Function at 0x140140080
Capabilities:
Compress data via winapi
Get common file path
Log keystrokes via polling
Print debug messages
Switch active desktop

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0xe80]
sub rsp, 0xf80
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0xe40], rax
mov rbx, r8
call fcn.14014a950
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, r15d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.1402c1eb4
call fcn.1400ebca0
cmp eax, 5
je 0x140142555
cmp eax, 0xc
je 0x140142555
mov qword [rsp + 0xfa0], rsi
mov qword [rsp + 0xfa8], rdi
xor esi, esi
mov qword [rsp + 0xfb8], r12
mov qword [rsp + 0xf70], r14
mov qword [rbp + 0x68], rsi
call fcn.140114bf0
mov qword [rbp - 0x30], rsi
mov qword [rbp + 0xc8], rsi
xorps xmm0, xmm0
movzx r14d, al
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x100], rax
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov dword [rbp + 0x120], esi
mov qword [rbp + 0x108], rax
or rax, 0xffffffffffffffff
lea r12, [0x14034d1a0]
test rbx, rbx
jne 0x14014016a
mov edi, esi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], r12
jmp 0x1401401ae
mov rdi, rax
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140140170
mov qword [rsp + 0x78], rsi
test edi, edi
jne 0x140140189
mov qword [rsp + 0x70], r12
jmp 0x1401401ae
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1402028a0
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402c06dc
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.140203bb0
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.140116230
cmp dword [rsp + 0x78], esi
jle 0x1401401db
mov rcx, qword [rsp + 0x70]
call fcn.1402bd0e0
lea rbx, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
test r14b, r14b
je 0x1401402ca
mov ecx, 0x18
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x140140211
mov qword [rax], rbx
lea rax, [rbp + 0x100]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 8], rax
jmp 0x140140214
mov rdi, rsi
mov rbx, rsi
test rdi, rdi
je 0x140140238
mov ecx, 4
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x140140232
mov dword [rax], esi
jmp 0x140140235
mov rbx, rsi
mov dword [rbx], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
je 0x1401402a7
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, str._crusader
xor r8d, r8d
mov rcx, rax
mov r14, rax
call fcn.140205020
test al, al
jne 0x1401402a7
lea rdx, str._kickstart
xor r8d, r8d
mov rcx, r14
call fcn.140202b80
test al, al
je 0x14014029b
call fcn.140114cf0
test al, al
jne 0x1401402a7
call fcn.140114dc0
test al, al
jne 0x1401402a7
call fcn.14013fb40
test al, al
jne 0x1401403f3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
jne 0x140140244
test rbx, rbx
je 0x1401402ca
mov eax, dword [rbx]
test eax, eax
jle 0x1401402b6
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x1401402ca
mov rcx, rdi
call fcn.14021ae20
mov rcx, rbx
call fcn.14021ae20
mov qword [rsp + 0xf78], r13
call fcn.14013f630
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, esi
lea rdi, [0x14041f388]
mov r14, rax
mov edx, dword [rdi - 8]
mov rcx, r14
call fcn.140149cc0
mov rcx, qword [rdi]
inc ebx
mov qword [rcx], rax
movsxd rcx, ebx
lea rdi, [rdi + 0x10]
cmp rcx, 0xa
jb 0x1401402f0
mov rcx, r14
call fcn.140149ef0
lea rcx, [0x140430df8]
mov dword [0x140430c58], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea rdi, [0x140430d90]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140140364
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140430d88], rax
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [0x14041eee8]
xor r14b, r14b
shr eax, 0xf
mov byte [rsp + 0x41], sil
mov byte [rsp + 0x40], sil
and al, r15b
mov byte [rsp + 0x45], r15b
mov byte [rsp + 0x4f], sil
mov byte [rsp + 0x43], sil
mov byte [rsp + 0x4e], sil
mov byte [rsp + 0x49], sil
mov dword [rbp - 0x80], eax
mov byte [rsp + 0x50], sil
mov byte [rsp + 0x4b], sil
mov byte [rsp + 0x4d], sil
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x4a], r15b
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x42], r15b
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x47], sil
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], esi
mov r13d, esi
test rbx, rbx
jne 0x140140423
mov edi, esi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], r12
jmp 0x140140460
test rbx, rbx
je 0x140142525
mov eax, dword [rbx]
test eax, eax
jle 0x140140406
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x140142525
mov rcx, rdi
call fcn.14021ae20
mov rcx, rbx
call fcn.14021ae20
jmp 0x140142525
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140140427
mov qword [rbp - 0x48], rsi
test edi, edi
jne 0x14014043e
mov qword [rbp - 0x50], r12
jmp 0x140140460
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1402028a0
mov eax, dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402c06dc
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.140203bb0
mov rbx, qword [0x14041eee8]
test rbx, rbx
jne 0x140140483
mov edi, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
jmp 0x1401404c0
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140140487
mov qword [rbp - 0x20], rsi
test edi, edi
jne 0x14014049e
mov qword [rbp - 0x28], r12
jmp 0x1401404c0
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.1402028a0
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402c06dc
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.140203bb0
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
call fcn.14000a340
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x38], rax
call fcn.14000a340
mov ecx, 0x18
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x90], rsi
call fcn.1402bcb4c
mov r12, rax
test rax, rax
je 0x140140539
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [r12 + 0x10], rsi
mov qword [r12], rax
lea rax, [rbp + 0x100]
mov qword [r12 + 8], rax
jmp 0x14014053c
mov r12, rsi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0xe8], rax
test r12, r12
je 0x14014057d
mov ecx, 4
call fcn.1402bcb4c
test rax, rax
je 0x140140570
mov dword [rax], esi
jmp 0x140140573
mov rax, rsi
mov qword [rbp + 0xf8], rax
mov dword [rax], r15d
mov rax, qword [r12]
mov rcx, r12
movaps xmmword [rsp + 0xf60], xmm6
movaps xmmword [rsp + 0xf50], xmm7
call qword [rax]
test al, al
je 0x1401413b9
movsd xmm7, qword [0x1403793a8]
mov rax, qword [r12]
mov rcx, r12
mov edi, 2
call qword [rax + 0x10]
lea rdx, str._kickstart
mov r8d, r15d
mov rcx, rax
mov rbx, rax
call fcn.140202b80
test al, al
je 0x1401406f2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x10000000
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rcx, rax
mov qword [rbp + 0xc8], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, 0xe0
call fcn.1402bcb4c
mov rbx, rax
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140140641
mov rcx, rax
call fcn.14020b3e0
lea rax, vtable.HitmanPro35::UI::KickstartDesktop.0
mov qword [rcx + 0xc0], rsi
mov qword [rcx], rax
mov qword [rcx + 0xc8], rsi
call fcn.140135620
jmp 0x140140645
mov qword [rbp + 0x68], rsi
lea rcx, [0x140358890]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov rcx, rax
mov qword [0x140430d50], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov qword [rsp + 0x30], rsi
lea rcx, str..hmpkick
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401406e0
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x22e260
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140430d50]
call qword [sym.imp.USER32.dll_SwitchDesktop]
jmp 0x1401413a8
lea rdx, str._debug
mov r8d, r15d
mov rcx, rbx
call fcn.140205020
mov r8d, r15d
mov rcx, rbx
test al, al
je 0x140140750
lea rdx, str.:full
call fcn.140202750
mov ecx, dword [0x140430c44]
test al, al
cmovne ecx, edi
mov dword [0x140430c44], ecx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x14013f360]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp 0x1401413a8
lea rdx, str._console
call fcn.140202b80
test al, al
je 0x1401407a1
test r14b, r14b
jne 0x1401413a8
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x1401413a8
call fcn.1402be390
lea r8, [0x140359550]
lea rdx, [0x140359570]
lea r9, [rax + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1402c1e5c
movzx r14d, r15b
jmp 0x1401413a8
lea rdx, str._crusader
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x14014223e
lea rdx, str._crusader:boot
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x140142212
lea rdx, [0x140359970]
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x1401421d2
lea rdx, str._installservice
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x1401421c1
lea rdx, str._uninstallservice
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x1401421b2
lea rdx, str._listen
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x14014215e
lea rdx, [0x140355008]
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x140142148
lea rdx, str._deactivate
mov r8d, r15d
mov rcx, rbx
call fcn.140202b80
test al, al
jne 0x140142131
lea rdx, str._update:
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
jne 0x1401420b4
lea rdx, str._updated:
call fcn.140205010
mov rcx, rbx
test al, al
je 0x140140926
lea rdx, [rbp + 0xa8]
mov r8d, 9
call fcn.140204810
lea rcx, [rbp + 0xa8]
xor edx, edx
call fcn.140200d70
cmp ax, 0x22
jne 0x140140909
lea rcx, [rbp + 0xa8]
call fcn.140203ba0
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0xa8]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rbp + 0xa8]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x1b8]
call fcn.140005eb0
lea rcx, [rbp + 0xa8]
call fcn.140109ef0
lea rcx, [rbp + 0xa8]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._upgraded:
call fcn.140205010
mov rcx, rbx
test al, al
je 0x1401409c1
lea rdx, [rbp + 0x98]
mov r8d, 0xa
call fcn.140204810
lea rcx, [rbp + 0x98]
xor edx, edx
call fcn.140200d70
cmp ax, 0x22
jne 0x1401409a4
lea rcx, [rbp + 0x98]
call fcn.140203ba0
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x98]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rbp + 0x98]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x1c8]
call fcn.140005eb0
lea rcx, [rbp + 0x98]
call fcn.14010bd40
lea rcx, [rbp + 0x98]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._xtdl
call fcn.140202b70
test al, al
jne 0x1401420aa
lea rdx, str._miniport
mov rcx, rbx
call fcn.140202b70
test al, al
jne 0x140142011
lea rdx, str._rfs
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
jne 0x140141fe6
lea rdx, str._sr
call fcn.140205010
test al, al
jne 0x140141f44
lea rdx, str._lcn
mov rcx, rbx
call fcn.140205010
test al, al
je 0x140140a6f
test r14b, r14b
jne 0x140140a3b
call fcn.14013f240
movzx r14d, al
lea rdx, [rsp + 0x60]
mov r8d, 5
mov rcx, rbx
call fcn.140204810
lea rcx, [rsp + 0x60]
call fcn.140203ba0
lea rcx, [rsp + 0x60]
test eax, eax
jg 0x140141551
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._write
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x140141db2
lea rdx, str._clone
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x140141b4a
lea rdx, str._swap
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x14014198a
lea rdx, str._overwrite
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x140141763
lea rdx, str._protectmbr
mov rcx, rbx
call fcn.140202b70
test al, al
jne 0x140141759
lea rdx, str._lic
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
je 0x140140b27
lea rdx, [rbp + 0x168]
mov r8d, 5
call fcn.140204810
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x168]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._renew
call fcn.140202b70
test al, al
je 0x140140b41
call fcn.140179c90
jmp 0x1401413a8
lea rdx, str._checklic
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x14014162e
lea rdx, str._scan
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140b75
mov byte [rsp + 0x40], r15b
jmp 0x1401413a8
lea rdx, str._scan:boot
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140c92
mov byte [rbp - 0x80], sil
call fcn.140114b00
test al, al
je 0x1401415f9
xor ecx, ecx
mov byte [rsp + 0x40], r15b
call fcn.1400f4570
mov rbx, rax
test rax, rax
je 0x140140c83
lea rcx, [rbp - 0x60]
call fcn.1402007c0
lea r8, [rbp - 0x60]
lea rdx, [0x1403548a0]
mov rcx, rbx
call fcn.1400d9fd0
mov rdi, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rdi]
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rcx, [rbp - 0x60]
call fcn.140203ba0
cmp eax, 0x13
jl 0x140140c71
lea rdx, str.yyyy_MM_dd_HH:mm:ss
lea rcx, [rbp + 0x148]
call fcn.140200840
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x60]
xor r9d, r9d
call fcn.1400ecb60
lea rcx, [rbp + 0x148]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x140140c71
lea rcx, [rbp - 8]
call fcn.1400cafe0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x198]
mov rcx, rax
call fcn.1400cb050
mov rcx, rax
call fcn.1400e5400
lea rcx, [rbp + 0x198]
movaps xmm6, xmm0
call fcn.1400cae80
comisd xmm7, xmm6
ja 0x1401415e2
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
call fcn.140116aa0
call fcn.1401168f0
jmp 0x1401413a8
lea rdx, str._installsophos
mov rcx, rbx
call fcn.140202b70
test al, al
jne 0x140141621
lea rdx, str._uninstallsophos
mov rcx, rbx
call fcn.140202b70
test al, al
jne 0x140141614
lea rdx, str._sophos
mov rcx, rbx
call fcn.140202b70
test al, al
jne 0x14014160a
lea rdx, str._quiet
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140cf4
mov byte [rsp + 0x41], r15b
jmp 0x1401413a8
lea rdx, str._noscan
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140d11
mov byte [rsp + 0x4b], r15b
jmp 0x1401413a8
lea rdx, str._noinstall
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140d2e
mov byte [rsp + 0x43], r15b
jmp 0x1401413a8
lea rdx, str._nostartboot
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140d4b
mov byte [rsp + 0x4e], r15b
jmp 0x1401413a8
lea rdx, str._nodesktopshortcut
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140d68
mov byte [rsp + 0x49], r15b
jmp 0x1401413a8
lea rdx, str._nostartmenushortcut
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140d85
mov byte [rsp + 0x50], r15b
jmp 0x1401413a8
lea rdx, str._noupdate
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140da2
mov byte [rsp + 0x45], sil
jmp 0x1401413a8
lea rdx, str._noupload
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140dbf
mov byte [rsp + 0x48], sil
jmp 0x1401413a8
lea rdx, str._noremnants
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140ddc
mov byte [rsp + 0x4a], sil
jmp 0x1401413a8
lea rdx, str._nocookies
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140df9
mov byte [rsp + 0x4c], sil
jmp 0x1401413a8
lea rdx, str._nopups
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140e16
mov byte [rsp + 0x42], sil
jmp 0x1401413a8
lea rdx, str._pup
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
je 0x140140e9b
lea rdx, [rbp + 0x58]
mov r8d, 5
call fcn.140204810
lea rdx, [0x14035a170]
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.140202b80
test al, al
je 0x140140e68
lea rcx, [rbp + 0x58]
mov dword [rsp + 0x58], 4
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str.ignore
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.140202b80
mov edi, dword [rsp + 0x58]
lea rcx, [rbp + 0x58]
test al, al
mov eax, 8
cmovne edi, eax
mov dword [rsp + 0x58], edi
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._scanonly
call fcn.140202b70
test al, al
je 0x140140ec4
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x41], r15b
mov byte [rsp + 0x43], r15b
mov byte [rsp + 0x44], r15b
jmp 0x1401413a8
lea rdx, str._clean
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140eeb
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x4f], r15b
mov byte [rsp + 0x45], sil
jmp 0x1401413a8
lea rdx, str._ews
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140f08
mov byte [rsp + 0x46], r15b
jmp 0x1401413a8
lea rdx, str._quick
mov rcx, rbx
call fcn.140202b70
test al, al
je 0x140140f25
mov byte [rsp + 0x47], r15b
jmp 0x1401413a8
lea rdx, str._log
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
je 0x14014100b
lea rdx, [rbp + 0x158]
mov r8d, 5
call fcn.140204810
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x158]
call fcn.140005eb0
lea rdx, [0x140355194]
lea rcx, [rbp - 0x50]
call fcn.140205010
test al, al
je 0x140140fc9
lea rdx, [0x140355194]
lea rcx, [rbp - 0x50]
call fcn.140202740
test al, al
je 0x140140fc9
lea rcx, [rbp - 0x50]
call fcn.140203ba0
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x50]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x1d8]
call fcn.140005eb0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x128]
call fcn.1400e4760
test r13d, r13d
jne 0x140140ffa
lea rdx, str..txt
lea rcx, [rbp + 0x128]
xor r8d, r8d
call fcn.140202b80
test al, al
cmovne r13d, edi
lea rcx, [rbp + 0x128]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._logtype
call fcn.140205010
mov rcx, rbx
test al, al
je 0x14014107c
lea rdx, [rbp - 0x18]
mov r8d, 9
call fcn.140204810
lea rdx, [0x14035a200]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.140202b80
test al, al
je 0x140141055
lea rcx, [rbp - 0x18]
mov r13d, edi
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, [0x140352508]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.140202b80
lea rcx, [rbp - 0x18]
test al, al
cmovne r13d, r15d
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._nologs
call fcn.140202b70
test al, al
je 0x140141096
mov byte [rsp + 0x4d], r15b
jmp 0x1401413a8
lea rdx, [0x14035a218]
mov rcx, rbx
call fcn.140205010
test al, al
je 0x1401410b2
mov byte [rbp - 0x80], r15b
jmp 0x1401413a8
lea rdx, str._ecat
mov rcx, rbx
call fcn.140205010
test al, al
jne 0x1401413a8
lea rdx, str._diskmode
mov rcx, rbx
call fcn.140205010
mov rcx, rbx
test al, al
je 0x140141126
lea rdx, [rbp + 0x138]
mov r8d, 0xa
call fcn.140204810
lea rdx, str.compatible
lea rcx, [rbp + 0x138]
xor r8d, r8d
call fcn.140202b80
mov ecx, dword [rsp + 0x54]
test al, al
cmovne ecx, r15d
mov dword [rsp + 0x54], ecx
lea rcx, [rbp + 0x138]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._excludelist
call fcn.140205010
mov rcx, rbx
test al, al
je 0x1401411ca
lea rdx, [rbp + 0x48]
mov r8d, 0xd
call fcn.140204810
lea rdx, [0x140355194]
lea rcx, [rbp + 0x48]
call fcn.140205010
test al, al
je 0x1401411ac
lea rdx, [0x140355194]
lea rcx, [rbp + 0x48]
call fcn.140202740
test al, al
je 0x1401411ac
lea rcx, [rbp + 0x48]
call fcn.140203ba0
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x48]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rbp + 0x48]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x1a8]
call fcn.140005eb0
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
xor r8d, r8d
call fcn.14013f770
lea rcx, [rbp + 0x48]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._filelist
call fcn.140205010
mov rcx, rbx
test al, al
je 0x14014126f
lea rdx, [rbp - 0x78]
mov r8d, 0xa
call fcn.140204810
lea rdx, [0x140355194]
lea rcx, [rbp - 0x78]
call fcn.140205010
test al, al
je 0x140141250
lea rdx, [0x140355194]
lea rcx, [rbp - 0x78]
call fcn.140202740
test al, al
je 0x140141250
lea rcx, [rbp - 0x78]
call fcn.140203ba0
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x78]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rbp - 0x78]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x178]
call fcn.140005eb0
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x78]
movzx r8d, r15b
call fcn.14013f770
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, [0x14035a2a0]
call fcn.140205010
mov rcx, rbx
test al, al
je 0x1401412b4
lea rdx, [rbp + 0x188]
mov r8d, 7
call fcn.140204810
lea rcx, [rbp + 0xb8]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0x188]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, str._proxycred
call fcn.140205010
mov rcx, rbx
test al, al
je 0x1401412f9
lea rdx, [rbp + 0xd8]
mov r8d, 0xb
call fcn.140204810
lea rcx, [rbp + 0x88]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, [0x140352e14]
call fcn.140205010
test al, al
jne 0x1401413a8
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1402053e0
mov rcx, rax
call fcn.140203ba0
lea rcx, [rbp - 0x40]
test eax, eax
sete dil
call fcn.140005eb0
test dil, dil
jne 0x1401413a8
lea rdx, [0x140355194]
mov rcx, rbx
call fcn.140205010
test al, al
je 0x140141395
lea rdx, [0x140355194]
mov rcx, rbx
call fcn.140202740
test al, al
je 0x140141395
mov rcx, rbx
call fcn.140203ba0
lea rdx, [rbp + 0x28]
mov r8d, r15d
lea r9d, [rax - 2]
mov rcx, rbx
call fcn.140204ad0
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x18]
call fcn.1400ea5e0
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x1401413a8
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
mov r8, rbx
call fcn.1400ea5e0
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
test al, al
jne 0x1401405a6
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
jne 0x1401413d2
cmp byte [rbp - 0x80], sil
je 0x1401413d2
call fcn.14013b0f0
call fcn.14010a070
lea rcx, [rbp + 0x210]
call fcn.1400eff00
lea rcx, [rbp + 0x210]
movzx edx, r14b
call fcn.14013f180
mov rdi, qword [rbp + 0x68]
lea rcx, [rbp + 0x210]
mov rdx, rdi
call fcn.14013f190
lea rcx, [rbp + 0x88]
call fcn.140203ba0
test eax, eax
jle 0x140141429
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x210]
call fcn.1400f2a90
lea rcx, [rbp + 0xb8]
call fcn.140203ba0
test eax, eax
jle 0x140141445
lea rcx, [rbp + 0xb8]
call fcn.14013fe90
cmp byte [rsp + 0x45], sil
jne 0x140141458
lea rcx, [rbp + 0x210]
call fcn.14013f170
movzx ebx, byte [rsp + 0x43]
test bl, bl
je 0x140141471
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011f0f0
cmp byte [rsp + 0x4e], sil
je 0x140141488
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011f100
cmp byte [rsp + 0x49], sil
je 0x14014149f
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011f110
cmp byte [rsp + 0x50], sil
je 0x1401414b6
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011f120
movzx r12d, byte [rsp + 0x41]
test r12b, r12b
je 0x1401414cd
lea rcx, [rbp + 0x210]
call fcn.14013f1b0
lea rcx, [rbp - 0x50]
call fcn.140203ba0
test eax, eax
jle 0x1401414ea
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x210]
call fcn.1401017a0
test r13d, r13d
je 0x1401414fe
lea rcx, [rbp + 0x210]
mov edx, r13d
call fcn.14013f230
cmp byte [rsp + 0x4d], sil
je 0x140141511
lea rcx, [rbp + 0x210]
call fcn.14013f220
lea rcx, [rbp - 0x28]
call fcn.140203ba0
test eax, eax
jle 0x140142297
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x210]
call fcn.140102d90
lea rcx, [rbp + 0x210]
cmp eax, 0xffffffff
jne 0x14014227e
call fcn.1400f13d0
mov esi, 7
jmp 0x1401424c5
xor edx, edx
call fcn.140200d70
xor r8d, r8d
movzx ecx, ax
call fcn.140187e60
mov rdi, rax
test rax, rax
je 0x1401415c2
lea rcx, [rsp + 0x60]
call fcn.140130560
lea rcx, str._s_r_n_t
mov rdx, rax
call fcn.1402bf424
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14018b2c0
test al, al
jne 0x1401415a7
lea rcx, str.Could_not_locate_file_r_n
call fcn.1402bd818
jmp 0x1401415b7
mov rdx, qword [rbp - 0x30]
lea rcx, str.LCN_I64u_r_n
call fcn.1402bd818
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x1401424c5
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
jmp 0x1401424c5
lea rcx, str.Need_administrator_rights_r_n
call fcn.1402bd818
jmp 0x1401424c5
call fcn.140173380
jmp 0x1401424c5
call fcn.140173b80
movzx esi, al
jmp 0x1401424c5
call fcn.1401733c0
movzx esi, al
jmp 0x1401424c5
lea rcx, [rbp - 0x60]
call fcn.1402007c0
lea rcx, [rbp + 0x58]
call fcn.1402007c0
lea rcx, [rbp - 0x18]
call fcn.1402007c0
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.14017b1b0
cmp eax, r15d
jne 0x1401416a9
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x14014169b
mov edi, 2
jmp 0x1401416a1
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x1401416a9
neg edi
lea rcx, [rbp - 0x28]
call fcn.140203ba0
test eax, eax
jle 0x14014172e
test edi, edi
jle 0x1401416ce
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
xor r8d, r8d
call fcn.140202ce0
test al, al
jne 0x14014172e
lea rcx, [rbp - 0x28]
call fcn.140179fe0
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.14017b1b0
cmp eax, r15d
jne 0x14014172e
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x140141720
mov edi, 2
jmp 0x140141726
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x14014172e
neg edi
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x58]
call fcn.140005eb0
lea rcx, [rbp - 0x60]
call fcn.140005eb0
mov esi, edi
jmp 0x1401424c5
call fcn.1401bebe0
jmp 0x1401424c5
test r14b, r14b
jne 0x14014176d
call fcn.14013f240
lea rcx, [rsp + 0x70]
call fcn.1402007c0
lea rcx, [rbp - 0x78]
call fcn.1402007c0
lea rcx, [rbp - 8]
call fcn.1400d3e50
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x21]
mov rcx, rbx
call fcn.140204810
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x70]
mov rcx, rax
movzx edx, di
call fcn.1402046f0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14014194c
lea rcx, [rsp + 0x70]
call fcn.140203ba0
test eax, eax
je 0x14014194c
lea rcx, [rbp - 0x78]
call fcn.140203ba0
test eax, eax
je 0x14014194c
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.140200d70
lea rcx, [rsp + 0x70]
xor edx, edx
movzx edi, ax
call fcn.140200d70
cmp ax, di
je 0x140141839
lea rcx, [rbp - 0x78]
call fcn.140130560
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.140130560
lea rcx, str.Files_must_be_on_the_same_drive_r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402bd818
jmp 0x140141958
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x70]
call fcn.14020c740
test al, al
jne 0x140141864
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140359da0]
mov edx, eax
call fcn.1402bd818
jmp 0x140141958
call fcn.140100e80
test rax, rax
jne 0x14014187a
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x140141953
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140200d70
movzx ecx, ax
movzx edi, ax
call fcn.1401bee80
mov r14, rax
test rax, rax
jne 0x1401418ad
lea rcx, str.No_file_system_for_drive__c:_r_n
movzx edx, di
call fcn.1402bf424
jmp 0x140141958
mov rax, qword [rax]
mov rcx, r14
call qword [rax + 0x68]
test al, al
jne 0x1401418ce
lea rcx, str.File_system__c:_does_not_support_overwrite_r_n
movzx edx, di
call fcn.1402bf424
jmp 0x140141958
lea rcx, [rbp - 0x78]
call fcn.140130560
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.140130560
lea rcx, str.Are_you_sure_you_want_to_overwrite__Y_N___r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402bd818
call fcn.1402c1ecc
add eax, 0xffffffa7
test eax, 0xffffffdf
jne 0x140141958
mov rbx, qword [r14]
lea rcx, [rbp - 8]
call fcn.1400d3f30
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d3f40
lea rdx, [rbp - 0x78]
mov r9d, edi
mov rcx, r14
mov r8, rax
call qword [rbx + 0x70]
test al, al
jne 0x14014193e
lea rcx, str.Overwrite_failed__r_n
call fcn.1402bf424
jmp 0x140141958
lea rcx, str.Overwrite_successful_r_n
call fcn.1402bf424
jmp 0x140141958
lea rcx, str.Invalid_arguments_r_n
call fcn.1402bd818
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rbp - 8]
call fcn.1400d3ef0
lea rcx, [rbp - 0x78]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x1401424c5
test r14b, r14b
jne 0x140141994
call fcn.14013f240
lea rcx, [rbp - 0x78]
call fcn.1402007c0
lea rcx, [rsp + 0x60]
call fcn.1402007c0
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x26]
mov rcx, rbx
call fcn.140204810
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x78]
mov rcx, rax
movzx edx, di
call fcn.1402046f0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x140141b15
lea rcx, [rbp - 0x78]
call fcn.140203ba0
test eax, eax
je 0x140141b15
lea rcx, [rsp + 0x60]
call fcn.140203ba0
test eax, eax
je 0x140141b15
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140200d70
lea rcx, [rbp - 0x78]
xor edx, edx
movzx edi, ax
call fcn.140200d70
cmp ax, di
je 0x140141a36
lea rcx, str.Files_must_be_on_the_same_drive_r_n
jmp 0x140141b1c
call fcn.140100e80
mov r14, rax
test rax, rax
jne 0x140141a4f
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x140141b1c
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.140200d70
movzx ecx, ax
call fcn.1401bee80
mov rbx, rax
test rax, rax
jne 0x140141a89
lea rcx, str.Failed_to_open_File_System_r_n
call fcn.1402bd818
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140101300
jmp 0x140141b21
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x38]
test al, al
jne 0x140141a9f
lea rcx, str.File_System_cannot_swap_files_r_n
jmp 0x140141af5
lea rcx, [rsp + 0x60]
call fcn.140130560
lea rcx, [rbp - 0x78]
mov rdi, rax
call fcn.140130560
lea rcx, str.Are_you_sure_you_want_to_swap__y_n__r_n_t_ws_r_n_t_ws_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402bd818
call fcn.1402c1ecc
cmp eax, 0x79
jne 0x140141afa
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x78]
mov rcx, rbx
call qword [rax + 0x40]
lea rcx, str.Successfully_swapped_files_r_n
test al, al
jne 0x140141af5
lea rcx, str.Failed_to_swap_files_r_n
call fcn.1402bd818
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140101300
jmp 0x140141b21
lea rcx, str.Invalid_arguments_r_n
call fcn.1402bd818
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rsp + 0x60]
call fcn.140005eb0
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x1401424c5
test r14b, r14b
jne 0x140141b54
call fcn.14013f240
lea rdx, [rsp + 0x70]
mov r8d, 7
mov rcx, rbx
call fcn.140204810
lea rdx, [0x140355194]
lea rcx, [rsp + 0x70]
call fcn.140205010
test al, al
je 0x140141bb1
lea rcx, [rsp + 0x70]
call fcn.140203ba0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140200d70
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call fcn.1401fa640
mov r13, rax
test rax, rax
je 0x140141d92
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rcx, [rsp + 0x70]
call fcn.140130560
lea rcx, [0x1403520e8]
mov rdx, rax
call fcn.1402bf424
mov rdi, qword [r13]
lea rax, [rsp + 0x46]
lea r9, [rbp + 0x70]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test al, al
jne 0x140141c31
lea rcx, str.Failed_:__n
call fcn.1402bf424
jmp 0x140141d86
mov rdx, qword [rbp - 0x30]
lea rcx, str.Size_:__I64u_bytes_n
call fcn.1402bf424
mov rax, qword [r13]
lea rdx, [rsp + 0x70]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x140141d86
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400e47e0
lea rdx, str..clone
mov rcx, rax
call fcn.140200ef0
lea rcx, [rbp + 0x28]
mov rdx, rax
call fcn.1402007e0
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rbp + 0xd8]
call fcn.14020e9b0
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x18]
mov rdx, rax
call fcn.1400d4050
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
lea rcx, [rbp - 0x18]
call fcn.14020c4d0
mov r14, rax
test rax, rax
je 0x140141d69
mov ecx, 0xa00000
call fcn.1402b7fa4
mov rdi, qword [rbx]
lea r9, [rsp + 0x54]
mov rdx, rax
mov r8d, 0xa00000
mov rcx, rbx
mov r12, rax
mov r15d, esi
call qword [rdi + 8]
test al, al
je 0x140141d2f
nop dword [rax]
mov rdi, qword [r14]
mov r8d, dword [rsp + 0x54]
mov rdx, r12
mov rcx, r14
call qword [rdi + 0x48]
lea r9, [rsp + 0x54]
mov r8d, 0xa00000
add r15d, eax
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x140141d00
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
lea rcx, str.Wrote:__u_bytes_n
mov edx, r15d
call fcn.1402bf424
lea rcx, [rbp - 0x18]
call fcn.140130560
lea rcx, str._n_____s_n
mov rdx, rax
call fcn.1402bf424
mov r15d, 1
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x28]
call fcn.140005eb0
mov rax, qword [r13]
mov edx, r15d
mov rcx, r13
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x1401424c5
lea rcx, [rsp + 0x60]
call fcn.1402007c0
lea rcx, [rbp - 0x60]
call fcn.1402007c0
lea rcx, [rbp - 8]
call fcn.1400d3e50
test r14b, r14b
jne 0x140141dd8
call fcn.14013f240
mov edi, 0x2c
lea rdx, [rbp - 0x40]
mov rcx, rbx
lea r8d, [rdi - 0x25]
call fcn.140204810
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x60]
mov rcx, rax
movzx edx, di
call fcn.1402046f0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
je 0x140141e21
lea rcx, str.Invalid_argument_s__r_n
jmp 0x140141f19
lea rcx, [rsp + 0x60]
call fcn.140203ba0
test eax, eax
je 0x140141f12
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14013f0c0
test al, al
je 0x140141f12
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x60]
call fcn.14020c740
test al, al
jne 0x140141e78
movaps xmm0, xmmword [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, str.Failed_to_read_file__ws_r_n
movdqa xmmword [rbp - 0x40], xmm0
call fcn.1402bd818
jmp 0x140141f1e
lea rcx, [rbp + 0xc30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rbp + 0xc30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1401fa640
mov rdi, rax
test rax, rax
jne 0x140141eaf
lea rcx, str.File_system_failed_r_n
jmp 0x140141f19
mov rax, qword [rax]
mov rdx, qword [rbp - 0x30]
lea r8, [rbp - 8]
mov rcx, rdi
call qword [rax + 0x60]
mov rcx, rdi
test al, al
mov rax, qword [rdi]
jne 0x140141eee
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d3f30
lea rcx, str.Failed_to_write__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402bd818
jmp 0x140141f1e
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d3f30
lea rcx, str.Wrote__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402bd818
jmp 0x140141f1e
lea rcx, str.Conversion_error_r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rbp - 8]
call fcn.1400d3ef0
lea rcx, [rbp - 0x60]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x1401424c5
test r14b, r14b
jne 0x140141f4e
call fcn.14013f240
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call fcn.140204810
call fcn.140100e80
mov rdi, rax
test rax, rax
jne 0x140141f7f
lea rcx, str.Failed_to_deploy_driver_r_n
call fcn.1402bd818
jmp 0x1401415c2
lea rdx, [0x140355194]
lea rcx, [rsp + 0x60]
call fcn.140205010
test al, al
je 0x140141fc9
lea rcx, [rsp + 0x60]
call fcn.140203ba0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140188180
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140101300
jmp 0x1401415c2
lea rdx, [rbp + 0x28]
mov r8d, 5
call fcn.140204810
lea rcx, [rbp + 0x28]
call fcn.1401bf000
call fcn.1402c1ecc
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x1401424c5
lea rcx, [rbp + 0x210]
call fcn.1400eff00
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013f140
lea rcx, [rbp + 0x210]
call fcn.140145a20
mov rdi, rax
test rax, rax
jne 0x140142062
lea rcx, str.Miniport_failed_r_n
call fcn.1402bf424
call fcn.1402c1ecc
lea rcx, [rbp + 0x210]
call fcn.1400f13d0
jmp 0x1401424c5
mov rcx, rax
call fcn.140145e10
mov rcx, rdi
call fcn.1400efe30
mov rcx, rax
call fcn.140130560
lea rcx, [0x14034d060]
mov rdx, rax
call fcn.1402bf424
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
call fcn.1402c1ecc
lea rcx, [rbp + 0x210]
call fcn.1400f13d0
jmp 0x1401424c5
call fcn.1401be680
jmp 0x1401424c0
lea rdx, [rsp + 0x60]
mov r8d, 8
call fcn.140204810
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140200d70
cmp ax, 0x22
jne 0x14014210b
lea rcx, [rsp + 0x60]
call fcn.140203ba0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140204ad0
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140200cb0
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.140109c20
lea rcx, [rsp + 0x60]
test al, al
sete sil
call fcn.140005eb0
jmp 0x1401424c5
call fcn.140179ad0
test al, al
je 0x1401421aa
call fcn.14010c410
test al, al
je 0x1401421aa
jmp 0x1401424c5
call fcn.14010c410
mov r15d, esi
test al, al
sete r15b
mov esi, r15d
jmp 0x1401424c5
lea rcx, [rbp - 0x18]
call fcn.1401c0fb0
lea rcx, [rbp - 0x18]
call fcn.1401c15b0
test r14b, r14b
jne 0x14014217a
call fcn.14013f240
lea rcx, str.Press_a_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
mov rcx, qword [rbp - 0x10]
lea rax, vtable.HitmanPro35::CrusaderService.0
mov qword [rbp - 0x18], rax
test rcx, rcx
je 0x1401421a7
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov r15d, esi
mov esi, r15d
jmp 0x1401424c5
xor ecx, ecx
call fcn.1401c1f90
movzx esi, al
jmp 0x1401424c5
xor edx, edx
xor ecx, ecx
call fcn.1401c19c0
movzx esi, al
jmp 0x1401424c5
lea rax, [0x14034d1a0]
lea r9, [rbp - 0x60]
movzx r8d, r15b
movzx edx, r15b
xor ecx, ecx
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rax
call fcn.140108ec0
test al, al
sete sil
cmp dword [rbp - 0x58], 0
jle 0x1401424c5
mov rcx, qword [rbp - 0x60]
call fcn.1402bd0e0
jmp 0x1401424c5
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, [0x1401c1710]
mov dword [0x140430e78], r15d
mov qword [rbp], rax
lea rax, str.HitmanPro38CrusaderBoot
mov qword [rbp - 8], rax
jmp 0x140142267
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, str.HitmanPro38Crusader
mov dword [0x140430e78], esi
mov qword [rbp - 8], rax
lea rax, [0x1401c1710]
mov qword [rbp], rax
lea rcx, [rbp - 8]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x1401424c5
call fcn.14013c220
test al, al
jne 0x140142297
test bl, bl
jne 0x140142297
lea rcx, [rbp + 0x210]
call fcn.140108e50
cmp byte [rsp + 0x4b], sil
jne 0x140142439
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
je 0x1401422c6
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x210]
call fcn.14013f1a0
movzx ebx, r15b
jmp 0x1401422cb
movzx ebx, byte [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.1400181b0
test rax, rax
je 0x1401422f2
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x210]
call fcn.1400f3060
lea rcx, [rbp + 0x38]
call fcn.140009e30
test bl, bl
je 0x140142302
lea rcx, [rbp + 0x210]
call fcn.14013f150
cmp byte [rsp + 0x4f], sil
je 0x140142315
lea rcx, [rbp + 0x210]
call fcn.14013f160
test r12b, r12b
je 0x140142334
lea rcx, [rbp + 0x210]
call fcn.14013f150
lea rcx, [rbp + 0x210]
xor edx, edx
call fcn.1400d0a90
movzx r12d, byte [rsp + 0x44]
test r12b, r12b
je 0x14014234b
lea rcx, [rbp + 0x210]
call fcn.14013f210
cmp byte [rsp + 0x48], sil
jne 0x14014235e
lea rcx, [rbp + 0x210]
call fcn.14013f1c0
cmp byte [rsp + 0x4a], sil
jne 0x140142384
lea rcx, [rbp + 0x210]
call fcn.14013f1d0
lea rcx, [rbp + 0x210]
call fcn.14013f1f0
movzx ebx, byte [rsp + 0x42]
jmp 0x140142399
movzx ebx, byte [rsp + 0x42]
test bl, bl
jne 0x140142399
lea rcx, [rbp + 0x210]
call fcn.14013f1f0
cmp byte [rsp + 0x4c], sil
jne 0x1401423ac
lea rcx, [rbp + 0x210]
call fcn.14013f1e0
test bl, bl
jne 0x1401423bc
lea rcx, [rbp + 0x210]
call fcn.14013f1f0
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1401423d2
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013f200
cmp byte [rsp + 0x47], sil
je 0x1401423e8
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013f130
cmp byte [rsp + 0x46], sil
je 0x1401423ff
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.1400f4e90
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x140142415
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013f140
lea rcx, [rbp + 0x210]
call fcn.140101800
lea rcx, [rbp + 0x210]
call fcn.1400edbb0
test al, al
mov eax, 5
cmovne esi, eax
jmp 0x14014243f
movzx r12d, byte [rsp + 0x44]
call fcn.1400f3c40
lea rcx, [rbp + 0x210]
test al, al
mov rax, 0xffffffffffffffff
cmove esi, eax
call fcn.1400f13d0
call fcn.14013f630
call fcn.1400f6d70
cmp qword [0x140430d50], 0
je 0x140142499
call fcn.140112350
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, qword [0x140430d50]
call qword [sym.imp.USER32.dll_CloseDesktop]
test rdi, rdi
je 0x1401424aa
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax + 8]
test r14b, r14b
je 0x1401424c5
test r12b, r12b
jne 0x1401424c5
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402bd818
call fcn.1402c1ecc
lea rcx, [rbp + 0xe8]
call fcn.14011c410
lea rcx, [rbp + 0x88]
call fcn.140005eb0
lea rcx, [rbp + 0xb8]
call fcn.140005eb0
lea rcx, [rbp + 0x18]
call fcn.140003e60
lea rcx, [rbp + 0x38]
call fcn.140003e60
lea rcx, [rbp - 0x28]
call fcn.140005eb0
lea rcx, [rbp - 0x50]
call fcn.140005eb0
mov r13, qword [rsp + 0xf78]
movaps xmm7, xmmword [rsp + 0xf50]
movaps xmm6, xmmword [rsp + 0xf60]
lea rcx, [rbp + 0x100]
call fcn.14011c170
mov r14, qword [rsp + 0xf70]
mov r12, qword [rsp + 0xfb8]
mov rdi, qword [rsp + 0xfa8]
mov eax, esi
mov rsi, qword [rsp + 0xfa0]
jmp 0x140142573
lea r8, [0x140352c88]
lea rdx, str.64_bit_version_of_HitmanPro_does_not_run_on_this_ARM64_machine__please_download_the_32_bit_version.
mov r9d, 0x30
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xf80
pop r15
pop rbx
pop rbp
ret