Function at 0x1400068c0
Capabilities:
Create process on windows
Create thread
Execute command
Self delete
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor esi, esi
cmp byte [0x140076048], 1
jne 0x140008ec9
cmp byte [0x14007604b], 1
jne 0x140006a99
lea r9d, [rsi + 4]
lea r8, str.Watcher_2.0__BETA_
lea rdx, str.Would_you_like_to_enable_dumper_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 6
je 0x14000694d
cmp eax, 1
jne 0x140006954
mov byte [0x140077100], sil
jmp 0x140006954
mov byte [0x140077100], 1
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140004610]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400065f0
xor edx, edx
lea rcx, [0x140076050]
call fcn.14001f120
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherIgnoredDirectory.log
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
call fcn.14000a060
cmp qword [rbp + 0x1c0], 0
je 0x140006a86
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x130]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140006a7a
nop dword [rax]
mov rax, qword [0x140077148]
cmp rax, qword [0x140077150]
je 0x140006a29
lea rdx, [0x140076068]
mov rcx, rax
call fcn.14000aa20
add qword [0x140077148], 0x20
jmp 0x140006a38
lea r8, [0x140076068]
mov rdx, rax
call fcn.14000dab0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x130]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140006a00
lea rcx, [rbp + 0x130]
call fcn.140009f10
mov byte [0x14007604b], 0
lea rcx, [rbp + 0x130]
call fcn.140004430
mov rax, qword [0x140077110]
or dword [rax + 0x40f0], 0x40
mov dword [rax + 0x4150], 0x3f800000
mov r8d, 0x128
lea rdx, [0x140076048]
lea rcx, str.Watcher_2.0__BETA__github.com_zf9
call fcn.14001bad0
call fcn.140058570
test al, al
je 0x140008ec4
lea rcx, [0x1400641e4]
call fcn.14005a350
mov r13, 0xffffffffffffffff
xorps xmm8, xmm8
movss xmm7, dword [0x140069fd4]
test al, al
je 0x140006e4e
mov qword [rsp + 0x58], 0
movss dword [rsp + 0x20], xmm8
lea r9, [rsp + 0x58]
call fcn.1400485d0
test al, al
je 0x140006e49
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherAllDump.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140006e37
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 0x48]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
mov rbx, rsi
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.14000a8e0
mov rdi, rax
cmp rax, r13
je 0x140006c16
nop dword [rax]
mov r9, rdi
sub r9, rbx
mov r8, rbx
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000a090
nop
lea rcx, [rbp - 8]
call fcn.14000a980
lea rbx, [rdi + 1]
mov r8, rbx
lea rcx, [rbp - 0x28]
call fcn.14000a8e0
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140006bd0
mov r9, r13
mov r8, rbx
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000a090
nop
lea rcx, [rbp - 8]
call fcn.14000a980
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
cmp rbx, rdi
je 0x140006e1a
movaps xmm1, xmm8
call fcn.14004b0c0
call fcn.14004bb20
xor r8d, r8d
lea rdx, str.Created
mov rcx, rbx
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140006cb9
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x48]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x58], 0
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x58]
jmp 0x140006dbd
xor r8d, r8d
lea rdx, str.Deleted
mov rcx, rbx
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140006d13
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
mov edx, 0xff
lea rcx, [rsp + 0x78]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x70], 0
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x70]
jmp 0x140006dbd
xor r8d, r8d
lea rdx, str.Modified
mov rcx, rbx
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140006d69
mov dword [rsp + 0x20], 0xff
xor edx, edx
mov r9d, 0xff
mov r8d, r9d
lea rcx, [rbp - 0x78]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x60], 0
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x60]
jmp 0x140006dbd
xor r8d, r8d
lea rdx, str.Renamed
mov rcx, rbx
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140006dfc
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xff
mov r8d, edx
lea rcx, [rbp - 0x68]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x40], 0
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x40]
mov r8d, 4
xor edx, edx
mov rcx, rax
call fcn.1400573f0
test al, al
je 0x140006df2
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x140006df2
mov rcx, rbx
call fcn.14000a970
mov rcx, rax
call fcn.140013400
mov ecx, 1
call fcn.140010990
cmp byte [0x14007604a], 1
jne 0x140006e0d
movaps xmm0, xmm7
call fcn.140020a10
add rbx, 0x20
cmp rbx, rdi
jne 0x140006c51
lea rcx, [rbp - 0x48]
call fcn.14000a0e0
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
nop
lea rcx, [rbp + 0x20]
call fcn.140008f40
call fcn.14004a880
nop
lea rcx, [rbp + 0x130]
call fcn.140004430
call fcn.14005a450
lea rcx, str.Created
call fcn.14005a350
test al, al
je 0x1400070de
mov qword [rsp + 0x40], 0
movss dword [rsp + 0x20], xmm8
lea r9, [rsp + 0x40]
call fcn.1400485d0
test al, al
je 0x1400070d9
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherCreatedCreated.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400070c7
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 0x48]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
mov rdi, rsi
nop dword [rax]
lea r14, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
setae r12b
mov r15, qword [rbp - 8]
cmovae r14, r15
mov rsi, qword [rbp + 8]
cmp rdi, rsi
jae 0x140006f5f
mov r8, rsi
sub r8, rdi
lea rcx, [r14 + rdi]
mov edx, 0xa
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140006f5f
sub rbx, r14
jmp 0x140006f62
mov rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x140006fff
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor r14d, r14d
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
cmp rsi, rdi
jb 0x140008f0e
mov r8, rbx
sub r8, rdi
sub rsi, rdi
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp - 8]
test r12b, r12b
cmovne rdx, r15
add rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000c700
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, qword [rbp - 0x38]
je 0x140006fdf
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], r14b
add qword [rbp - 0x40], 0x20
jmp 0x140006fed
lea r8, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000d820
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
lea rdi, [rbx + 1]
jmp 0x140006f20
mov r9, r13
mov r8, rdi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 8]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000a090
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
cmp rbx, rdi
je 0x1400070a8
mov qword [rsp + 0x40], 0
nop
movaps xmm1, xmm8
call fcn.14004b0c0
call fcn.14004bb20
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rax
call fcn.1400573f0
test al, al
je 0x14000708e
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x14000708e
mov rcx, rbx
call fcn.14000a970
mov rcx, rax
call fcn.140013400
cmp byte [0x14007604a], 1
jne 0x14000709f
movaps xmm0, xmm7
call fcn.140020a10
add rbx, 0x20
cmp rbx, rdi
jne 0x140007040
lea rcx, [rbp - 0x48]
call fcn.14000a0e0
nop
lea rcx, [rbp - 8]
call fcn.14000a980
nop
lea rcx, [rbp + 0x20]
call fcn.140008f40
xor esi, esi
call fcn.14004a880
nop
lea rcx, [rbp + 0x130]
call fcn.140004430
call fcn.14005a450
lea rcx, str.Deleted
call fcn.14005a350
test al, al
je 0x1400073de
mov qword [rsp + 0x40], 0
movss dword [rsp + 0x20], xmm8
lea r9, [rsp + 0x40]
call fcn.1400485d0
test al, al
je 0x140007397
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherDeletedDeleted.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140007385
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 0x48]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rsi
mov rdi, rsi
nop dword [rax]
lea r14, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
setae r12b
mov r15, qword [rbp - 8]
cmovae r14, r15
mov rsi, qword [rbp + 8]
cmp rdi, rsi
jae 0x1400071ef
mov r8, rsi
sub r8, rdi
lea rcx, [r14 + rdi]
mov edx, 0xa
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400071ef
sub rbx, r14
jmp 0x1400071f2
mov rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x1400072bb
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
cmp rsi, rdi
jb 0x140008f14
mov r8, rbx
sub r8, rdi
sub rsi, rdi
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp - 8]
test r12b, r12b
cmovne rdx, r15
add rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000c700
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, qword [rbp - 0x38]
je 0x140007267
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x28], 0
add qword [rbp - 0x40], 0x20
jmp 0x140007278
lea r8, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000d820
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400072ab
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400072b4
call fcn.1400606f0
lea rdi, [rbx + 1]
jmp 0x1400071b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9, r13
mov r8, rdi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 8]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000a090
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
cmp rbx, rdi
je 0x140007368
mov qword [rsp + 0x60], 0
nop dword [rax + rax]
movaps xmm1, xmm8
call fcn.14004b0c0
call fcn.14004bb20
mov rcx, rbx
call fcn.14000a970
lea r9, [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rax
call fcn.1400573f0
test al, al
je 0x14000734e
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x14000734e
mov rcx, rbx
call fcn.14000a970
mov rcx, rax
call fcn.140013400
cmp byte [0x14007604a], 1
jne 0x14000735f
movaps xmm0, xmm7
call fcn.140020a10
add rbx, 0x20
cmp rbx, rdi
jne 0x140007300
lea rcx, [rbp - 0x48]
call fcn.14000a0e0
nop
lea rcx, [rbp - 8]
call fcn.14000a980
nop
lea rcx, [rbp + 0x20]
call fcn.140008f40
call fcn.14004a880
nop
lea rcx, [rbp + 0x130]
call fcn.140004430
mov rdx, qword [0x140077110]
mov rax, qword [rdx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x1400073de
mov r8, qword [rdx + 0x4520]
test r8, r8
je 0x1400073de
movsx rax, word [r8 + 0x70]
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [r8 + 8]
test byte [rcx + 4], 8
jne 0x1400073de
mov rax, qword [rdx + 0x3fe0]
dec dword [rax + 0x108]
lea rcx, str.Modified
call fcn.14005a350
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
test al, al
je 0x140007874
mov qword [rsp + 0x40], 0
movss dword [rsp + 0x20], xmm8
lea r9, [rsp + 0x40]
call fcn.1400485d0
test al, al
je 0x140007828
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherModifiedModified.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400077cc
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 8]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
xor r15d, r15d
mov qword [rbp + 8], r15
mov edi, r15d
nop word [rax + rax]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
setae r12b
mov r15, qword [rbp - 0x48]
cmovae r14, r15
mov rsi, qword [rbp - 0x38]
cmp rdi, rsi
jae 0x1400074ff
mov r8, rsi
sub r8, rdi
lea rcx, [r14 + rdi]
mov edx, 0xa
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400074ff
sub rbx, r14
jmp 0x140007502
mov rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x1400075cb
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
cmp rsi, rdi
jb 0x140008f1a
mov r8, rbx
sub r8, rdi
sub rsi, rdi
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp - 0x48]
test r12b, r12b
cmovne rdx, r15
add rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000c700
nop
mov rdx, qword [rbp]
cmp rdx, qword [rbp + 8]
je 0x140007577
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x28], 0
add qword [rbp], 0x20
jmp 0x140007588
lea r8, [rbp - 0x28]
lea rcx, [rbp - 8]
call fcn.14000d820
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400075bb
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075c4
call fcn.1400606f0
lea rdi, [rbx + 1]
jmp 0x1400074c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9, r13
mov r8, rdi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14000a090
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
mov rsi, qword [rbp]
mov rdi, qword [rbp - 8]
cmp rdi, rsi
je 0x1400076cf
mov qword [rsp + 0x60], 0
nop
movaps xmm1, xmm8
call fcn.14004b0c0
mov rax, qword [0x140077110]
mov rbx, qword [rax + 0x44b8]
test rbx, rbx
je 0x140007667
cmp byte [rbx + 0x20a], 0
je 0x140007654
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
cmp eax, dword [rbx + 0x74]
jge 0x140007654
cmp ecx, 0xffffffff
je 0x14000764d
mov rcx, rbx
call fcn.14004bd90
mov edx, dword [rbx + 0x7c]
inc edx
jmp 0x14000765f
movaps xmm1, xmm8
call fcn.14004b0c0
xor edx, edx
mov rcx, rbx
call fcn.14004bba0
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140007674
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 4]
call fcn.1400573f0
test al, al
je 0x1400076a9
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x1400076a9
mov rcx, rdi
call fcn.14000a970
mov rcx, rax
call fcn.140013400
cmp byte [0x14007604a], 1
jne 0x1400076ba
movaps xmm0, xmm7
call fcn.140020a10
add rdi, 0x20
cmp rdi, rsi
jne 0x140007610
mov rsi, qword [rbp]
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x14000772c
mov rdx, rsi
mov rcx, rdi
call fcn.14000bf90
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp - 8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
xor r15d, r15d
mov qword [rbp + 8], r15
jmp 0x14000772f
xor r15d, r15d
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000776d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007768
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x38]
call fcn.14000a690
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
jmp 0x1400077cf
xor r15d, r15d
call fcn.14004a880
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r12
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call fcn.140009ea0
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14000782b
xor r15d, r15d
mov rdx, qword [0x140077110]
mov rax, qword [rdx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x140007877
mov r8, qword [rdx + 0x4520]
test r8, r8
je 0x140007877
movsx rax, word [r8 + 0x70]
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [r8 + 8]
test byte [rcx + 4], 8
jne 0x140007877
mov rax, qword [rdx + 0x3fe0]
dec dword [rax + 0x108]
jmp 0x140007877
xor r15d, r15d
lea rcx, str.Renamed
call fcn.14005a350
test al, al
je 0x140007d18
mov qword [rsp + 0x40], 0
lea rcx, str.Table
call fcn.14001f280
movss dword [rsp + 0x28], xmm8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20007c1
mov r8d, 1
mov edx, eax
lea rcx, str.Table
call fcn.140048670
test al, al
je 0x140007cd1
lea rcx, [rbp + 0x130]
call fcn.1400044a0
lea rdx, str.C:ProgramDataWatcherRenamedRenamed.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140007c7a
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 8]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov rdi, r15
nop dword [rax]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
setae r12b
mov r15, qword [rbp - 0x48]
cmovae r14, r15
mov rsi, qword [rbp - 0x38]
cmp rdi, rsi
jae 0x1400079af
mov r8, rsi
sub r8, rdi
lea rcx, [rdi + r14]
mov edx, 0xa
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400079af
sub rbx, r14
jmp 0x1400079b2
mov rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x140007a7b
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
cmp rsi, rdi
jb 0x140008f20
mov r8, rbx
sub r8, rdi
sub rsi, rdi
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp - 0x48]
test r12b, r12b
cmovne rdx, r15
add rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000c700
nop
mov rdx, qword [rbp]
cmp rdx, qword [rbp + 8]
je 0x140007a27
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x28], 0
add qword [rbp], 0x20
jmp 0x140007a38
lea r8, [rbp - 0x28]
lea rcx, [rbp - 8]
call fcn.14000d820
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140007a6b
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007a74
call fcn.1400606f0
lea rdi, [rbx + 1]
jmp 0x140007970
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9, r13
mov r8, rdi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14000a090
nop
lea rcx, [rbp - 0x28]
call fcn.14000a980
mov rsi, qword [rbp]
mov rdi, qword [rbp - 8]
cmp rdi, rsi
je 0x140007b7f
mov qword [rsp + 0x60], 0
nop
movaps xmm1, xmm8
call fcn.14004b0c0
mov rax, qword [0x140077110]
mov rbx, qword [rax + 0x44b8]
test rbx, rbx
je 0x140007b17
cmp byte [rbx + 0x20a], 0
je 0x140007b04
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
cmp eax, dword [rbx + 0x74]
jge 0x140007b04
cmp ecx, 0xffffffff
je 0x140007afd
mov rcx, rbx
call fcn.14004bd90
mov edx, dword [rbx + 0x7c]
inc edx
jmp 0x140007b0f
movaps xmm1, xmm8
call fcn.14004b0c0
xor edx, edx
mov rcx, rbx
call fcn.14004bba0
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140007b24
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 4]
call fcn.1400573f0
test al, al
je 0x140007b59
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x140007b59
mov rcx, rdi
call fcn.14000a970
mov rcx, rax
call fcn.140013400
cmp byte [0x14007604a], 1
jne 0x140007b6a
movaps xmm0, xmm7
call fcn.140020a10
add rdi, 0x20
cmp rdi, rsi
jne 0x140007ac0
mov rsi, qword [rbp]
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x140007bdc
mov rdx, rsi
mov rcx, rdi
call fcn.14000bf90
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp - 8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007bc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
xor r15d, r15d
mov qword [rbp + 8], r15
jmp 0x140007bdf
xor r15d, r15d
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140007c1d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x38]
call fcn.14000a690
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.14004a880
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r12
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call fcn.140009ea0
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdx, qword [0x140077110]
mov rax, qword [rdx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x140007d18
mov r8, qword [rdx + 0x4520]
test r8, r8
je 0x140007d18
movsx rax, word [r8 + 0x70]
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [r8 + 8]
test byte [rcx + 4], 8
jne 0x140007d18
mov rax, qword [rdx + 0x3fe0]
dec dword [rax + 0x108]
lea rcx, str.Error_Logs
call fcn.14005a350
test al, al
je 0x140008461
mov qword [rsp + 0x40], 0
lea rcx, str.Table
call fcn.14001f280
movss dword [rsp + 0x28], xmm8
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20007c1
mov r8d, 1
mov edx, eax
lea rcx, str.Table
call fcn.140048670
test al, al
je 0x14000841a
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x130]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:ProgramDataWatcherErrorMessage.txt
lea rcx, [rbp + 0x130]
call fcn.140009f50
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400083c3
lea rcx, [rbp + 0x20]
call fcn.140008fa0
lea rcx, [rbp + 0x20]
call fcn.140009070
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x20]
call fcn.140008fb0
nop
lea rcx, [rbp + 0x130]
call fcn.140009f10
lea rcx, [rbp - 0x48]
call fcn.140004020
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov rdi, r15
nop word [rax + rax]
lea r14, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
setae r12b
mov r15, qword [rbp - 0x28]
cmovae r14, r15
mov rsi, qword [rbp - 0x18]
cmp rdi, rsi
jae 0x140007e5f
mov r8, rsi
sub r8, rdi
lea rcx, [r14 + rdi]
mov edx, 0xa
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007e5f
sub rbx, r14
jmp 0x140007e62
mov rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x140007f2b
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
cmp rsi, rdi
jb 0x140008f26
mov r8, rbx
sub r8, rdi
sub rsi, rdi
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp - 0x28]
test r12b, r12b
cmovne rdx, r15
add rdx, rdi
lea rcx, [rbp - 8]
call fcn.14000c700
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, qword [rbp - 0x38]
je 0x140007ed7
movups xmm0, xmmword [rbp - 8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 8]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 8], 0
add qword [rbp - 0x40], 0x20
jmp 0x140007ee8
lea r8, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.14000d820
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140007f1b
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f24
call fcn.1400606f0
lea rdi, [rbx + 1]
jmp 0x140007e20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9, r13
mov r8, rdi
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000a880
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000a090
nop
lea rcx, [rbp - 8]
call fcn.14000a980
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x48]
xor r15d, r15d
cmp rdi, r14
je 0x1400082d0
nop dword [rax]
movaps xmm1, xmm8
call fcn.14004b0c0
mov rax, qword [0x140077110]
mov rbx, qword [rax + 0x44b8]
test rbx, rbx
je 0x140007fc7
cmp byte [rbx + 0x20a], r15b
je 0x140007fb4
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
cmp eax, dword [rbx + 0x74]
jge 0x140007fb4
cmp ecx, 0xffffffff
je 0x140007fad
mov rcx, rbx
call fcn.14004bd90
mov edx, dword [rbx + 0x7c]
inc edx
jmp 0x140007fbf
movaps xmm1, xmm8
call fcn.14004b0c0
xor edx, edx
mov rcx, rbx
call fcn.14004bba0
mov rsi, qword [rdi + 0x10]
mov rcx, rdi
mov rbx, qword [rdi + 0x18]
cmp rbx, 0x10
jb 0x140007fdb
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 7
lea r9, str.Created
xor r8d, r8d
mov rdx, rsi
call fcn.14000c4e0
cmp rax, 0xffffffffffffffff
je 0x1400080b8
movaps xmm6, xmmword [0x14006a380]
mov rbx, qword [0x140077110]
mov dword [rbp - 8], r15d
movups xmm0, xmmword [rbx + 0x39d0]
movups xmmword [rbp - 4], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 8]
call fcn.140032b30
movups xmmword [rbx + 0x39d0], xmm6
mov qword [rsp + 0x60], r15
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140008046
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 4]
call fcn.1400573f0
test al, al
je 0x14000807b
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x14000807b
mov rcx, rdi
call fcn.14000a970
mov rcx, rax
call fcn.140013400
mov r8, qword [0x140077110]
movsxd rax, dword [r8 + 0x4180]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x4188]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, 0x39d
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8], xmm0
dec dword [r8 + 0x4180]
jmp 0x14000824a
mov rcx, rdi
cmp rbx, 0x10
jb 0x1400080c4
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 7
lea r9, str.Deleted
xor r8d, r8d
mov rdx, rsi
call fcn.14000c4e0
cmp rax, 0xffffffffffffffff
je 0x140008122
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
mov edx, 0xff
lea rcx, [rbp - 0x68]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x70], r15
mov rcx, rdi
call fcn.14000a970
lea r9, [rsp + 0x70]
jmp 0x1400081c4
xor r8d, r8d
lea rdx, str.Modified
mov rcx, rdi
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140008174
mov dword [rsp + 0x20], 0xff
xor edx, edx
mov r9d, 0xff
mov r8d, r9d
lea rcx, [rbp - 0x78]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x58], r15
mov rcx, rdi
call fcn.14000a970
lea r9, [rsp + 0x58]
jmp 0x1400081c4
xor r8d, r8d
lea rdx, str.Renamed
mov rcx, rdi
call fcn.14000a930
cmp rax, 0xffffffffffffffff
je 0x140008205
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xff
mov r8d, edx
lea rcx, [rbp - 0x58]
call fcn.140001050
mov rdx, rax
xor ecx, ecx
call fcn.140010930
mov qword [rsp + 0x78], r15
mov rcx, rdi
call fcn.14000a970
lea r9, [rsp + 0x78]
mov r8d, 4
xor edx, edx
mov rcx, rax
call fcn.1400573f0
test al, al
je 0x1400081f9
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x1400081f9
mov rcx, rdi
call fcn.14000a970
mov rcx, rax
call fcn.140013400
mov ecx, 1
call fcn.140010990
jmp 0x14000824a
mov qword [rsp + 0x48], r15
mov rcx, rdi
call fcn.14000a970
lea r9, [rsp + 0x48]
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rax
call fcn.1400573f0
test al, al
je 0x14000824a
mov rax, qword [0x140077110]
cmp word [rax + 0x36ca], 2
jne 0x14000824a
mov rcx, rdi
call fcn.14000a970
mov rcx, rax
call fcn.140013400
cmp byte [0x14007604a], 1
jne 0x1400082bb
mov rax, qword [0x140077110]
mov rcx, qword [rax + 0x3fe0]
movss xmm6, dword [rcx + 0x7c]
maxss xmm6, dword [rax + 0x3958]
movss xmm1, dword [rcx + 0x124]
movaps xmm0, xmm1
subss xmm0, xmm6
addss xmm1, dword [rcx + 0x14c]
addss xmm1, xmm6
subss xmm1, xmm0
mulss xmm1, xmm7
addss xmm1, xmm0
subss xmm1, dword [rcx + 0x4c]
movaps xmm2, xmm7
call fcn.140020930
movss xmm5, dword [rcx + 0x7c]
subss xmm5, xmm6
movaps xmm0, xmm8
maxss xmm0, xmm5
movss dword [rcx + 0xbc], xmm0
add rdi, 0x20
cmp rdi, r14
jne 0x140007f70
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x48]
test rdi, rdi
je 0x140008328
mov rdx, r14
mov rcx, rdi
call fcn.14000bf90
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x48]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008317
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140008366
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008361
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x38]
call fcn.14000a690
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.14004a880
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r12
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call fcn.140009ea0
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdx, qword [0x140077110]
mov rax, qword [rdx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x140008461
mov r8, qword [rdx + 0x4520]
test r8, r8
je 0x140008461
movsx rax, word [r8 + 0x70]
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [r8 + 8]
test byte [rcx + 4], 8
jne 0x140008461
mov rax, qword [rdx + 0x3fe0]
dec dword [rax + 0x108]
lea rcx, str.Other
call fcn.14005a350
test al, al
je 0x140008ebf
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
lea rcx, str.Clear_All_Logs
call fcn.14004fea0
test al, al
je 0x140008564
lea rcx, str.del__f__q_C:ProgramDataWatcherCreatedCreated.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataWatcherDeletedDeleted.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataWatcherModifiedModified.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataWatcherRenamedRenamed.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataWatcherAllDump.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataWatcherErrorMessage.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0x104
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x30
lea r8, str.Watcher_2.0__BETA_
lea rdx, str.Application_Restart_Required
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r8, [rbp + 0x32e]
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x28]
call fcn.14000bd50
lea rcx, [rbp - 0x28]
call fcn.14000a970
mov r8, rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
lea rcx, str.Clear_All_Dumped_Files
call fcn.14004fea0
test al, al
je 0x140008631
mov byte [0x140076049], 0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__f__q_C:ProgramDataWatcherAllDump.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:ProgramDataWatcherFileDumps
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0x104
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x30
lea r8, str.Watcher_2.0__BETA_
lea rdx, str.Application_Restart_Required
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r8, [rbp + 0x32e]
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x28]
call fcn.14000bd50
lea rcx, [rbp - 0x28]
call fcn.14000a970
mov r8, rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
lea rcx, str.Delete_All_Created_Files_And_Exit
call fcn.140050200
test al, al
je 0x140008668
lea rcx, str.rmdir__s__q_C:ProgramDataWatcher
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140051500
call fcn.140051bb0
call fcn.140051bb0
call fcn.140051bb0
call fcn.140051bb0
lea rcx, str.Ignored_Directories:
call fcn.14004f600
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
xor r8d, r8d
mov edx, 0xff
lea rcx, [rbp - 0x58]
call fcn.140001050
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
lea rdx, [0x140063e00]
lea rcx, [rsp + 0x48]
call fcn.14004f700
mov rsi, qword [0x140077140]
mov r13, qword [0x140077148]
movss xmm6, dword [0x14006a0a4]
cmp rsi, r13
je 0x140008a70
movaps xmm0, xmmword [0x14006a4a0]
movups xmmword [rsp + 0x60], xmm0
nop dword [rax]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400086fd
mov rdx, qword [rsi]
lea rcx, [rsp + 0x60]
call fcn.14004f700
movaps xmm1, xmm6
movaps xmm0, xmm8
call fcn.140020100
mov r15, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 8
jb 0x140008f08
mov r12, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14000873e
mov r12, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor edx, edx
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rdx
lea r14, [r15 + 8]
mov ebx, 0xf
lea rdi, [rbp - 0x28]
cmp r14, rbx
jbe 0x1400087dc
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140008772
mov rbx, rcx
jmp 0x14000877f
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400087c6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008f2c
mov rcx, rax
call fcn.1400606f8
test rax, rax
je 0x140008b50
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400087d8
test rcx, rcx
je 0x1400087d5
call fcn.1400606f8
mov rdi, rax
jmp 0x1400087d8
mov rdi, rdx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rbx
movabs rax, 0x232365766f6d6552
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rsp + 0x48], 0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rsp + 0x48]
call fcn.14004fea0
test al, al
je 0x140008a21
lea rax, [rbp - 0x48]
mov qword [rsp + 0x78], rax
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140008844
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor ebx, ebx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x140008860
lea rcx, [rbp - 0x48]
call fcn.14000c700
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov r8d, 0x2b
lea rdx, str.C:ProgramDataWatcherIgnoredDirectory.log
lea rcx, [rbp - 8]
call fcn.14000c700
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 8]
call fcn.140004030
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:ProgramDataWatcherIgnoredDirectory.log
lea rcx, [rbp + 0x20]
call fcn.140009f50
nop
mov rcx, qword [0x140077140]
mov rdx, qword [0x140077148]
cmp rcx, rdx
je 0x1400088ee
call fcn.14000bf90
mov rax, qword [0x140077140]
mov qword [0x140077148], rax
cmp qword [rbp + 0xb0], 0
je 0x1400089bc
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x20]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400089b1
nop word [rax + rax]
mov rax, qword [0x140077148]
cmp rax, qword [0x140077150]
je 0x140008969
lea rdx, [0x140076068]
mov rcx, rax
call fcn.14000aa20
add qword [0x140077148], 0x20
jmp 0x140008978
lea r8, [0x140076068]
mov rdx, rax
call fcn.14000dab0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x20]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140008940
lea rcx, [rbp + 0x20]
call fcn.140009f10
jmp 0x1400089d9
mov r9d, 0x30
lea r8, str.Watcher_2.0__BETA_
lea rdx, str.Unable_to_open_file_nContact_Support_Error:_AUTO_UPDATE_removeLineFromFile
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], r12
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x30]
call fcn.140009ea0
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140008a28
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140008a63
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008b50
call fcn.1400606f0
add rsi, 0x20
cmp rsi, r13
jne 0x1400086f0
mov qword [rsp + 0x48], 0
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x200
lea rbx, [0x140076f00]
mov r8, rbx
xor edx, edx
lea rcx, str.IgnorePath
call fcn.140054ec0
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x48]
lea rcx, str.Add_Input_To_File
call fcn.14004fea0
test al, al
je 0x140008cdb
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140008ae7
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.14000c700
nop
lea rdi, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdi, qword [rbp - 0x48]
mov rax, qword [rbp - 0x38]
cmp rax, 2
jb 0x140008bd9
lea rsi, [rax + rdi]
lea r8, [rsi - 1]
sub r8, rdi
mov edx, 0x5c
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140008bd9
cmp byte [rbx], 0x5c
jne 0x140008b57
cmp byte [rbx + 1], 0x5c
jne 0x140008b57
mov eax, r14d
jmp 0x140008b5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sbb eax, eax
or eax, 1
test eax, eax
je 0x140008b81
inc rbx
lea r8, [rsi - 1]
sub r8, rbx
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140008b40
jmp 0x140008bd9
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x140008bd9
nop word [rax + rax]
mov qword [rsp + 0x20], 1
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.14000b110
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
lea r8, [rbx + 1]
mov qword [rsp + 0x20], 2
lea r9, [0x14006452c]
mov rdx, qword [rbp - 0x38]
call fcn.14000c4e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140008b90
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov r8d, 8
lea rdx, str.C:ProgramDataWatcherIgnoredDirectory.log
lea rcx, [rbp + 0x20]
call fcn.1400091e0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [rbp + 0x20]
call fcn.14000d3d0
mov rcx, rax
lea rdx, [0x140063f4c]
call fcn.14000b900
lea rcx, [rbp + 0x28]
call fcn.14000af20
test rax, rax
jne 0x140008c56
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x28]
call fcn.140009ea0
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140008cdb
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cd6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400606f0
movaps xmm1, xmm6
movaps xmm0, xmm8
call fcn.140020100
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
lea rcx, str.Manual_Update_Ignore_Path_Cache
call fcn.14004fea0
test al, al
je 0x140008e78
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:ProgramDataWatcherIgnoredDirectory.log
lea rcx, [rbp + 0x20]
call fcn.140009f50
nop
mov rcx, qword [0x140077140]
mov rdx, qword [0x140077148]
cmp rcx, rdx
je 0x140008d51
call fcn.14000bf90
mov rax, qword [0x140077140]
mov qword [0x140077148], rax
cmp qword [rbp + 0xb0], 0
je 0x140008e1c
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x20]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140008e11
nop dword [rax + rax]
mov rax, qword [0x140077148]
cmp rax, qword [0x140077150]
je 0x140008dc9
lea rdx, [0x140076068]
mov rcx, rax
call fcn.14000aa20
add qword [0x140077148], 0x20
jmp 0x140008dd8
lea r8, [0x140076068]
mov rdx, rax
call fcn.14000dab0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140076068]
lea rcx, [rbp + 0x20]
call fcn.14000d230
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140008da0
lea rcx, [rbp + 0x20]
call fcn.140009f10
jmp 0x140008e39
mov r9d, 0x30
lea r8, str.Watcher_2.0__BETA_
lea rdx, str.Unable_to_open_file_nContact_Support_Error:_AUTO_UPDATE_UpdateIgnorePathCache
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r12
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x30]
call fcn.140009ea0
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdx, qword [0x140077110]
mov rax, qword [rdx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x140008ebf
mov r8, qword [rdx + 0x4520]
test r8, r8
je 0x140008ebf
movsx rax, word [r8 + 0x70]
lea rcx, [rax + rax*2]
add rcx, rcx
mov rax, qword [r8 + 8]
test byte [rax + rcx*8 + 4], 8
jne 0x140008ebf
mov rax, qword [rdx + 0x3fe0]
dec dword [rax + 0x108]
call fcn.140058ac0
call fcn.14001e870
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400606d0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001240
nop
call fcn.14000b3d0
nop
call fcn.14000b3d0
nop
call fcn.14000b3d0
nop
call fcn.14000b3d0
nop
call fcn.14000b3d0
nop
call fcn.1400011a0
int3