Function at 0x14004f220
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe68]
sub rsp, 0xf40
mov qword [rbp + 0x4a0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rbp + 0xe30], rax
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rcx, [rbp + 0x480]
call fcn.140063f10
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054216
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x78], rax
lea rdx, str.C:Windowsiassistinformation.txt
lea rcx, [rbp + 0x78]
call fcn.14000ce70
test al, al
jne 0x14004f2bb
lea rdx, str.C:Windowsiassistinformation.txt
lea rcx, [rbp + 0x78]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054221
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005422c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054237
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054242
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005424d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054258
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], r15
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x78]
lea rcx, [rbp + 0x4b0]
call fcn.14000ac90
nop
cmp qword [rbp + 0x540], 0
je 0x1400505d8
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x4b0]
mov dl, 0xa
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x4b0]
call fcn.14005ac90
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400505d8
lea r14, [rbp + 0x5c0]
mov rdi, qword [rbp + 0x5c0]
mov rsi, qword [rbp + 0x5d8]
cmp rsi, 0x10
cmovae r14, rdi
mov rbx, qword [rbp + 0x5d0]
cmp rbx, 9
jb 0x14004f48a
lea r15, [r14 + rbx]
lea r8, [r15 - 8]
sub r8, r14
mov edx, 0x46
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f487
movzx r12d, byte [0x1400a4a38]
mov r13, qword [str.FilePath]
nop dword [rax]
cmp qword [rax], r13
jne 0x14004f46b
cmp byte [rax + 8], r12b
je 0x14004f4c4
inc rax
lea r8, [r15 - 8]
sub r8, rax
mov edx, 0x46
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004f460
xor r15d, r15d
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004f710
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000c670
mov rax, qword [rsp + 0x58]
cmp dword [rax - 0x10], 0
jge 0x14004f4cc
mov ecx, 0xffffffff
jmp 0x14004f4f6
sub rax, r14
xor r15d, r15d
jmp 0x14004f491
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x58]
jne 0x14004f4f0
mov ecx, 0xffffffff
jmp 0x14004f4f6
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x488]
lea rcx, [rsp + 0x58]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004f573
cmp dword [rbx + 0x10], 0
jl 0x14004f564
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004f564
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004f559
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14004f573
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x488]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f596
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov rdi, r15
movzx eax, word [rbx]
test ax, ax
je 0x14004f633
nop word [rax + rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f5cc
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004f5cf
mov rdi, r15
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004f5b0
test rdi, rdi
je 0x14004f62e
mov rax, qword [rsp + 0x58]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x14005426e
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004f615
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14000d2f0
mov rax, qword [rsp + 0x58]
cmp edi, dword [rax - 0xc]
jg 0x140054263
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x58]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f651
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004f640
mov rax, qword [rsp + 0x58]
cmp rbx, rax
je 0x14004f6fb
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400542b0
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004f693
lea rcx, [rsp + 0x58]
call fcn.14000d2f0
mov rax, qword [rsp + 0x58]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004f6da
test rdx, rdx
je 0x140054288
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054279
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x58]
test edi, edi
js 0x1400542a5
cmp edi, dword [rax - 0xc]
jg 0x1400542a5
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], r15w
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0xb
jb 0x14004f787
lea r15, [r14 + rbx]
lea r8, [r15 - 0xa]
sub r8, r14
mov edx, 0x53
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f787
movzx r12d, byte [0x1400a4a4a]
movzx r13d, word [0x1400a4a48]
mov rcx, qword [str.StepNumber]
cmp qword [rax], rcx
jne 0x14004f76b
cmp word [rax + 8], r13w
jne 0x14004f76b
cmp byte [rax + 0xa], r12b
je 0x14004f7bf
inc rax
lea r8, [r15 - 0xa]
sub r8, rax
mov edx, 0x53
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004f752
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004f9fa
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.14000c670
mov rax, qword [rbp - 0x80]
cmp dword [rax - 0x10], 0
jge 0x14004f7c4
mov ecx, 0xffffffff
jmp 0x14004f7ed
sub rax, r14
jmp 0x14004f78e
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rbp - 0x80]
jne 0x14004f7e7
mov ecx, 0xffffffff
jmp 0x14004f7ed
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x80]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x80]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004f866
cmp dword [rbx + 0x10], 0
jl 0x14004f858
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004f858
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004f84e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x80], rax
jmp 0x14004f866
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x80]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x490]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f889
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x80]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004f91d
nop dword [rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f8bc
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004f8bf
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004f8a0
test rdi, rdi
je 0x14004f919
mov rax, qword [rbp - 0x80]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400542c6
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004f902
mov edx, edi
lea rcx, [rbp - 0x80]
call fcn.14000d2f0
mov rax, qword [rbp - 0x80]
cmp edi, dword [rax - 0xc]
jg 0x1400542bb
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x80]
mov word [rax + rcx*2], si
mov rbx, qword [rbp - 0x80]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f941
nop word [rax + rax]
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004f930
mov rax, qword [rbp - 0x80]
cmp rbx, rax
je 0x14004f9e5
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054308
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004f980
lea rcx, [rbp - 0x80]
call fcn.14000d2f0
mov rax, qword [rbp - 0x80]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004f9c6
test rdx, rdx
je 0x1400542e0
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x1400542d1
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x80]
test edi, edi
js 0x1400542fd
cmp edi, dword [rax - 0xc]
jg 0x1400542fd
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x80]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0xc
jb 0x14004fa67
lea r15, [r14 + rbx]
lea r8, [r15 - 0xb]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004fa67
mov r12d, dword [0x1400a4a58]
mov r13, qword [str.AdminNeeded]
nop word [rax + rax]
cmp qword [rax], r13
jne 0x14004fa4b
cmp dword [rax + 8], r12d
je 0x14004faa1
inc rax
lea r8, [r15 - 0xb]
sub r8, rax
mov edx, 0x41
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004fa40
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004fcef
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000c670
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], 0
jge 0x14004faa6
mov ecx, 0xffffffff
jmp 0x14004fad0
sub rax, r14
jmp 0x14004fa6e
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x60]
jne 0x14004faca
mov ecx, 0xffffffff
jmp 0x14004fad0
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x498]
lea rcx, [rsp + 0x60]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004fb4d
cmp dword [rbx + 0x10], 0
jl 0x14004fb3e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004fb3e
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004fb33
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14004fb4d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x498]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fb70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004fc07
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fba1
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004fba4
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004fb85
test rdi, rdi
je 0x14004fc02
mov rax, qword [rsp + 0x60]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x14005431e
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004fbea
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.14000d2f0
mov rax, qword [rsp + 0x60]
cmp edi, dword [rax - 0xc]
jg 0x140054313
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x60]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fc31
nop dword [rax]
nop dword [rax + rax]
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004fc20
mov rax, qword [rsp + 0x60]
cmp rbx, rax
je 0x14004fcda
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054360
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004fc73
lea rcx, [rsp + 0x60]
call fcn.14000d2f0
mov rax, qword [rsp + 0x60]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004fcba
test rdx, rdx
je 0x140054338
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054329
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x60]
test edi, edi
js 0x140054355
cmp edi, dword [rax - 0xc]
jg 0x140054355
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x12
jb 0x14004fd65
lea r15, [r14 + rbx]
lea r8, [r15 - 0x11]
sub r8, r14
mov edx, 0x61
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004fd65
movzx r12d, word [0x1400a4a70]
mov r13, qword [0x1400a4a68]
mov rcx, qword [str.ankscptFolderPath]
cmp qword [rax], rcx
jne 0x14004fd49
cmp qword [rax + 8], r13
jne 0x14004fd49
cmp word [rax + 0x10], r12w
je 0x14004fd9f
inc rax
lea r8, [r15 - 0x11]
sub r8, rax
mov edx, 0x61
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004fd30
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004ffe1
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14000c670
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
jge 0x14004fda4
mov ecx, 0xffffffff
jmp 0x14004fdce
sub rax, r14
jmp 0x14004fd6c
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x68]
jne 0x14004fdc8
mov ecx, 0xffffffff
jmp 0x14004fdce
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x68]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004fe4b
cmp dword [rbx + 0x10], 0
jl 0x14004fe3c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004fe3c
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004fe31
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x14004fe4b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x250]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fe6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x68]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004ff05
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fe9f
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004fea2
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004fe83
test rdi, rdi
je 0x14004ff00
mov rax, qword [rsp + 0x68]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x140054376
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004fee8
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.14000d2f0
mov rax, qword [rsp + 0x68]
cmp edi, dword [rax - 0xc]
jg 0x14005436b
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x68]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004ff23
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004ff12
mov rax, qword [rsp + 0x68]
cmp rbx, rax
je 0x14004ffcc
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400543b8
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004ff65
lea rcx, [rsp + 0x68]
call fcn.14000d2f0
mov rax, qword [rsp + 0x68]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004ffac
test rdx, rdx
je 0x140054390
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054381
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x68]
test edi, edi
js 0x1400543ad
cmp edi, dword [rax - 0xc]
jg 0x1400543ad
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x14
jb 0x140050064
lea r15, [r14 + rbx]
lea r8, [r15 - 0x13]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140050064
mov r12d, dword [0x1400a4a88]
mov r13, qword [0x1400a4a80]
nop word [rax + rax]
mov rcx, qword [str.ActionStrForTestBtn]
cmp qword [rax], rcx
jne 0x140050048
cmp qword [rax + 8], r13
jne 0x140050048
cmp dword [rax + 0x10], r12d
je 0x14005009e
inc rax
lea r8, [r15 - 0x13]
sub r8, rax
mov edx, 0x41
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140050030
mov rax, 0xffffffffffffffff
test eax, eax
js 0x1400502e0
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.14000c670
mov rax, qword [rsp + 0x78]
cmp dword [rax - 0x10], 0
jge 0x1400500a3
mov ecx, 0xffffffff
jmp 0x1400500cd
sub rax, r14
jmp 0x14005006b
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x78]
jne 0x1400500c7
mov ecx, 0xffffffff
jmp 0x1400500cd
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x258]
lea rcx, [rsp + 0x78]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x78]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005014a
cmp dword [rbx + 0x10], 0
jl 0x14005013b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005013b
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050130
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x14005014a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x258]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005016d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x140050204
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14005019e
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400501a1
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140050182
test rdi, rdi
je 0x1400501ff
mov rax, qword [rsp + 0x78]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400543ce
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400501e7
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.14000d2f0
mov rax, qword [rsp + 0x78]
cmp edi, dword [rax - 0xc]
jg 0x1400543c3
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x78]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140050222
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140050211
mov rax, qword [rsp + 0x78]
cmp rbx, rax
je 0x1400502cb
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054410
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x140050264
lea rcx, [rsp + 0x78]
call fcn.14000d2f0
mov rax, qword [rsp + 0x78]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x1400502ab
test rdx, rdx
je 0x1400543e8
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x1400543d9
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x78]
test edi, edi
js 0x140054405
cmp edi, dword [rax - 0xc]
jg 0x140054405
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x16
jb 0x140050358
lea r15, [r14 + rbx]
lea r8, [r15 - 0x15]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140050358
nop word [rax + rax]
mov r8d, 0x16
lea rdx, str.ActionParamForTestBtn
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140050392
inc rbx
lea r8, [r15 - 0x15]
sub r8, rbx
mov edx, 0x41
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140050320
mov rbx, 0xffffffffffffffff
test ebx, ebx
js 0x1400505d0
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14000c670
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0
jge 0x140050397
mov ecx, 0xffffffff
jmp 0x1400503c1
sub rbx, r14
jmp 0x14005035f
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x70]
jne 0x1400503bb
mov ecx, 0xffffffff
jmp 0x1400503c1
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x70]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005043e
cmp dword [rbx + 0x10], 0
jl 0x14005042f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005042f
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050424
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14005043e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x260]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050461
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x70]
xor r15d, r15d
mov edi, r15d
movzx eax, word [rbx]
test ax, ax
je 0x140050503
nop dword [rax + rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14005049c
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14005049f
mov rdi, r15
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140050480
test rdi, rdi
je 0x1400504fe
mov rax, qword [rsp + 0x70]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x140054426
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400504e5
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.14000d2f0
mov rax, qword [rsp + 0x70]
cmp edi, dword [rax - 0xc]
jg 0x14005441b
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x70]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140050521
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140050510
mov rax, qword [rsp + 0x70]
cmp rbx, rax
je 0x14004f3c0
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054468
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x140050563
lea rcx, [rsp + 0x70]
call fcn.14000d2f0
mov rax, qword [rsp + 0x70]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x1400505aa
test rdx, rdx
je 0x140054440
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054431
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x70]
test edi, edi
js 0x14005445d
cmp edi, dword [rax - 0xc]
jg 0x14005445d
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r15w
jmp 0x14004f3c0
xor r15d, r15d
jmp 0x14004f3c0
lea rcx, [rbp + 0x4c0]
call fcn.14000cca0
test rax, rax
jne 0x14005060b
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x4b0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r15w
mov rdx, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140050640
lea rcx, [rbp + 0x640]
call fcn.14000e890
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054473
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rbx, str.C:WindowsiassistdecrFile.ankscpt
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000ce70
test al, al
jne 0x1400506af
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140050695
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000d350
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x630], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r15w
mov rdx, qword [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400506e0
lea rcx, [rbp + 0x620]
call fcn.14000e890
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x610], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x610], xmm1
mov word [rbp + 0x600], r15w
mov r8d, 0xb
lea rdx, str.ANKRPY4_13
lea rcx, [rbp + 0x600]
call fcn.14000e890
nop
lea rax, [rbp + 0x80]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x268]
mov qword [rsp + 0x50], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005447e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x90], rax
lea rdx, str._OutputFilePath_
lea rcx, [rbp + 0x90]
call fcn.14000ce70
test al, al
jne 0x140050799
lea rdx, str._OutputFilePath_
lea rcx, [rbp + 0x90]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054489
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa0], rax
lea rdx, str.Decrypt_Solution_File:_InputFilePath_
lea rcx, [rbp + 0xa0]
call fcn.14000ce70
test al, al
jne 0x1400507e6
lea rdx, str.Decrypt_Solution_File:_InputFilePath_
lea rcx, [rbp + 0xa0]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054494
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x80]
call fcn.14000ce70
test al, al
jne 0x140050833
lea rdx, [0x140099090]
lea rcx, [rbp + 0x80]
call fcn.14000c670
nop
mov rbx, qword [rbp + 0xa0]
lea rdi, [rbx - 0x18]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140050854
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140050865
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005449f
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
mov dword [rsp + 0x30], 0x40
mov r9, qword [rsp + 0x58]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.14000d050
nop
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400508c6
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400508d7
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400544aa
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x100], rax
mov ebx, 0xc0
mov dword [rsp + 0x30], ebx
mov r9, qword [rbp + 0x90]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x88]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x100]
call fcn.14000d050
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x268]
call fcn.14000bc20
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.14005c860
btr ebx, 7
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050978
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xffffffbf
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400509a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x1400509bd
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400509e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x640]
call fcn.140065510
test al, al
je 0x140050aa8
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
mov qword [rbp - 0x60], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544b5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 8], rax
lea rdx, [0x140099090]
lea rcx, [rbp - 8]
call fcn.14000ce70
test al, al
jne 0x140050a57
lea rdx, [0x140099090]
lea rcx, [rbp - 8]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544c0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, str.File_decrypted_successfully.
lea rcx, [rbp]
call fcn.14000ce70
test al, al
jne 0x140050a9b
lea rdx, str.File_decrypted_successfully.
lea rcx, [rbp]
call fcn.14000c670
nop
lea rdx, [rbp - 8]
lea rcx, [rbp]
jmp 0x140050b49
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x60], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544cb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 8], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 8]
call fcn.14000ce70
test al, al
jne 0x140050afd
lea rdx, [0x140099090]
lea rcx, [rbp + 8]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544d6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x10], rax
lea rdx, str.Failed_to_decrypt_the_file.
lea rcx, [rbp + 0x10]
call fcn.14000ce70
test al, al
jne 0x140050b41
lea rdx, str.Failed_to_decrypt_the_file.
lea rcx, [rbp + 0x10]
call fcn.14000c670
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x10]
mov r8d, 0xffffffff
call fcn.14005c860
mov qword [rbp + 0x5f0], r15
mov qword [rbp + 0x5f8], r15
mov qword [rbp + 0x5f0], r15
mov qword [rbp + 0x5f8], 7
mov word [rbp + 0x5e0], r15w
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544e1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544ec
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400544f7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
mov r14d, 1
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054502
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, str.r__ccsUTF_8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r8, qword [rbp + 0x108]
test r8, r8
je 0x140051350
mov edx, 0x3e8
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
je 0x140051343
lea r12, str.______
lea r13, str.needadminright_
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005450d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x18]
call fcn.14000ce70
test al, al
jne 0x140050cb0
lea rcx, [rbp + 0x660]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140050c92
mov r8d, eax
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x18]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x18]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x28]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050d0f
cmp dword [rbx + 0x10], 0
jl 0x140050d01
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050d01
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050cf7
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x28], rax
jmp 0x140050d0f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x28]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050d2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140050d40
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x5e0]
call fcn.14000e890
lea r10, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 8
cmovae r10, qword [rbp + 0x5e0]
mov rax, qword [rbp + 0x5f0]
cmp rax, 6
jb 0x140050de2
add rax, 0xfffffffffffffffb
lea r11, [r10 + rax*2]
mov rax, r10
nop word [rax + rax]
mov rcx, r11
sub rcx, rax
sar rcx, 1
je 0x140050de2
cmp word [rax], 0x2d
je 0x140050dab
add rax, 2
sub rcx, 1
jmp 0x140050d99
test rax, rax
je 0x140050de2
mov r8d, 6
mov rdx, r12
mov r9, rax
sub r9, r12
nop
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x140050ddc
add rdx, 2
sub r8, 1
jne 0x140050dc0
sub rax, r10
sar rax, 1
jmp 0x140050de9
add rax, 2
jmp 0x140050d90
mov rax, 0xffffffffffffffff
lea ecx, [r14 + 1]
test eax, eax
cmovs ecx, r14d
mov r14d, ecx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
cmp r14d, eax
jne 0x14005131c
lea r10, [rbp + 0x5e0]
mov rsi, qword [rbp + 0x5e0]
mov rdi, qword [rbp + 0x5f8]
cmp rdi, 8
cmovae r10, rsi
mov rbx, qword [rbp + 0x5f0]
cmp rbx, 0xb
jb 0x140050e98
lea r11, [rbx - 0xa]
lea r11, [r10 + r11*2]
mov rcx, r10
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140050e98
cmp word [rcx], 0x61
je 0x140050e5b
add rcx, 2
sub rax, 1
jmp 0x140050e49
test rcx, rcx
je 0x140050e98
mov r8d, 0xb
lea rax, str.actionstr_
mov rdx, rax
mov r9, rcx
sub r9, rax
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x140050e92
add rdx, 2
sub r8, 1
jne 0x140050e76
sub rcx, r10
sar rcx, 1
jmp 0x140050e9f
add rcx, 2
jmp 0x140050e40
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x140050fd5
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x140050ec1
mov rdx, rsi
test rsi, rsi
jne 0x140050ec1
mov eax, r15d
jmp 0x140050eda
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140050ed0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000d350
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
jge 0x140050ef9
mov eax, 0xffffffff
jmp 0x140050f1b
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140050f15
mov eax, 0xffffffff
jmp 0x140050f1b
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x40]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050f93
cmp dword [rbx + 0x10], 0
jl 0x140050f84
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050f84
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050f79
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140050f93
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x270]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050fb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14000bf30
mov rdi, qword [rbp + 0x5f8]
mov rbx, qword [rbp + 0x5f0]
mov rsi, qword [rbp + 0x5e0]
lea r10, [rbp + 0x5e0]
cmp rdi, 8
cmovae r10, rsi
cmp rbx, 0x14
jb 0x140051052
lea r11, [rbx - 0x13]
lea r11, [r10 + r11*2]
mov rcx, r10
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140051052
cmp word [rcx], 0x61
je 0x140051010
add rcx, 2
sub rax, 1
jmp 0x140050ffe
test rcx, rcx
je 0x140051052
mov r8d, 0x14
lea rax, str.actionparameterstr_
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x14005104c
add rdx, 2
sub r8, 1
jne 0x140051030
sub rcx, r10
sar rcx, 1
jmp 0x140051059
add rcx, 2
jmp 0x140050ff5
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x140051187
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x14005107b
mov rdx, rsi
test rsi, rsi
jne 0x14005107b
mov eax, r15d
jmp 0x14005108c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140051082
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000d350
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jge 0x1400510ab
mov eax, 0xffffffff
jmp 0x1400510cd
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x1400510c7
mov eax, 0xffffffff
jmp 0x1400510cd
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x48]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051145
cmp dword [rbx + 0x10], 0
jl 0x140051136
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051136
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005112b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140051145
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x278]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051168
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.14000bf30
mov rdi, qword [rbp + 0x5f8]
mov rbx, qword [rbp + 0x5f0]
mov rsi, qword [rbp + 0x5e0]
lea r10, [rbp + 0x5e0]
cmp rdi, 8
cmovae r10, rsi
cmp rbx, 0x10
jb 0x140051202
lea r11, [rbx - 0xf]
lea r11, [r10 + r11*2]
mov rcx, r10
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140051202
cmp word [rcx], 0x6e
je 0x1400511cb
add rcx, 2
sub rax, 1
jmp 0x1400511b9
test rcx, rcx
je 0x140051202
mov r8d, 0x10
mov rdx, r13
mov r9, rcx
sub r9, r13
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x1400511fc
add rdx, 2
sub r8, 1
jne 0x1400511e0
sub rcx, r10
sar rcx, 1
jmp 0x140051209
add rcx, 2
jmp 0x1400511b0
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x14005131c
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x14005122b
mov rdx, rsi
test rsi, rsi
jne 0x14005122b
mov eax, r15d
jmp 0x14005123c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140051232
mov r8d, eax
lea rcx, [rbp - 0x78]
call fcn.14000d350
mov rbx, qword [rbp - 0x78]
cmp dword [rbx - 0x10], 0
jge 0x140051259
mov eax, 0xffffffff
jmp 0x14005127b
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140051275
mov eax, 0xffffffff
jmp 0x14005127b
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x78]
call fcn.14000bd70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400512f0
cmp dword [rbx + 0x10], 0
jl 0x1400512e2
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400512e2
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400512d8
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x78], rax
jmp 0x1400512f0
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x280]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051313
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp - 0x78]
call fcn.14000bf30
mov r8, qword [rbp + 0x108]
mov edx, 0x3e8
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
jne 0x140050c51
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x1400513cc
mov rdx, qword [rsp + 0x78]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x40]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400513cc
cmp dword [rdi + 0x10], 0
jl 0x1400513be
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400513be
call fcn.14000d260
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400513ae
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1400513cc
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000d350
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x58]
call fcn.14000b940
test al, al
je 0x140051448
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140051448
cmp dword [rdi + 0x10], 0
jl 0x14005143a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14005143a
call fcn.14000d260
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14005142a
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x48]
jmp 0x140051448
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.14000d350
lea rax, [rbp + 0x238]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x60], rax
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x238], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054518
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rdx, str.actionString
lea rcx, [rbp + 0x20]
call fcn.14000ce70
test al, al
jne 0x1400514b9
lea rdx, str.actionString
lea rcx, [rbp + 0x20]
call fcn.14000c670
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x20]
call fcn.14005c860
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x48]
call fcn.14000b940
test al, al
je 0x140051546
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140051546
cmp dword [rdi + 0x10], 0
jl 0x140051533
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140051533
call fcn.14000d260
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140051528
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x140051546
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000d350
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x240]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x60], rax
lea rdi, [rbx - 0x18]
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x240], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054523
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
lea rdx, str.actionParameterString
lea rcx, [rbp + 0x28]
call fcn.14000ce70
test al, al
jne 0x1400515b5
lea rdx, str.actionParameterString
lea rcx, [rbp + 0x28]
call fcn.14000c670
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x28]
call fcn.14005c860
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x78]
call fcn.14000b940
test al, al
mov rax, qword [rsp + 0x60]
je 0x14005164b
lea rcx, [rax - 0x18]
mov rsi, qword [rbp - 0x78]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x14005164b
cmp dword [rsi + 0x10], 0
jl 0x140051636
mov rdx, qword [rsi]
cmp qword [rcx], rdx
jne 0x140051636
call fcn.14000d260
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140051627
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x78], rax
mov rbx, qword [rsp + 0x48]
jmp 0x140051646
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000d350
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14005452e
mov rcx, qword [rbp - 0x78]
sub rax, rcx
nop dword [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x140051675
add rcx, 2
test edx, edx
jne 0x140051660
test r8d, r8d
jne 0x1400540f7
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054539
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x140099090]
lea rcx, [rsp + 0x38]
call fcn.14000ce70
test al, al
jne 0x1400516c5
lea rdx, [0x140099090]
lea rcx, [rsp + 0x38]
call fcn.14000c670
nop
lea rdx, str.Start_Restart_Service
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x14005177e
lea rax, [rbp + 0x248]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x248], rax
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x288]
call fcn.1400021f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051772
cmp dword [rbx + 0x10], 0
jl 0x140051763
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051763
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051758
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051772
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x288]
jmp 0x140053aca
lea rdx, str.Stop_Service
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051837
lea rax, [rbp + 0x118]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x290]
call fcn.1400024b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005182b
cmp dword [rbx + 0x10], 0
jl 0x14005181c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005181c
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051811
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005182b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x290]
jmp 0x140053aca
lea rdx, str.Force_Close_Application
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x1400518f3
lea rax, [rbp + 0x120]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x120], rax
xor r8d, r8d
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x298]
call fcn.140007740
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400518e7
cmp dword [rbx + 0x10], 0
jl 0x1400518d8
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400518d8
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400518cd
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400518e7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x298]
jmp 0x140053aca
lea rdx, str.Force_Close_Application_and_Child_Processes
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x1400519af
lea rax, [rbp + 0x128]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x128], rax
mov r8b, 1
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x2a0]
call fcn.140007740
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400519a3
cmp dword [rbx + 0x10], 0
jl 0x140051994
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051994
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051989
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400519a3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2a0]
jmp 0x140053aca
lea rdx, str.Install_Application
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051a93
lea rax, [rbp + 0x130]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x138]
mov qword [rbp - 0x60], rax
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x130], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x138], rax
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x2a8]
call fcn.140007a20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051a87
cmp dword [rbx + 0x10], 0
jl 0x140051a78
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051a78
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051a6d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051a87
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2a8]
jmp 0x140053aca
lea rdx, str.Uninstall_Application
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051b4c
lea rax, [rbp + 0x140]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x2b0]
call fcn.140008810
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051b40
cmp dword [rbx + 0x10], 0
jl 0x140051b31
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051b31
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051b26
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051b40
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2b0]
jmp 0x140053aca
lea rdx, str.Delete_Specific_File_from_folder
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051c76
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
test rax, rax
jne 0x140051b80
lea edi, [rax - 1]
jmp 0x140051b86
sub rdi, rbx
sar rdi, 1
mov r8d, dword [rbx - 0x10]
sub r8d, edi
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x48]
call fcn.14000bd70
nop
mov r8d, edi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.14000bcd0
nop
mov rcx, qword [rbp - 0x38]
cmp dword [rcx - 0x10], 0
jl 0x140051c28
lea rdx, str._username_
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051c24
mov rcx, qword [rbp - 0x38]
sub rax, rcx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051c28
lea rcx, [rbp + 0x148]
call fcn.140063f10
nop
mov r8, qword [rbp + 0x148]
lea rdx, str._username_
lea rcx, [rbp - 0x38]
call fcn.14000c1a0
nop
mov rdx, qword [rbp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051c24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp + 0x150]
call fcn.14005f4e0
mov r8d, eax
lea rdx, [0x14009a148]
lea rcx, [rsp + 0x38]
call fcn.14000d580
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051c6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x150]
jmp 0x140053aca
lea rdx, str.Rename_Folder
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051d2f
lea rax, [rbp + 0x158]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x2b8]
call fcn.140001cf0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051d23
cmp dword [rbx + 0x10], 0
jl 0x140051d14
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051d14
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051d09
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051d23
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2b8]
jmp 0x140053aca
lea rdx, str.Rename_File
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051de8
lea rax, [rbp + 0x160]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x2c0]
call fcn.140001820
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051ddc
cmp dword [rbx + 0x10], 0
jl 0x140051dcd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051dcd
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051dc2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051ddc
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2c0]
jmp 0x140053aca
lea rdx, str.Delete_File
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140051f16
cmp dword [rbx - 0x10], 0
jl 0x140051e75
lea rdx, str._username_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051e75
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051e75
lea rcx, [rbp + 0x168]
call fcn.140063f10
nop
mov r8, qword [rbp + 0x168]
lea rdx, str._username_
lea rcx, [rsp + 0x48]
call fcn.14000c1a0
nop
mov rdx, qword [rbp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051e70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x2c8]
call fcn.140001330
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051f0a
cmp dword [rbx + 0x10], 0
jl 0x140051efb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051efb
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051ef0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051f0a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2c8]
jmp 0x140053aca
lea rdx, str.Delete_Folder
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140052044
cmp dword [rbx - 0x10], 0
jl 0x140051fa3
lea rdx, str._username_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051fa3
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051fa3
lea rcx, [rbp + 0x178]
call fcn.140063f10
nop
mov r8, qword [rbp + 0x178]
lea rdx, str._username_
lea rcx, [rsp + 0x48]
call fcn.14000c1a0
nop
mov rdx, qword [rbp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051f9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x180]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x2d0]
call fcn.1400015d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052038
cmp dword [rbx + 0x10], 0
jl 0x140052029
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052029
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005201e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140052038
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2d0]
jmp 0x140053aca
lea rdx, str.Add_new_Registry_Key
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Add_new_Registry_String_value
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Add_new_Registry_Binary_value
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Delete_Registry_Subkey
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Delete_Registry_Entry_in_a_Subkey
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Custom_Registry_Command
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Release_the_IPv4_Address_of_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Releases_the_IPv4_Address_for_a_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Get_a_New_IPv4_Address_for_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Get_a_New_IPv4_Address_for_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Release_the_IPv6_Address_of_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Releases_the_IPv6_Address_for_a_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Get_a_New_IPv6_Address_for_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Get_a_New_IPv6_Address_for_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Flush_DNS_Cache
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Registering_DNS_Records
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x140053a2c
lea rdx, str.Add_new_Registry_DWORD_value
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x14005235f
cmp dword [rbx - 0x10], 0
jl 0x140052261
lea rdx, str._officeversion_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052261
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140052261
lea rcx, [rbp + 0x188]
call fcn.140060580
nop
mov r8, qword [rbp + 0x188]
lea rdx, str._officeversion_
lea rcx, [rsp + 0x48]
call fcn.14000c1a0
nop
mov rdx, qword [rbp + 0x188]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005225c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x190]
mov qword [rbp - 0x60], rax
mov rcx, qword [rbp + 0x30]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x190], rax
mov r8d, 1
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2d8]
call fcn.140002820
mov rbx, rax
or dword [rsp + 0x30], 0x4000
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400522eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbx]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005234b
cmp dword [rbx + 0x10], 0
jl 0x14005233d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005233d
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052332
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005234b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
and dword [rsp + 0x30], 0xffffbfff
mov rdx, qword [rbp + 0x2d8]
jmp 0x140053aca
lea rdx, str.Office_Repair_ClickToRun_
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140052c96
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054544
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x58]
call fcn.14000ce70
test al, al
jne 0x1400523bc
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x58]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005454f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov edx, 0x5c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
jne 0x1400523f7
mov eax, 0xffffffff
jmp 0x1400523ff
sub rax, qword [rsp + 0x58]
sar rax, 1
mov r8d, eax
lea rdx, [rbp + 0x2e0]
lea rcx, [rsp + 0x58]
call fcn.14000bcd0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052472
cmp dword [rbx + 0x10], 0
jl 0x140052464
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052464
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005245a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140052472
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2e0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052495
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x140099d78]
lea rcx, [rbp - 0x58]
call fcn.14000c4d0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xc0]
call fcn.14000bc20
nop
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jl 0x140052bf5
lea rdx, str..ps1
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052802
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140052802
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005455a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x40]
call fcn.14000ce70
test al, al
jne 0x140052535
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x40]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054565
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x98], rax
lea rdx, str.powershell__ExecutionPolicy_ByPass__File__
lea rcx, [rbp + 0x98]
call fcn.14000ce70
test al, al
jne 0x140052582
lea rdx, str.powershell__ExecutionPolicy_ByPass__File__
lea rcx, [rbp + 0x98]
call fcn.14000c670
nop
mov rbx, qword [rbp + 0x98]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400525a3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400525b4
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140054570
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x11
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xc0]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.14000d050
nop
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140052612
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052623
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005457b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd8], rax
bts edi, 0x12
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x40]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.14000d050
mov rdx, qword [rbp + 0xd8]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400526ca
cmp dword [rbx + 0x10], 0
jl 0x1400526bd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400526bd
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400526af
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x68], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400526ca
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.14000d350
btr edi, 0x12
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400526f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfffdffff
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005271e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14005273a
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005275a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x198]
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x198], rax
mov r8b, 1
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x2e8]
call fcn.14005e5d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400527f6
cmp dword [rbx + 0x10], 0
jl 0x1400527e7
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400527e7
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400527dc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400527f6
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2e8]
jmp 0x140052bd7
cmp dword [rbx - 0x10], 0
jl 0x140052bf5
lea rdx, str..bat
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052bf5
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140052bf5
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054586
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x50]
call fcn.14000ce70
test al, al
jne 0x140052877
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x50]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054591
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa8], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xa8]
call fcn.14000ce70
test al, al
jne 0x1400528c4
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xa8]
call fcn.14000c670
nop
mov rbx, qword [rbp + 0xa8]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400528e5
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400528f6
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005459c
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x13
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xc0]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.14000d050
nop
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140052954
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052965
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400545a7
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb0], rax
bts edi, 0x14
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x50]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x48]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000d050
mov rdx, qword [rbp + 0xb0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052a0c
cmp dword [rbx + 0x10], 0
jl 0x1400529ff
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400529ff
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400529f1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x68], rax
mov edi, dword [rsp + 0x30]
jmp 0x140052a0c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.14000d350
btr edi, 0x14
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfff7ffff
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140052a7c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x68]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140052ac3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052ad4
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400545b2
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb8], rax
or dword [rsp + 0x30], 0x200000
mov ecx, 0x22
mov word [rbp - 0x48], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb8]
call fcn.14000d050
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x2f0]
call fcn.14005aa40
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x2f8]
call fcn.14005e5d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052ba5
cmp dword [rbx + 0x10], 0
jl 0x140052b96
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052b96
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052b8b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140052ba5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x2f8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052bc8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xffdfffff
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052c48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140052c48
lea rax, [rbp + 0x300]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x308]
mov qword [rbp - 0x60], rax
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x300]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.Incorrect_extension
lea rcx, [rbp + 0x308]
call fcn.14000c8e0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052c6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052c8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
jmp 0x140053aca
lea rdx, str.Run_VB_Script
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x1400530ce
lea rdx, str.Run_BAT_File
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
jne 0x1400530ce
lea rdx, str.Run_PowerShell_Script
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140052f92
lea rax, [rbp + 0x310]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x318]
mov qword [rbp - 0x60], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x310]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.Run_Powershell_Script_started
lea rcx, [rbp + 0x318]
call fcn.14000c8e0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400545bd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x30]
call fcn.14000ce70
test al, al
jne 0x140052d77
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x30]
call fcn.14000c670
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
lea rcx, [rax + 0x18]
mov qword [rbp + 0x348], rcx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x18]
call fcn.140006910
nop
mov rax, qword [rbp - 0x18]
movzx ecx, word [rax]
cmp cx, word [0x14009a114]
jne 0x140052e2c
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x140052e2c
cmp dword [rbx + 0x10], 0
jl 0x140052e1f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052e1f
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052e15
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x18], rax
jmp 0x140052e2c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x18]
call fcn.14000d350
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1b0]
call fcn.14000bc20
nop
xor r8d, r8d
lea rdx, str..ps1
lea rcx, [rsp + 0x48]
call fcn.14000c150
test eax, eax
js 0x140052f4e
lea rdx, str.powershell__ExecutionPolicy_ByPass__File
lea rcx, [rbp + 0x1a8]
call fcn.14000c8e0
nop
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x320]
call fcn.14000bc20
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000d1a0
nop
lea rcx, [rbp + 0x320]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1a8]
call fcn.14000d230
lea rax, [rbp + 0x328]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x330]
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x328]
call fcn.14000c9f0
mov rbx, rax
lea rdx, str.Run_Powershell_Script__:
lea rcx, [rbp + 0x330]
call fcn.14000c8e0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
lea rax, [rbp + 0x338]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x338]
call fcn.14000c9f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x340]
call fcn.14005e5d0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d1a0
nop
lea rcx, [rbp + 0x340]
call fcn.14000d230
jmp 0x140052f60
lea rdx, str.Incorrect_extension.
lea rcx, [rsp + 0x38]
call fcn.14000c670
nop
lea rcx, [rbp + 0x1b0]
call fcn.14000d230
nop
lea rcx, [rbp - 0x18]
call fcn.14000d230
nop
lea rcx, [rbp + 0x348]
call fcn.14000d230
nop
lea rcx, [rbp - 0x30]
call fcn.14000d230
jmp 0x140053ae6
lea rdx, str.Run_Powershell_Command
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140052ffa
lea rax, [rbp + 0x350]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x350]
call fcn.14000c9f0
nop
mov r8d, 2
mov rdx, rax
lea rcx, [rbp + 0x358]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d1a0
nop
lea rcx, [rbp + 0x358]
call fcn.14000d230
jmp 0x140053ae6
lea rdx, str.Run_Command_Line_Script
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140053062
lea rax, [rbp + 0x360]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x360]
call fcn.14000c9f0
nop
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x368]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d1a0
nop
lea rcx, [rbp + 0x368]
call fcn.14000d230
jmp 0x140053ae6
lea rdx, str.Run_WMIC_Command
lea rcx, [rsp + 0x40]
call fcn.14000b940
test al, al
je 0x140053ae6
lea rax, [rbp + 0x370]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x370]
call fcn.14000c9f0
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rbp + 0x378]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d1a0
nop
lea rcx, [rbp + 0x378]
call fcn.14000d230
jmp 0x140053ae6
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400545c8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x70]
call fcn.14000ce70
test al, al
jne 0x140053112
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x70]
call fcn.14000c670
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d260
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x1b8]
mov qword [rsp + 0x50], rcx
lea r14, [rax - 0x18]
mov rcx, r14
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp - 0x10]
call fcn.140006910
nop
mov rax, qword [rbp - 0x10]
movzx ecx, word [rax]
cmp cx, word [0x14009a114]
jne 0x1400531cc
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
lea rdi, [rax - 0x18]
cmp rcx, rdi
je 0x1400531cc
cmp dword [rdi + 0x10], 0
jl 0x1400531bf
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400531bf
call fcn.14000d260
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400531b0
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x10], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1400531cc
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14000d350
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf8]
call fcn.14000bc20
nop
cmp dword [rbx - 0x10], 0
jl 0x1400539af
lea rdx, str..vbs
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400535bc
sub rax, rbx
sar rax, 1
test eax, eax
js 0x1400535bc
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400545d3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x60]
call fcn.14000ce70
test al, al
jne 0x140053257
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x60]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400545de
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xc8], rax
lea rdx, str.CScript___NOLOGO__
lea rcx, [rbp + 0xc8]
call fcn.14000ce70
test al, al
jne 0x1400532a4
lea rdx, str.CScript___NOLOGO__
lea rcx, [rbp + 0xc8]
call fcn.14000c670
nop
mov rbx, qword [rbp + 0xc8]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400532c5
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400532d6
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400545e9
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x18
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xf8]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.14000d050
nop
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140053334
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140053345
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400545f4
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd0], rax
bts edi, 0x19
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x60]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xd0]
call fcn.14000d050
mov rdx, qword [rbp + 0xd0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400533ec
cmp dword [rbx + 0x10], 0
jl 0x1400533df
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400533df
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400533d1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x70], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400533ec
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d350
btr edi, 0x19
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053417
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfeffffff
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053440
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14005345c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005347c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x380]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400534a3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400534b4
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400545ff
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x110], rax
or dword [rsp + 0x30], 0x4000000
mov ecx, 0x22
mov word [rbp - 0x50], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x110]
call fcn.14000d050
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x380]
call fcn.14005aa40
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x388]
call fcn.14005e5d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140053585
cmp dword [rbx + 0x10], 0
jl 0x140053576
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140053576
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005356b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140053585
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x388]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400535a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfbffffff
mov rdx, qword [rbp + 0x110]
jmp 0x140053991
cmp dword [rbx - 0x10], 0
jl 0x1400539af
lea rdx, str..bat
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400539af
sub rax, rbx
sar rax, 1
test eax, eax
js 0x1400539af
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005460a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x70]
call fcn.14000ce70
test al, al
jne 0x140053631
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x70]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140054615
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe0], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xe0]
call fcn.14000ce70
test al, al
jne 0x14005367e
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xe0]
call fcn.14000c670
nop
mov rbx, qword [rbp + 0xe0]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005369f
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400536b0
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140054620
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x1c
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xf8]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.14000d050
nop
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14005370e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14005371f
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005462b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe8], rax
bts edi, 0x1d
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x70]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x68]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xe8]
call fcn.14000d050
mov rdx, qword [rbp + 0xe8]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400537c6
cmp dword [rbx + 0x10], 0
jl 0x1400537b9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400537b9
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400537ab
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x70], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400537c6
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d350
btr edi, 0x1d
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400537f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xefffffff
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005381a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140053836
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053856
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x390]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14005387d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14005388e
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005420b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf0], rax
or dword [rsp + 0x30], 0x40000000
mov ecx, 0x22
mov word [rbp - 0x4c], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0xf0]
call fcn.14000d050
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x390]
call fcn.14005aa40
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x398]
call fcn.14005e5d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005395f
cmp dword [rbx + 0x10], 0
jl 0x140053950
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140053950
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140053945
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005395f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x398]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053982
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xbfffffff
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400539c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400539c1
lea rdx, str.Incorrect_extension.
lea rcx, [rsp + 0x38]
call fcn.14000c670
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400539e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053a06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140053a23
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
jmp 0x140053aca
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d260
add rax, 0x18
mov qword [rbp + 0x1c0], rax
mov r8b, 1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x3a0]
call fcn.14005e5d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140053ac3
cmp dword [rbx + 0x10], 0
jl 0x140053ab4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140053ab4
call fcn.14000d260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140053aa9
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140053ac3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d350
nop
mov rdx, qword [rbp + 0x3a0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053ae6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a114]
lea rcx, [rsp + 0x38]
call fcn.14000ba40
test al, al
je 0x140053cb7
lea rax, [rbp + 0x3a8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x1d0]
call fcn.14000c8e0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1c8]
call fcn.14000c8e0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x3a8]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x3c0]
call fcn.14000bc20
nop
lea r8, [rbp + 0x1d0]
mov rdx, rax
lea rcx, [rbp + 0x3b8]
call fcn.14000bc20
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14000bc20
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cf00
nop
lea rcx, [rbp + 0x3b8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x3c0]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1c8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1d0]
call fcn.14000d230
lea rax, [rbp + 0x3c8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x1e0]
call fcn.14000c8e0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1d8]
call fcn.14000c8e0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x3c8]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x3e0]
call fcn.14000bc20
nop
lea r8, [rbp + 0x1e0]
mov rdx, rax
lea rcx, [rbp + 0x3d8]
call fcn.14000bc20
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.14000bc20
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
nop
lea rcx, [rbp + 0x3d8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x3e0]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1d8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1e0]
jmp 0x1400540e7
lea rdx, [0x1400a521c]
lea rcx, [rsp + 0x38]
call fcn.14000ba40
test al, al
je 0x140053e66
lea rax, [rbp + 0x3e8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x50], rax
lea rdx, str._Is_Not_Availabe_For_Administrator_Right.
lea rcx, [rbp + 0x1f0]
call fcn.14000c8e0
nop
lea rdx, str.Action_String_
lea rcx, [rbp + 0x1e8]
call fcn.14000c8e0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x3e8]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x3f8]
call fcn.14000bc20
nop
lea r8, [rbp + 0x1f0]
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.14000bc20
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cf00
nop
lea rcx, [rbp + 0x3f8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1e8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1f0]
call fcn.14000d230
lea rax, [rbp + 0x400]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x408]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x200]
call fcn.14000c8e0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1f8]
call fcn.14000c8e0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x400]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x418]
call fcn.14000bc20
nop
lea r8, [rbp + 0x200]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.14000bc20
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.14000bc20
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
nop
lea rcx, [rbp + 0x410]
call fcn.14000d230
nop
lea rcx, [rbp + 0x418]
call fcn.14000d230
nop
lea rcx, [rbp + 0x1f8]
call fcn.14000d230
nop
lea rcx, [rbp + 0x200]
jmp 0x1400540e7
lea rax, [rbp + 0x420]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x428]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x218]
call fcn.14000c8e0
nop
lea rdx, str._nAction_String:
lea rcx, [rbp + 0x210]
call fcn.14000c8e0
nop
lea rdx, str.Result:
lea rcx, [rbp + 0x208]
call fcn.14000c8e0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x420]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x448]
call fcn.14000bc20
nop
lea r8, [rbp + 0x210]
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.14000bc20
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x438]
call fcn.14000bc20
nop
lea r8, [rbp + 0x218]
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.14000bc20
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x428]
call fcn.14000bc20
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
nop
lea rcx, [rbp + 0x430]
call fcn.14000d230
nop
lea rcx, [rbp + 0x438]
call fcn.14000d230
nop
lea rcx, [rbp + 0x440]
call fcn.14000d230
nop
lea rcx, [rbp + 0x448]
call fcn.14000d230
nop
lea rcx, [rbp + 0x208]
call fcn.14000d230
nop
lea rcx, [rbp + 0x210]
call fcn.14000d230
nop
lea rcx, [rbp + 0x218]
call fcn.14000d230
lea rax, [rbp + 0x450]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x458]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x230]
call fcn.14000c8e0
nop
lea rdx, str._nAction_String:
lea rcx, [rbp + 0x228]
call fcn.14000c8e0
nop
lea rdx, str.Result:
lea rcx, [rbp + 0x220]
call fcn.14000c8e0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x450]
call fcn.14000c8e0
mov rbx, rax
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x478]
call fcn.14000bc20
nop
lea r8, [rbp + 0x228]
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.14000bc20
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x468]
call fcn.14000bc20
nop
lea r8, [rbp + 0x230]
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.14000bc20
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x458]
call fcn.14000bc20
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cf00
nop
lea rcx, [rbp + 0x460]
call fcn.14000d230
nop
lea rcx, [rbp + 0x468]
call fcn.14000d230
nop
lea rcx, [rbp + 0x470]
call fcn.14000d230
nop
lea rcx, [rbp + 0x478]
call fcn.14000d230
nop
lea rcx, [rbp + 0x220]
call fcn.14000d230
nop
lea rcx, [rbp + 0x228]
call fcn.14000d230
nop
lea rcx, [rbp + 0x230]
call fcn.14000d230
nop
lea rcx, [rsp + 0x38]
call fcn.14000d230
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp - 0x28]
call fcn.14000d230
nop
lea rcx, [rbp - 0x78]
call fcn.14000d230
nop
lea rcx, [rsp + 0x48]
call fcn.14000d230
nop
lea rcx, [rsp + 0x40]
call fcn.14000d230
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000e660
nop
lea rcx, [rbp + 0x600]
call fcn.14000e660
nop
lea rcx, [rbp + 0x620]
call fcn.14000e660
nop
lea rcx, [rbp - 0x40]
call fcn.14000d230
nop
lea rcx, [rbp + 0x640]
call fcn.14000e660
nop
lea rcx, [rbp + 0x4b0]
call fcn.140006aa0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000ac20
nop
lea rcx, [rsp + 0x70]
call fcn.14000d230
nop
lea rcx, [rsp + 0x78]
call fcn.14000d230
nop
lea rcx, [rsp + 0x68]
call fcn.14000d230
nop
lea rcx, [rsp + 0x60]
call fcn.14000d230
nop
lea rcx, [rbp - 0x80]
call fcn.14000d230
nop
lea rcx, [rsp + 0x58]
call fcn.14000d230
nop
lea rcx, [rbp + 0x78]
call fcn.14000d230
nop
lea rcx, [rbp + 0x480]
call fcn.14000d230
mov rcx, qword [rbp + 0xe30]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0xf40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x140054294
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x1400542ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x140054344
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x14005439c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x1400543f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x14005444c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
int3
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
int3