Function at 0x140011fe0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov dword [rsp + 8], ecx
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x760
mov qword [r11 - 0x230], 0xfffffffffffffffe
mov r13d, ecx
xor r15d, r15d
mov dword [rsp + 0x70], r15d
lea rax, [rsp + 0x78]
mov qword [r11 + 0x10], rax
lea rax, [r11 - 0x718]
mov qword [r11 + 0x18], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013cde
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.invoked
lea rcx, [rsp + 0x78]
call fcn.14000cc80
test al, al
jne 0x14001206a
lea rdx, str.invoked
lea rcx, [rsp + 0x78]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013ce9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rdx, str._Bitlocker_Recovery_solution_getting
lea rcx, [rsp + 0x80]
call fcn.14000cc80
test al, al
jne 0x1400120ba
lea rdx, str._Bitlocker_Recovery_solution_getting
lea rcx, [rsp + 0x80]
call fcn.14000c480
nop
mov r14d, 0xffffffff
mov r8d, r14d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x80]
call fcn.14005c670
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013cf4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x128], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013cff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013d0a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013d15
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013d20
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013d2b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, str.C:WinBDERecoveryKey
lea rcx, [rsp + 0x90]
call fcn.14000cc80
test al, al
jne 0x1400121cb
lea rdx, str.C:WinBDERecoveryKey
lea rcx, [rsp + 0x90]
call fcn.14000c480
nop
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140012200
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140012319
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140013d36
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, str.BitLockerKeyExtracted.txt
lea rcx, [rsp + 0x88]
call fcn.14000cc80
test al, al
jne 0x140012250
lea rdx, str.BitLockerKeyExtracted.txt
lea rcx, [rsp + 0x88]
call fcn.14000c480
nop
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140012267
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140012278
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140013d41
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x70], 1
mov r9, qword [rsp + 0x88]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x108]
call fcn.14000ce60
mov rbx, qword [rsp + 0x108]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x70], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400122f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012319
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x48]
call fcn.14000c480
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x50]
call fcn.14000c480
nop
lea rax, [rsp + 0x208]
mov qword [rsp + 0x740], rax
lea rdx, str.wmic_logicaldisk_get_name
lea rcx, [rsp + 0x208]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.14005e3e0
mov qword [rsp + 0x748], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x510], rcx
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x210], rbx
cmp rcx, rbx
je 0x14001240c
cmp dword [rbx + 0x10], 0
jl 0x1400123ed
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400123ed
call fcn.14000d070
mov qword [rsp + 0x218], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400123da
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x218]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x14001240c
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x500], r8d
mov qword [rsp + 0x518], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x220]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x228], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001243e
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x520], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x528], rax
mov rbx, qword [rsp + 0x40]
lea rsi, [rbx - 0x18]
mov qword [rsp + 0x530], rsi
mov rcx, rsi
call fcn.14000d070
mov qword [rsp + 0x538], rax
add rax, 0x18
mov qword [rsp + 0x110], rax
lea rdx, str._Bitlocker_Recovery_solution_is_now_inside_the_trial
lea rcx, [rsp + 0x230]
call fcn.14000c6f0
nop
mov r8d, r14d
lea rdx, [rsp + 0x110]
mov rcx, rax
call fcn.14005c670
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x504], eax
test eax, eax
jns 0x1400124cb
mov edi, r14d
mov dword [rsp + 0x38], r14d
jmp 0x1400124ff
lea rdx, [0x14009a6c0]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
mov qword [rsp + 0x540], rax
test rax, rax
jne 0x1400124f5
mov edi, r14d
mov dword [rsp + 0x38], r14d
jmp 0x1400124ff
sub rdi, rbx
sar rdi, 1
mov dword [rsp + 0x38], edi
mov r8d, edi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000bae0
nop
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x508], r8d
sub r8d, edi
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x40]
call fcn.14000bb80
mov qword [rsp + 0x548], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x550], rcx
mov qword [rsp + 0x238], rsi
cmp rcx, rsi
je 0x1400125c2
cmp dword [rsi + 0x10], 0
jl 0x1400125a3
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1400125a3
call fcn.14000d070
mov qword [rsp + 0x240], rax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140012590
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x240]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x1400125c2
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x158], r8d
mov qword [rsp + 0x558], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x250], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012600
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x15c], eax
test eax, eax
jns 0x140012618
mov eax, r14d
jmp 0x140012640
lea rdx, [0x14009a6c4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x560], rax
test rax, rax
jne 0x14001263a
mov eax, r14d
jmp 0x140012640
sub rax, rbx
sar rax, 1
mov dword [rsp + 0x38], eax
lea r8d, [rax + 1]
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x40]
call fcn.14000bae0
mov qword [rsp + 0x660], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x570], rcx
mov rbx, qword [rsp + 0x30]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x258], rbx
cmp rcx, rbx
je 0x1400126f2
cmp dword [rbx + 0x10], 0
jl 0x1400126d3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400126d3
call fcn.14000d070
mov qword [rsp + 0x260], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400126c0
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x260]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x1400126f2
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x160], r8d
mov qword [rsp + 0x578], rdx
lea rcx, [rsp + 0x30]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x270], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012724
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov qword [rsp + 0x278], rbx
mov rdi, r15
mov qword [rsp + 0x118], r15
nop
movzx ecx, word [rsi]
test cx, cx
je 0x14001278a
mov word [rsp + 0x7b0], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14001276c
test rdi, rdi
jne 0x140012777
mov rdi, rsi
mov qword [rsp + 0x118], rsi
jmp 0x140012777
mov rdi, r15
mov qword [rsp + 0x118], r15
add rsi, 2
mov qword [rsp + 0x278], rsi
mov rbx, qword [rsp + 0x30]
jmp 0x140012740
test rdi, rdi
je 0x1400127fe
sub rdi, rbx
sar rdi, 1
mov dword [rsp + 0x164], edi
test edi, edi
js 0x140013d4c
lea rax, [rbx - 0x18]
mov qword [rsp + 0x580], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x168], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x16c], eax
or eax, ecx
jge 0x1400127e0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14000d100
mov rbx, qword [rsp + 0x30]
cmp edi, dword [rbx - 0xc]
jg 0x140013d56
mov dword [rbx - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x120], rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rsp + 0x7b8], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140012833
add rbx, 2
mov qword [rsp + 0x120], rbx
jmp 0x140012810
mov rax, qword [rsp + 0x30]
cmp rbx, rax
je 0x140012935
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x170], ebx
mov edx, dword [rax - 0x10]
mov dword [rsp + 0x174], edx
test edx, edx
js 0x140013d60
lea rcx, [rax - 0x18]
mov qword [rsp + 0x588], rcx
mov r8d, 1
sub r8d, dword [rcx + 0x10]
mov dword [rsp + 0x178], r8d
mov ecx, dword [rcx + 0xc]
sub ecx, edx
mov dword [rsp + 0x17c], ecx
or ecx, r8d
jge 0x14001289e
lea rcx, [rsp + 0x30]
call fcn.14000d100
mov rax, qword [rsp + 0x30]
movsxd rcx, ebx
lea r9, [rax + rcx*2]
mov qword [rsp + 0x120], r9
mov edx, dword [rax - 0x10]
mov dword [rsp + 0x180], edx
mov edi, edx
sub edi, ebx
mov dword [rsp + 0x184], edi
mov dword [rsp + 0x188], edx
lea ecx, [rdi + 1]
movsxd r8, ecx
add r8, r8
mov qword [rsp + 0x590], r8
je 0x140012914
test r9, r9
jne 0x1400128f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140013d76
lea ecx, [rdx + 1]
movsxd rdx, ecx
add rdx, rdx
cmp rdx, r8
jb 0x140013d6a
mov rdx, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x30]
test edi, edi
js 0x140013d86
cmp edi, dword [rax - 0xc]
jg 0x140013d86
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r15w
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000b750
test al, al
jne 0x140013530
lea rdx, str.manage_bde__status
lea rcx, [rsp + 0x130]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x3b8]
call fcn.14000ba30
nop
mov rcx, qword [rsp + 0x130]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x280], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400129b0
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x288]
mov qword [rsp + 0x598], rax
lea rdx, str.manage_bde__status
lea rcx, [rsp + 0x138]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x288]
call fcn.14000ba30
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0x138]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x290], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012a33
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x18c], eax
test eax, eax
js 0x140012a78
lea rdx, str.ERROR
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5a0], rax
test rax, rax
je 0x140012a78
sub rax, qword [rsp + 0x58]
sar rax, 1
mov dword [rsp + 0x190], eax
cmp eax, 0xffffffff
jne 0x1400133d2
lea rax, [rsp + 0x298]
mov qword [rsp + 0x5a8], rax
lea rdx, str.wmic_logicaldisk_get_caption_description_filesystem
lea rcx, [rsp + 0x298]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x380]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x194], eax
test eax, eax
js 0x140012af4
lea rdx, str.__Conversion_Status:____Fully_Encrypted
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5b0], rax
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x140012af4
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x198], eax
test eax, eax
jns 0x140012b32
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x19c], eax
test eax, eax
js 0x140012b3c
lea rdx, str.__Conversion_Status:____Used_Space_Only_Encrypted
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5b8], rax
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x140012b3c
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x1a0], eax
test eax, eax
js 0x140012b3c
mov byte [rsp + 0x7a8], 1
jmp 0x140012b44
mov byte [rsp + 0x7a8], 0
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x1a4], eax
test eax, eax
js 0x140012fb3
lea rdx, str._Conversion_Status:____Unknown
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5c0], rax
test rax, rax
je 0x140012fb3
mov rcx, qword [rsp + 0x58]
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x1a8], eax
test eax, eax
js 0x140012fb3
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x1ac], eax
test eax, eax
js 0x140012fb3
lea rdx, str.Lock_Status:__________Locked
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5c8], rax
test rax, rax
je 0x140012fb3
sub rax, qword [rsp + 0x58]
sar rax, 1
mov dword [rsp + 0x1b0], eax
test eax, eax
js 0x140012fb3
lea rdx, str.manage_bde__protectors__get
lea rcx, [rsp + 0x60]
call fcn.14000c6f0
nop
mov rdi, qword [rsp + 0x30]
movsxd rcx, dword [rdi - 0x10]
mov dword [rsp + 0x1b4], ecx
mov qword [rsp + 0x2a0], rdi
mov rsi, rdi
mov rax, qword [rsp + 0x60]
sub rsi, rax
sar rsi, 1
mov qword [rsp + 0x5d0], rsi
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140013d91
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r15, rax
mov dword [rsp + 0x1b8], r15d
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140013d9b
lea ebx, [r12 + rax]
mov dword [rsp + 0x1c0], ebx
test ebx, ebx
js 0x140013da5
mov rax, qword [rsp + 0x60]
lea rcx, [rax - 0x18]
mov qword [rsp + 0x5d8], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x200], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x1c4], ecx
or ecx, edx
jge 0x140012c9c
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.14000d100
mov rax, qword [rsp + 0x60]
cmp rsi, r12
ja 0x140012cad
lea rdi, [rax + rsi*2]
mov qword [rsp + 0x2a0], rdi
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000da90
mov rax, qword [rsp + 0x60]
cmp ebx, dword [rax - 0xc]
jg 0x140013dbb
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x60]
xor r15d, r15d
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0x140]
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x5e8], rax
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
call fcn.14000d070
mov qword [rsp + 0x5f8], rax
add rax, 0x18
mov qword [rsp + 0x140], rax
lea rdx, str._Bitlocker_Recovery_solution_in_working
lea rcx, [rsp + 0x2a8]
call fcn.14000c6f0
nop
mov r8d, r14d
lea rdx, [rsp + 0x140]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x600], rax
lea rdx, str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea rcx, [rsp + 0xa8]
call fcn.14000c6f0
nop
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b0]
call fcn.14000ba30
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x2f8]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012ddb
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a8e4]
lea rcx, [rsp + 0xb0]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e0]
call fcn.14000ba30
nop
lea r8, [rsp + 0xb0]
mov rdx, rax
lea rcx, [rsp + 0x2d0]
call fcn.14000ba30
mov qword [rsp + 0x608], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x610], rcx
mov rbx, qword [rsp + 0x50]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2c0], rbx
cmp rcx, rbx
je 0x140012eb8
cmp dword [rbx + 0x10], 0
jl 0x140012e99
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140012e99
call fcn.14000d070
mov qword [rsp + 0x2c8], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140012e86
mov rdx, qword [rsp + 0x2c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x2c8]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x140012eb8
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1c8], r8d
mov qword [rsp + 0x618], rdx
lea rcx, [rsp + 0x50]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x2d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012eeb
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x2e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2e8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012f1e
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012f51
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x2f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x300], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012f84
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x308], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012fb3
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp byte [rsp + 0x7a8], 1
jne 0x1400133a0
lea rdx, str.manage_bde__protectors__get
lea rcx, [rsp + 0x68]
call fcn.14000c6f0
nop
mov rdi, qword [rsp + 0x30]
movsxd rcx, dword [rdi - 0x10]
mov dword [rsp + 0x1cc], ecx
mov qword [rsp + 0x310], rdi
mov rsi, rdi
mov rax, qword [rsp + 0x68]
sub rsi, rax
sar rsi, 1
mov qword [rsp + 0x620], rsi
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140013db0
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r15, rax
mov dword [rsp + 0x1d0], r15d
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140013dc6
lea ebx, [rax + r12]
mov dword [rsp + 0x1d8], ebx
test ebx, ebx
js 0x140013dd0
mov rax, qword [rsp + 0x68]
lea rcx, [rax - 0x18]
mov qword [rsp + 0x628], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x1dc], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x1e0], ecx
or ecx, edx
jge 0x140013088
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.14000d100
mov rax, qword [rsp + 0x68]
cmp rsi, r12
ja 0x140013099
lea rdi, [rax + rsi*2]
mov qword [rsp + 0x310], rdi
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000da90
mov rax, qword [rsp + 0x68]
cmp ebx, dword [rax - 0xc]
jg 0x140013dda
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x68]
xor r15d, r15d
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x630], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x638], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
call fcn.14000d070
mov qword [rsp + 0x648], rax
add rax, 0x18
mov qword [rsp + 0xb8], rax
lea rdx, str._Bitlocker_Recovery_solution_in_working
lea rcx, [rsp + 0x318]
call fcn.14000c6f0
nop
mov r8d, r14d
lea rdx, [rsp + 0xb8]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x320]
mov qword [rsp + 0x650], rax
lea rdx, str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea rcx, [rsp + 0xc0]
call fcn.14000c6f0
nop
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x320]
call fcn.14000ba30
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x368]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x328], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400131c7
mov rdx, qword [rsp + 0x328]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a8e4]
lea rcx, [rsp + 0xc8]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x350]
call fcn.14000ba30
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x340]
call fcn.14000ba30
mov qword [rsp + 0x658], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x758], rcx
mov rbx, qword [rsp + 0x48]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x330], rbx
cmp rcx, rbx
je 0x1400132a4
cmp dword [rbx + 0x10], 0
jl 0x140013285
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013285
call fcn.14000d070
mov qword [rsp + 0x338], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140013272
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x338]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x1400132a4
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1e4], r8d
mov qword [rsp + 0x668], rdx
lea rcx, [rsp + 0x48]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x348], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400132d7
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x358], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001330a
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x360], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001333d
mov rdx, qword [rsp + 0x360]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x370], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013370
mov rdx, qword [rsp + 0x370]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x378], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400133a0
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x388], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400133d2
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1e8], r8d
sub r8d, dword [rsp + 0x38]
dec r8d
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x40]
call fcn.14000bb80
mov qword [rsp + 0x670], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x678], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x390], rbx
cmp rcx, rbx
je 0x140013490
cmp dword [rbx + 0x10], 0
jl 0x140013471
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013471
call fcn.14000d070
mov qword [rsp + 0x398], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14001345e
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x398]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x140013490
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1ec], r8d
mov qword [rsp + 0x680], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x3a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3a8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400134c3
mov rdx, qword [rsp + 0x3a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3b0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400134f3
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x3b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013525
mov rdx, qword [rsp + 0x3c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp dword [rsp + 0x38], 0
jg 0x140012600
lea rcx, [rsp + 0x48]
call fcn.14005a760
test al, al
je 0x1400137f7
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1f0], r8d
add r8d, 0xfffffffe
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x48]
call fcn.14000bae0
mov qword [rsp + 0x688], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x690], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x3c8], rbx
cmp rcx, rbx
je 0x1400135fc
cmp dword [rbx + 0x10], 0
jl 0x1400135dd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400135dd
call fcn.14000d070
mov qword [rsp + 0x3d0], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400135ca
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x3d0]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x1400135fc
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1f4], r8d
mov qword [rsp + 0x698], rdx
lea rcx, [rsp + 0x48]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x3d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001362e
mov rdx, qword [rsp + 0x3e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x6a0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x6a8], rax
lea rdx, str.working
lea rcx, [rsp + 0x3e8]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str._Bitlocker_Recovery_solution_finally
lea rcx, [rsp + 0x3f0]
call fcn.14000c6f0
nop
mov r8d, r14d
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x3f8]
mov qword [rsp + 0x6b0], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x6b8], rax
lea rdx, str._.The_recovery_and_password_key_has_been_saved_to__C:WinBDERecoveryKey_.Please_review_and__Click_on_NEXT_STEP
lea rcx, [rsp + 0xd8]
call fcn.14000c6f0
nop
lea rdx, str.The_drives_with_bitlocker_enabled_are
lea rcx, [rsp + 0xd0]
call fcn.14000c6f0
nop
lea rax, [rsp + 0x408]
mov qword [rsp + 0x6c0], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x3f8]
call fcn.14000c6f0
mov rdi, rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x410]
call fcn.14000ba30
nop
lea r8, [rsp + 0xd8]
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.14000ba30
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0x408]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d170
nop
mov rcx, qword [rsp + 0x410]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x418], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013789
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x420], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400137bc
mov rdx, qword [rsp + 0x420]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x428], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013bcc
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140013bcc
lea rcx, [rsp + 0x50]
call fcn.14005a760
test al, al
je 0x140013abe
mov rbx, qword [rsp + 0x50]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1f8], r8d
add r8d, 0xfffffffe
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x50]
call fcn.14000bae0
mov qword [rsp + 0x6c8], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x6d0], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x430], rbx
cmp rcx, rbx
je 0x1400138c3
cmp dword [rbx + 0x10], 0
jl 0x1400138a4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400138a4
call fcn.14000d070
mov qword [rsp + 0x438], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140013891
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x438]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x1400138c3
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1fc], r8d
mov qword [rsp + 0x6d8], rdx
lea rcx, [rsp + 0x50]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x440]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400138f5
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x450]
mov qword [rsp + 0x6e0], rax
lea rax, [rsp + 0x458]
mov qword [rsp + 0x6e8], rax
lea rdx, str.working
lea rcx, [rsp + 0x450]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str._Bitlocker_Recovery_solution_finally
lea rcx, [rsp + 0x458]
call fcn.14000c6f0
nop
mov r8d, r14d
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x460]
mov qword [rsp + 0x6f0], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x6f8], rax
lea rdx, str._is_locked.Please_unlock_them_in_order_to_save_complete_extraction_keys._Click_on_NEXT_STEP
lea rcx, [rsp + 0xe8]
call fcn.14000c6f0
nop
lea rdx, str.The_drive
lea rcx, [rsp + 0xe0]
call fcn.14000c6f0
nop
lea rax, [rsp + 0x470]
mov qword [rsp + 0x700], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x460]
call fcn.14000c6f0
mov rdi, rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x478]
call fcn.14000ba30
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x468]
call fcn.14000ba30
mov rbx, rax
lea rdx, str.DLocked
lea rcx, [rsp + 0x470]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d170
nop
mov rcx, qword [rsp + 0x478]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013a50
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xe0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013a83
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013bcc
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140013bcc
lea rdx, str.Please_contact_IT_Support_for_your_problem.
lea rcx, [rsp + 0x98]
call fcn.14000c480
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x708], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x710], rax
mov rcx, qword [rsp + 0x128]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x718], rcx
call fcn.14000d070
mov qword [rsp + 0x720], rax
add rax, 0x18
mov qword [rsp + 0xf0], rax
lea rdx, str._Bitlocker_Recovery_key_Extraction_Error
lea rcx, [rsp + 0x498]
call fcn.14000c6f0
nop
mov r8d, r14d
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x728], rax
lea rax, [rsp + 0x4a8]
mov qword [rsp + 0x730], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x738], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x4a0]
call fcn.14000c6f0
mov rdi, rax
lea rdx, str.Bitlocker_is_not_enabled_on_any_drive
lea rcx, [rsp + 0x4a8]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Failure
lea rcx, [rsp + 0x4b0]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d170
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013bfc
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140013c04
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013c27
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013c47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013c67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013c87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013caa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140013ccb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x760
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
int3