Function at 0x14013e690
Capabilities:
Compress data via winapi
Get common file path
Log keystrokes via polling
Print debug messages
Switch active desktop

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe70]
sub rsp, 0xf70
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0xe40], rax
mov rbx, r8
call fcn.140148f00
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, r15d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.1402be9f4
xor esi, esi
mov qword [rbp + 0x68], rsi
call fcn.140113200
mov qword [rbp - 0x30], rsi
xorps xmm0, xmm0
movzx r14d, al
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp + 0xc8], rsi
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x100], rax
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov dword [rbp + 0x120], esi
mov qword [rbp + 0x108], rax
or rax, 0xffffffffffffffff
lea r12, [0x140348ca0]
test rbx, rbx
jne 0x14013e750
mov edi, esi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], r12
jmp 0x14013e791
mov rdi, rax
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013e753
mov qword [rsp + 0x78], rsi
test edi, edi
jne 0x14013e76c
mov qword [rsp + 0x70], r12
jmp 0x14013e791
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1401ff260
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402bd21c
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.140200570
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.140114840
cmp dword [rsp + 0x78], esi
jle 0x14013e7be
mov rcx, qword [rsp + 0x70]
call fcn.1402b9c20
lea rbx, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
test r14b, r14b
je 0x14013e8ad
mov ecx, 0x18
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x14013e7f4
mov qword [rax], rbx
lea rax, [rbp + 0x100]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 8], rax
jmp 0x14013e7f7
mov rdi, rsi
mov rbx, rsi
test rdi, rdi
je 0x14013e81b
mov ecx, 4
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x14013e815
mov dword [rax], esi
jmp 0x14013e818
mov rbx, rsi
mov dword [rbx], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
je 0x14013e88a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, str._crusader
xor r8d, r8d
mov rcx, rax
mov r14, rax
call fcn.1402019e0
test al, al
jne 0x14013e88a
lea rdx, str._kickstart
xor r8d, r8d
mov rcx, r14
call fcn.1401ff540
test al, al
je 0x14013e87e
call fcn.140113300
test al, al
jne 0x14013e88a
call fcn.1401133d0
test al, al
jne 0x14013e88a
call fcn.14013e150
test al, al
jne 0x14013e9d6
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
jne 0x14013e827
test rbx, rbx
je 0x14013e8ad
mov eax, dword [rbx]
test eax, eax
jle 0x14013e899
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x14013e8ad
mov rcx, rdi
call fcn.1402177e0
mov rcx, rbx
call fcn.1402177e0
mov qword [rsp + 0xfa0], r13
call fcn.14013dc40
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, esi
lea rdi, [0x14041a3a8]
mov r14, rax
mov edx, dword [rdi - 8]
mov rcx, r14
call fcn.140148270
mov rcx, qword [rdi]
inc ebx
mov qword [rcx], rax
movsxd rcx, ebx
lea rdi, [rdi + 0x10]
cmp rcx, 0xa
jb 0x14013e8d3
mov rcx, r14
call fcn.1401484a0
lea rcx, [0x14042bca8]
mov dword [0x14042bba4], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea rdi, [0x14042bcd0]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14013e947
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042bd38], rax
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [0x14041a158]
xor r14b, r14b
shr eax, 0xf
mov byte [rsp + 0x41], sil
mov byte [rsp + 0x40], sil
and al, r15b
mov byte [rsp + 0x45], r15b
mov byte [rsp + 0x4f], sil
mov byte [rsp + 0x43], sil
mov byte [rsp + 0x4e], sil
mov byte [rsp + 0x49], sil
mov dword [rbp - 0x80], eax
mov byte [rsp + 0x50], sil
mov byte [rsp + 0x4b], sil
mov byte [rsp + 0x4d], sil
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x4a], r15b
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x42], r15b
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x47], sil
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], esi
mov r13d, esi
test rbx, rbx
jne 0x14013ea06
mov edi, esi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], r12
jmp 0x14013ea49
test rbx, rbx
je 0x140140af9
mov eax, dword [rbx]
test eax, eax
jle 0x14013e9e9
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x140140af9
mov rcx, rdi
call fcn.1402177e0
mov rcx, rbx
call fcn.1402177e0
jmp 0x140140af9
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013ea10
mov qword [rbp - 0x48], rsi
test edi, edi
jne 0x14013ea27
mov qword [rbp - 0x50], r12
jmp 0x14013ea49
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1401ff260
mov eax, dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402bd21c
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.140200570
mov rbx, qword [0x14041a158]
test rbx, rbx
jne 0x14013ea6c
mov edi, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
jmp 0x14013eaa9
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013ea70
mov qword [rbp - 0x20], rsi
test edi, edi
jne 0x14013ea87
mov qword [rbp - 0x28], r12
jmp 0x14013eaa9
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.1401ff260
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402bd21c
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.140200570
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
call fcn.14000a340
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x38], rax
call fcn.14000a340
mov ecx, 0x18
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x90], rsi
call fcn.1402b968c
mov r12, rax
test rax, rax
je 0x14013eb22
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [r12 + 0x10], rsi
mov qword [r12], rax
lea rax, [rbp + 0x100]
mov qword [r12 + 8], rax
jmp 0x14013eb25
mov r12, rsi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0xe8], rax
test r12, r12
je 0x14013eb66
mov ecx, 4
call fcn.1402b968c
test rax, rax
je 0x14013eb59
mov dword [rax], esi
jmp 0x14013eb5c
mov rax, rsi
mov qword [rbp + 0xf8], rax
mov dword [rax], r15d
mov rax, qword [r12]
mov rcx, r12
movaps xmmword [rsp + 0xf60], xmm6
movaps xmmword [rsp + 0xf50], xmm7
call qword [rax]
test al, al
je 0x14013f9a2
movsd xmm7, qword [0x1403747d8]
mov rax, qword [r12]
mov rcx, r12
mov edi, 2
call qword [rax + 0x10]
lea rdx, str._kickstart
mov r8d, r15d
mov rcx, rax
mov rbx, rax
call fcn.1401ff540
test al, al
je 0x14013ecdb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x10000000
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rcx, rax
mov qword [rbp + 0xc8], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, 0xe0
call fcn.1402b968c
mov rbx, rax
mov qword [rbp + 0x68], rax
test rax, rax
je 0x14013ec2a
mov rcx, rax
call fcn.14020beb0
lea rax, vtable.HitmanPro35::UI::KickstartDesktop.0
mov qword [rcx + 0xc0], rsi
mov qword [rcx], rax
mov qword [rcx + 0xc8], rsi
call fcn.140133c30
jmp 0x14013ec2e
mov qword [rbp + 0x68], rsi
lea rcx, [0x1403542e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov rcx, rax
mov qword [0x14042bc70], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov qword [rsp + 0x30], rsi
lea rcx, str..hmpkick
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14013ecc9
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x22e260
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14042bc70]
call qword [sym.imp.USER32.dll_SwitchDesktop]
jmp 0x14013f991
lea rdx, str._debug
mov r8d, r15d
mov rcx, rbx
call fcn.1402019e0
mov r8d, r15d
mov rcx, rbx
test al, al
je 0x14013ed39
lea rdx, str.:full
call fcn.1401ff110
mov ecx, dword [0x14042bb64]
test al, al
cmovne ecx, edi
mov dword [0x14042bb64], ecx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x14013d970]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp 0x14013f991
lea rdx, str._console
call fcn.1401ff540
test al, al
je 0x14013ed8a
test r14b, r14b
jne 0x14013f991
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x14013f991
call fcn.1402baed0
lea r8, [0x140355018]
lea rdx, [0x140355010]
lea r9, [rax + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1402be99c
movzx r14d, r15b
jmp 0x14013f991
lea rdx, str._crusader
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x140140820
lea rdx, str._crusader:boot
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x1401407f4
lea rdx, [0x140355360]
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x1401407b4
lea rdx, str._installservice
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x1401407a3
lea rdx, str._uninstallservice
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x140140794
lea rdx, str._listen
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x140140740
lea rdx, [0x140351140]
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x14014072a
lea rdx, str._deactivate
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff540
test al, al
jne 0x140140713
lea rdx, str._update:
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
jne 0x140140696
lea rdx, str._updated:
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013ef0f
lea rdx, [rbp + 0xa8]
mov r8d, 9
call fcn.1402011d0
lea rcx, [rbp + 0xa8]
xor edx, edx
call fcn.1401fd730
cmp ax, 0x22
jne 0x14013eef2
lea rcx, [rbp + 0xa8]
call fcn.140200560
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0xa8]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rbp + 0xa8]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x1b8]
call fcn.140005eb0
lea rcx, [rbp + 0xa8]
call fcn.140108910
lea rcx, [rbp + 0xa8]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._upgraded:
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013efaa
lea rdx, [rbp + 0x98]
mov r8d, 0xa
call fcn.1402011d0
lea rcx, [rbp + 0x98]
xor edx, edx
call fcn.1401fd730
cmp ax, 0x22
jne 0x14013ef8d
lea rcx, [rbp + 0x98]
call fcn.140200560
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x98]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rbp + 0x98]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x1c8]
call fcn.140005eb0
lea rcx, [rbp + 0x98]
call fcn.14010a760
lea rcx, [rbp + 0x98]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._xtdl
call fcn.1401ff530
test al, al
jne 0x14014068c
lea rdx, str._miniport
mov rcx, rbx
call fcn.1401ff530
test al, al
jne 0x1401405f3
lea rdx, str._rfs
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
jne 0x1401405c8
lea rdx, str._sr
call fcn.1402019d0
test al, al
jne 0x140140526
lea rdx, str._lcn
mov rcx, rbx
call fcn.1402019d0
test al, al
je 0x14013f058
test r14b, r14b
jne 0x14013f024
call fcn.14013d850
movzx r14d, al
lea rdx, [rsp + 0x60]
mov r8d, 5
mov rcx, rbx
call fcn.1402011d0
lea rcx, [rsp + 0x60]
call fcn.140200560
lea rcx, [rsp + 0x60]
test eax, eax
jg 0x14013fb3a
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._write
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x140140394
lea rdx, str._clone
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x140140133
lea rdx, str._swap
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x14013ff73
lea rdx, str._overwrite
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x14013fd4c
lea rdx, str._protectmbr
mov rcx, rbx
call fcn.1401ff530
test al, al
jne 0x14013fd42
lea rdx, str._lic
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f110
lea rdx, [rbp + 0x168]
mov r8d, 5
call fcn.1402011d0
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x168]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._renew
call fcn.1401ff530
test al, al
je 0x14013f12a
call fcn.140178050
jmp 0x14013f991
lea rdx, str._checklic
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x14013fc17
lea rdx, str._scan
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f15e
mov byte [rsp + 0x40], r15b
jmp 0x14013f991
lea rdx, str._scan:boot
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f27b
mov byte [rbp - 0x80], sil
call fcn.140113110
test al, al
je 0x14013fbe2
xor ecx, ecx
mov byte [rsp + 0x40], r15b
call fcn.1400f2f90
mov rbx, rax
test rax, rax
je 0x14013f26c
lea rcx, [rbp - 0x60]
call fcn.1401fd180
lea r8, [rbp - 0x60]
lea rdx, [0x140350a00]
mov rcx, rbx
call fcn.1400d8b50
mov rdi, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rdi]
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rcx, [rbp - 0x60]
call fcn.140200560
cmp eax, 0x13
jl 0x14013f25a
lea rdx, str.yyyy_MM_dd_HH:mm:ss
lea rcx, [rbp + 0x148]
call fcn.1401fd200
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x60]
xor r9d, r9d
call fcn.1400eb5f0
lea rcx, [rbp + 0x148]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013f25a
lea rcx, [rbp - 8]
call fcn.1400cafe0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x198]
mov rcx, rax
call fcn.1400cb050
mov rcx, rax
call fcn.1400e3f80
lea rcx, [rbp + 0x198]
movaps xmm6, xmm0
call fcn.1400cae80
comisd xmm7, xmm6
ja 0x14013fbcb
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
call fcn.1401150b0
call fcn.140114f00
jmp 0x14013f991
lea rdx, str._installsophos
mov rcx, rbx
call fcn.1401ff530
test al, al
jne 0x14013fc0a
lea rdx, str._uninstallsophos
mov rcx, rbx
call fcn.1401ff530
test al, al
jne 0x14013fbfd
lea rdx, str._sophos
mov rcx, rbx
call fcn.1401ff530
test al, al
jne 0x14013fbf3
lea rdx, str._quiet
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f2dd
mov byte [rsp + 0x41], r15b
jmp 0x14013f991
lea rdx, str._noscan
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f2fa
mov byte [rsp + 0x4b], r15b
jmp 0x14013f991
lea rdx, str._noinstall
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f317
mov byte [rsp + 0x43], r15b
jmp 0x14013f991
lea rdx, str._nostartboot
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f334
mov byte [rsp + 0x4e], r15b
jmp 0x14013f991
lea rdx, str._nodesktopshortcut
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f351
mov byte [rsp + 0x49], r15b
jmp 0x14013f991
lea rdx, str._nostartmenushortcut
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f36e
mov byte [rsp + 0x50], r15b
jmp 0x14013f991
lea rdx, str._noupdate
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f38b
mov byte [rsp + 0x45], sil
jmp 0x14013f991
lea rdx, str._noupload
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f3a8
mov byte [rsp + 0x48], sil
jmp 0x14013f991
lea rdx, str._noremnants
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f3c5
mov byte [rsp + 0x4a], sil
jmp 0x14013f991
lea rdx, str._nocookies
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f3e2
mov byte [rsp + 0x4c], sil
jmp 0x14013f991
lea rdx, str._nopups
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f3ff
mov byte [rsp + 0x42], sil
jmp 0x14013f991
lea rdx, str._pup
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f484
lea rdx, [rbp + 0x58]
mov r8d, 5
call fcn.1402011d0
lea rdx, [0x140355b60]
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401ff540
test al, al
je 0x14013f451
lea rcx, [rbp + 0x58]
mov dword [rsp + 0x58], 4
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str.ignore
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401ff540
mov edi, dword [rsp + 0x58]
lea rcx, [rbp + 0x58]
test al, al
mov eax, 8
cmovne edi, eax
mov dword [rsp + 0x58], edi
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._scanonly
call fcn.1401ff530
test al, al
je 0x14013f4ad
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x41], r15b
mov byte [rsp + 0x43], r15b
mov byte [rsp + 0x44], r15b
jmp 0x14013f991
lea rdx, str._clean
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f4d4
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x4f], r15b
mov byte [rsp + 0x45], sil
jmp 0x14013f991
lea rdx, str._ews
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f4f1
mov byte [rsp + 0x46], r15b
jmp 0x14013f991
lea rdx, str._quick
mov rcx, rbx
call fcn.1401ff530
test al, al
je 0x14013f50e
mov byte [rsp + 0x47], r15b
jmp 0x14013f991
lea rdx, str._log
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f5f4
lea rdx, [rbp + 0x158]
mov r8d, 5
call fcn.1402011d0
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x158]
call fcn.140005eb0
lea rdx, [0x1403512cc]
lea rcx, [rbp - 0x50]
call fcn.1402019d0
test al, al
je 0x14013f5b2
lea rdx, [0x1403512cc]
lea rcx, [rbp - 0x50]
call fcn.1401ff100
test al, al
je 0x14013f5b2
lea rcx, [rbp - 0x50]
call fcn.140200560
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x50]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x1d8]
call fcn.140005eb0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x128]
call fcn.1400e32e0
test r13d, r13d
jne 0x14013f5e3
lea rdx, str..txt
lea rcx, [rbp + 0x128]
xor r8d, r8d
call fcn.1401ff540
test al, al
cmovne r13d, edi
lea rcx, [rbp + 0x128]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._logtype
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f665
lea rdx, [rbp - 0x18]
mov r8d, 9
call fcn.1402011d0
lea rdx, [0x140355bf0]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401ff540
test al, al
je 0x14013f63e
lea rcx, [rbp - 0x18]
mov r13d, edi
call fcn.140005eb0
jmp 0x14013f991
lea rdx, [0x14034e020]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401ff540
lea rcx, [rbp - 0x18]
test al, al
cmovne r13d, r15d
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._nologs
call fcn.1401ff530
test al, al
je 0x14013f67f
mov byte [rsp + 0x4d], r15b
jmp 0x14013f991
lea rdx, [0x140355c08]
mov rcx, rbx
call fcn.1402019d0
test al, al
je 0x14013f69b
mov byte [rbp - 0x80], r15b
jmp 0x14013f991
lea rdx, str._ecat
mov rcx, rbx
call fcn.1402019d0
test al, al
jne 0x14013f991
lea rdx, str._diskmode
mov rcx, rbx
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f70f
lea rdx, [rbp + 0x138]
mov r8d, 0xa
call fcn.1402011d0
lea rdx, str.compatible
lea rcx, [rbp + 0x138]
xor r8d, r8d
call fcn.1401ff540
mov ecx, dword [rsp + 0x54]
test al, al
cmovne ecx, r15d
mov dword [rsp + 0x54], ecx
lea rcx, [rbp + 0x138]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._excludelist
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f7b3
lea rdx, [rbp + 0x48]
mov r8d, 0xd
call fcn.1402011d0
lea rdx, [0x1403512cc]
lea rcx, [rbp + 0x48]
call fcn.1402019d0
test al, al
je 0x14013f795
lea rdx, [0x1403512cc]
lea rcx, [rbp + 0x48]
call fcn.1401ff100
test al, al
je 0x14013f795
lea rcx, [rbp + 0x48]
call fcn.140200560
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x48]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rbp + 0x48]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x1a8]
call fcn.140005eb0
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
xor r8d, r8d
call fcn.14013dd80
lea rcx, [rbp + 0x48]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._filelist
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f858
lea rdx, [rbp - 0x78]
mov r8d, 0xa
call fcn.1402011d0
lea rdx, [0x1403512cc]
lea rcx, [rbp - 0x78]
call fcn.1402019d0
test al, al
je 0x14013f839
lea rdx, [0x1403512cc]
lea rcx, [rbp - 0x78]
call fcn.1401ff100
test al, al
je 0x14013f839
lea rcx, [rbp - 0x78]
call fcn.140200560
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x78]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rbp - 0x78]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x178]
call fcn.140005eb0
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x78]
movzx r8d, r15b
call fcn.14013dd80
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, [0x140355c90]
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f89d
lea rdx, [rbp + 0x188]
mov r8d, 7
call fcn.1402011d0
lea rcx, [rbp + 0xb8]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0x188]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, str._proxycred
call fcn.1402019d0
mov rcx, rbx
test al, al
je 0x14013f8e2
lea rdx, [rbp + 0xd8]
mov r8d, 0xb
call fcn.1402011d0
lea rcx, [rbp + 0x88]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, [0x14034f004]
call fcn.1402019d0
test al, al
jne 0x14013f991
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140201da0
mov rcx, rax
call fcn.140200560
lea rcx, [rbp - 0x40]
test eax, eax
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013f991
lea rdx, [0x1403512cc]
mov rcx, rbx
call fcn.1402019d0
test al, al
je 0x14013f97e
lea rdx, [0x1403512cc]
mov rcx, rbx
call fcn.1401ff100
test al, al
je 0x14013f97e
mov rcx, rbx
call fcn.140200560
lea rdx, [rbp + 0x28]
mov r8d, r15d
lea r9d, [rax - 2]
mov rcx, rbx
call fcn.140201490
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x18]
call fcn.1400e9160
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x14013f991
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
mov r8, rbx
call fcn.1400e9160
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
test al, al
jne 0x14013eb8f
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
jne 0x14013f9bb
cmp byte [rbp - 0x80], sil
je 0x14013f9bb
call fcn.140139700
call fcn.140108a90
lea rcx, [rbp + 0x210]
call fcn.1400ee990
lea rcx, [rbp + 0x210]
movzx edx, r14b
call fcn.14013d790
mov rdi, qword [rbp + 0x68]
lea rcx, [rbp + 0x210]
mov rdx, rdi
call fcn.14013d7a0
lea rcx, [rbp + 0x88]
call fcn.140200560
test eax, eax
jle 0x14013fa12
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x210]
call fcn.1400f14b0
lea rcx, [rbp + 0xb8]
call fcn.140200560
test eax, eax
jle 0x14013fa2e
lea rcx, [rbp + 0xb8]
call fcn.14013e4a0
cmp byte [rsp + 0x45], sil
jne 0x14013fa41
lea rcx, [rbp + 0x210]
call fcn.14013d780
movzx ebx, byte [rsp + 0x43]
test bl, bl
je 0x14013fa5a
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011d700
cmp byte [rsp + 0x4e], sil
je 0x14013fa71
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011d710
cmp byte [rsp + 0x49], sil
je 0x14013fa88
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011d720
cmp byte [rsp + 0x50], sil
je 0x14013fa9f
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011d730
movzx r12d, byte [rsp + 0x41]
test r12b, r12b
je 0x14013fab6
lea rcx, [rbp + 0x210]
call fcn.14013d7c0
lea rcx, [rbp - 0x50]
call fcn.140200560
test eax, eax
jle 0x14013fad3
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x210]
call fcn.1401001c0
test r13d, r13d
je 0x14013fae7
lea rcx, [rbp + 0x210]
mov edx, r13d
call fcn.14013d840
cmp byte [rsp + 0x4d], sil
je 0x14013fafa
lea rcx, [rbp + 0x210]
call fcn.14013d830
lea rcx, [rbp - 0x28]
call fcn.140200560
test eax, eax
jle 0x140140879
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x210]
call fcn.1401017b0
lea rcx, [rbp + 0x210]
cmp eax, 0xffffffff
jne 0x140140860
call fcn.1400efdf0
mov esi, 7
jmp 0x140140a99
xor edx, edx
call fcn.1401fd730
xor r8d, r8d
movzx ecx, ax
call fcn.140186220
mov rdi, rax
test rax, rax
je 0x14013fbab
lea rcx, [rsp + 0x60]
call fcn.14012eb70
lea rcx, str._s_r_n_t
mov rdx, rax
call fcn.1402bbf64
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140189680
test al, al
jne 0x14013fb90
lea rcx, str.Could_not_locate_file_r_n
call fcn.1402ba358
jmp 0x14013fba0
mov rdx, qword [rbp - 0x30]
lea rcx, str.LCN_I64u_r_n
call fcn.1402ba358
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x140140a99
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
jmp 0x140140a99
lea rcx, str.Need_administrator_rights_r_n
call fcn.1402ba358
jmp 0x140140a99
call fcn.140171740
jmp 0x140140a99
call fcn.140171f40
movzx esi, al
jmp 0x140140a99
call fcn.140171780
movzx esi, al
jmp 0x140140a99
lea rcx, [rbp - 0x60]
call fcn.1401fd180
lea rcx, [rbp + 0x58]
call fcn.1401fd180
lea rcx, [rbp - 0x18]
call fcn.1401fd180
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.140179570
cmp eax, r15d
jne 0x14013fc92
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x14013fc84
mov edi, 2
jmp 0x14013fc8a
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x14013fc92
neg edi
lea rcx, [rbp - 0x28]
call fcn.140200560
test eax, eax
jle 0x14013fd17
test edi, edi
jle 0x14013fcb7
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
xor r8d, r8d
call fcn.1401ff6a0
test al, al
jne 0x14013fd17
lea rcx, [rbp - 0x28]
call fcn.1401783a0
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.140179570
cmp eax, r15d
jne 0x14013fd17
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x14013fd09
mov edi, 2
jmp 0x14013fd0f
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x14013fd17
neg edi
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x58]
call fcn.140005eb0
lea rcx, [rbp - 0x60]
call fcn.140005eb0
mov esi, edi
jmp 0x140140a99
call fcn.1401bc9e0
jmp 0x140140a99
test r14b, r14b
jne 0x14013fd56
call fcn.14013d850
lea rcx, [rsp + 0x70]
call fcn.1401fd180
lea rcx, [rbp - 0x78]
call fcn.1401fd180
lea rcx, [rbp - 8]
call fcn.1400d29d0
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x21]
mov rcx, rbx
call fcn.1402011d0
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x70]
mov rcx, rax
movzx edx, di
call fcn.1402010b0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013ff35
lea rcx, [rsp + 0x70]
call fcn.140200560
test eax, eax
je 0x14013ff35
lea rcx, [rbp - 0x78]
call fcn.140200560
test eax, eax
je 0x14013ff35
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401fd730
lea rcx, [rsp + 0x70]
xor edx, edx
movzx edi, ax
call fcn.1401fd730
cmp ax, di
je 0x14013fe22
lea rcx, [rbp - 0x78]
call fcn.14012eb70
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.14012eb70
lea rcx, str.Files_must_be_on_the_same_drive_r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402ba358
jmp 0x14013ff41
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x70]
call fcn.140208850
test al, al
jne 0x14013fe4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140355790]
mov edx, eax
call fcn.1402ba358
jmp 0x14013ff41
call fcn.1400ff8a0
test rax, rax
jne 0x14013fe63
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x14013ff3c
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401fd730
movzx ecx, ax
movzx edi, ax
call fcn.1401bcc80
mov r14, rax
test rax, rax
jne 0x14013fe96
lea rcx, str.No_file_system_for_drive__c:_r_n
movzx edx, di
call fcn.1402bbf64
jmp 0x14013ff41
mov rax, qword [rax]
mov rcx, r14
call qword [rax + 0x68]
test al, al
jne 0x14013feb7
lea rcx, str.File_system__c:_does_not_support_overwrite_r_n
movzx edx, di
call fcn.1402bbf64
jmp 0x14013ff41
lea rcx, [rbp - 0x78]
call fcn.14012eb70
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.14012eb70
lea rcx, str.Are_you_sure_you_want_to_overwrite__Y_N___r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402ba358
call fcn.1402bea0c
add eax, 0xffffffa7
test eax, 0xffffffdf
jne 0x14013ff41
mov rbx, qword [r14]
lea rcx, [rbp - 8]
call fcn.1400d2ab0
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2ac0
lea rdx, [rbp - 0x78]
mov r9d, edi
mov rcx, r14
mov r8, rax
call qword [rbx + 0x70]
test al, al
jne 0x14013ff27
lea rcx, str.Overwrite_failed__r_n
call fcn.1402bbf64
jmp 0x14013ff41
lea rcx, str.Overwrite_successful_r_n
call fcn.1402bbf64
jmp 0x14013ff41
lea rcx, str.Invalid_arguments_r_n
call fcn.1402ba358
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rbp - 8]
call fcn.1400d2a70
lea rcx, [rbp - 0x78]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x140140a99
test r14b, r14b
jne 0x14013ff7d
call fcn.14013d850
lea rcx, [rbp - 0x78]
call fcn.1401fd180
lea rcx, [rsp + 0x60]
call fcn.1401fd180
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x26]
mov rcx, rbx
call fcn.1402011d0
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x78]
mov rcx, rax
movzx edx, di
call fcn.1402010b0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x1401400fe
lea rcx, [rbp - 0x78]
call fcn.140200560
test eax, eax
je 0x1401400fe
lea rcx, [rsp + 0x60]
call fcn.140200560
test eax, eax
je 0x1401400fe
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401fd730
lea rcx, [rbp - 0x78]
xor edx, edx
movzx edi, ax
call fcn.1401fd730
cmp ax, di
je 0x14014001f
lea rcx, str.Files_must_be_on_the_same_drive_r_n
jmp 0x140140105
call fcn.1400ff8a0
mov r14, rax
test rax, rax
jne 0x140140038
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x140140105
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401fd730
movzx ecx, ax
call fcn.1401bcc80
mov rbx, rax
test rax, rax
jne 0x140140072
lea rcx, str.Failed_to_open_File_System_r_n
call fcn.1402ba358
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400ffd20
jmp 0x14014010a
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x38]
test al, al
jne 0x140140088
lea rcx, str.File_System_cannot_swap_files_r_n
jmp 0x1401400de
lea rcx, [rsp + 0x60]
call fcn.14012eb70
lea rcx, [rbp - 0x78]
mov rdi, rax
call fcn.14012eb70
lea rcx, str.Are_you_sure_you_want_to_swap__y_n__r_n_t_ws_r_n_t_ws_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402ba358
call fcn.1402bea0c
cmp eax, 0x79
jne 0x1401400e3
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x78]
mov rcx, rbx
call qword [rax + 0x40]
lea rcx, str.Successfully_swapped_files_r_n
test al, al
jne 0x1401400de
lea rcx, str.Failed_to_swap_files_r_n
call fcn.1402ba358
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400ffd20
jmp 0x14014010a
lea rcx, str.Invalid_arguments_r_n
call fcn.1402ba358
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rsp + 0x60]
call fcn.140005eb0
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x140140a99
test r14b, r14b
jne 0x14014013d
call fcn.14013d850
lea rdx, [rsp + 0x70]
mov r8d, 7
mov rcx, rbx
call fcn.1402011d0
lea rdx, [0x1403512cc]
lea rcx, [rsp + 0x70]
call fcn.1402019d0
test al, al
je 0x14014019a
lea rcx, [rsp + 0x70]
call fcn.140200560
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401fd730
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call fcn.1401f7000
mov r13, rax
test rax, rax
je 0x140140374
lea rcx, [rbp + 0x70]
call fcn.1400ce800
lea rcx, [rsp + 0x70]
call fcn.14012eb70
lea rcx, [0x14034da98]
mov rdx, rax
call fcn.1402bbf64
mov rdi, qword [r13]
lea rax, [rsp + 0x46]
lea r9, [rbp + 0x70]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test al, al
jne 0x14014021a
lea rcx, str.Failed_:__n
call fcn.1402bbf64
jmp 0x140140368
mov rdx, qword [rbp - 0x30]
lea rcx, str.Size_:__I64u_bytes_n
call fcn.1402bbf64
mov rax, qword [r13]
lea rdx, [rsp + 0x70]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x140140368
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400e3360
lea rdx, str..clone
mov rcx, rax
call fcn.1401fd8b0
lea rcx, [rbp + 0x28]
mov rdx, rax
call fcn.1401fd1a0
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rbp + 0xd8]
call fcn.14020aac0
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x18]
mov rdx, rax
call fcn.1400d2bd0
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
lea rcx, [rbp - 0x18]
call fcn.1402085e0
mov r14, rax
test rax, rax
je 0x14014034b
mov ecx, 0xa00000
call fcn.1402b4964
mov rdi, qword [rbx]
lea r9, [rsp + 0x54]
mov rdx, rax
mov r8d, 0xa00000
mov rcx, rbx
mov r12, rax
mov r15d, esi
call qword [rdi + 8]
test al, al
je 0x140140311
mov rdi, qword [r14]
mov r8d, dword [rsp + 0x54]
mov rdx, r12
mov rcx, r14
call qword [rdi + 0x48]
lea r9, [rsp + 0x54]
mov r8d, 0xa00000
add r15d, eax
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x1401402e2
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
lea rcx, str.Wrote:__u_bytes_n
mov edx, r15d
call fcn.1402bbf64
lea rcx, [rbp - 0x18]
call fcn.14012eb70
lea rcx, str._n_____s_n
mov rdx, rax
call fcn.1402bbf64
mov r15d, 1
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x28]
call fcn.140005eb0
mov rax, qword [r13]
mov edx, r15d
mov rcx, r13
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x140140a99
lea rcx, [rsp + 0x60]
call fcn.1401fd180
lea rcx, [rbp - 0x60]
call fcn.1401fd180
lea rcx, [rbp - 8]
call fcn.1400d29d0
test r14b, r14b
jne 0x1401403ba
call fcn.14013d850
mov edi, 0x2c
lea rdx, [rbp - 0x40]
mov rcx, rbx
lea r8d, [rdi - 0x25]
call fcn.1402011d0
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x60]
mov rcx, rax
movzx edx, di
call fcn.1402010b0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
je 0x140140403
lea rcx, str.Invalid_argument_s__r_n
jmp 0x1401404fb
lea rcx, [rsp + 0x60]
call fcn.140200560
test eax, eax
je 0x1401404f4
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14013d6d0
test al, al
je 0x1401404f4
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x60]
call fcn.140208850
test al, al
jne 0x14014045a
movaps xmm0, xmmword [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, str.Failed_to_read_file__ws_r_n
movdqa xmmword [rbp - 0x40], xmm0
call fcn.1402ba358
jmp 0x140140500
lea rcx, [rbp + 0xc30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rbp + 0xc30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1401f7000
mov rdi, rax
test rax, rax
jne 0x140140491
lea rcx, str.File_system_failed_r_n
jmp 0x1401404fb
mov rax, qword [rax]
mov rdx, qword [rbp - 0x30]
lea r8, [rbp - 8]
mov rcx, rdi
call qword [rax + 0x60]
mov rcx, rdi
test al, al
mov rax, qword [rdi]
jne 0x1401404d0
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2ab0
lea rcx, str.Failed_to_write__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402ba358
jmp 0x140140500
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2ab0
lea rcx, str.Wrote__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402ba358
jmp 0x140140500
lea rcx, str.Conversion_error_r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rbp - 8]
call fcn.1400d2a70
lea rcx, [rbp - 0x60]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x140140a99
test r14b, r14b
jne 0x140140530
call fcn.14013d850
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call fcn.1402011d0
call fcn.1400ff8a0
mov rdi, rax
test rax, rax
jne 0x140140561
lea rcx, str.Failed_to_deploy_driver_r_n
call fcn.1402ba358
jmp 0x14013fbab
lea rdx, [0x1403512cc]
lea rcx, [rsp + 0x60]
call fcn.1402019d0
test al, al
je 0x1401405ab
lea rcx, [rsp + 0x60]
call fcn.140200560
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140186540
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400ffd20
jmp 0x14013fbab
lea rdx, [rbp + 0x28]
mov r8d, 5
call fcn.1402011d0
lea rcx, [rbp + 0x28]
call fcn.1401bce00
call fcn.1402bea0c
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x140140a99
lea rcx, [rbp + 0x210]
call fcn.1400ee990
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013d750
lea rcx, [rbp + 0x210]
call fcn.140143fd0
mov rdi, rax
test rax, rax
jne 0x140140644
lea rcx, str.Miniport_failed_r_n
call fcn.1402bbf64
call fcn.1402bea0c
lea rcx, [rbp + 0x210]
call fcn.1400efdf0
jmp 0x140140a99
mov rcx, rax
call fcn.1401443c0
mov rcx, rdi
call fcn.1400ee8c0
mov rcx, rax
call fcn.14012eb70
lea rcx, [0x140348b5c]
mov rdx, rax
call fcn.1402bbf64
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
call fcn.1402bea0c
lea rcx, [rbp + 0x210]
call fcn.1400efdf0
jmp 0x140140a99
call fcn.1401bc480
jmp 0x140140a94
lea rdx, [rsp + 0x60]
mov r8d, 8
call fcn.1402011d0
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401fd730
cmp ax, 0x22
jne 0x1401406ed
lea rcx, [rsp + 0x60]
call fcn.140200560
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.140201490
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401fd670
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.140108640
lea rcx, [rsp + 0x60]
test al, al
sete sil
call fcn.140005eb0
jmp 0x140140a99
call fcn.140177e90
test al, al
je 0x14014078c
call fcn.14010ae30
test al, al
je 0x14014078c
jmp 0x140140a99
call fcn.14010ae30
mov r15d, esi
test al, al
sete r15b
mov esi, r15d
jmp 0x140140a99
lea rcx, [rbp - 0x18]
call fcn.1401bedb0
lea rcx, [rbp - 0x18]
call fcn.1401bf3b0
test r14b, r14b
jne 0x14014075c
call fcn.14013d850
lea rcx, str.Press_a_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
mov rcx, qword [rbp - 0x10]
lea rax, vtable.HitmanPro35::CrusaderService.0
mov qword [rbp - 0x18], rax
test rcx, rcx
je 0x140140789
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov r15d, esi
mov esi, r15d
jmp 0x140140a99
xor ecx, ecx
call fcn.1401bfd90
movzx esi, al
jmp 0x140140a99
xor edx, edx
xor ecx, ecx
call fcn.1401bf7c0
movzx esi, al
jmp 0x140140a99
lea rax, [0x140348ca0]
lea r9, [rbp - 0x60]
movzx r8d, r15b
movzx edx, r15b
xor ecx, ecx
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rax
call fcn.1401078e0
test al, al
sete sil
cmp dword [rbp - 0x58], 0
jle 0x140140a99
mov rcx, qword [rbp - 0x60]
call fcn.1402b9c20
jmp 0x140140a99
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, [0x1401bf510]
mov dword [0x14042bd90], r15d
mov qword [rbp], rax
lea rax, str.HitmanPro38CrusaderBoot
mov qword [rbp - 8], rax
jmp 0x140140849
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, str.HitmanPro38Crusader
mov dword [0x14042bd90], esi
mov qword [rbp - 8], rax
lea rax, [0x1401bf510]
mov qword [rbp], rax
lea rcx, [rbp - 8]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x140140a99
call fcn.14013a830
test al, al
jne 0x140140879
test bl, bl
jne 0x140140879
lea rcx, [rbp + 0x210]
call fcn.140107870
cmp byte [rsp + 0x4b], sil
jne 0x140140a0d
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
je 0x1401408a8
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x210]
call fcn.14013d7b0
movzx ebx, r15b
jmp 0x1401408ad
movzx ebx, byte [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.1400181b0
test rax, rax
je 0x1401408d4
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x210]
call fcn.1400f1a80
lea rcx, [rbp + 0x38]
call fcn.140009e30
test bl, bl
je 0x1401408e4
lea rcx, [rbp + 0x210]
call fcn.14013d760
cmp byte [rsp + 0x4f], sil
je 0x1401408f7
lea rcx, [rbp + 0x210]
call fcn.14013d770
test r12b, r12b
je 0x140140908
lea rcx, [rbp + 0x210]
call fcn.14013d760
movzx r12d, byte [rsp + 0x44]
test r12b, r12b
je 0x14014091f
lea rcx, [rbp + 0x210]
call fcn.14013d820
cmp byte [rsp + 0x48], sil
jne 0x140140932
lea rcx, [rbp + 0x210]
call fcn.14013d7d0
cmp byte [rsp + 0x4a], sil
jne 0x140140958
lea rcx, [rbp + 0x210]
call fcn.14013d7e0
lea rcx, [rbp + 0x210]
call fcn.14013d800
movzx ebx, byte [rsp + 0x42]
jmp 0x14014096d
movzx ebx, byte [rsp + 0x42]
test bl, bl
jne 0x14014096d
lea rcx, [rbp + 0x210]
call fcn.14013d800
cmp byte [rsp + 0x4c], sil
jne 0x140140980
lea rcx, [rbp + 0x210]
call fcn.14013d7f0
test bl, bl
jne 0x140140990
lea rcx, [rbp + 0x210]
call fcn.14013d800
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1401409a6
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013d810
cmp byte [rsp + 0x47], sil
je 0x1401409bc
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013d740
cmp byte [rsp + 0x46], sil
je 0x1401409d3
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.1400f38b0
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x1401409e9
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013d750
lea rcx, [rbp + 0x210]
call fcn.140100220
lea rcx, [rbp + 0x210]
call fcn.1400ec640
test al, al
mov eax, 5
cmovne esi, eax
jmp 0x140140a13
movzx r12d, byte [rsp + 0x44]
call fcn.1400f2660
lea rcx, [rbp + 0x210]
test al, al
mov rax, 0xffffffffffffffff
cmove esi, eax
call fcn.1400efdf0
call fcn.14013dc40
call fcn.1400f5790
cmp qword [0x14042bc70], 0
je 0x140140a6d
call fcn.140110960
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, qword [0x14042bc70]
call qword [sym.imp.USER32.dll_CloseDesktop]
test rdi, rdi
je 0x140140a7e
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax + 8]
test r14b, r14b
je 0x140140a99
test r12b, r12b
jne 0x140140a99
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402ba358
call fcn.1402bea0c
lea rcx, [rbp + 0xe8]
call fcn.14011aa20
lea rcx, [rbp + 0x88]
call fcn.140005eb0
lea rcx, [rbp + 0xb8]
call fcn.140005eb0
lea rcx, [rbp + 0x18]
call fcn.140003e60
lea rcx, [rbp + 0x38]
call fcn.140003e60
lea rcx, [rbp - 0x28]
call fcn.140005eb0
lea rcx, [rbp - 0x50]
call fcn.140005eb0
mov r13, qword [rsp + 0xfa0]
movaps xmm7, xmmword [rsp + 0xf50]
movaps xmm6, xmmword [rsp + 0xf60]
lea rcx, [rbp + 0x100]
call fcn.14011a780
mov eax, esi
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0xf70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret