne 0x140064aa1
cmp rax, r11
je 0x140064adb
nop
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x140064adb
cmp cx, 0x2f
je 0x140064adb
mov r10, rdx
cmp rax, rdx
jne 0x140064ac0
sub r11, r10
sar r11, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov r8, r11
mov rdx, r10
lea rcx, [rsp + 0xa8]
call fcn.14006cf50
or r12d, 0x1c00
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x108], rax
call fcn.14010aae0
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x120], xmm0
lea r8, [rsp + 0x120]
mov edx, eax
lea rcx, [rsp + 0x318]
call fcn.14006baa0
or r12d, 0xe000
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x140064bcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064bc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064bc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], 7
mov word [rsp + 0xa8], si
lea rcx, [rsp + 0x318]
cmp qword [rsp + 0x330], 0x10
cmovae rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x194]
lea r8, [rsp + 0x1a8]
lea rdx, str._02d__02d__04d
call fcn.140005f60
cmp eax, 3
jne 0x140064d2c
cmp dword [rsp + 0x190], r15d
jne 0x140064d2c
cmp dword [rsp + 0x194], r13d
jne 0x140064d2c
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x1a8], eax
jne 0x140064d2c
mov qword [rsp + 0x2a0], 0
lea rax, [0x14018a110]
mov qword [rsp + 0x2a8], rax
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140064c89
mov rcx, qword [rbx]
call fcn.14010b218
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x1a0], rcx
mov dword [rsp + 0x110], edx
lea rax, [0x14018a110]
mov qword [rsp + 0x118], rax
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x2a0], xmm0
cmp edx, 0x91
jne 0x140064ce7
lea r8, [rsp + 0x1a0]
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call fcn.14005d480
mov eax, dword [rsp + 0x2a0]
test eax, eax
setne cl
test eax, eax
je 0x140064cff
mov qword [rsp + 0x1a0], r14
test cl, cl
jne 0x140065d67
jmp 0x140064d2c
mov rdx, qword [rsp + 0x330]
cmp rdx, 0x10
jb 0x140064d72
inc rdx
mov rcx, qword [rsp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064d6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
lea rcx, [rsp + 0x290]
call fcn.14005cef0
test eax, eax
jne 0x140065d7f
jmp 0x140064a20
mov rcx, qword [rsp + 0x298]
test rcx, rcx
je 0x140064dde
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140064dd1
mov rbx, qword [rsp + 0x298]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140064dd1
mov rcx, qword [rsp + 0x298]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x188]
test rdi, rdi
je 0x140064e20
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140064e1b
mov rbx, qword [rsp + 0x188]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140064e1b
mov rcx, qword [rsp + 0x188]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, dword [rsp + 0x30]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x338]
call fcn.14006b310
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], rsi
mov r8d, 0x5b
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rsp + 0x270]
call fcn.14006cf50
nop
lea rdx, [rsp + 0x338]
cmp qword [rsp + 0x350], 0x10
cmovae rdx, qword [rsp + 0x338]
mov r15, qword [rsp + 0x348]
add r15, rdx
lea rdi, [rsp + 0x338]
cmp qword [rsp + 0x350], 0x10
cmovae rdi, qword [rsp + 0x338]
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
cmp rdi, r15
jne 0x140064ee8
mov qword [rsp + 0x168], rsi
mov eax, 7
mov qword [rsp + 0x170], rax
mov word [rsp + 0x158], si
jmp 0x140065037
mov rax, r15
sub rax, rdi
mov rdx, rsi
mov qword [rsp + 0x168], rdx
mov ebx, 7
mov qword [rsp + 0x170], rbx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140065d87
cmp rax, 8
jb 0x140064fd0
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x140064f34
mov rbx, rcx
jmp 0x140064f40
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rax, rbx
add rax, 1
cmovb rax, r14
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140065d8d
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140064fa5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140065d8d
mov rcx, rax
call fcn.14010b98c
mov rcx, rax
test rax, rax
je 0x140064f9e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x168]
jmp 0x140064fbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140064fb9
call fcn.14010b98c
mov rdx, qword [rsp + 0x168]
jmp 0x140064fbc
mov rax, rsi
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x170], rbx
nop dword [rax]
lea rcx, [rsp + 0x158]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x158]
movsx eax, byte [rdi]
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x168]
inc rdx
mov qword [rsp + 0x168], rdx
inc rdi
cmp rdi, r15
je 0x140065011
mov rbx, qword [rsp + 0x170]
jmp 0x140064fd0
lea rax, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rax, qword [rsp + 0x158]
mov word [rax + rdx*2], si
mov rax, qword [rsp + 0x170]
lea r8, [rsp + 0x158]
cmp rax, 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rdx, qword [rsp + 0x270]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140065087
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x140065095
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
mov r8, qword [rsp + 0x280]
cmovae rdx, qword [rsp + 0x270]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_79
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rsp + 0x1b0]
call fcn.14006cf50
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
cmovae rdx, qword [rsp + 0x1b0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140065198
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x1400651a6
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
mov r8, qword [rsp + 0x1c0]
cmovae rdx, qword [rsp + 0x1b0]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rsi
mov r8d, 0x59
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU
lea rcx, [rsp + 0x1d0]
call fcn.14006cf50
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae rdx, qword [rsp + 0x1d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x1400652a9
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x1400652b7
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
mov r8, qword [rsp + 0x1e0]
cmovae rdx, qword [rsp + 0x1d0]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rsi
mov r8d, 0x5b
lea rdx, str.HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rsp + 0x1f0]
call fcn.14006cf50
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rdx, qword [rsp + 0x1f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x1400653ba
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x1400653c8
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
mov r8, qword [rsp + 0x200]
cmovae rdx, qword [rsp + 0x1f0]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShell
lea rcx, [rsp + 0x210]
call fcn.14006cf50
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
cmovae rdx, qword [rsp + 0x210]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x1400654cb
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x1400654d9
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
mov r8, qword [rsp + 0x220]
cmovae rdx, qword [rsp + 0x210]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rsi
mov r8d, 0x5d
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rsp + 0x230]
call fcn.14006cf50
nop
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae rdx, qword [rsp + 0x230]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x1400655dc
lea rdx, [0x140146620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x1400655ea
lea rdx, str.Error_deleting_registry_entry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14006bf50
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
mov r8, qword [rsp + 0x240]
cmovae rdx, qword [rsp + 0x230]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14014661c]
mov rcx, rax
call fcn.14006bf50
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
mov r8, qword [rsp + 0x168]
cmovae rdx, qword [rsp + 0x158]
mov rcx, rax
call fcn.14006e410
lea rdx, [0x14006c130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rsp + 0x3a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x3a0]
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1400656a0
call fcn.14010aae0
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov rcx, rsi
mov qword [rsp + 0x98], rcx
mov edx, 7
mov qword [rsp + 0xa0], rdx
mov word [rsp + 0x88], si
or r12d, 0x40
mov dword [rsp + 0x30], r12d
test r14, r14
je 0x140065782
cmp r14, 0x7fffffff
ja 0x140065d93
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
lea rdx, [rsp + 0x3a0]
mov ecx, edi
call fcn.14010ab08
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140065d99
movsxd rdx, ebx
lea rcx, [rsp + 0x88]
call fcn.14006ae80
lea r9, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae r9, qword [rsp + 0x88]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
lea rdx, [rsp + 0x3a0]
mov ecx, edi
call fcn.14010ab08
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140065da5
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
and r12d, 0xffffffbf
or r12d, 0x30
lea r10, [rsp + 0x88]
cmp rdx, 8
cmovae r10, qword [rsp + 0x88]
lea rdx, [r10 + rcx*2]
mov rcx, r10
call fcn.14005bfc0
cmp rax, rdx
je 0x14006581c
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400657bf
cmp cx, 0x2f
jne 0x1400657c8
add rax, 2
cmp rax, rdx
jne 0x1400657b0
cmp rax, rdx
je 0x14006581c
nop dword [rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400657ee
cmp cx, 0x2f
je 0x1400657ee
mov rdx, r8
cmp rax, r8
jne 0x1400657d0
jmp 0x14006581c
cmp rax, rdx
je 0x14006581c
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140065814
cmp cx, 0x2f
jne 0x14006581c
mov rdx, r8
cmp rax, r8
jne 0x140065800
sub rdx, r10
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x358], xmm0
mov qword [rsp + 0x368], rsi
mov qword [rsp + 0x370], rsi
mov r8, rdx
mov rdx, r10
lea rcx, [rsp + 0x358]
call fcn.14006cf50
or r12d, 0x380
mov rdx, qword [rsp + 0xa0]
cmp rdx, 8
jb 0x1400658a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006589d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006589d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x80], rax
call fcn.14010aae0
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
or r12d, 4
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 0xb]
lea rdx, str.reshade.ini
mov ecx, eax
call fcn.14010ab08
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140065daf
movsxd rdx, ebx
lea rcx, [rsp + 0x38]
call fcn.14006ae80
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], ebx
mov r8d, ntohs
lea rdx, str.reshade.ini
mov ecx, edi
call fcn.14010ab08
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140065dbb
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x2e8]
call fcn.14005c360
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400659a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400659a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400659a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
movdqa xmm0, xmmword [0x140148b70]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x180]
call fcn.14005d3a0
movsd xmm0, qword [rax]
movsd qword [rsp + 0xc8], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x2d0], ecx
lea rax, [0x14018a110]
mov qword [rsp + 0x2d8], rax
movaps xmm0, xmmword [rsp + 0x2d0]
movdqa xmmword [rsp + 0x2d0], xmm0
mov eax, dword [rsp + 0xc8]
test eax, eax
je 0x140065a46
cmp eax, 1
je 0x140065a4e
lea rcx, [rsp + 0x2e8]
cmp qword [rsp + 0x300], 8
cmovae rcx, qword [rsp + 0x2e8]
call fcn.14010b218
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140065dc5
jmp 0x140065a4e
test ecx, ecx
jne 0x140065dde
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x150]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140065ae5
lea r8, [rsp + 0x198]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x150]
test eax, eax
je 0x140065adf
mov dword [rsp + 0x250], 1
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x254], rax
mov dword [rsp + 0x25c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x250]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1401458a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140065ced
lea rcx, str.FiveM.exe
call fcn.140064270
mov edi, eax
lea rdx, str.Cleaning_Started_Stage_1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004a340
lea rdx, [0x14006c560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test edi, edi
je 0x140065bfe
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140065bfe
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 7
lea rdx, [0x1401458a0]
lea rcx, [rsp + 0x60]
call fcn.14004a5e0
nop
mov r8, rbx
lea rdx, [rsp + 0x60]
mov ecx, edi
call fcn.140063db0
movzx edi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140065bcd
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065bc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
test dil, dil
je 0x140065bf5
lea rdx, str.E_Traces_Cleaned
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004a340
lea rdx, [0x14006c560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.lsass.exe
call fcn.140064270
mov ebx, eax
lea rdx, str.Cleaning_Started_Stage_2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004a340
lea rdx, [0x14006c560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test ebx, ebx
je 0x140065cc8
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140065cc8
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.fifateambuy.online
lea rcx, [rsp + 0x60]
call fcn.14004a5e0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140063db0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140065cc8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065cc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bce8
mov r9d, 0x40
lea r8, str.Traces_Cleaned
lea rdx, str.Good_Luck_to_Screensharers
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.14010b5b0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1400384b0
nop
call fcn.1400060c0
int3
call fcn.1400384b0
int3
call fcn.1400060c0
nop
lea r8, [rsp + 0x378]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.14005ccc0
nop
mov r8, rbx
lea rcx, str.status
call fcn.14005ccc0
nop
mov r8, rbx
lea rdx, [rsp + 0x2a0]
lea rcx, str.remove_all
call fcn.14005cd30
nop
mov edx, eax
call fcn.14005cbd0
nop
call fcn.1400384b0
int3
call fcn.1400060c0
nop
call fcn.14004b050
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14004b320
int3
shr rcx, 0x20
call fcn.14004b320
nop
shr rbx, 0x20
mov ecx, ebx
call fcn.14004b320
int3
shr rcx, 0x20
call fcn.14004b320
nop
shr rdx, 0x20
lea r8, [rsp + 0x2e8]
lea rcx, str.remove
call fcn.14005ccc0
int3
lea r8, [rsp + 0x2e8]
lea rdx, [rsp + 0x2d0]
lea rcx, str.exists
call fcn.14005cd30
int3