Function at 0x1400df970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1460]
mov eax, 0x1560
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x15b8], rbx
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rbp + 0x14a8], ebx
lea rax, vtable.CFunctionEnterExit.0
mov qword [rbp - 0x68], rax
lea rsi, str.SASCommandLineSwitch_Dispatcher
mov qword [rbp - 0x60], rsi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x50]
call fcn.140249b10
mov r8, rsi
lea rdx, [0x1402862f8]
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov r12d, 1
mov r9d, r12d
mov r8d, r12d
lea rdx, [rbp - 0x50]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
mov r9d, r12d
mov r8d, r12d
lea rcx, vtable.CSASApplicationLogManager.0
test r14, r14
mov rdx, r14
jne 0x1400dfa26
lea rdx, str.No_Command_Line
call fcn.140004a50
mov r9d, r12d
mov r8d, r12d
lea rcx, vtable.CSASApplicationLogManager.0
test r15, r15
jne 0x1400dfc7e
lea rdx, str.hWndApplication__NULL
call fcn.140004a50
xor edx, edx
lea rcx, str.SUPERANTISPYWARE
call qword [sym.imp.USER32.dll_FindWindowA]
mov r15, rax
mov r9d, r12d
mov r8d, r12d
lea rcx, vtable.CSASApplicationLogManager.0
test rax, rax
jne 0x1400dfb33
lea rdx, str.No_Copies_Running
call fcn.140004a50
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
lea ecx, [r15 + 0x10]
call fcn.140247068
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x74], r12d
lea r8, [rsp + 0x78]
lea rdx, str.task
mov rcx, r14
call fcn.1400df4c0
test eax, eax
je 0x1400dfb0d
mov r9d, r12d
mov r8d, r12d
lea rdx, str.task
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [rbp - 0x80]
call fcn.140224e50
test eax, eax
jne 0x1400dfb0d
mov r9d, r12d
mov r8d, r12d
lea rdx, str.No_Configuration
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
call fcn.140226e20
mov ebx, r12d
mov qword [rsp + 0x78], rsi
add dword [rbp - 0x74], 0xffffffff
jne 0x1400e0405
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400e0405
call fcn.140247060
jmp 0x1400e0405
lea rdx, str.Copies_Running
call fcn.140004a50
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
mov rcx, r12
call fcn.140247068
mov rcx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400dfb79
mov r8d, dword [rbp - 0x78]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rbp - 0x74], r12d
lea r8, [rsp + 0x78]
lea rdx, str.task
mov rcx, r14
call fcn.1400df4c0
test eax, eax
sete dil
mov qword [rsp + 0x78], rsi
add dword [rbp - 0x74], 0xffffffff
jne 0x1400dfbb0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400dfbb0
call fcn.140247060
mov eax, dword [0x14034e674]
test dil, dil
cmovne eax, ebx
mov dword [0x14034e674], eax
mov r9d, r12d
mov r8d, r12d
lea rdx, str.Relay_Command_Line
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, r12d
mov r8d, r12d
mov rdx, r14
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x3c0]
call fcn.140249b10
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1400dfc20
cmp rdi, 0x1000
jae 0x1400e0402
mov rdx, r14
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov qword [rsp + 0x60], 0x2007
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x1000
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 0x4a]
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1400e0402
lea rdx, str.hWndApplication___NULL
call fcn.140004a50
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x74], r12d
lea r8, [rsp + 0x78]
lea rdx, str.task
mov rcx, r14
call fcn.1400df4c0
test eax, eax
je 0x1400dff1f
mov r9d, r12d
mov r8d, r12d
lea rdx, str.task
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
cmp dword [0x14034e690], 0
je 0x1400dff1f
mov r9d, r12d
mov r8d, r12d
lea rdx, [0x1402b39a0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
cmp dword [0x14037ade0], 0
jne 0x1400e03e9
cmp dword [0x14037cae8], 0
jne 0x1400e03e9
cmp dword [0x1403517f0], 0
jne 0x1400e03e9
mov rcx, qword [rbp - 0x80]
call fcn.140224e50
mov r9d, r12d
mov r8d, r12d
lea rcx, vtable.CSASApplicationLogManager.0
test eax, eax
je 0x1400dfed9
lea rdx, str.Has_Task
call fcn.140004a50
mov rcx, qword [rbp - 0x80]
call fcn.1402272c0
mov r13, qword [0x14037add0]
test r13, r13
je 0x1400dfe60
cmp dword [0x1403507c8], 5
jne 0x1400dfe60
lea rcx, [r13 + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [r13], 0
je 0x1400dfe4f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x6c]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r10d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 0x40c
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._04u__02u__02u__02u:_02u:_02u_t_u_t_u_r_n
mov edx, 0x410
lea rcx, [rbp - 0x50]
call fcn.14000b150
lea rax, [rbp - 0x50]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400dfe11
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x14a8]
lea rdx, [rbp - 0x50]
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp - 0x50]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400dfe40
mov eax, dword [rbp + 0x14a8]
lea rcx, [r13 + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r15, qword [rbp + 0x14a0]
cmp dword [0x140350790], 0
je 0x1400dfea3
mov rcx, qword [0x14037cae0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [0x14037ade4], eax
test eax, eax
jne 0x1400dfeaa
mov dword [0x14037ade8], ebx
xor r8d, r8d
mov rcx, r15
cmp dword [0x1403507c8], 5
jne 0x1400dfec8
movsxd r9, dword [0x1403507bc]
mov edx, 0x815
jmp 0x1400dff19
mov dword [0x14037ade4], r12d
cmp dword [0x1403507bc], 0
jne 0x1400dfe80
mov rcx, qword [0x14037cae0]
call qword [sym.imp.USER32.dll_IsIconic]
mov dword [0x14037ade8], eax
jmp 0x1400dfe86
mov dword [0x14037ade0], r12d
xor r9d, r9d
mov edx, 0x80a
jmp 0x1400dff19
lea rdx, str.No_Task
call fcn.140004a50
call fcn.140226e20
cmp dword [0x14034e674], 0
je 0x1400dff1f
mov r9d, r12d
mov r8d, r12d
lea rdx, str.g_fCloseAfterTask___WM_CLOSE
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageA]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov rcx, r12
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400dff56
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], r12d
lea r8, [rsp + 0x60]
lea rdx, str.standalonescan
mov rcx, r14
call fcn.1400df4c0
mov edi, eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400dff8c
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400dff8c
call fcn.140247060
test edi, edi
je 0x1400e04a9
mov r9d, r12d
mov r8d, r12d
lea rdx, str.CmdLine:_Tech_edition
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x50]
call fcn.140249b10
mov r8d, 0x410
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea rdx, str.tid.db
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rax, qword [0x14037adb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x3c0]
call fcn.140054cb0
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x80
mov r9d, r12d
mov edx, 0x80000000
mov r8d, 3
lea rcx, [rbp + 0x3c0]
call fcn.1400557a0
test eax, eax
jne 0x1400e00ab
mov qword [rbp + 0x14b0], rbx
mov dword [rbp + 0x14a8], ebx
lea r8, [rbp + 0x14a8]
lea rdx, [rbp + 0x14b0]
lea rcx, [rbp + 0x3c0]
call fcn.140055a80
test eax, eax
jne 0x1400e00ab
mov rcx, qword [rbp + 0x14b0]
test rcx, rcx
je 0x1400e00ab
mov eax, dword [rbp + 0x14a8]
mov byte [rax + rcx], 0
mov rcx, qword [rbp + 0x14b0]
call fcn.1402520ac
mov dword [0x140337e90], eax
mov r9d, r12d
mov r8d, r12d
mov rdx, qword [rbp + 0x14b0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
lea rcx, [rbp + 0x3c0]
call fcn.140055000
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov rcx, r12
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e00ee
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], r12d
lea r8, [rsp + 0x60]
lea rdx, str.silent
mov rcx, r14
call fcn.1400df4c0
mov dword [0x14034e674], eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e012e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e012e
call fcn.140247060
mov eax, dword [0x14034e674]
test eax, eax
je 0x1400e0156
mov r9d, r12d
mov r8d, r12d
lea rdx, str.CmdLine:_Silent
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r13, r12
mov rdi, r12
jmp 0x1400e01f1
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov rcx, r12
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e018d
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], r12d
lea r8, [rsp + 0x60]
lea rdx, str.clean
mov rcx, r14
call fcn.1400df4c0
mov edi, eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e01c3
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e01c3
call fcn.140247060
mov r13, rbx
mov r12, rbx
test edi, edi
mov edi, 1
je 0x1400e01f1
mov r9d, edi
mov r8d, edi
lea rdx, str.CmdLine:_Clean
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r13d, edi
mov r12d, edi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov rcx, rdi
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e0228
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], edi
lea r8, [rsp + 0x60]
lea rdx, str.complete
mov rcx, r14
call fcn.1400df4c0
mov r15d, eax
mov dword [rbp + 0x14b0], eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e0264
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e0264
call fcn.140247060
mov edi, ebx
test r15d, r15d
jne 0x1400e030d
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov r15d, 1
mov ecx, r15d
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e02ac
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], r15d
mov dword [rbp + 0x14a8], r15d
lea r8, [rsp + 0x60]
lea rdx, str.quick
mov rcx, r14
call fcn.1400df4c0
test eax, eax
jne 0x1400e02dd
cmp dword [0x14034e674], eax
jne 0x1400e02dd
xor r15b, r15b
jmp 0x1400e02e0
mov r15b, 1
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e02fb
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e02fb
call fcn.140247060
test r15b, r15b
mov eax, 1
cmovne edi, eax
mov r15d, dword [rbp + 0x14b0]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov ebx, 1
mov ecx, ebx
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e0348
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], ebx
lea r8, [rsp + 0x60]
lea rdx, str.scanlog
mov rcx, r14
call fcn.1400df4c0
mov ebx, eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e037d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e037d
call fcn.140247060
test ebx, ebx
mov ebx, 1
je 0x1400e03a5
mov r9d, ebx
mov r8d, ebx
lea rdx, str.CmdLine:_XML_Scan_Log
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [0x14037caf4], ebx
test r15d, r15d
je 0x1400e0461
mov r9d, ebx
mov r8d, ebx
lea rdx, str.CmdLine:_Complete_Scan
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
movsxd r9, dword [0x14034e674]
mov r8, r12
mov edx, 0x81f
mov rcx, qword [rbp + 0x14a0]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r12d, 1
add dword [rbp - 0x74], 0xffffffff
mov qword [rsp + 0x78], rsi
jne 0x1400e0402
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400e0402
call fcn.140247060
mov ebx, r12d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x50]
call fcn.140249b10
lea r8, str.SASCommandLineSwitch_Dispatcher
lea rdx, str._s___Leavex
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov r9d, r12d
mov r8d, r12d
lea rdx, [rbp - 0x50]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
mov eax, ebx
mov rbx, qword [rsp + 0x15b8]
add rsp, 0x1560
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test edi, edi
je 0x1400e03e3
mov r12d, 1
mov r9d, r12d
mov r8d, r12d
lea rdx, str.CmdLine:_Quick_Scan
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
movsxd r9, dword [0x14034e674]
mov r8, r13
mov edx, 0x818
mov rcx, qword [rbp + 0x14a0]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1400e03e9
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov rcx, r12
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e04e0
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
mov dword [rsp + 0x74], r12d
lea r8, [rsp + 0x60]
lea rdx, str.register
mov rcx, r14
call fcn.1400df4c0
mov ebx, eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1400e0516
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e0516
call fcn.140247060
test ebx, ebx
je 0x1400e03e9
mov r9d, r12d
mov r8d, r12d
lea rdx, str.register
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x209
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1400e03e9