Function at 0x140005110
Capabilities:
Check os version
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x230]
xor esi, esi
mov rcx, qword [rbp + 0x238]
mov r14d, r9d
mov r12, qword [rbp + 0x240]
mov r13d, esi
mov dword [rbp - 0x7c], edx
mov edi, esi
mov rdx, qword [0x1400c9088]
mov r15d, esi
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x60], rsi
mov dword [rbp - 0x80], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x40], esi
test r8, r8
je 0x1400115ed
test rax, rax
je 0x1400115ed
test rcx, rcx
je 0x1400115ed
test r12, r12
je 0x1400115ed
test byte [0x1400c9100], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0xf0003
mov dword [rsp + 0x40], esi
jne 0x140011450
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x50]
xor r9d, r9d
mov dword [rsp + 0x20], esi
lea rdx, [rbp - 0x70]
xor ecx, ecx
call fcn.140006060
test byte [0x1400c9100], 2
mov ebx, eax
jne 0x140011478
test ebx, ebx
je 0x14000533c
lea rcx, [0x1400c8e38]
mov dword [rsp + 0x40], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x1400115c3
cmp dword [rbx], 0x6060
jne 0x1400115c3
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400114a0
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp qword [rbx + 0x60], rsi
jne 0x1400114ba
mov rax, qword [rbx + 8]
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbx + 0x10]
mov rax, qword [rax + 0x118]
call qword [0x1400a8400]
test eax, eax
je 0x140005339
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x1400114fa
mov rax, qword [0x1400c84f0]
mov dword [rbx + 0x30], esi
mov dword [rbx + 0x50], esi
cmp rax, rbx
je 0x14001150c
test rax, rax
jne 0x14001151c
cmp qword [rbx + 0x18], rsi
jne 0x14001153f
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x14001154e
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x140011560
mov r8, qword [rbx + 0x48]
test r8, r8
jne 0x1400115a8
mov rcx, qword [0x1400c9078]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rdi, rsi
xor ecx, ecx
call fcn.140006040
mov rdx, qword [rbp - 0x78]
mov esi, eax
mov rbx, qword [rdx + 0x60]
mov rcx, rbx
mov qword [rbp - 0x68], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [rbx + 0x2c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rbx + 0x28], eax
test esi, esi
js 0x140011cac
mov r11, qword [rbp - 0x78]
lea rax, [r11 + 0x38]
test rax, rax
je 0x140011ca7
xor esi, esi
lea rcx, [r11 + 0x40]
mov eax, esi
test rcx, rcx
je 0x14000539c
mov rax, qword [rcx + 0x10]
mov rdx, rax
mov r10, rax
mov r8, rsi
test rcx, rcx
je 0x140005487
mov r11d, dword [rbp - 0x7c]
mov r9, r8
cmp rdx, rcx
je 0x140005487
mov r8d, r11d
mov rdx, r10
sub r8d, dword [r10 + 0x24]
js 0x140011612
test r8d, r8d
jne 0x1400115f7
mov r8, rdx
test r14d, r14d
jne 0x140005487
mov r14d, esi
mov r12, rsi
mov r13d, esi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140005405
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140005411
mov dword [rax], r13d
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x14000541d
mov dword [rax], r14d
test r15d, r15d
jne 0x140011cb7
test rdi, rdi
jne 0x140011cec
test esi, esi
js 0x140011d10
add dword [rbx + 0x2c], 0xffffffff
mov eax, dword [rbx + 0x2c]
jne 0x140005445
xor eax, eax
mov dword [rbx + 0x28], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14000d4b0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r14d, r14d
mov r15d, 0x7ffffffe
test r8, r8
je 0x1400054d4
mov rdi, qword [r8 + 0x28]
mov qword [rsp + 0x38], rdi
test rdi, rdi
je 0x14001161a
dec dword [rdi + 0x24]
mov qword [r8 + 0x28], r14
mov rax, qword [r8]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, r8
call qword [0x1400a8400]
test esi, esi
js 0x1400118b1
mov rcx, qword [0x1400c9078]
xor eax, eax
mov qword [rsp + 0x70], rax
mov esi, eax
mov dword [rsp + 0x50], eax
lea edx, [rax + 8]
lea r8d, [rax + 0x58]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140011624
lea rax, [0x1400c72a8]
test rdi, rdi
je 0x140011676
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov r8, rdi
lea edx, [r9 - 0x57]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x140011680
mov r14, rdi
jmp 0x140005f3c
lea eax, [rax*2 + 2]
cmp eax, 0x200
ja 0x1400117a1
lea rax, [rbp - 0x30]
mov r8, r9
sub r8, rax
lea rcx, [rbp - 0x30]
mov edx, 0x100
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x1400055a5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000559c
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140005574
jmp 0x140011798
test rdx, rdx
je 0x140011798
xor eax, eax
mov word [rcx], ax
test r9, r9
je 0x1400055be
mov rcx, r9
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [0x1400c9078]
mov r8, r14
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
jne 0x1400117ab
mov ecx, esi
call fcn.140006040
mov esi, eax
test eax, eax
js 0x140011897
lea rax, [rbp - 0x30]
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x1400055f3
mov rcx, 0xffffffffffffffff
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000d114
xor r10d, r10d
mov r14, rax
test rax, rax
je 0x140011832
lea rax, [rdi - 1]
cmp rax, r15
ja 0x1400117f9
mov rdx, r15
lea r8, [rbp - 0x30]
sub rdx, rdi
mov rcx, r14
sub r8, r14
mov r9d, r10d
nop word [rax + rax]
lea rax, [rdx + rdi]
test rax, rax
je 0x14000567e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140005675
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140005650
jmp 0x1400117ea
test rdi, rdi
je 0x1400117ea
mov word [rcx], r10w
mov esi, r9d
test r9d, r9d
js 0x140005f81
mov rcx, qword [r12]
lea rax, [0x1400c8ea0]
cmp rcx, rax
jne 0x140011815
mov qword [r12], r14
mov r14, r10
mov rcx, r14
call fcn.14000d154
mov rdx, qword [rsp + 0x38]
xor r10d, r10d
test esi, esi
js 0x1400118a4
mov r14, qword [rbp - 0x78]
add r14, 8
je 0x140011880
mov r13, r10
mov esi, 1
mov rdi, r10
add r14, 8
je 0x1400056e4
mov rdi, qword [r14 + 0x10]
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdi
test r14, r14
je 0x14001188f
mov r15, rdx
mov r12, r13
cmp rax, r14
je 0x140005f10
mov rdx, qword [rcx + 0x28]
mov r13, rcx
lea rcx, [rbp - 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
js 0x14001186a
jne 0x14001183c
mov qword [rsp + 0x38], r15
xor r14d, r14d
mov r12, qword [rsp + 0x38]
mov esi, r14d
mov r15d, 0x7ffffffe
mov rdi, 0xffffffffffffffff
test esi, esi
je 0x14000583e
cmp esi, 1
jne 0x140011a06
lea ecx, [rsi + 0x47]
call fcn.14000d114
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x1400119f3
mov r12, qword [rsp + 0x68]
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rax, [0x14008c0c0]
mov qword [r13], rax
lea rax, [0x1400c8ea0]
mov qword [r13 + 0x28], rax
mov qword [r13 + 0x20], 0x746e6575
mov qword [r13 + 0x30], r14
mov qword [r13 + 0x38], 0
test r12, r12
je 0x14001199b
lea rax, [rbp - 0x30]
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400057c0
mov rcx, 0xffffffffffffffff
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000d114
mov rsi, rax
test rax, rax
je 0x14001195e
lea rax, [rdi - 1]
cmp rax, r15
ja 0x140011928
mov rdx, r15
lea r8, [rbp - 0x30]
sub rdx, rdi
mov rcx, rsi
sub r8, rsi
lea rax, [rdx + rdi]
test rax, rax
je 0x140005e3f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140005e36
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140005811
jmp 0x140011919
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x48], r13
test r14, r14
je 0x14001190c
mov ecx, 0x18
call fcn.14000d114
mov rdi, rax
test rax, rax
je 0x1400118f6
mov dword [rax + 8], 1
lea rdx, [0x14008c008]
mov qword [rax], rdx
mov qword [rax + 0x10], r14
cmp r14, 0xffffffffffffffff
je 0x1400118cf
mov rdx, qword [r13 + 0x30]
xor r14d, r14d
mov esi, r14d
mov r8d, dword [rdx + 8]
cmp r8d, 0x7fffffff
je 0x1400058af
lea ecx, [r8 - 1]
mov eax, r8d
lock cmpxchg dword [rdx + 8], ecx
jne 0x1400118b9
lea eax, [r8 - 1]
test eax, eax
jne 0x1400058d1
mov rax, qword [rdx]
movabs r10, 0xca34bf075ed23170
mov rax, qword [rax + 8]
mov rcx, rdx
call qword [0x1400a8400]
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x40], eax
mov qword [r13 + 0x30], rdi
mov qword [rsp + 0x68], r14
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
mov dword [rsp + 0x40], r13d
mov rdi, r12
mov r15d, r13d
test esi, esi
js 0x140011c99
mov rsi, qword [rsp + 0x48]
mov ecx, 0x38
call fcn.14000d114
mov qword [rsp + 0x60], rax
mov r12, rax
test rax, rax
je 0x140011c80
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rax, section..rdata
mov qword [r12], rax
mov eax, dword [rbp - 0x7c]
mov dword [r12 + 0x24], eax
lea rax, [0x1400c8ea0]
mov qword [r12 + 0x30], rax
mov dword [r12 + 0x20], 0x746e6573
mov qword [r12 + 0x28], rsi
test rdi, rdi
je 0x140011c71
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x70], r14
mov rsi, qword [rax + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
xor r8d, r8d
lea r9, [rsp + 0x58]
mov rcx, rax
lea edx, [r8 + 0xe]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x1400059f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x1400059c9
call fcn.1400094f0
mov edi, eax
test eax, eax
jns 0x1400059f6
cmp di, 0x3f0
je 0x1400059f6
jmp 0x140005a55
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov edx, 0xe
lea r9, [rsp + 0x58]
mov rcx, rax
lea r8d, [rdx - 0xd]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x1400059b2
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140011a13
mov edi, r14d
test edi, edi
js 0x140005a3a
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
nop dword [rax + rax]
test eax, eax
je 0x140011a1f
mov edi, r14d
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140011a2b
mov rcx, qword [rsp + 0x58]
mov esi, edi
test rcx, rcx
jne 0x140005f23
mov r15, qword [rsp + 0x70]
test edi, edi
js 0x140011a3f
mov qword [rbp - 0x70], r14
mov r13, r14
mov qword [rsp + 0x58], r14
mov rsi, r14
test r15, r15
je 0x140011a9f
mov rcx, r15
mov qword [rsp + 0x58], rcx
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x140005bec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140005bec
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
mov rsi, rax
test rax, rax
je 0x140011abe
mov r9d, dword [rsp + 0x50]
lea edx, [r12 + 2]
mov rcx, qword [rsp + 0x58]
mov r8, rsi
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
je 0x140005bec
mov edx, dword [rsi]
mov r12d, r14d
mov ecx, r14d
test edx, edx
je 0x140005bec
lea rax, [rsi + 8]
nop dword [rax]
mov rdi, qword [rax]
cmp byte [rdi + 1], 3
je 0x140005b68
inc ecx
add rax, 0x10
cmp ecx, edx
jb 0x140005b50
jmp 0x140005bec
cmp dword [rdi + 8], 5
jne 0x140005b59
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, eax
mov r14d, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov r13, rax
test rax, rax
je 0x140011ad5
mov r8, rdi
mov rdx, rax
mov ecx, r14d
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x140011ae6
lea rdx, [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x78]
test eax, eax
je 0x140005bec
mov r12d, 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005bff
test r15, r15
je 0x140011af0
test r13, r13
je 0x140005c22
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140005c45
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r12d, r12d
je 0x140011b02
mov r14, qword [rbp - 0x70]
test r14, r14
je 0x140011b79
mov rcx, 0xffffffffffffffff
mov rdi, rcx
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140005c65
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000d114
mov r15, rax
test rax, rax
je 0x140011b6f
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x140011b33
xor r12d, r12d
sub rdx, rdi
mov r8d, r12d
sub r14, r15
mov rcx, r15
lea rax, [rdi + rdx]
test rax, rax
je 0x140005ce2
movzx eax, word [rcx + r14]
test ax, ax
je 0x140005cd9
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140005cb4
jmp 0x140011b24
test rdi, rdi
je 0x140011b24
mov word [rcx], r12w
mov esi, r8d
test r8d, r8d
js 0x140005fb0
mov rdi, qword [rsp + 0x60]
lea rax, [0x1400c8ea0]
mov rcx, qword [rdi + 0x30]
cmp rcx, rax
jne 0x140011b54
mov qword [rdi + 0x30], r15
mov r15, r12
mov rcx, r15
call fcn.14000d154
mov r14, qword [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
test r15, r15
je 0x140005d50
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
xor r14d, r14d
test esi, esi
js 0x140011c8f
mov r11, qword [rbp - 0x78]
mov r10d, r14d
mov ecx, r14d
lea rdx, [r11 + 0x40]
test rdx, rdx
je 0x140005d72
mov rcx, qword [rdx + 0x10]
mov r15d, dword [rsp + 0x40]
mov r8, rcx
mov rax, rcx
test rdx, rdx
je 0x140011bef
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x38]
mov esi, r13d
mov r13, qword [rsp + 0x48]
mov r14, r13
cmp r8, rdx
jne 0x140011b83
mov rbx, qword [rbp - 0x68]
xor r14d, r14d
mov r12, qword [rsp + 0x60]
mov r8, qword [r12 + 0x10]
test r8, r8
je 0x140011c42
mov r9, qword [r12 + 0x18]
test r9, r9
je 0x140011c42
test r10, r10
jne 0x140011bf9
cmp r8, r12
jne 0x140011c18
mov rax, qword [rdx + 0x10]
mov esi, r14d
mov qword [rax + 0x18], r12
mov rax, qword [rdx + 0x10]
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], rdx
mov qword [rdx + 0x10], r12
test esi, esi
js 0x140011c94
inc dword [r13 + 0x24]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005e1b
cmp dword [rcx + 0x24], 0
je 0x140011c4c
mov r12, qword [rsp + 0x48]
mov r15d, r14d
mov rdi, r14
mov r13d, 1
mov r14d, dword [rsp + 0x30]
jmp 0x1400053ec
test rdi, rdi
je 0x140011919
xor edi, edi
mov word [rcx], di
test r14d, r14d
js 0x140006003
mov rcx, qword [r13 + 0x28]
lea rax, [0x1400c8ea0]
cmp rcx, rax
jne 0x140011943
mov qword [r13 + 0x28], rsi
mov rsi, rdi
mov rcx, rsi
call fcn.14000d154
test r14d, r14d
js 0x1400119a1
mov ecx, 0x18
call fcn.14000d114
mov rcx, rax
test rax, rax
je 0x140011993
mov dword [rax + 8], 1
lea rdx, [0x14008c008]
mov qword [rax], rdx
mov qword [rax + 0x10], r12
cmp r12, 0xffffffffffffffff
je 0x140011969
mov qword [r13 + 0x30], rax
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x40], eax
xor r14d, r14d
cmp qword [r13 + 0x30], r14
je 0x1400119e0
mov rdi, qword [rbp - 0x78]
lea rdx, [rbp - 0x30]
mov r12, qword [rsp + 0x48]
mov r13d, 1
mov r8, r12
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x68], r14
lea rcx, [rdi + 8]
call fcn.14000b520
mov esi, eax
test eax, eax
js 0x1400058ec
inc dword [rdi + 0x30]
mov rsi, r12
mov rdi, r12
mov dword [rsp + 0x40], r13d
mov r15d, r13d
jmp 0x140005904
mov r12, qword [rsp + 0x38]
mov r15d, 0x7ffffffe
xor r14d, r14d
jmp 0x140005742
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140005a65
test esi, esi
jne 0x140011787
mov rcx, qword [r14]
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x140011772
mov r9, qword [rsp + 0x70]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
cmp word [r9 + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x140005f70
jmp 0x14000554f
mov rdx, qword [rsp + 0x38]
lea rax, [0x1400c8ea0]
cmp r14, rax
je 0x1400056b9
lea rax, [0x1400c8ea2]
mov qword [rsp + 0x38], rdx
cmp r14, rax
jne 0x1400056a9
jmp 0x1400056b9
lea rax, [0x1400c8ea0]
cmp r15, rax
je 0x140005d1a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [0x1400c8ea2]
cmp r15, rax
jne 0x140005d12
jmp 0x140005d1a
lea rax, [0x1400c8ea0]
cmp rsi, rax
je 0x140005e70
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [0x1400c8ea2]
cmp rsi, rax
jne 0x140005e68
jmp 0x140005e70
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400aa3d8]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.1400575c4
nop
jmp 0x1400051e3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400aa3e8]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.1400575c4
nop
jmp 0x140005210
test byte [rax + 0xc], 2
je 0x140005259
xor edx, edx
mov rcx, rbx
call fcn.140050510
nop
jmp 0x140005259
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400114e8
test byte [rcx + 0x44], 4
je 0x1400114e8
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa8e0]
mov edx, 0x16
call fcn.1400162ec
mov rcx, qword [rbx + 0x60]
call fcn.14000e85c
mov qword [rbx + 0x60], rsi
jmp 0x140005276
mov qword [rax + 8], rsi
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400114fa
jmp 0x1400052bd
mov rax, qword [rbx + 0x28]
mov qword [0x1400c84f0], rax
jmp 0x1400052dc
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, rbx
je 0x140011533
test rax, rax
jne 0x14001151c
jmp 0x1400052dc
mov rax, qword [rbx + 0x28]
mov qword [rcx], rax
jmp 0x1400052dc
lea rcx, [rbx + 0x18]
call fcn.140050a04
nop
jmp 0x1400052e6
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x140005307
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140011586
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov qword [rbx + 0x40], rsi
jmp 0x140005314
mov rcx, qword [0x1400c9078]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x140005321
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x14000533c
mov esi, 0x80070057
jmp 0x140005349
mov r8, r9
test rax, rax
je 0x1400053b2
mov rax, qword [rax + 0x10]
mov rdx, rax
mov r10, rax
jmp 0x1400053b2
mov r8, r9
jmp 0x140005487
mov esi, 0x80004003
jmp 0x1400054ae
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x14000550e
test byte [rcx + 0x44], 0x20
je 0x14000550e
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa8c0]
mov edx, 0xa
lea r9d, [rdx + 0x4e]
call fcn.14001635c
lea rax, [0x1400c72a8]
mov esi, 8
jmp 0x140011721
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x14001169a
lea esi, [rax + 5]
jmp 0x14001171a
cmp eax, 0x7a
jne 0x14001171a
mov rcx, qword [0x1400c9078]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov esi, dword [rsp + 0x50]
mov ecx, esi
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
jne 0x1400116cf
lea esi, [rax + 8]
jmp 0x14001171a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x140011702
xor ecx, ecx
mov esi, ecx
jmp 0x140005547
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, 5
test eax, eax
cmove eax, esi
mov esi, eax
lea rax, [0x1400c72a8]
mov rcx, qword [0x1400c72a8]
cmp rcx, rax
je 0x14001174b
test byte [rcx + 0x44], 0x20
je 0x14001174b
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa900]
mov edx, 0x31
mov r9d, esi
call fcn.140016318
test rdi, rdi
je 0x140005f34
mov rcx, qword [0x1400c9078]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x140005f34
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140011787
lea esi, [rax + 8]
mov r9, qword [rsp + 0x70]
mov rdi, 0xffffffffffffffff
jmp 0x1400055aa
sub rcx, 2
jmp 0x1400055a5
mov esi, 0x7a
jmp 0x1400055aa
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400055de
test byte [rcx + 0x44], 0x20
je 0x1400055de
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa900]
mov edx, 0xe
mov r9d, esi
call fcn.140016318
nop
jmp 0x1400055de
sub rcx, 2
mov r9d, 0x8007007a
jmp 0x14000567e
mov eax, 0x80070057
mov r9d, eax
mov esi, eax
test rdi, rdi
je 0x140005682
mov word [r14], r10w
jmp 0x140005f81
lea rax, [0x1400c8ea2]
cmp rcx, rax
je 0x1400056a2
call fcn.14000d154
xor r10d, r10d
jmp 0x1400056a2
mov esi, 0x8007000e
jmp 0x140005f81
mov rdx, r15
mov rax, r13
mov qword [rsp + 0x38], rdx
mov rcx, r13
mov r13, r12
test rdi, rdi
je 0x1400056f8
mov rdi, qword [rdi + 0x10]
mov rax, rdi
mov qword [rsp + 0x38], rdx
mov rcx, rdi
jmp 0x1400056f8
mov r13, r12
mov qword [rsp + 0x38], r15
mov r12, r15
mov r15d, 0x7ffffffe
jmp 0x140005f1b
mov r12, qword [rsp + 0x38]
mov esi, 0x80070057
jmp 0x140005f1b
mov r12, rdx
jmp 0x140005f1b
mov r12, qword [rsp + 0x38]
xor r14d, r14d
jmp 0x140005749
mov r12, qword [rsp + 0x38]
xor r14d, r14d
jmp 0x140005742
mov r12, rdi
jmp 0x140005742
mov r8d, dword [rdx + 8]
cmp r8d, 0x7fffffff
jne 0x14000589d
jmp 0x1400058af
mov rax, qword [rdx]
mov esi, 0x80004005
movabs r10, 0xef3537fb7e56b870
mov edx, 1
mov rcx, rdi
call qword [0x1400a8400]
mov qword [rsp + 0x38], r12
jmp 0x1400118fb
mov esi, 0x8007000e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140011911
mov esi, 0x80070057
xor r14d, r14d
jmp 0x1400058e2
sub rcx, 2
mov r14d, 0x8007007a
jmp 0x140005e3f
mov eax, 0x80070057
mov r14d, eax
test rdi, rdi
je 0x140005e44
xor ecx, ecx
mov word [rsi], cx
jmp 0x140006003
lea rax, [0x1400c8ea2]
cmp rcx, rax
je 0x140005e61
call fcn.14000d154
nop
jmp 0x140005e61
mov r14d, 0x8007000e
jmp 0x140006003
mov rax, qword [rdx]
mov r14d, 0x80004005
movabs r10, 0xef3537fb7e56b870
mov edx, 1
call qword [0x1400a8400]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
jmp 0x1400119a1
mov r14d, 0x8007000e
jmp 0x1400119a1
mov r14d, 0x80070057
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140005eba
test byte [rcx + 0x44], 0x20
je 0x140005eba
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa40]
mov edx, 0x11
mov r9d, r14d
call fcn.14001635c
nop
jmp 0x140005eba
mov esi, 0x80004005
mov r15d, 1
mov r12, r13
jmp 0x140011c99
mov r12, r14
mov esi, 0x8007000e
mov r15d, 1
jmp 0x140011c99
mov r13d, dword [rsp + 0x30]
mov r12d, r13d
jmp 0x1400058ec
call fcn.1400094f0
mov edi, eax
jmp 0x140005a12
call fcn.1400094f0
mov edi, eax
jmp 0x140005a3a
test edi, edi
js 0x140005a55
call fcn.1400094f0
mov edi, eax
jmp 0x140005a55
test r15, r15
je 0x140011a92
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r15, r14
mov qword [rsp + 0x70], r14
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140011a92
test byte [rcx + 0x44], 0x20
je 0x140011a92
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa40]
mov edx, 0x12
mov r9d, edi
call fcn.14001635c
nop
jmp 0x140005d37
test edi, edi
js 0x140005d3c
jmp 0x140005a72
lea rcx, [rsp + 0x58]
call fcn.14004b854
mov r12d, eax
test eax, eax
je 0x140005bec
mov rcx, qword [rsp + 0x58]
jmp 0x140005a92
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x140005bec
mov ecx, 0xe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x78]
jmp 0x140005bec
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x140005bff
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call fcn.140006040
mov esi, eax
test eax, eax
js 0x140005d2d
jmp 0x140005c4e
sub rcx, 2
mov r8d, 0x8007007a
jmp 0x140005ce2
mov r8d, 0x80070057
mov esi, r8d
test rdi, rdi
je 0x140011b4c
xor eax, eax
mov word [r15], ax
jmp 0x140005fb0
xor r12d, r12d
jmp 0x140005ce6
lea rax, [0x1400c8ea2]
cmp rcx, rax
je 0x140005d0b
call fcn.14000d154
nop
jmp 0x140005d0b
mov esi, 0x8007000e
jmp 0x140005fb0
mov esi, 0x80070057
jmp 0x140005d1e
mov r8, rax
mov qword [rsp + 0x48], r14
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], r12
sub eax, dword [r8 + 0x24]
mov qword [rsp + 0x38], rbx
test eax, eax
jle 0x140005da4
mov qword [rsp + 0x48], r14
mov r10, r8
mov dword [rsp + 0x30], esi
mov rax, r8
mov qword [rsp + 0x68], r12
mov r13d, esi
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x140005d90
mov rcx, qword [rcx + 0x10]
mov r8, rcx
mov qword [rsp + 0x48], r14
mov rax, rcx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x38], rbx
jmp 0x140005d90
mov r13, qword [rsp + 0x48]
jmp 0x140005db0
mov rcx, r10
call fcn.1400432d8
test eax, eax
js 0x140005dd5
mov rdx, r12
call fcn.1400432f4
mov esi, eax
jmp 0x140005dfb
cmp r9, r12
je 0x140005dde
mov qword [r8 + 0x18], r9
mov rcx, qword [r12 + 0x18]
mov rax, qword [r12 + 0x10]
mov qword [rcx + 0x10], rax
mov qword [r12 + 0x10], r12
mov qword [r12 + 0x18], r12
jmp 0x140005dde
mov esi, 0x80004005
jmp 0x140005dfb
dec dword [r11 + 0x30]
mov rax, qword [rcx]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
call qword [0x1400a8400]
nop
jmp 0x140005e1b
mov rdi, r12
mov esi, 0x80004005
mov r12, qword [rsp + 0x48]
jmp 0x140011c9e
mov r12, qword [rsp + 0x48]
mov rdi, r14
mov esi, 0x8007000e
jmp 0x140011c9e
mov r15d, dword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov r13d, dword [rbp - 0x80]
jmp 0x1400053ec
mov esi, 0x80070057
mov r12, r13
mov r14d, r13d
jmp 0x1400053ec
mov rax, qword [rbp - 0x78]
dec dword [rax + 0x30]
test r12, r12
je 0x140005426
mov rax, qword [r12]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, r12
call qword [0x1400a8400]
nop
jmp 0x140005426
mov rax, qword [rdi]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, rdi
call qword [0x1400a8400]
nop
jmp 0x14000542f
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140005437
test byte [rcx + 0x44], 0x20
je 0x140005437
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa40]
mov edx, 0xc
mov r9d, esi
call fcn.14001635c
nop
jmp 0x140005437