Function at 0x140130790
Capabilities:
Compress data via winapi
Get common file path
Log keystrokes via polling
Print debug messages
Switch active desktop

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe70]
sub rsp, 0xf70
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0xe40], rax
lea rcx, [0x1403306e8]
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x140130816
lea rdx, [0x1403306c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401307f8
mov ecx, 0x800
call rax
jmp 0x140130816
lea rdx, str.SetDllDirectoryA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140130816
lea rcx, [0x140311bed]
call rax
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, r12d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.14029c7a0
xor esi, esi
mov qword [rbp + 0x68], rsi
call fcn.140112cc0
or r14, 0xffffffffffffffff
xorps xmm0, xmm0
movzx r15d, al
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x100], rax
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x120], esi
lea rax, [0x140323de0]
test rbx, rbx
jne 0x14013089c
mov edi, esi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rax
jmp 0x1401308de
mov rdi, r14
nop
inc rdi
cmp word [rbx + rdi*2], si
jne 0x1401308a0
mov qword [rsp + 0x78], rsi
test edi, edi
jne 0x1401308b9
mov qword [rsp + 0x70], rax
jmp 0x1401308de
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1401e9030
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.14029b4d8
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1401ea290
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.140114300
cmp dword [rsp + 0x78], esi
jle 0x14013090b
mov rcx, qword [rsp + 0x70]
call fcn.140298600
lea rbx, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
test r15b, r15b
je 0x1401309fa
mov ecx, 0x18
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x140130941
mov qword [rax], rbx
lea rax, [rbp + 0x100]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 8], rax
jmp 0x140130944
mov rdi, rsi
mov rbx, rsi
test rdi, rdi
je 0x140130968
mov ecx, 4
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x140130962
mov dword [rax], esi
jmp 0x140130965
mov rbx, rsi
mov dword [rbx], r12d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
je 0x1401309d7
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, str._crusader
xor r8d, r8d
mov rcx, rax
mov r15, rax
call fcn.1401eb700
test al, al
jne 0x1401309d7
lea rdx, str._kickstart
xor r8d, r8d
mov rcx, r15
call fcn.1401e9310
test al, al
je 0x1401309cb
call fcn.140112dc0
test al, al
jne 0x1401309d7
call fcn.140112e90
test al, al
jne 0x1401309d7
call fcn.140130250
test al, al
jne 0x140130b2a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
jne 0x140130974
test rbx, rbx
je 0x1401309fa
mov eax, dword [rbx]
test eax, eax
jle 0x1401309e6
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x1401309fa
mov rcx, rdi
call fcn.1402012c0
mov rcx, rbx
call fcn.1402012c0
mov qword [rsp + 0xfa0], r13
call fcn.14012fd40
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, esi
lea rdi, [0x1403ec3b8]
mov r15, rax
mov edx, dword [rdi - 8]
mov rcx, r15
call fcn.14013a2f0
mov rcx, qword [rdi]
inc ebx
mov qword [rcx], rax
movsxd rcx, ebx
lea rdi, [rdi + 0x10]
cmp rcx, 0xa
jb 0x140130a20
mov rcx, r15
call fcn.14013a520
lea rcx, [0x1403fd8d0]
mov dword [0x1403fd7b4], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea rdi, [0x1403fd900]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140130a94
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403fd8c8], rax
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [0x1403ec168]
xor r15b, r15b
shr eax, 0xf
mov byte [rsp + 0x41], sil
mov byte [rsp + 0x40], sil
and al, r12b
mov byte [rsp + 0x45], r12b
mov byte [rsp + 0x4f], sil
mov byte [rsp + 0x43], sil
mov byte [rsp + 0x4e], sil
mov byte [rsp + 0x49], sil
mov dword [rbp - 0x80], eax
mov byte [rsp + 0x50], sil
mov byte [rsp + 0x4b], sil
mov byte [rsp + 0x4d], sil
mov byte [rsp + 0x48], r12b
mov byte [rsp + 0x4a], r12b
mov byte [rsp + 0x4c], r12b
mov byte [rsp + 0x42], r12b
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x47], sil
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], esi
mov r13d, esi
test rbx, rbx
jne 0x140130b5a
lea rbx, [0x140323de0]
mov edi, esi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], rbx
jmp 0x140130ba7
test rbx, rbx
je 0x140132bac
mov eax, dword [rbx]
test eax, eax
jle 0x140130b3d
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x140132bac
mov rcx, rdi
call fcn.1402012c0
mov rcx, rbx
call fcn.1402012c0
jmp 0x140132bac
mov rdi, r14
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140130b60
mov qword [rbp - 0x48], rsi
test edi, edi
jne 0x140130b7e
lea rbx, [0x140323de0]
mov qword [rbp - 0x50], rbx
jmp 0x140130ba7
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1401e9030
mov eax, dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.14029b4d8
lea rbx, [0x140323de0]
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1401ea290
mov rdi, qword [0x1403ec168]
test rdi, rdi
jne 0x140130bd0
mov r14d, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rbx
jmp 0x140130c0c
inc r14
cmp word [rdi + r14*2], si
jne 0x140130bd0
mov qword [rbp - 0x20], rsi
test r14d, r14d
jne 0x140130be9
mov qword [rbp - 0x28], rbx
jmp 0x140130c0c
lea rcx, [rbp - 0x28]
mov edx, r14d
call fcn.1401e9030
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
inc eax
movsxd r9, r14d
mov r8, rdi
movsxd rdx, eax
call fcn.14029b4d8
lea rcx, [rbp - 0x28]
mov edx, r14d
call fcn.1401ea290
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
call fcn.14000a210
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x38], rax
call fcn.14000a210
mov ecx, 0x18
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x90], rsi
call fcn.14029806c
mov r14, rax
test rax, rax
je 0x140130c83
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [r14 + 0x10], rsi
mov qword [r14], rax
lea rax, [rbp + 0x100]
mov qword [r14 + 8], rax
jmp 0x140130c86
mov r14, rsi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0xe8], rax
test r14, r14
je 0x140130cc7
mov ecx, 4
call fcn.14029806c
test rax, rax
je 0x140130cba
mov dword [rax], esi
jmp 0x140130cbd
mov rax, rsi
mov qword [rbp + 0xf8], rax
mov dword [rax], r12d
mov rax, qword [r14]
mov rcx, r14
movaps xmmword [rsp + 0xf60], xmm6
movaps xmmword [rsp + 0xf50], xmm7
call qword [rax]
test al, al
je 0x140131aa1
movsd xmm7, qword [0x14034ccc8]
mov rax, qword [r14]
mov rcx, r14
mov edi, 2
call qword [rax + 0x10]
lea rdx, str._kickstart
mov r8d, r12d
mov rcx, rax
mov rbx, rax
call fcn.1401e9310
test al, al
je 0x140130e3a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x10000000
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rcx, rax
mov qword [rbp + 0xc8], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, 0xe0
call fcn.14029806c
mov rbx, rax
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140130d89
mov rcx, rax
call fcn.1401f59c0
lea rax, vtable.HitmanPro35::UI::KickstartDesktop.0
mov qword [rcx + 0xc0], rsi
mov qword [rcx], rax
mov qword [rcx + 0xc8], rsi
call fcn.140125d70
jmp 0x140130d8d
mov qword [rbp + 0x68], rsi
lea rcx, [0x14032e5e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov rcx, rax
mov qword [0x1403fd8b8], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov qword [rsp + 0x30], rsi
lea rcx, str..hmpkick
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140130e28
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x22e260
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1403fd8b8]
call qword [sym.imp.USER32.dll_SwitchDesktop]
jmp 0x140131a91
lea rdx, str._debug
mov r8d, r12d
mov rcx, rbx
call fcn.1401eb700
mov r8d, r12d
mov rcx, rbx
test al, al
je 0x140130e98
lea rdx, str.:full
call fcn.1401e8ee0
mov ecx, dword [0x1403fd7b0]
test al, al
cmovne ecx, edi
mov dword [0x1403fd7b0], ecx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x14012fa70]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp 0x140131a91
lea rdx, str._console
call fcn.1401e9310
test al, al
je 0x140130ee9
test r15b, r15b
jne 0x140131a91
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x140131a91
call fcn.1402997f8
lea r8, [0x14032f2b8]
lea rdx, [0x14032f2b0]
lea r9, [rax + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14029c748
movzx r15d, r12b
jmp 0x140131a91
lea rdx, str._crusader
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x1401328e0
lea rdx, str._crusader:boot
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x1401328b4
lea rdx, str._installservice
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x1401328a3
lea rdx, str._uninstallservice
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x140132894
lea rdx, str._listen
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x140132830
lea rdx, [0x14032bf48]
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x14013281a
lea rdx, str._deactivate
mov r8d, r12d
mov rcx, rbx
call fcn.1401e9310
test al, al
jne 0x1401327ff
lea rdx, str._update:
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
jne 0x140132782
lea rdx, str._updated:
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x140131054
lea rdx, [rbp + 0xa8]
mov r8d, 9
call fcn.1401eaef0
lea rcx, [rbp + 0xa8]
xor edx, edx
call fcn.1401e7500
cmp ax, 0x22
jne 0x140131037
lea rcx, [rbp + 0xa8]
call fcn.1401ea280
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0xa8]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rbp + 0xa8]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x1b8]
call fcn.140005d80
lea rcx, [rbp + 0xa8]
call fcn.140108af0
lea rcx, [rbp + 0xa8]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._upgraded:
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x1401310ef
lea rdx, [rbp + 0x98]
mov r8d, 0xa
call fcn.1401eaef0
lea rcx, [rbp + 0x98]
xor edx, edx
call fcn.1401e7500
cmp ax, 0x22
jne 0x1401310d2
lea rcx, [rbp + 0x98]
call fcn.1401ea280
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x98]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rbp + 0x98]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x1c8]
call fcn.140005d80
lea rcx, [rbp + 0x98]
call fcn.14010a220
lea rcx, [rbp + 0x98]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._xtdl
call fcn.1401e9300
test al, al
jne 0x140132778
lea rdx, str._miniport
mov rcx, rbx
call fcn.1401e9300
test al, al
jne 0x1401326df
lea rdx, str._rfs
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
jne 0x1401326b4
lea rdx, str._sr
call fcn.1401eb6f0
test al, al
jne 0x140132612
lea rdx, str._lcn
mov rcx, rbx
call fcn.1401eb6f0
test al, al
je 0x14013119d
test r15b, r15b
jne 0x140131169
call fcn.14012f950
movzx r15d, al
lea rdx, [rsp + 0x60]
mov r8d, 5
mov rcx, rbx
call fcn.1401eaef0
lea rcx, [rsp + 0x60]
call fcn.1401ea280
lea rcx, [rsp + 0x60]
test eax, eax
jg 0x140131c39
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._write
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x140132480
lea rdx, str._clone
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x14013221a
lea rdx, str._swap
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x14013205a
lea rdx, str._overwrite
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x140131e33
lea rdx, str._protectmbr
mov rcx, rbx
call fcn.1401e9300
test al, al
jne 0x140131e29
lea rdx, str._lic
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x140131255
lea rdx, [rbp + 0x168]
mov r8d, 5
call fcn.1401eaef0
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x168]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._renew
call fcn.1401e9300
test al, al
je 0x14013126f
call fcn.140167570
jmp 0x140131a91
lea rdx, str._checklic
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x140131cf2
lea rdx, str._scan
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401312a3
mov byte [rsp + 0x40], r12b
jmp 0x140131a91
lea rdx, str._scan:boot
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401313c0
mov byte [rbp - 0x80], sil
call fcn.140112bd0
test al, al
je 0x140131ce1
xor ecx, ecx
mov byte [rsp + 0x40], r12b
call fcn.1400f3b20
mov rbx, rax
test rax, rax
je 0x1401313b1
lea rcx, [rbp - 0x60]
call fcn.1401e6f50
lea r8, [rbp - 0x60]
lea rdx, [0x14032b7d0]
mov rcx, rbx
call fcn.1400d5720
mov rdi, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rdi]
lea rcx, [rbp + 0x70]
call fcn.1400cdd90
lea rcx, [rbp - 0x60]
call fcn.1401ea280
cmp eax, 0x13
jl 0x14013139f
lea rdx, str.yyyy_MM_dd_HH:mm:ss
lea rcx, [rbp + 0x148]
call fcn.1401e6fd0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x60]
xor r9d, r9d
call fcn.1400ec150
lea rcx, [rbp + 0x148]
test al, al
sete dil
call fcn.140005d80
test dil, dil
jne 0x14013139f
lea rcx, [rbp - 8]
call fcn.1400d1620
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x198]
mov rcx, rax
call fcn.1400ca960
mov rcx, rax
call fcn.1400e0b50
lea rcx, [rbp + 0x198]
movaps xmm6, xmm0
call fcn.1400ca910
comisd xmm7, xmm6
ja 0x140131cca
lea rcx, [rbp + 0x70]
call fcn.1400ca950
lea rcx, [rbp - 0x60]
call fcn.140005d80
call fcn.140114bf0
call fcn.140114a40
jmp 0x140131a91
lea rdx, str._quiet
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401313dd
mov byte [rsp + 0x41], r12b
jmp 0x140131a91
lea rdx, str._noscan
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401313fa
mov byte [rsp + 0x4b], r12b
jmp 0x140131a91
lea rdx, str._noinstall
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x140131417
mov byte [rsp + 0x43], r12b
jmp 0x140131a91
lea rdx, str._nostartboot
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x140131434
mov byte [rsp + 0x4e], r12b
jmp 0x140131a91
lea rdx, str._nodesktopshortcut
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x140131451
mov byte [rsp + 0x49], r12b
jmp 0x140131a91
lea rdx, str._nostartmenushortcut
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x14013146e
mov byte [rsp + 0x50], r12b
jmp 0x140131a91
lea rdx, str._noupdate
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x14013148b
mov byte [rsp + 0x45], sil
jmp 0x140131a91
lea rdx, str._noupload
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401314a8
mov byte [rsp + 0x48], sil
jmp 0x140131a91
lea rdx, str._noremnants
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401314c5
mov byte [rsp + 0x4a], sil
jmp 0x140131a91
lea rdx, str._nocookies
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401314e2
mov byte [rsp + 0x4c], sil
jmp 0x140131a91
lea rdx, str._nopups
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401314ff
mov byte [rsp + 0x42], sil
jmp 0x140131a91
lea rdx, str._pup
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x140131584
lea rdx, [rbp + 0x58]
mov r8d, 5
call fcn.1401eaef0
lea rdx, [0x14032fd88]
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401e9310
test al, al
je 0x140131551
lea rcx, [rbp + 0x58]
mov dword [rsp + 0x58], 4
call fcn.140005d80
jmp 0x140131a91
lea rdx, str.ignore
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401e9310
mov edi, dword [rsp + 0x58]
lea rcx, [rbp + 0x58]
test al, al
mov eax, 8
cmovne edi, eax
mov dword [rsp + 0x58], edi
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._scanonly
call fcn.1401e9300
test al, al
je 0x1401315ad
mov byte [rsp + 0x40], r12b
mov byte [rsp + 0x41], r12b
mov byte [rsp + 0x43], r12b
mov byte [rsp + 0x44], r12b
jmp 0x140131a91
lea rdx, str._clean
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401315d4
mov byte [rsp + 0x40], r12b
mov byte [rsp + 0x4f], r12b
mov byte [rsp + 0x45], sil
jmp 0x140131a91
lea rdx, str._ews
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x1401315f1
mov byte [rsp + 0x46], r12b
jmp 0x140131a91
lea rdx, str._quick
mov rcx, rbx
call fcn.1401e9300
test al, al
je 0x14013160e
mov byte [rsp + 0x47], r12b
jmp 0x140131a91
lea rdx, str._log
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x1401316f4
lea rdx, [rbp + 0x158]
mov r8d, 5
call fcn.1401eaef0
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x158]
call fcn.140005d80
lea rdx, [0x14032c0d4]
lea rcx, [rbp - 0x50]
call fcn.1401eb6f0
test al, al
je 0x1401316b2
lea rdx, [0x14032c0d4]
lea rcx, [rbp - 0x50]
call fcn.1401e8ed0
test al, al
je 0x1401316b2
lea rcx, [rbp - 0x50]
call fcn.1401ea280
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x50]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x1d8]
call fcn.140005d80
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x128]
call fcn.1400dfeb0
test r13d, r13d
jne 0x1401316e3
lea rdx, str..txt
lea rcx, [rbp + 0x128]
xor r8d, r8d
call fcn.1401e9310
test al, al
cmovne r13d, edi
lea rcx, [rbp + 0x128]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._logtype
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x140131765
lea rdx, [rbp - 0x18]
mov r8d, 9
call fcn.1401eaef0
lea rdx, [0x14032fe18]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401e9310
test al, al
je 0x14013173e
lea rcx, [rbp - 0x18]
mov r13d, edi
call fcn.140005d80
jmp 0x140131a91
lea rdx, [0x140328de0]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401e9310
lea rcx, [rbp - 0x18]
test al, al
cmovne r13d, r12d
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._nologs
call fcn.1401e9300
test al, al
je 0x14013177f
mov byte [rsp + 0x4d], r12b
jmp 0x140131a91
lea rdx, [0x14032fe30]
mov rcx, rbx
call fcn.1401eb6f0
test al, al
je 0x14013179b
mov byte [rbp - 0x80], r12b
jmp 0x140131a91
lea rdx, str._ecat
mov rcx, rbx
call fcn.1401eb6f0
test al, al
jne 0x140131a91
lea rdx, str._diskmode
mov rcx, rbx
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x14013180f
lea rdx, [rbp + 0x138]
mov r8d, 0xa
call fcn.1401eaef0
lea rdx, str.compatible
lea rcx, [rbp + 0x138]
xor r8d, r8d
call fcn.1401e9310
mov ecx, dword [rsp + 0x54]
test al, al
cmovne ecx, r12d
mov dword [rsp + 0x54], ecx
lea rcx, [rbp + 0x138]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._excludelist
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x1401318b3
lea rdx, [rbp + 0x48]
mov r8d, 0xd
call fcn.1401eaef0
lea rdx, [0x14032c0d4]
lea rcx, [rbp + 0x48]
call fcn.1401eb6f0
test al, al
je 0x140131895
lea rdx, [0x14032c0d4]
lea rcx, [rbp + 0x48]
call fcn.1401e8ed0
test al, al
je 0x140131895
lea rcx, [rbp + 0x48]
call fcn.1401ea280
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x48]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rbp + 0x48]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x1a8]
call fcn.140005d80
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
xor r8d, r8d
call fcn.14012fe80
lea rcx, [rbp + 0x48]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._filelist
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x140131958
lea rdx, [rbp - 0x78]
mov r8d, 0xa
call fcn.1401eaef0
lea rdx, [0x14032c0d4]
lea rcx, [rbp - 0x78]
call fcn.1401eb6f0
test al, al
je 0x140131939
lea rdx, [0x14032c0d4]
lea rcx, [rbp - 0x78]
call fcn.1401e8ed0
test al, al
je 0x140131939
lea rcx, [rbp - 0x78]
call fcn.1401ea280
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x78]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rbp - 0x78]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x178]
call fcn.140005d80
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x78]
movzx r8d, r12b
call fcn.14012fe80
lea rcx, [rbp - 0x78]
call fcn.140005d80
jmp 0x140131a91
lea rdx, [0x14032feb8]
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x14013199d
lea rdx, [rbp + 0x188]
mov r8d, 7
call fcn.1401eaef0
lea rcx, [rbp + 0xb8]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0x188]
call fcn.140005d80
jmp 0x140131a91
lea rdx, str._proxycred
call fcn.1401eb6f0
mov rcx, rbx
test al, al
je 0x1401319e2
lea rdx, [rbp + 0xd8]
mov r8d, 0xb
call fcn.1401eaef0
lea rcx, [rbp + 0x88]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp + 0xd8]
call fcn.140005d80
jmp 0x140131a91
lea rdx, [0x140329d94]
call fcn.1401eb6f0
test al, al
jne 0x140131a91
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1401ebac0
mov rcx, rax
call fcn.1401ea280
lea rcx, [rbp - 0x40]
test eax, eax
sete dil
call fcn.140005d80
test dil, dil
jne 0x140131a91
lea rdx, [0x14032c0d4]
mov rcx, rbx
call fcn.1401eb6f0
test al, al
je 0x140131a7e
lea rdx, [0x14032c0d4]
mov rcx, rbx
call fcn.1401e8ed0
test al, al
je 0x140131a7e
mov rcx, rbx
call fcn.1401ea280
lea rdx, [rbp + 0x28]
mov r8d, r12d
lea r9d, [rax - 2]
mov rcx, rbx
call fcn.1401eb1b0
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x18]
call fcn.1400e92e0
lea rcx, [rbp + 0x28]
call fcn.140005d80
jmp 0x140131a91
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
mov r8, rbx
call fcn.1400e92e0
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
test al, al
jne 0x140130cef
lea rcx, [rbp + 0x18]
call fcn.140017f70
test rax, rax
jne 0x140131aba
cmp byte [rbp - 0x80], sil
je 0x140131aba
call fcn.14012b840
call fcn.140108c70
lea rcx, [rbp + 0x210]
call fcn.1400ef570
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14012f890
mov rdi, qword [rbp + 0x68]
lea rcx, [rbp + 0x210]
mov rdx, rdi
call fcn.14012f8a0
lea rcx, [rbp + 0x88]
call fcn.1401ea280
test eax, eax
jle 0x140131b11
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x210]
call fcn.1400f2040
lea rcx, [rbp + 0xb8]
call fcn.1401ea280
test eax, eax
jle 0x140131b2d
lea rcx, [rbp + 0xb8]
call fcn.1401305a0
cmp byte [rsp + 0x45], sil
jne 0x140131b40
lea rcx, [rbp + 0x210]
call fcn.14012f880
movzx ebx, byte [rsp + 0x43]
test bl, bl
je 0x140131b59
lea rcx, [rbp + 0x210]
movzx edx, r12b
call fcn.14011cfd0
cmp byte [rsp + 0x4e], sil
je 0x140131b70
lea rcx, [rbp + 0x210]
movzx edx, r12b
call fcn.14011cfe0
cmp byte [rsp + 0x49], sil
je 0x140131b87
lea rcx, [rbp + 0x210]
movzx edx, r12b
call fcn.14011cff0
cmp byte [rsp + 0x50], sil
je 0x140131b9e
lea rcx, [rbp + 0x210]
movzx edx, r12b
call fcn.14011d000
movzx r14d, byte [rsp + 0x41]
test r14b, r14b
je 0x140131bb5
lea rcx, [rbp + 0x210]
call fcn.14012f8c0
lea rcx, [rbp - 0x50]
call fcn.1401ea280
test eax, eax
jle 0x140131bd2
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x210]
call fcn.1401008e0
test r13d, r13d
je 0x140131be6
lea rcx, [rbp + 0x210]
mov edx, r13d
call fcn.14012f940
cmp byte [rsp + 0x4d], sil
je 0x140131bf9
lea rcx, [rbp + 0x210]
call fcn.14012f930
lea rcx, [rbp - 0x28]
call fcn.1401ea280
test eax, eax
jle 0x140132939
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x210]
call fcn.140101ec0
lea rcx, [rbp + 0x210]
cmp eax, 0xffffffff
jne 0x140132920
call fcn.1400f0980
mov esi, 7
jmp 0x140132b4c
xor edx, edx
call fcn.1401e7500
xor r8d, r8d
movzx ecx, ax
call fcn.140175400
mov rdi, rax
test rax, rax
je 0x140131caa
lea rcx, [rsp + 0x60]
call fcn.140120cb0
lea rcx, str._s_r_n_t
mov rdx, rax
call fcn.14029a88c
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140178860
test al, al
jne 0x140131c8f
lea rcx, str.Could_not_locate_file_r_n
call fcn.140298d38
jmp 0x140131c9f
mov rdx, qword [rbp - 0x30]
lea rcx, str.LCN_I64u_r_n
call fcn.140298d38
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rsp + 0x60]
call fcn.140005d80
jmp 0x140132b4c
lea rcx, [rbp + 0x70]
call fcn.1400ca950
lea rcx, [rbp - 0x60]
call fcn.140005d80
jmp 0x140132b4c
lea rcx, str.Need_administrator_rights_r_n
call fcn.140298d38
jmp 0x140132b4c
lea rcx, [rbp - 0x60]
call fcn.1401e6f50
lea rcx, [rbp + 0x58]
call fcn.1401e6f50
lea rcx, [rbp - 0x18]
call fcn.1401e6f50
lea rcx, [rbp + 0x70]
call fcn.1400cdd90
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.140168a70
cmp eax, r12d
jne 0x140131d6d
mov eax, dword [rsp + 0x58]
test r12b, al
je 0x140131d5f
mov edi, 2
jmp 0x140131d65
test al, 2
cmovne edi, r12d
bt eax, 8
jae 0x140131d6d
neg edi
lea rcx, [rbp - 0x28]
call fcn.1401ea280
test eax, eax
jle 0x140131dfe
test edi, edi
jle 0x140131d9e
mov eax, dword [rbp - 0x1c]
cmp dword [rbp - 0x54], eax
jne 0x140131d9e
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
xor r8d, r8d
call fcn.1401e9470
test al, al
jne 0x140131dfe
lea rcx, [rbp - 0x28]
call fcn.1401678a0
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.140168a70
cmp eax, r12d
jne 0x140131dfe
mov eax, dword [rsp + 0x58]
test r12b, al
je 0x140131df0
mov edi, 2
jmp 0x140131df6
test al, 2
cmovne edi, r12d
bt eax, 8
jae 0x140131dfe
neg edi
lea rcx, [rbp + 0x70]
call fcn.1400ca950
lea rcx, [rbp - 0x18]
call fcn.140005d80
lea rcx, [rbp + 0x58]
call fcn.140005d80
lea rcx, [rbp - 0x60]
call fcn.140005d80
mov esi, edi
jmp 0x140132b4c
call fcn.1401ab670
jmp 0x140132b4c
test r15b, r15b
jne 0x140131e3d
call fcn.14012f950
lea rcx, [rsp + 0x70]
call fcn.1401e6f50
lea rcx, [rbp - 0x78]
call fcn.1401e6f50
lea rcx, [rbp - 8]
call fcn.1400d13a0
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x21]
mov rcx, rbx
call fcn.1401eaef0
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x70]
mov rcx, rax
movzx edx, di
call fcn.1401eadd0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005d80
test dil, dil
jne 0x14013201c
lea rcx, [rsp + 0x70]
call fcn.1401ea280
test eax, eax
je 0x14013201c
lea rcx, [rbp - 0x78]
call fcn.1401ea280
test eax, eax
je 0x14013201c
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401e7500
lea rcx, [rsp + 0x70]
xor edx, edx
movzx edi, ax
call fcn.1401e7500
cmp ax, di
je 0x140131f09
lea rcx, [rbp - 0x78]
call fcn.140120cb0
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.140120cb0
lea rcx, str.Files_must_be_on_the_same_drive_r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.140298d38
jmp 0x140132028
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x70]
call fcn.1401f2430
test al, al
jne 0x140131f34
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14032fa98]
mov edx, eax
call fcn.140298d38
jmp 0x140132028
call fcn.1400fffc0
test rax, rax
jne 0x140131f4a
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x140132023
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401e7500
movzx ecx, ax
movzx edi, ax
call fcn.1401ab910
mov r14, rax
test rax, rax
jne 0x140131f7d
lea rcx, str.No_file_system_for_drive__c:_r_n
movzx edx, di
call fcn.14029a88c
jmp 0x140132028
mov rax, qword [rax]
mov rcx, r14
call qword [rax + 0x68]
test al, al
jne 0x140131f9e
lea rcx, str.File_system__c:_does_not_support_overwrite_r_n
movzx edx, di
call fcn.14029a88c
jmp 0x140132028
lea rcx, [rbp - 0x78]
call fcn.140120cb0
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.140120cb0
lea rcx, str.Are_you_sure_you_want_to_overwrite__Y_N___r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.140298d38
call fcn.14029c7b8
add eax, 0xffffffa7
test eax, 0xffffffdf
jne 0x140132028
mov rbx, qword [r14]
lea rcx, [rbp - 8]
call fcn.1400d1480
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d1490
lea rdx, [rbp - 0x78]
mov r9d, edi
mov rcx, r14
mov r8, rax
call qword [rbx + 0x70]
test al, al
jne 0x14013200e
lea rcx, str.Overwrite_failed__r_n
call fcn.14029a88c
jmp 0x140132028
lea rcx, str.Overwrite_successful_r_n
call fcn.14029a88c
jmp 0x140132028
lea rcx, str.Invalid_arguments_r_n
call fcn.140298d38
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rbp - 8]
call fcn.1400d1440
lea rcx, [rbp - 0x78]
call fcn.140005d80
lea rcx, [rsp + 0x70]
call fcn.140005d80
jmp 0x140132b4c
test r15b, r15b
jne 0x140132064
call fcn.14012f950
lea rcx, [rbp - 0x78]
call fcn.1401e6f50
lea rcx, [rsp + 0x60]
call fcn.1401e6f50
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x26]
mov rcx, rbx
call fcn.1401eaef0
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x78]
mov rcx, rax
movzx edx, di
call fcn.1401eadd0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005d80
test dil, dil
jne 0x1401321e5
lea rcx, [rbp - 0x78]
call fcn.1401ea280
test eax, eax
je 0x1401321e5
lea rcx, [rsp + 0x60]
call fcn.1401ea280
test eax, eax
je 0x1401321e5
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401e7500
lea rcx, [rbp - 0x78]
xor edx, edx
movzx edi, ax
call fcn.1401e7500
cmp ax, di
je 0x140132106
lea rcx, str.Files_must_be_on_the_same_drive_r_n
jmp 0x1401321ec
call fcn.1400fffc0
mov r14, rax
test rax, rax
jne 0x14013211f
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x1401321ec
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401e7500
movzx ecx, ax
call fcn.1401ab910
mov rbx, rax
test rax, rax
jne 0x140132159
lea rcx, str.Failed_to_open_File_System_r_n
call fcn.140298d38
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140100440
jmp 0x1401321f1
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x38]
test al, al
jne 0x14013216f
lea rcx, str.File_System_cannot_swap_files_r_n
jmp 0x1401321c5
lea rcx, [rsp + 0x60]
call fcn.140120cb0
lea rcx, [rbp - 0x78]
mov rdi, rax
call fcn.140120cb0
lea rcx, str.Are_you_sure_you_want_to_swap__y_n__r_n_t_ws_r_n_t_ws_r_n
mov rdx, rax
mov r8, rdi
call fcn.140298d38
call fcn.14029c7b8
cmp eax, 0x79
jne 0x1401321ca
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x78]
mov rcx, rbx
call qword [rax + 0x40]
lea rcx, str.Successfully_swapped_files_r_n
test al, al
jne 0x1401321c5
lea rcx, str.Failed_to_swap_files_r_n
call fcn.140298d38
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140100440
jmp 0x1401321f1
lea rcx, str.Invalid_arguments_r_n
call fcn.140298d38
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rsp + 0x60]
call fcn.140005d80
lea rcx, [rbp - 0x78]
call fcn.140005d80
jmp 0x140132b4c
test r15b, r15b
jne 0x140132224
call fcn.14012f950
lea rdx, [rsp + 0x70]
mov r8d, 7
mov rcx, rbx
call fcn.1401eaef0
lea rdx, [0x14032c0d4]
lea rcx, [rsp + 0x70]
call fcn.1401eb6f0
test al, al
je 0x140132281
lea rcx, [rsp + 0x70]
call fcn.1401ea280
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp - 0x40]
call fcn.140005d80
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401e7500
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call fcn.1401e0ed0
mov r13, rax
test rax, rax
je 0x140132460
lea rcx, [rbp + 0x70]
call fcn.1400cdd90
lea rcx, [rsp + 0x70]
call fcn.140120cb0
lea rcx, [0x140328838]
mov rdx, rax
call fcn.14029a88c
mov rdi, qword [r13]
lea rax, [rsp + 0x46]
lea r9, [rbp + 0x70]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test al, al
jne 0x140132301
lea rcx, str.Failed_:__n
call fcn.14029a88c
jmp 0x140132454
mov rdx, qword [rbp - 0x30]
lea rcx, str.Size_:__I64u_bytes_n
call fcn.14029a88c
mov rax, qword [r13]
lea rdx, [rsp + 0x70]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x140132454
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400dff30
lea rdx, str..clone
mov rcx, rax
call fcn.1401e7680
lea rcx, [rbp + 0x28]
mov rdx, rax
call fcn.1401e6f70
lea rcx, [rbp - 0x40]
call fcn.140005d80
lea rcx, [rbp + 0xd8]
call fcn.1401f4700
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x18]
mov rdx, rax
call fcn.1400d1690
lea rcx, [rbp + 0xd8]
call fcn.140005d80
lea rcx, [rbp - 0x18]
call fcn.1401f21c0
mov r14, rax
test rax, rax
je 0x140132437
mov ecx, 0xa00000
call fcn.140296f58
mov rdi, qword [rbx]
lea r9, [rsp + 0x54]
mov rdx, rax
mov r8d, 0xa00000
mov rcx, rbx
mov r12, rax
mov r15d, esi
call qword [rdi + 8]
test al, al
je 0x1401323ff
nop dword [rax]
mov rdi, qword [r14]
mov r8d, dword [rsp + 0x54]
mov rdx, r12
mov rcx, r14
call qword [rdi + 0x48]
lea r9, [rsp + 0x54]
mov r8d, 0xa00000
add r15d, eax
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x1401323d0
mov rax, qword [r14]
mov r12d, 1
mov rcx, r14
mov edx, r12d
call qword [rax]
lea rcx, str.Wrote:__u_bytes_n
mov edx, r15d
call fcn.14029a88c
lea rcx, [rbp - 0x18]
call fcn.140120cb0
lea rcx, str._n_____s_n
mov rdx, rax
call fcn.14029a88c
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
lea rcx, [rbp - 0x18]
call fcn.140005d80
lea rcx, [rbp + 0x28]
call fcn.140005d80
mov rax, qword [r13]
mov edx, r12d
mov rcx, r13
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rsp + 0x70]
call fcn.140005d80
jmp 0x140132b4c
lea rcx, [rsp + 0x60]
call fcn.1401e6f50
lea rcx, [rbp - 0x60]
call fcn.1401e6f50
lea rcx, [rbp - 8]
call fcn.1400d13a0
test r15b, r15b
jne 0x1401324a6
call fcn.14012f950
mov edi, 0x2c
lea rdx, [rbp - 0x40]
mov rcx, rbx
lea r8d, [rdi - 0x25]
call fcn.1401eaef0
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x60]
mov rcx, rax
movzx edx, di
call fcn.1401eadd0
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005d80
test dil, dil
je 0x1401324ef
lea rcx, str.Invalid_argument_s__r_n
jmp 0x1401325e7
lea rcx, [rsp + 0x60]
call fcn.1401ea280
test eax, eax
je 0x1401325e0
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14012f7d0
test al, al
je 0x1401325e0
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x60]
call fcn.1401f2430
test al, al
jne 0x140132546
movaps xmm0, xmmword [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, str.Failed_to_read_file__ws_r_n
movdqa xmmword [rbp - 0x40], xmm0
call fcn.140298d38
jmp 0x1401325ec
lea rcx, [rbp + 0xc30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rbp + 0xc30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1401e0ed0
mov rdi, rax
test rax, rax
jne 0x14013257d
lea rcx, str.File_system_failed_r_n
jmp 0x1401325e7
mov rax, qword [rax]
mov rdx, qword [rbp - 0x30]
lea r8, [rbp - 8]
mov rcx, rdi
call qword [rax + 0x60]
mov rcx, rdi
test al, al
mov rax, qword [rdi]
jne 0x1401325bc
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d1480
lea rcx, str.Failed_to_write__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.140298d38
jmp 0x1401325ec
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d1480
lea rcx, str.Wrote__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.140298d38
jmp 0x1401325ec
lea rcx, str.Conversion_error_r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rbp - 8]
call fcn.1400d1440
lea rcx, [rbp - 0x60]
call fcn.140005d80
lea rcx, [rsp + 0x60]
call fcn.140005d80
jmp 0x140132b4c
test r15b, r15b
jne 0x14013261c
call fcn.14012f950
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call fcn.1401eaef0
call fcn.1400fffc0
mov rdi, rax
test rax, rax
jne 0x14013264d
lea rcx, str.Failed_to_deploy_driver_r_n
call fcn.140298d38
jmp 0x140131caa
lea rdx, [0x14032c0d4]
lea rcx, [rsp + 0x60]
call fcn.1401eb6f0
test al, al
je 0x140132697
lea rcx, [rsp + 0x60]
call fcn.1401ea280
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp - 0x40]
call fcn.140005d80
lea rcx, [rsp + 0x60]
call fcn.140175720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140100440
jmp 0x140131caa
lea rdx, [rbp + 0x28]
mov r8d, 5
call fcn.1401eaef0
lea rcx, [rbp + 0x28]
call fcn.1401aba90
call fcn.14029c7b8
lea rcx, [rbp + 0x28]
call fcn.140005d80
jmp 0x140132b4c
lea rcx, [rbp + 0x210]
call fcn.1400ef570
lea rcx, [rbp + 0x210]
mov edx, r12d
call fcn.14012f850
lea rcx, [rbp + 0x210]
call fcn.140136080
mov rdi, rax
test rax, rax
jne 0x140132730
lea rcx, str.Miniport_failed_r_n
call fcn.14029a88c
call fcn.14029c7b8
lea rcx, [rbp + 0x210]
call fcn.1400f0980
jmp 0x140132b4c
mov rcx, rax
call fcn.140136460
mov rcx, rdi
call fcn.1400ef4a0
mov rcx, rax
call fcn.140120cb0
lea rcx, [0x140323ca0]
mov rdx, rax
call fcn.14029a88c
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
call fcn.14029c7b8
lea rcx, [rbp + 0x210]
call fcn.1400f0980
jmp 0x140132b4c
call fcn.1401ab110
jmp 0x140132b47
lea rdx, [rsp + 0x60]
mov r8d, 8
call fcn.1401eaef0
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401e7500
cmp ax, 0x22
jne 0x1401327d9
lea rcx, [rsp + 0x60]
call fcn.1401ea280
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r12d
call fcn.1401eb1b0
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401e7440
lea rcx, [rbp - 0x40]
call fcn.140005d80
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.140108840
lea rcx, [rsp + 0x60]
test al, al
sete sil
call fcn.140005d80
jmp 0x140132b4c
call fcn.140167470
test al, al
je 0x14013288c
call fcn.14010a8f0
test al, al
je 0x14013288c
jmp 0x140132b4c
call fcn.14010a8f0
mov r12d, esi
test al, al
sete r12b
mov esi, r12d
jmp 0x140132b4c
cmp dword [0x1403fd9c0], esi
lea rdi, vtable.HitmanPro35::CrusaderService.0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rdi
jne 0x140132850
lea rcx, [rbp - 0x60]
call fcn.1401ad970
lea rcx, [rbp - 0x60]
call fcn.1401adf50
test r15b, r15b
jne 0x140132863
call fcn.14012f950
lea rcx, str.Press_a_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x60], rdi
test rcx, rcx
je 0x140132889
mov rax, qword [rcx]
mov edx, r12d
call qword [rax]
mov r12d, esi
mov esi, r12d
jmp 0x140132b4c
xor ecx, ecx
call fcn.1401ae950
movzx esi, al
jmp 0x140132b4c
xor edx, edx
xor ecx, ecx
call fcn.1401ae380
movzx esi, al
jmp 0x140132b4c
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, [0x1401ae0b0]
mov dword [0x1403fd9c0], r12d
mov qword [rbp], rax
lea rax, str.HitmanPro37CrusaderBoot
mov qword [rbp - 8], rax
jmp 0x140132909
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, str.HitmanPro37Crusader
mov dword [0x1403fd9c0], esi
mov qword [rbp - 8], rax
lea rax, [0x1401ae0b0]
mov qword [rbp], rax
lea rcx, [rbp - 8]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x140132b4c
call fcn.14012c970
test al, al
jne 0x140132939
test bl, bl
jne 0x140132939
lea rcx, [rbp + 0x210]
call fcn.140107a70
cmp byte [rsp + 0x4b], sil
jne 0x140132acd
lea rcx, [rbp + 0x18]
call fcn.140017f70
test rax, rax
je 0x140132968
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x210]
call fcn.14012f8b0
movzx ebx, r12b
jmp 0x14013296d
movzx ebx, byte [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.140017f70
test rax, rax
je 0x140132994
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x210]
call fcn.1400f2610
lea rcx, [rbp + 0x38]
call fcn.140009d00
test bl, bl
je 0x1401329a4
lea rcx, [rbp + 0x210]
call fcn.14012f860
cmp byte [rsp + 0x4f], sil
je 0x1401329b7
lea rcx, [rbp + 0x210]
call fcn.14012f870
test r14b, r14b
je 0x1401329c8
lea rcx, [rbp + 0x210]
call fcn.14012f860
movzx r14d, byte [rsp + 0x44]
test r14b, r14b
je 0x1401329df
lea rcx, [rbp + 0x210]
call fcn.14012f920
cmp byte [rsp + 0x48], sil
jne 0x1401329f2
lea rcx, [rbp + 0x210]
call fcn.14012f8d0
cmp byte [rsp + 0x4a], sil
jne 0x140132a18
lea rcx, [rbp + 0x210]
call fcn.14012f8e0
lea rcx, [rbp + 0x210]
call fcn.14012f900
movzx ebx, byte [rsp + 0x42]
jmp 0x140132a2d
movzx ebx, byte [rsp + 0x42]
test bl, bl
jne 0x140132a2d
lea rcx, [rbp + 0x210]
call fcn.14012f900
cmp byte [rsp + 0x4c], sil
jne 0x140132a40
lea rcx, [rbp + 0x210]
call fcn.14012f8f0
test bl, bl
jne 0x140132a50
lea rcx, [rbp + 0x210]
call fcn.14012f900
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140132a66
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14012f910
cmp byte [rsp + 0x47], sil
je 0x140132a7c
lea rcx, [rbp + 0x210]
mov edx, r12d
call fcn.14012f840
cmp byte [rsp + 0x46], sil
je 0x140132a93
lea rcx, [rbp + 0x210]
movzx edx, r12b
call fcn.1400f41e0
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x140132aa9
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14012f850
lea rcx, [rbp + 0x210]
call fcn.140100940
lea rcx, [rbp + 0x210]
call fcn.1400ed220
test al, al
mov eax, 5
cmovne esi, eax
jmp 0x140132ad3
movzx r14d, byte [rsp + 0x44]
lea rcx, [rbp + 0x210]
call fcn.1400f0980
call fcn.14012fd40
call fcn.1400f6350
cmp qword [0x1403fd8b8], 0
je 0x140132b20
movzx ecx, r12b
call fcn.140110410
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, qword [0x1403fd8b8]
call qword [sym.imp.USER32.dll_CloseDesktop]
test rdi, rdi
je 0x140132b31
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax + 8]
test r15b, r15b
je 0x140132b4c
test r14b, r14b
jne 0x140132b4c
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.140298d38
call fcn.14029c7b8
lea rcx, [rbp + 0xe8]
call fcn.14011a530
lea rcx, [rbp + 0x88]
call fcn.140005d80
lea rcx, [rbp + 0xb8]
call fcn.140005d80
lea rcx, [rbp + 0x18]
call fcn.140003d30
lea rcx, [rbp + 0x38]
call fcn.140003d30
lea rcx, [rbp - 0x28]
call fcn.140005d80
lea rcx, [rbp - 0x50]
call fcn.140005d80
mov r13, qword [rsp + 0xfa0]
movaps xmm7, xmmword [rsp + 0xf50]
movaps xmm6, xmmword [rsp + 0xf60]
lea rcx, [rbp + 0x100]
call fcn.14011a290
mov eax, esi
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0xf70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret