Function at 0x140005b10
Capabilities:
Check os version
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400c87d8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x230]
xor esi, esi
mov rcx, qword [rbp + 0x238]
mov r14d, r9d
mov r12, qword [rbp + 0x240]
mov r13d, esi
mov dword [rbp - 0x7c], edx
mov edi, esi
mov rdx, qword [0x1400ca120]
mov r15d, esi
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x60], rsi
mov dword [rbp - 0x80], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x40], esi
test r8, r8
je 0x140012cfb
test rax, rax
je 0x140012cfb
test rcx, rcx
je 0x140012cfb
test r12, r12
je 0x140012cfb
test byte [0x1400ca180], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0xf0003
mov dword [rsp + 0x40], esi
jne 0x140012b5e
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x50]
xor r9d, r9d
mov dword [rsp + 0x20], esi
lea rdx, [rbp - 0x70]
xor ecx, ecx
call fcn.140006a60
test byte [0x1400ca180], 2
mov ebx, eax
jne 0x140012b86
test ebx, ebx
je 0x140005d3c
lea rcx, [0x1400c9ea8]
mov dword [rsp + 0x40], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x140012cd1
cmp dword [rbx], 0x6060
jne 0x140012cd1
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x140012bae
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp qword [rbx + 0x60], rsi
jne 0x140012bc8
mov rax, qword [rbx + 8]
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbx + 0x10]
mov rax, qword [rax + 0x118]
call qword [0x1400a9400]
test eax, eax
je 0x140005d39
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x140012c08
mov rax, qword [0x1400c94f0]
mov dword [rbx + 0x30], esi
mov dword [rbx + 0x50], esi
cmp rax, rbx
je 0x140012c1a
test rax, rax
jne 0x140012c2a
cmp qword [rbx + 0x18], rsi
jne 0x140012c4d
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x140012c5c
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x140012c6e
mov r8, qword [rbx + 0x48]
test r8, r8
jne 0x140012cb6
mov rcx, qword [0x1400ca110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rdi, rsi
xor ecx, ecx
call fcn.140006a40
mov rdx, qword [rbp - 0x78]
mov esi, eax
mov rbx, qword [rdx + 0x60]
mov rcx, rbx
mov qword [rbp - 0x68], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [rbx + 0x2c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rbx + 0x28], eax
test esi, esi
js 0x1400133ba
mov r11, qword [rbp - 0x78]
lea rax, [r11 + 0x38]
test rax, rax
je 0x1400133b5
xor esi, esi
lea rcx, [r11 + 0x40]
mov eax, esi
test rcx, rcx
je 0x140005d9c
mov rax, qword [rcx + 0x10]
mov rdx, rax
mov r10, rax
mov r8, rsi
test rcx, rcx
je 0x140005e87
mov r11d, dword [rbp - 0x7c]
mov r9, r8
cmp rdx, rcx
je 0x140005e87
mov r8d, r11d
mov rdx, r10
sub r8d, dword [r10 + 0x24]
js 0x140012d20
test r8d, r8d
jne 0x140012d05
mov r8, rdx
test r14d, r14d
jne 0x140005e87
mov r14d, esi
mov r12, rsi
mov r13d, esi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140005e05
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140005e11
mov dword [rax], r13d
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x140005e1d
mov dword [rax], r14d
test r15d, r15d
jne 0x1400133c5
test rdi, rdi
jne 0x1400133fa
test esi, esi
js 0x14001341e
add dword [rbx + 0x2c], 0xffffffff
mov eax, dword [rbx + 0x2c]
jne 0x140005e45
xor eax, eax
mov dword [rbx + 0x28], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14000e2c0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r14d, r14d
mov r15d, 0x7ffffffe
test r8, r8
je 0x140005ed4
mov rdi, qword [r8 + 0x28]
mov qword [rsp + 0x38], rdi
test rdi, rdi
je 0x140012d28
dec dword [rdi + 0x24]
mov qword [r8 + 0x28], r14
mov rax, qword [r8]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, r8
call qword [0x1400a9400]
test esi, esi
js 0x140012fbf
mov rcx, qword [0x1400ca110]
xor eax, eax
mov qword [rsp + 0x70], rax
mov esi, eax
mov dword [rsp + 0x50], eax
lea edx, [rax + 8]
lea r8d, [rax + 0x58]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140012d32
lea rax, [0x1400c82a8]
test rdi, rdi
je 0x140012d84
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov r8, rdi
lea edx, [r9 - 0x57]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x140012d8e
mov r14, rdi
jmp 0x14000693c
lea eax, [rax*2 + 2]
cmp eax, 0x200
ja 0x140012eaf
lea rax, [rbp - 0x30]
mov r8, r9
sub r8, rax
lea rcx, [rbp - 0x30]
mov edx, 0x100
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x140005fa5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140005f9c
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140005f74
jmp 0x140012ea6
test rdx, rdx
je 0x140012ea6
xor eax, eax
mov word [rcx], ax
test r9, r9
je 0x140005fbe
mov rcx, r9
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [0x1400ca110]
mov r8, r14
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
jne 0x140012eb9
mov ecx, esi
call fcn.140006a40
mov esi, eax
test eax, eax
js 0x140012fa5
lea rax, [rbp - 0x30]
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x140005ff3
mov rcx, 0xffffffffffffffff
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000df2c
xor r10d, r10d
mov r14, rax
test rax, rax
je 0x140012f40
lea rax, [rdi - 1]
cmp rax, r15
ja 0x140012f07
mov rdx, r15
lea r8, [rbp - 0x30]
sub rdx, rdi
mov rcx, r14
sub r8, r14
mov r9d, r10d
nop word [rax + rax]
lea rax, [rdx + rdi]
test rax, rax
je 0x14000607e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006075
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140006050
jmp 0x140012ef8
test rdi, rdi
je 0x140012ef8
mov word [rcx], r10w
mov esi, r9d
test r9d, r9d
js 0x140006981
mov rcx, qword [r12]
lea rax, [0x1400c9f10]
cmp rcx, rax
jne 0x140012f23
mov qword [r12], r14
mov r14, r10
mov rcx, r14
call fcn.14000df6c
mov rdx, qword [rsp + 0x38]
xor r10d, r10d
test esi, esi
js 0x140012fb2
mov r14, qword [rbp - 0x78]
add r14, 8
je 0x140012f8e
mov r13, r10
mov esi, 1
mov rdi, r10
add r14, 8
je 0x1400060e4
mov rdi, qword [r14 + 0x10]
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdi
test r14, r14
je 0x140012f9d
mov r15, rdx
mov r12, r13
cmp rax, r14
je 0x140006910
mov rdx, qword [rcx + 0x28]
mov r13, rcx
lea rcx, [rbp - 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
js 0x140012f78
jne 0x140012f4a
mov qword [rsp + 0x38], r15
xor r14d, r14d
mov r12, qword [rsp + 0x38]
mov esi, r14d
mov r15d, 0x7ffffffe
mov rdi, 0xffffffffffffffff
test esi, esi
je 0x14000623e
cmp esi, 1
jne 0x140013114
lea ecx, [rsi + 0x47]
call fcn.14000df2c
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x140013101
mov r12, qword [rsp + 0x68]
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rax, [0x14008d0c0]
mov qword [r13], rax
lea rax, [0x1400c9f10]
mov qword [r13 + 0x28], rax
mov qword [r13 + 0x20], 0x746e6575
mov qword [r13 + 0x30], r14
mov qword [r13 + 0x38], 0
test r12, r12
je 0x1400130a9
lea rax, [rbp - 0x30]
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400061c0
mov rcx, 0xffffffffffffffff
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000df2c
mov rsi, rax
test rax, rax
je 0x14001306c
lea rax, [rdi - 1]
cmp rax, r15
ja 0x140013036
mov rdx, r15
lea r8, [rbp - 0x30]
sub rdx, rdi
mov rcx, rsi
sub r8, rsi
lea rax, [rdx + rdi]
test rax, rax
je 0x14000683f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006836
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140006211
jmp 0x140013027
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x48], r13
test r14, r14
je 0x14001301a
mov ecx, 0x18
call fcn.14000df2c
mov rdi, rax
test rax, rax
je 0x140013004
mov dword [rax + 8], 1
lea rdx, [0x14008d060]
mov qword [rax], rdx
mov qword [rax + 0x10], r14
cmp r14, 0xffffffffffffffff
je 0x140012fdd
mov rdx, qword [r13 + 0x30]
xor r14d, r14d
mov esi, r14d
mov r8d, dword [rdx + 8]
cmp r8d, 0x7fffffff
je 0x1400062af
lea ecx, [r8 - 1]
mov eax, r8d
lock cmpxchg dword [rdx + 8], ecx
jne 0x140012fc7
lea eax, [r8 - 1]
test eax, eax
jne 0x1400062d1
mov rax, qword [rdx]
movabs r10, 0xca34bf075ed23170
mov rax, qword [rax + 8]
mov rcx, rdx
call qword [0x1400a9400]
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x40], eax
mov qword [r13 + 0x30], rdi
mov qword [rsp + 0x68], r14
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
mov dword [rsp + 0x40], r13d
mov rdi, r12
mov r15d, r13d
test esi, esi
js 0x1400133a7
mov rsi, qword [rsp + 0x48]
mov ecx, 0x38
call fcn.14000df2c
mov qword [rsp + 0x60], rax
mov r12, rax
test rax, rax
je 0x14001338e
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rax, section..rdata
mov qword [r12], rax
mov eax, dword [rbp - 0x7c]
mov dword [r12 + 0x24], eax
lea rax, [0x1400c9f10]
mov qword [r12 + 0x30], rax
mov dword [r12 + 0x20], 0x746e6573
mov qword [r12 + 0x28], rsi
test rdi, rdi
je 0x14001337f
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x70], r14
mov rsi, qword [rax + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
xor r8d, r8d
lea r9, [rsp + 0x58]
mov rcx, rax
lea edx, [r8 + 0xe]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x1400063f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x1400063c9
call fcn.14000aaf0
mov edi, eax
test eax, eax
jns 0x1400063f6
cmp di, 0x3f0
je 0x1400063f6
jmp 0x140006455
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov edx, 0xe
lea r9, [rsp + 0x58]
mov rcx, rax
lea r8d, [rdx - 0xd]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x1400063b2
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140013121
mov edi, r14d
test edi, edi
js 0x14000643a
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
nop dword [rax + rax]
test eax, eax
je 0x14001312d
mov edi, r14d
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140013139
mov rcx, qword [rsp + 0x58]
mov esi, edi
test rcx, rcx
jne 0x140006923
mov r15, qword [rsp + 0x70]
test edi, edi
js 0x14001314d
mov qword [rbp - 0x70], r14
mov r13, r14
mov qword [rsp + 0x58], r14
mov rsi, r14
test r15, r15
je 0x1400131ad
mov rcx, r15
mov qword [rsp + 0x58], rcx
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x1400065ec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x1400065ec
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
mov rsi, rax
test rax, rax
je 0x1400131cc
mov r9d, dword [rsp + 0x50]
lea edx, [r12 + 2]
mov rcx, qword [rsp + 0x58]
mov r8, rsi
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
je 0x1400065ec
mov edx, dword [rsi]
mov r12d, r14d
mov ecx, r14d
test edx, edx
je 0x1400065ec
lea rax, [rsi + 8]
nop dword [rax]
mov rdi, qword [rax]
cmp byte [rdi + 1], 3
je 0x140006568
inc ecx
add rax, 0x10
cmp ecx, edx
jb 0x140006550
jmp 0x1400065ec
cmp dword [rdi + 8], 5
jne 0x140006559
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, eax
mov r14d, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov r13, rax
test rax, rax
je 0x1400131e3
mov r8, rdi
mov rdx, rax
mov ecx, r14d
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x1400131f4
lea rdx, [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x78]
test eax, eax
je 0x1400065ec
mov r12d, 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400065ff
test r15, r15
je 0x1400131fe
test r13, r13
je 0x140006622
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140006645
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r12d, r12d
je 0x140013210
mov r14, qword [rbp - 0x70]
test r14, r14
je 0x140013287
mov rcx, 0xffffffffffffffff
mov rdi, rcx
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140006665
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000df2c
mov r15, rax
test rax, rax
je 0x14001327d
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x140013241
xor r12d, r12d
sub rdx, rdi
mov r8d, r12d
sub r14, r15
mov rcx, r15
lea rax, [rdi + rdx]
test rax, rax
je 0x1400066e2
movzx eax, word [rcx + r14]
test ax, ax
je 0x1400066d9
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400066b4
jmp 0x140013232
test rdi, rdi
je 0x140013232
mov word [rcx], r12w
mov esi, r8d
test r8d, r8d
js 0x1400069b0
mov rdi, qword [rsp + 0x60]
lea rax, [0x1400c9f10]
mov rcx, qword [rdi + 0x30]
cmp rcx, rax
jne 0x140013262
mov qword [rdi + 0x30], r15
mov r15, r12
mov rcx, r15
call fcn.14000df6c
mov r14, qword [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
test r15, r15
je 0x140006750
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
xor r14d, r14d
test esi, esi
js 0x14001339d
mov r11, qword [rbp - 0x78]
mov r10d, r14d
mov ecx, r14d
lea rdx, [r11 + 0x40]
test rdx, rdx
je 0x140006772
mov rcx, qword [rdx + 0x10]
mov r15d, dword [rsp + 0x40]
mov r8, rcx
mov rax, rcx
test rdx, rdx
je 0x1400132fd
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x38]
mov esi, r13d
mov r13, qword [rsp + 0x48]
mov r14, r13
cmp r8, rdx
jne 0x140013291
mov rbx, qword [rbp - 0x68]
xor r14d, r14d
mov r12, qword [rsp + 0x60]
mov r8, qword [r12 + 0x10]
test r8, r8
je 0x140013350
mov r9, qword [r12 + 0x18]
test r9, r9
je 0x140013350
test r10, r10
jne 0x140013307
cmp r8, r12
jne 0x140013326
mov rax, qword [rdx + 0x10]
mov esi, r14d
mov qword [rax + 0x18], r12
mov rax, qword [rdx + 0x10]
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], rdx
mov qword [rdx + 0x10], r12
test esi, esi
js 0x1400133a2
inc dword [r13 + 0x24]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000681b
cmp dword [rcx + 0x24], 0
je 0x14001335a
mov r12, qword [rsp + 0x48]
mov r15d, r14d
mov rdi, r14
mov r13d, 1
mov r14d, dword [rsp + 0x30]
jmp 0x140005dec
test rdi, rdi
je 0x140013027
xor edi, edi
mov word [rcx], di
test r14d, r14d
js 0x140006a03
mov rcx, qword [r13 + 0x28]
lea rax, [0x1400c9f10]
cmp rcx, rax
jne 0x140013051
mov qword [r13 + 0x28], rsi
mov rsi, rdi
mov rcx, rsi
call fcn.14000df6c
test r14d, r14d
js 0x1400130af
mov ecx, 0x18
call fcn.14000df2c
mov rcx, rax
test rax, rax
je 0x1400130a1
mov dword [rax + 8], 1
lea rdx, [0x14008d060]
mov qword [rax], rdx
mov qword [rax + 0x10], r12
cmp r12, 0xffffffffffffffff
je 0x140013077
mov qword [r13 + 0x30], rax
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x40], eax
xor r14d, r14d
cmp qword [r13 + 0x30], r14
je 0x1400130ee
mov rdi, qword [rbp - 0x78]
lea rdx, [rbp - 0x30]
mov r12, qword [rsp + 0x48]
mov r13d, 1
mov r8, r12
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x68], r14
lea rcx, [rdi + 8]
call fcn.14000bde0
mov esi, eax
test eax, eax
js 0x1400062ec
inc dword [rdi + 0x30]
mov rsi, r12
mov rdi, r12
mov dword [rsp + 0x40], r13d
mov r15d, r13d
jmp 0x140006304
mov r12, qword [rsp + 0x38]
mov r15d, 0x7ffffffe
xor r14d, r14d
jmp 0x140006142
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140006465
test esi, esi
jne 0x140012e95
mov rcx, qword [r14]
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x140012e80
mov r9, qword [rsp + 0x70]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
cmp word [r9 + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x140006970
jmp 0x140005f4f
mov rdx, qword [rsp + 0x38]
lea rax, [0x1400c9f10]
cmp r14, rax
je 0x1400060b9
lea rax, [0x1400c9f12]
mov qword [rsp + 0x38], rdx
cmp r14, rax
jne 0x1400060a9
jmp 0x1400060b9
lea rax, [0x1400c9f10]
cmp r15, rax
je 0x14000671a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [0x1400c9f12]
cmp r15, rax
jne 0x140006712
jmp 0x14000671a
lea rax, [0x1400c9f10]
cmp rsi, rax
je 0x140006870
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [0x1400c9f12]
cmp rsi, rax
jne 0x140006868
jmp 0x140006870
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400ab388]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.140058804
nop
jmp 0x140005be3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400ab3a8]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.140058804
nop
jmp 0x140005c10
test byte [rax + 0xc], 2
je 0x140005c59
xor edx, edx
mov rcx, rbx
call fcn.140051750
nop
jmp 0x140005c59
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x140012bf6
test byte [rcx + 0x44], 4
je 0x140012bf6
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ab950]
mov edx, 0x16
call fcn.140016c5c
mov rcx, qword [rbx + 0x60]
call fcn.14000f66c
mov qword [rbx + 0x60], rsi
jmp 0x140005c76
mov qword [rax + 8], rsi
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140012c08
jmp 0x140005cbd
mov rax, qword [rbx + 0x28]
mov qword [0x1400c94f0], rax
jmp 0x140005cdc
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, rbx
je 0x140012c41
test rax, rax
jne 0x140012c2a
jmp 0x140005cdc
mov rax, qword [rbx + 0x28]
mov qword [rcx], rax
jmp 0x140005cdc
lea rcx, [rbx + 0x18]
call fcn.140051c44
nop
jmp 0x140005ce6
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x140005d07
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140012c94
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400ca110]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov qword [rbx + 0x40], rsi
jmp 0x140005d14
mov rcx, qword [0x1400ca110]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x140005d21
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x140005d3c
mov esi, 0x80070057
jmp 0x140005d49
mov r8, r9
test rax, rax
je 0x140005db2
mov rax, qword [rax + 0x10]
mov rdx, rax
mov r10, rax
jmp 0x140005db2
mov r8, r9
jmp 0x140005e87
mov esi, 0x80004003
jmp 0x140005eae
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x140005f0e
test byte [rcx + 0x44], 0x20
je 0x140005f0e
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ab930]
mov edx, 0xa
lea r9d, [rdx + 0x4e]
call fcn.140016ccc
lea rax, [0x1400c82a8]
mov esi, 8
jmp 0x140012e2f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140012da8
lea esi, [rax + 5]
jmp 0x140012e28
cmp eax, 0x7a
jne 0x140012e28
mov rcx, qword [0x1400ca110]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov esi, dword [rsp + 0x50]
mov ecx, esi
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
jne 0x140012ddd
lea esi, [rax + 8]
jmp 0x140012e28
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x140012e10
xor ecx, ecx
mov esi, ecx
jmp 0x140005f47
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, 5
test eax, eax
cmove eax, esi
mov esi, eax
lea rax, [0x1400c82a8]
mov rcx, qword [0x1400c82a8]
cmp rcx, rax
je 0x140012e59
test byte [rcx + 0x44], 0x20
je 0x140012e59
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ab970]
mov edx, 0x31
mov r9d, esi
call fcn.140016c88
test rdi, rdi
je 0x140006934
mov rcx, qword [0x1400ca110]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x140006934
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140012e95
lea esi, [rax + 8]
mov r9, qword [rsp + 0x70]
mov rdi, 0xffffffffffffffff
jmp 0x140005faa
sub rcx, 2
jmp 0x140005fa5
mov esi, 0x7a
jmp 0x140005faa
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x140005fde
test byte [rcx + 0x44], 0x20
je 0x140005fde
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ab970]
mov edx, 0xe
mov r9d, esi
call fcn.140016c88
nop
jmp 0x140005fde
sub rcx, 2
mov r9d, 0x8007007a
jmp 0x14000607e
mov eax, 0x80070057
mov r9d, eax
mov esi, eax
test rdi, rdi
je 0x140006082
mov word [r14], r10w
jmp 0x140006981
lea rax, [0x1400c9f12]
cmp rcx, rax
je 0x1400060a2
call fcn.14000df6c
xor r10d, r10d
jmp 0x1400060a2
mov esi, 0x8007000e
jmp 0x140006981
mov rdx, r15
mov rax, r13
mov qword [rsp + 0x38], rdx
mov rcx, r13
mov r13, r12
test rdi, rdi
je 0x1400060f8
mov rdi, qword [rdi + 0x10]
mov rax, rdi
mov qword [rsp + 0x38], rdx
mov rcx, rdi
jmp 0x1400060f8
mov r13, r12
mov qword [rsp + 0x38], r15
mov r12, r15
mov r15d, 0x7ffffffe
jmp 0x14000691b
mov r12, qword [rsp + 0x38]
mov esi, 0x80070057
jmp 0x14000691b
mov r12, rdx
jmp 0x14000691b
mov r12, qword [rsp + 0x38]
xor r14d, r14d
jmp 0x140006149
mov r12, qword [rsp + 0x38]
xor r14d, r14d
jmp 0x140006142
mov r12, rdi
jmp 0x140006142
mov r8d, dword [rdx + 8]
cmp r8d, 0x7fffffff
jne 0x14000629d
jmp 0x1400062af
mov rax, qword [rdx]
mov esi, 0x80004005
movabs r10, 0xef3537fb7e56b870
mov edx, 1
mov rcx, rdi
call qword [0x1400a9400]
mov qword [rsp + 0x38], r12
jmp 0x140013009
mov esi, 0x8007000e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14001301f
mov esi, 0x80070057
xor r14d, r14d
jmp 0x1400062e2
sub rcx, 2
mov r14d, 0x8007007a
jmp 0x14000683f
mov eax, 0x80070057
mov r14d, eax
test rdi, rdi
je 0x140006844
xor ecx, ecx
mov word [rsi], cx
jmp 0x140006a03
lea rax, [0x1400c9f12]
cmp rcx, rax
je 0x140006861
call fcn.14000df6c
nop
jmp 0x140006861
mov r14d, 0x8007000e
jmp 0x140006a03
mov rax, qword [rdx]
mov r14d, 0x80004005
movabs r10, 0xef3537fb7e56b870
mov edx, 1
call qword [0x1400a9400]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
jmp 0x1400130af
mov r14d, 0x8007000e
jmp 0x1400130af
mov r14d, 0x80070057
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x1400068ba
test byte [rcx + 0x44], 0x20
je 0x1400068ba
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400abb38]
mov edx, 0x11
mov r9d, r14d
call fcn.140016ccc
nop
jmp 0x1400068ba
mov esi, 0x80004005
mov r15d, 1
mov r12, r13
jmp 0x1400133a7
mov r12, r14
mov esi, 0x8007000e
mov r15d, 1
jmp 0x1400133a7
mov r13d, dword [rsp + 0x30]
mov r12d, r13d
jmp 0x1400062ec
call fcn.14000aaf0
mov edi, eax
jmp 0x140006412
call fcn.14000aaf0
mov edi, eax
jmp 0x14000643a
test edi, edi
js 0x140006455
call fcn.14000aaf0
mov edi, eax
jmp 0x140006455
test r15, r15
je 0x1400131a0
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r15, r14
mov qword [rsp + 0x70], r14
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x1400131a0
test byte [rcx + 0x44], 0x20
je 0x1400131a0
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400abb38]
mov edx, 0x12
mov r9d, edi
call fcn.140016ccc
nop
jmp 0x140006737
test edi, edi
js 0x14000673c
jmp 0x140006472
lea rcx, [rsp + 0x58]
call fcn.14004caa0
mov r12d, eax
test eax, eax
je 0x1400065ec
mov rcx, qword [rsp + 0x58]
jmp 0x140006492
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x1400065ec
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x78]
jmp 0x1400065ec
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x1400065ff
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call fcn.140006a40
mov esi, eax
test eax, eax
js 0x14000672d
jmp 0x14000664e
sub rcx, 2
mov r8d, 0x8007007a
jmp 0x1400066e2
mov r8d, 0x80070057
mov esi, r8d
test rdi, rdi
je 0x14001325a
xor eax, eax
mov word [r15], ax
jmp 0x1400069b0
xor r12d, r12d
jmp 0x1400066e6
lea rax, [0x1400c9f12]
cmp rcx, rax
je 0x14000670b
call fcn.14000df6c
nop
jmp 0x14000670b
mov esi, 0x8007000e
jmp 0x1400069b0
mov esi, 0x80070057
jmp 0x14000671e
mov r8, rax
mov qword [rsp + 0x48], r14
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], r12
sub eax, dword [r8 + 0x24]
mov qword [rsp + 0x38], rbx
test eax, eax
jle 0x1400067a4
mov qword [rsp + 0x48], r14
mov r10, r8
mov dword [rsp + 0x30], esi
mov rax, r8
mov qword [rsp + 0x68], r12
mov r13d, esi
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x140006790
mov rcx, qword [rcx + 0x10]
mov r8, rcx
mov qword [rsp + 0x48], r14
mov rax, rcx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x38], rbx
jmp 0x140006790
mov r13, qword [rsp + 0x48]
jmp 0x1400067b0
mov rcx, r10
call fcn.1400444a8
test eax, eax
js 0x1400067d5
mov rdx, r12
call fcn.1400444c4
mov esi, eax
jmp 0x1400067fb
cmp r9, r12
je 0x1400067de
mov qword [r8 + 0x18], r9
mov rcx, qword [r12 + 0x18]
mov rax, qword [r12 + 0x10]
mov qword [rcx + 0x10], rax
mov qword [r12 + 0x10], r12
mov qword [r12 + 0x18], r12
jmp 0x1400067de
mov esi, 0x80004005
jmp 0x1400067fb
dec dword [r11 + 0x30]
mov rax, qword [rcx]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
call qword [0x1400a9400]
nop
jmp 0x14000681b
mov rdi, r12
mov esi, 0x80004005
mov r12, qword [rsp + 0x48]
jmp 0x1400133ac
mov r12, qword [rsp + 0x48]
mov rdi, r14
mov esi, 0x8007000e
jmp 0x1400133ac
mov r15d, dword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov r13d, dword [rbp - 0x80]
jmp 0x140005dec
mov esi, 0x80070057
mov r12, r13
mov r14d, r13d
jmp 0x140005dec
mov rax, qword [rbp - 0x78]
dec dword [rax + 0x30]
test r12, r12
je 0x140005e26
mov rax, qword [r12]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, r12
call qword [0x1400a9400]
nop
jmp 0x140005e26
mov rax, qword [rdi]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, rdi
call qword [0x1400a9400]
nop
jmp 0x140005e2f
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x140005e37
test byte [rcx + 0x44], 0x20
je 0x140005e37
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400abb38]
mov edx, 0xc
mov r9d, esi
call fcn.140016ccc
nop
jmp 0x140005e37