Function at 0x14000ede0
Capabilities:
Check if file exists
Delete file
Get file attributes
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1280]
mov eax, 0x1380
call fcn.14003d960
sub rsp, rax
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x1270], rax
mov rsi, rcx
xor r15d, r15d
lea ecx, [r15 + 0x30]
call fcn.14001a098
mov rbx, rax
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov dword [rax + 0x1c], 0x20
mov r13, 0xffffffffffffffff
mov qword [rax], r13
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov dword [rax + 0x24], 5
mov dword [rax + 0x20], r15d
mov dword [rax + 0x28], 2
mov dword [rax + 0x2c], 2
mov dword [rax + 0x18], 0x3840
mov ecx, 0x3840
call fcn.14001a1a4
mov qword [rbx + 0x10], rax
mov rdi, rax
xor eax, eax
mov ecx, 0x3840
rep stosb byte [rdi], al
lea ecx, [rax + 0x40]
call fcn.14001a1a4
mov qword [rbx + 8], rax
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov qword [rsi], rbx
lea rcx, str.Waiting_for_incoming_connection_from_client
call fcn.1400017e0
mov rdi, qword [rsi]
lea r8d, [r15 + 0x40]
lea rdx, str..pipe_vmcom1
mov rcx, qword [rdi + 8]
call fcn.140027380
lea rdx, str..pipe_
lea rcx, str..pipe_vmcom1
call fcn.14001be7c
test rax, rax
je 0x14000eef1
mov dword [rdi + 0x28], r15d
jmp 0x14000ef0f
lea rdx, str..COM
lea rcx, str..pipe_vmcom1
call fcn.14001be7c
neg rax
sbb ecx, ecx
add ecx, 2
mov dword [rdi + 0x28], ecx
mov dword [rdi + 0x2c], r15d
mov rcx, rdi
call fcn.140002010
test eax, eax
jne 0x14000ef3e
lea rcx, str.Failed_to_create_server
call fcn.1400019f0
lea rcx, str.Failed_to_establish_connection_with_client
call fcn.1400019f0
xor al, al
jmp 0x14001196c
lea rcx, str.Server_created
call fcn.1400017e0
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimePreciseAsFileTime]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.DLL_FileTimeToSystemTime]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [rbp + 0xde]
movzx ecx, word [rbp + 0xdc]
movzx edi, word [rbp + 0xda]
movzx r10d, word [rbp + 0xd8]
movzx r9d, word [rbp + 0xd6]
movzx r8d, word [rbp + 0xd2]
movzx edx, word [rbp + 0xd0]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r10d
lea rcx, str.Connection_established_with_client_at__04d__02d__02d__02d:_02d:_02d._04d_n
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 9
lea rdx, str.localPath
lea rcx, [rsp + 0x40]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x30]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000f03b
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rcx, qword [rbp + 0x30]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x158], r15
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f0a0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x140]
call fcn.140012be0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000f0f9
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f0f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119ba
call fcn.14001a090
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000f146
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119c0
call fcn.14001a090
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0xa
lea rdx, str.remotePath
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x80]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000f1cb
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f230
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xb0]
call fcn.140012be0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000f289
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f284
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119c6
call fcn.14001a090
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000f2d6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f2d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119cc
call fcn.14001a090
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], r15
mov r8d, 3
lea rdx, [0x14004ca34]
lea rcx, [rbp + 0x160]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x90]
call fcn.140012be0
nop
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x90]
mov rcx, qword [rsi + 0x10]
call fcn.140001590
mov edi, eax
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14000f3a7
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f3a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119d2
call fcn.14001a090
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14000f401
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f3fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119d8
call fcn.14001a090
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
lea rcx, str.Sending_sample__s_to_client
call fcn.1400017e0
test edi, edi
jne 0x14000f5d2
lea r12, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r12, qword [rbp + 0xb0]
lea r15, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova r15, qword [rbp + 0x140]
mov rax, qword [rsi]
mov qword [rbp - 0x38], rax
xor r14d, r14d
mov qword [rbp + 0x30], r14
lea rax, str.7z_x64.dll
mov qword [rsp + 0x40], rax
lea rax, str.C:Program_Files7_Zip7z.dll
mov qword [rsp + 0x48], rax
xor edi, edi
mov rbx, qword [rsp + rdi*8 + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000f4a0
inc rdi
cmp rdi, 2
jl 0x14000f482
jmp 0x14000f4a7
mov r14, rbx
mov qword [rbp + 0x30], rbx
test r14, r14
jne 0x14000f4b8
lea rcx, str.7z.dll_not_found.
call fcn.1400019f0
mov ecx, 0x104
call fcn.14001a1a4
mov rbx, rax
mov r9, r15
lea r8, str._s.7z
mov edx, 0x104
mov rcx, rax
call fcn.140001190
mov ecx, 0x80
call fcn.14001a1a4
mov r8, rax
mov qword [rbp + 0x40], rax
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
lea rdx, str.Infected
sub r8, rdx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx]
mov word [r8 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000f510
mov dword [rbp + 0x38], 9
mov dword [rbp + 0x3c], 1
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0x30]
call fcn.140001bc0
test eax, eax
je 0x14000f59f
mov ecx, 0x104
call fcn.14001a1a4
mov rdi, rax
mov r8, r12
lea rdx, str._s.7z
mov rcx, rax
call fcn.140001130
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rbp - 0x38]
call fcn.140002f90
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov rcx, rbx
call fcn.14001a090
xor r15d, r15d
jmp 0x14000f610
lea rcx, str.Failed_to_compress_file
call fcn.1400019f0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, qword [rbp - 0x38]
call fcn.140002f90
mov rcx, rbx
call fcn.14001a090
xor r15d, r15d
jmp 0x14000f610
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
lea r8, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r8, qword [rbp + 0xb0]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rcx, qword [rsi]
call fcn.140002f90
lea rcx, str.Checking_if_target_file_exists_in_sandbox
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
lea r14, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r14, qword [rbp + 0xb0]
mov rbx, qword [rbp + 0xc0]
movabs r12, 0x7fffffffffffffff
cmp rbx, r12
ja 0x1400119de
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rbx, 0xf
ja 0x14000f68a
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x50], xmm0
jmp 0x14000f70c
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x14000f6bf
mov rdi, r12
add rax, 0x27
mov rcx, rax
call fcn.14001a098
mov rcx, rax
test rax, rax
je 0x1400119e4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000f6f1
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000f6e2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400119a2
jmp 0x14000f69d
test rcx, rcx
je 0x14000f6ee
call fcn.14001a098
jmp 0x14000f6f1
mov rax, r15
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.14003dcb0
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi]
call fcn.140003ea0
test eax, eax
jne 0x14000f730
lea rcx, str.target_file_not_found_in_sandbox
call fcn.1400019f0
xor dil, dil
jmp 0x1400118d1
lea rcx, str.Target_file_exists_in_sandbox
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0xa
lea rdx, str.ok_clicker
lea rcx, [rsp + 0x40]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x30]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000f7ae
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rcx, qword [rbp + 0x30]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
lea rax, [rbp + 0x270]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x14000f810
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x90]
call fcn.140012be0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000f869
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f864
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119ea
call fcn.14001a090
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000f8b6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119f0
call fcn.14001a090
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
lea r14, [rbp + 0x90]
mov r15, qword [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova r14, r15
mov rbx, qword [rbp + 0xa0]
cmp rbx, r12
ja 0x1400119f6
cmp rbx, 0xf
ja 0x14000f921
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x50], xmm0
jmp 0x14000f9b2
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x14000f960
mov rdi, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001a098
mov rcx, rax
test rax, rax
je 0x1400119fc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000f997
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000f989
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400119a8
jmp 0x14000f93e
test rcx, rcx
je 0x14000f995
call fcn.14001a098
jmp 0x14000f997
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.14003dcb0
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi]
call fcn.140003ea0
test eax, eax
jne 0x14000f9d6
lea rcx, str.ok_clicker_not_found_in_sandbox
call fcn.1400019f0
xor dil, dil
jmp 0x140011890
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea r8d, [rbx + 0xe]
lea rdx, str.AutoClickTitle
lea rcx, [rbp - 0x80]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea r8d, [rbx + 7]
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000fa46
mov rdi, qword [rdi]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000fab0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x120]
call fcn.140012be0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000fb0b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fb06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a02
call fcn.14001a090
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000fb59
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fb54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a08
call fcn.14001a090
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rdx, qword [rbp + 0x120]
lea rcx, str.ok_clicker_tool_exists_in_sandbox__with_title__s_to_check.
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0xb
lea rdx, str.xLoggerPath
lea rcx, [rsp + 0x40]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x30]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000fbfe
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rcx, qword [rbp + 0x30]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000fc60
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x50]
call fcn.140012be0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000fcb6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a0e
call fcn.14001a090
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000fd03
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a14
call fcn.14001a090
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
lea r14, [rbp + 0x50]
mov r15, qword [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r14, r15
mov rbx, qword [rbp + 0x60]
cmp rbx, r12
ja 0x140011a1a
cmp rbx, 0xf
ja 0x14000fd62
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x10], xmm0
jmp 0x14000fdf3
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x14000fda1
mov rdi, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001a098
mov rcx, rax
test rax, rax
je 0x140011a20
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000fdd8
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000fdca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400119ae
jmp 0x14000fd7f
test rcx, rcx
je 0x14000fdd6
call fcn.14001a098
jmp 0x14000fdd8
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call fcn.14003dcb0
lea rdx, [rbp + 0x10]
mov rcx, qword [rsi]
call fcn.140003ea0
test eax, eax
jne 0x14000fe17
lea rcx, str.Failed_to_send_xLogger_to_sandbox
call fcn.1400019f0
xor dil, dil
jmp 0x1400117ef
lea rcx, str.xLogger_tool_exists_in_sandbox
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea r8d, [rbx + 6]
lea rdx, str.binlog
lea rcx, [rbp - 0x80]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea r8d, [rbx + 7]
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14000fe93
mov rdi, qword [rdi]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000fef0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x30]
call fcn.140012be0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000ff48
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a26
call fcn.14001a090
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000ff96
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a2c
call fcn.14001a090
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
lea rbx, [rbp + 0x30]
mov r15, qword [rbp + 0x48]
cmp r15, 0xf
seta byte [rbp - 0x60]
cmova rbx, qword [rbp + 0x30]
mov r14, qword [rbp + 0x40]
cmp r14, r12
ja 0x140011a32
cmp r14, 0xf
ja 0x14000fff5
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 0xf
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x10], xmm0
jmp 0x140010086
mov rdi, r14
or rdi, 0xf
cmp rdi, r12
jbe 0x140010034
mov rdi, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001a098
mov rcx, rax
test rax, rax
je 0x140011a38
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001006b
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14001005d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400119b4
jmp 0x140010012
test rcx, rcx
je 0x140010069
call fcn.14001a098
jmp 0x14001006b
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], rdi
lea r8, [r14 + 1]
mov rdx, rbx
mov rcx, rax
call fcn.14003dcb0
lea rdx, [rbp + 0x10]
mov rcx, qword [rsi]
call fcn.140003ea0
test eax, eax
jne 0x1400100ae
lea rcx, str.Failed_to_send_binlog_to_sandbox
call fcn.1400019f0
xor dil, dil
mov rbx, qword [rbp + 0x30]
jmp 0x1400117b4
lea rcx, str.binlog_tool_exists_in_sandbox
call fcn.1400017e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor ebx, ebx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
lea r8d, [rbx + 7]
lea rdx, str.timeout
lea rcx, [rbp + 0x10]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 7]
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x40]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14001012a
mov rdi, qword [rdi]
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140010190
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x180]
call fcn.140012be0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400101eb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400101e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a3e
call fcn.14001a090
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140010239
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010234
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a44
call fcn.14001a090
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov r8d, 0xf
lea rdx, str.launchParameter
lea rcx, [rbp - 0x80]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x1400102bb
mov rdi, qword [rdi]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x178], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140010320
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x160]
call fcn.140012be0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14001037b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a4a
call fcn.14001a090
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400103c9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400103c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a50
call fcn.14001a090
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0xf
lea rdx, str.unparsedLogPath
lea rcx, [rsp + 0x40]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x10]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x14001044b
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rcx, qword [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400104b0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x100]
call fcn.140012be0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140010509
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010504
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a56
call fcn.14001a090
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140010556
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a5c
call fcn.14001a090
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov r8d, 9
lea rdx, str.mutexName
lea rcx, [rbp - 0x80]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x1400105db
mov rdi, qword [rdi]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rbx
mov qword [rbp + 0x1c0], rbx
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140010640
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x1a8]
call fcn.140012be0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14001069b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010696
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a62
call fcn.14001a090
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400106e9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a68
call fcn.14001a090
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rbx
mov r8d, 0xf
lea rdx, str.EnableTitanHide
lea rcx, [rbp + 0x70]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x58]
call fcn.140012be0
nop
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0x10]
call fcn.140001590
mov edi, eax
cmp eax, 1
sete r14b
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400107a0
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001079b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a6e
call fcn.14001a090
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400107ee
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a74
call fcn.14001a090
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rbx
mov r8d, 0xc
lea rdx, str.EnableScylla
lea rcx, [rbp + 0x70]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x58]
call fcn.140012be0
nop
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0x10]
call fcn.140001590
mov r15d, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14001088f
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001088a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a7a
call fcn.14001a090
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400108dd
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400108d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a80
call fcn.14001a090
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rbx
mov r8d, 0xc
lea rdx, str.HideDebugger
lea rcx, [rbp + 0x70]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov r8d, 7
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x58]
call fcn.140012be0
nop
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0x10]
call fcn.140001590
mov ebx, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14001097d
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a86
call fcn.14001a090
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400109cf
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400109ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a8c
call fcn.14001a090
cmp edi, 1
jne 0x140010b07
lea rcx, str.TitanHide_is_enabled__this_may_cause_vm_is_not_stable_and_likely_to_crash
call fcn.140001900
lea rcx, [rbp + 0x10]
call fcn.1400125a0
nop
mov byte [rsp + 0x20], 0
movzx r9d, dil
lea r8, [rbp + 0x10]
lea rdx, str.sc_query_TitanHide
mov rcx, qword [rsi]
call fcn.140003a10
lea rdx, str.RUNNING
lea rcx, [rbp + 0x10]
call fcn.140012160
cmp rax, 0xffffffffffffffff
jne 0x140010afe
lea rcx, str.TitanHide_is_not_running__tries_to_start_it
call fcn.140001900
mov byte [rsp + 0x20], 0
movzx r9d, dil
lea r8, [rbp + 0x10]
lea rdx, str.net_session
mov rcx, qword [rsi]
call fcn.140003a10
lea rdx, [0x14004cd10]
lea rcx, [rbp + 0x10]
call fcn.140012160
cmp rax, 0xffffffffffffffff
jne 0x14001127f
lea rdx, str.Access_is_denied
lea rcx, [rbp + 0x10]
call fcn.140012160
cmp rax, 0xffffffffffffffff
jne 0x14001127f
mov byte [rsp + 0x20], 0
movzx r9d, dil
lea r8, [rbp + 0x10]
lea rdx, str.sc_start_TitanHide
mov rcx, qword [rsi]
call fcn.140003a10
lea rdx, str.FAILED
lea rcx, [rbp + 0x10]
call fcn.140012160
cmp rax, 0xffffffffffffffff
je 0x140010abe
lea rcx, str.Failed_to_start_TitanHide
jmp 0x140011286
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x10]
lea rdx, str.sc_query_TitanHide
mov rcx, qword [rsi]
call fcn.140003a10
lea rdx, str.RUNNING
lea rcx, [rbp + 0x10]
call fcn.140012160
cmp rax, 0xffffffffffffffff
jne 0x140010afe
lea rcx, str.Failed_to_start_TitanHide
call fcn.1400019f0
xor r14b, r14b
lea rcx, [rbp + 0x10]
call fcn.140012320
lea rdx, [0x14004b553]
lea rcx, [rbp + 0xe0]
call fcn.140012440
nop
lea rdx, [0x14004b553]
lea rcx, [rbp + 0x70]
call fcn.140012440
nop
cmp qword [rbp + 0x130], 0
je 0x140010bc7
lea rcx, [rbp + 0x120]
call fcn.1400121a0
mov rdx, rax
lea rcx, str.Launching_ok_clicker_to_monitor_dialog__s
call fcn.1400017e0
lea r8, [0x14004cdf4]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call fcn.140012940
nop
lea r8, [rbp + 0x120]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140012a20
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
nop
lea rcx, [rbp - 0x10]
call fcn.140012320
lea rcx, [rbp + 0xe0]
call fcn.1400121a0
mov rdx, rax
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x70]
mov rcx, qword [rsi]
call fcn.140003a10
lea rcx, [rbp + 0xe0]
call fcn.1400121b0
lea rcx, [rbp + 0x70]
call fcn.1400121b0
lea rcx, str.Constructing_command_line_for_xLogger
call fcn.1400017e0
lea r8, str.__c__
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140012940
nop
lea r8, [rbp + 0xb0]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140012a20
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
nop
lea rcx, [rbp - 0x10]
call fcn.140012320
cmp qword [rbp + 0x170], 0
je 0x140010c6f
lea r8, [rbp + 0x160]
lea rdx, [0x14004cdf4]
lea rcx, [rbp - 0x30]
call fcn.1400128d0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
lea r8, [rbp + 0x100]
lea rdx, str.___l__
lea rcx, [rbp - 0x10]
call fcn.1400128d0
nop
lea r8, [0x14004be6c]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400129b0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
nop
lea rcx, [rbp - 0x10]
call fcn.140012320
cmp qword [rbp + 0x190], 0
je 0x140010d0f
mov r8d, 0xa
lea rcx, [rbp + 0x180]
call fcn.140001410
test eax, eax
jle 0x140010d0f
lea r8, [rbp + 0x180]
lea rdx, str.___timeout
lea rcx, [rbp - 0x30]
call fcn.1400128d0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
cmp qword [rbp + 0x1b8], 0
je 0x140010d4a
lea r8, [rbp + 0x1a8]
lea rdx, str.___mutex
lea rcx, [rbp - 0x30]
call fcn.1400128d0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400121f0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
test r14b, r14b
je 0x140010d62
lea rdx, str.___titan
lea rcx, [rbp + 0xe0]
call fcn.1400121d0
cmp r15d, 1
jne 0x140010d7b
lea rdx, str.___scylla
lea rcx, [rbp + 0xe0]
call fcn.1400121d0
cmp ebx, 1
jne 0x140010d93
lea rdx, str.___hide_debugger
lea rcx, [rbp + 0xe0]
call fcn.1400121d0
lea rdx, str.___external_console
lea rcx, [rbp + 0xe0]
call fcn.1400121d0
lea rcx, str.Calling_xLogger...
call fcn.1400017e0
lea r8, [rbp + 0xe0]
lea rdx, str.echo_start_C:WindowsSystem32cmd.exe__c
lea rcx, [rbp - 0x58]
call fcn.1400128d0
nop
lea r8, str._2_1___xLogger.log____xLogger.bat__xLogger.bat__del_xLogger.bat
mov rdx, rax
lea rcx, [rbp + 0x208]
call fcn.1400129b0
nop
lea rcx, [rbp - 0x58]
call fcn.140012320
lea rcx, [rbp + 0x208]
call fcn.1400121a0
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x70]
mov rcx, qword [rsi]
call fcn.140003a10
mov r8d, 0xa
lea rcx, [rbp + 0x180]
call fcn.140001410
imul ecx, eax, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rdx, str.start_C:WindowsSystem32cmd.exe__c_taskkill__f__im_xLogger
lea rcx, [rbp + 0x208]
call fcn.140012210
lea rcx, [rbp + 0x208]
call fcn.1400121a0
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x70]
mov rcx, qword [rsi]
call fcn.140003a10
lea rdx, str.xLoggerLogPathHost
lea rcx, [rbp - 0x10]
call fcn.140012440
nop
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x30]
call fcn.140012440
nop
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x248]
mov rcx, qword [rsi + 0x10]
call fcn.1400014a0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
nop
lea rcx, [rbp - 0x10]
call fcn.140012320
lea rcx, str.xLogger_killed.
call fcn.1400017e0
lea rdx, str.xLogger.log
lea rcx, [rbp - 0x58]
call fcn.140012440
mov rdx, rax
mov rcx, qword [rsi]
call fcn.140003ea0
test eax, eax
je 0x140010f28
lea rcx, str.Receive_xLogger_log_file
call fcn.1400017e0
lea rax, [rbp - 0x58]
mov qword [rbp - 0x38], rax
lea rcx, [rbp + 0x248]
call fcn.1400121a0
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140012440
mov rdi, rax
lea rdx, str.xLogger.log
lea rcx, [rbp + 0x10]
call fcn.140012440
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsi]
call fcn.140004280
lea rdx, str.SleepAfterExecution
lea rcx, [rbp + 0x10]
call fcn.140012440
nop
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x58]
call fcn.140012440
nop
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0x10]
call fcn.140001590
imul edi, eax, 0x3e8
lea rcx, [rbp - 0x58]
call fcn.140012320
nop
lea rcx, [rbp + 0x10]
call fcn.140012320
test edi, edi
jle 0x140010f9d
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
lea rcx, str.Sleep_for__d_seconds_after_execution
call fcn.1400017e0
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rcx, [rbp + 0xe0]
call fcn.1400121b0
lea rcx, [rbp + 0x70]
call fcn.1400121b0
lea rdx, str.parsedLogPath
lea rcx, [rbp + 0x10]
call fcn.140012440
nop
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x58]
call fcn.140012440
nop
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1c8]
mov rcx, qword [rsi + 0x10]
call fcn.1400014a0
nop
lea rcx, [rbp - 0x58]
call fcn.140012320
nop
lea rcx, [rbp + 0x10]
call fcn.140012320
lea rdx, str.parsedLogPathHost
lea rcx, [rbp - 0x10]
call fcn.140012440
nop
lea rdx, str.SANDBOX
lea rcx, [rbp - 0x30]
call fcn.140012440
nop
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x228]
mov rcx, qword [rsi + 0x10]
call fcn.1400014a0
nop
lea rcx, [rbp - 0x30]
call fcn.140012320
nop
lea rcx, [rbp - 0x10]
call fcn.140012320
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r8d, [r14 + 0x13]
lea rdx, str.unparsedLogPathHost
lea rcx, [rsp + 0x60]
call fcn.140012be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
lea r8d, [r14 + 7]
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x10]
call fcn.140012be0
nop
mov rdi, qword [rsi + 0x10]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call fcn.14003e350
cmp qword [rdi + 0x18], 0xf
jbe 0x1400110bf
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rcx, qword [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x270]
lea r8, [0x14004b553]
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x1f8], r14
mov qword [rbp + 0x200], r14
lea rax, [rbp + 0x270]
nop
inc r13
cmp byte [rax + r13], 0
jne 0x140011120
mov r8, r13
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x1e8]
call fcn.140012be0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14001117c
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a92
call fcn.14001a090
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400111c9
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a98
call fcn.14001a090
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rax, qword [rbp + 0x40]
sub r12, rax
cmp r12, 2
jb 0x140011a9e
lea r9, [rbp + 0x30]
cmp byte [rbp - 0x60], 0
cmovne r9, qword [rbp + 0x30]
mov qword [rsp + 0x30], 2
lea rcx, [0x14004c070]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x10]
call fcn.140013210
nop
lea r9, [rbp + 0x100]
cmp qword [rbp + 0x118], 0xf
cmova r9, qword [rbp + 0x100]
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x1400112a0
lea rax, [rcx + rbx]
mov qword [rbp], rax
lea rdi, [rbp - 0x10]
cmp rdx, 0xf
cmova rdi, qword [rbp - 0x10]
add rdi, rcx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.14003dcb0
mov byte [rbx + rdi], 0
lea rax, [rbp - 0x10]
jmp 0x1400112b1
lea rcx, str.Failed_to_start_TitanHide__please_run_this_program_as_administrator
call fcn.1400019f0
nop
lea rcx, [rbp + 0x10]
call fcn.140012320
xor dil, dil
xor r14d, r14d
jmp 0x140011674
mov qword [rsp + 0x20], rbx
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140012e20
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x14004c06c]
lea rcx, [rbp - 0x58]
call fcn.1400125c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rdx, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1d8]
lea rcx, [rsp + 0x40]
call fcn.1400125c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x14004be6c]
lea rcx, [rbp - 0x80]
call fcn.1400125c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x30]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0xe0]
call fcn.1400125c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14001141c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011416
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011aa4
call fcn.14001a090
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140011457
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011452
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011aaa
call fcn.14001a090
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400114a4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001149f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ab0
call fcn.14001a090
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400114f2
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400114ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ab6
call fcn.14001a090
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov r8, qword [rbp + 8]
cmp r8, 0xf
jbe 0x140011515
mov rdx, qword [rbp - 0x10]
call fcn.140012690
lea rcx, str.Binarization_log...
call fcn.1400017e0
lea rcx, [rbp + 0xe0]
call fcn.1400121a0
mov rdx, rax
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x70]
mov rcx, qword [rsi]
call fcn.140003a10
lea rcx, [rbp + 0x228]
call fcn.1400121a0
mov rdx, rax
lea rcx, str.Receive_binlog_file__s
call fcn.1400017e0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x228]
call fcn.1400121a0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140012440
mov rdi, rax
lea rcx, [rbp + 0x1c8]
call fcn.1400121a0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140012440
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsi]
call fcn.140004280
cmp qword [rbp + 0x110], 0
je 0x14001161a
lea rcx, [rbp + 0x100]
call fcn.1400121a0
mov rdx, rax
lea rcx, str.Receive_log_file__s
call fcn.1400017e0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1e8]
call fcn.1400121a0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140012440
mov rdi, rax
lea rcx, [rbp + 0x100]
call fcn.1400121a0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140012440
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsi]
call fcn.140004280
mov dil, 1
lea rcx, [rbp + 0x1e8]
call fcn.140012320
nop
lea rcx, [rbp + 0x228]
call fcn.140012320
nop
lea rcx, [rbp + 0x1c8]
call fcn.140012320
nop
lea rcx, [rbp + 0x248]
call fcn.140012320
nop
lea rcx, [rbp + 0x208]
call fcn.140012320
nop
lea rcx, [rbp + 0x70]
call fcn.140012320
nop
lea rcx, [rbp + 0xe0]
call fcn.140012320
mov rbx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 0xf
jbe 0x1400116ba
inc rdx
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011abc
call fcn.14001a090
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400116fb
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ac2
call fcn.14001a090
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x140011756
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ac8
call fcn.14001a090
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140011797
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ace
call fcn.14001a090
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
mov r15, qword [rbp + 0x48]
cmp r15, 0xf
jbe 0x1400117eb
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400117e3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ad4
mov rcx, rbx
call fcn.14001a090
mov r15, qword [rbp + 0x50]
mov rax, qword [rbp + 0x68]
cmp rax, 0xf
jbe 0x14001182b
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140011822
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ada
mov rcx, r15
call fcn.14001a090
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14001186c
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ae0
call fcn.14001a090
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov r15, qword [rbp + 0x90]
mov rax, qword [rbp + 0xa8]
cmp rax, 0xf
jbe 0x1400118ce
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400118c6
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ae6
mov rcx, r15
call fcn.14001a090
xor r15d, r15d
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140011912
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001190d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011aec
call fcn.14001a090
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140011968
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001199c
call fcn.14001a090
movzx eax, dil
mov rcx, qword [rbp + 0x1270]
xor rcx, rsp
call fcn.14001a070
lea r11, [rsp + 0x1380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400271a4
nop
call fcn.140001350
nop
call fcn.140001350
nop
call fcn.140001350
nop
call fcn.140001350
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3
call fcn.1400013f0
int3
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3
call fcn.1400013f0
int3
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3
call fcn.1400013f0
int3
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3
call fcn.1400013f0
int3
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3
call fcn.1400013f0
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
nop
call fcn.1400271a4
int3