Function at 0x1400121d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov dword [rsp + 8], ecx
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x760
mov qword [r11 - 0x230], 0xfffffffffffffffe
mov r13d, ecx
xor r15d, r15d
mov dword [rsp + 0x70], r15d
lea rax, [rsp + 0x78]
mov qword [r11 + 0x10], rax
lea rax, [r11 - 0x718]
mov qword [r11 + 0x18], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013ece
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.invoked
lea rcx, [rsp + 0x78]
call fcn.14000ce70
test al, al
jne 0x14001225a
lea rdx, str.invoked
lea rcx, [rsp + 0x78]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013ed9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rdx, str._Bitlocker_Recovery_solution_getting
lea rcx, [rsp + 0x80]
call fcn.14000ce70
test al, al
jne 0x1400122aa
lea rdx, str._Bitlocker_Recovery_solution_getting
lea rcx, [rsp + 0x80]
call fcn.14000c670
nop
mov r14d, 0xffffffff
mov r8d, r14d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x80]
call fcn.14005c860
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013ee4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x128], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013eef
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013efa
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013f05
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013f10
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013f1b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, str.C:WinBDERecoveryKey
lea rcx, [rsp + 0x90]
call fcn.14000ce70
test al, al
jne 0x1400123bb
lea rdx, str.C:WinBDERecoveryKey
lea rcx, [rsp + 0x90]
call fcn.14000c670
nop
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400123f0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140012509
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140013f26
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, str.BitLockerKeyExtracted.txt
lea rcx, [rsp + 0x88]
call fcn.14000ce70
test al, al
jne 0x140012440
lea rdx, str.BitLockerKeyExtracted.txt
lea rcx, [rsp + 0x88]
call fcn.14000c670
nop
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140012457
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140012468
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140013f31
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x70], 1
mov r9, qword [rsp + 0x88]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x108]
call fcn.14000d050
mov rbx, qword [rsp + 0x108]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x70], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400124e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012509
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x48]
call fcn.14000c670
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x50]
call fcn.14000c670
nop
lea rax, [rsp + 0x208]
mov qword [rsp + 0x740], rax
lea rdx, str.wmic_logicaldisk_get_name
lea rcx, [rsp + 0x208]
call fcn.14000c8e0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.14005e5d0
mov qword [rsp + 0x748], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x510], rcx
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x210], rbx
cmp rcx, rbx
je 0x1400125fc
cmp dword [rbx + 0x10], 0
jl 0x1400125dd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400125dd
call fcn.14000d260
mov qword [rsp + 0x218], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400125ca
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x218]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x1400125fc
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x500], r8d
mov qword [rsp + 0x518], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x220]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x228], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001262e
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x520], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x528], rax
mov rbx, qword [rsp + 0x40]
lea rsi, [rbx - 0x18]
mov qword [rsp + 0x530], rsi
mov rcx, rsi
call fcn.14000d260
mov qword [rsp + 0x538], rax
add rax, 0x18
mov qword [rsp + 0x110], rax
lea rdx, str._Bitlocker_Recovery_solution_is_now_inside_the_trial
lea rcx, [rsp + 0x230]
call fcn.14000c8e0
nop
mov r8d, r14d
lea rdx, [rsp + 0x110]
mov rcx, rax
call fcn.14005c860
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x504], eax
test eax, eax
jns 0x1400126bb
mov edi, r14d
mov dword [rsp + 0x38], r14d
jmp 0x1400126ef
lea rdx, [0x14009a6d0]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
mov qword [rsp + 0x540], rax
test rax, rax
jne 0x1400126e5
mov edi, r14d
mov dword [rsp + 0x38], r14d
jmp 0x1400126ef
sub rdi, rbx
sar rdi, 1
mov dword [rsp + 0x38], edi
mov r8d, edi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000bcd0
nop
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x508], r8d
sub r8d, edi
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x40]
call fcn.14000bd70
mov qword [rsp + 0x548], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x550], rcx
mov qword [rsp + 0x238], rsi
cmp rcx, rsi
je 0x1400127b2
cmp dword [rsi + 0x10], 0
jl 0x140012793
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140012793
call fcn.14000d260
mov qword [rsp + 0x240], rax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140012780
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x240]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x1400127b2
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x158], r8d
mov qword [rsp + 0x558], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x250], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400127f0
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x15c], eax
test eax, eax
jns 0x140012808
mov eax, r14d
jmp 0x140012830
lea rdx, [0x14009a6d4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x560], rax
test rax, rax
jne 0x14001282a
mov eax, r14d
jmp 0x140012830
sub rax, rbx
sar rax, 1
mov dword [rsp + 0x38], eax
lea r8d, [rax + 1]
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x40]
call fcn.14000bcd0
mov qword [rsp + 0x660], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x570], rcx
mov rbx, qword [rsp + 0x30]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x258], rbx
cmp rcx, rbx
je 0x1400128e2
cmp dword [rbx + 0x10], 0
jl 0x1400128c3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400128c3
call fcn.14000d260
mov qword [rsp + 0x260], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400128b0
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x260]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x1400128e2
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x160], r8d
mov qword [rsp + 0x578], rdx
lea rcx, [rsp + 0x30]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x270], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012914
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov qword [rsp + 0x278], rbx
mov rdi, r15
mov qword [rsp + 0x118], r15
nop
movzx ecx, word [rsi]
test cx, cx
je 0x14001297a
mov word [rsp + 0x7b0], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14001295c
test rdi, rdi
jne 0x140012967
mov rdi, rsi
mov qword [rsp + 0x118], rsi
jmp 0x140012967
mov rdi, r15
mov qword [rsp + 0x118], r15
add rsi, 2
mov qword [rsp + 0x278], rsi
mov rbx, qword [rsp + 0x30]
jmp 0x140012930
test rdi, rdi
je 0x1400129ee
sub rdi, rbx
sar rdi, 1
mov dword [rsp + 0x164], edi
test edi, edi
js 0x140013f3c
lea rax, [rbx - 0x18]
mov qword [rsp + 0x580], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x168], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x16c], eax
or eax, ecx
jge 0x1400129d0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14000d2f0
mov rbx, qword [rsp + 0x30]
cmp edi, dword [rbx - 0xc]
jg 0x140013f46
mov dword [rbx - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x120], rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rsp + 0x7b8], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140012a23
add rbx, 2
mov qword [rsp + 0x120], rbx
jmp 0x140012a00
mov rax, qword [rsp + 0x30]
cmp rbx, rax
je 0x140012b25
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x170], ebx
mov edx, dword [rax - 0x10]
mov dword [rsp + 0x174], edx
test edx, edx
js 0x140013f50
lea rcx, [rax - 0x18]
mov qword [rsp + 0x588], rcx
mov r8d, 1
sub r8d, dword [rcx + 0x10]
mov dword [rsp + 0x178], r8d
mov ecx, dword [rcx + 0xc]
sub ecx, edx
mov dword [rsp + 0x17c], ecx
or ecx, r8d
jge 0x140012a8e
lea rcx, [rsp + 0x30]
call fcn.14000d2f0
mov rax, qword [rsp + 0x30]
movsxd rcx, ebx
lea r9, [rax + rcx*2]
mov qword [rsp + 0x120], r9
mov edx, dword [rax - 0x10]
mov dword [rsp + 0x180], edx
mov edi, edx
sub edi, ebx
mov dword [rsp + 0x184], edi
mov dword [rsp + 0x188], edx
lea ecx, [rdi + 1]
movsxd r8, ecx
add r8, r8
mov qword [rsp + 0x590], r8
je 0x140012b04
test r9, r9
jne 0x140012ae2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140013f66
lea ecx, [rdx + 1]
movsxd rdx, ecx
add rdx, rdx
cmp rdx, r8
jb 0x140013f5a
mov rdx, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x30]
test edi, edi
js 0x140013f76
cmp edi, dword [rax - 0xc]
jg 0x140013f76
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r15w
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000b940
test al, al
jne 0x140013720
lea rdx, str.manage_bde__status
lea rcx, [rsp + 0x130]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x3b8]
call fcn.14000bc20
nop
mov rcx, qword [rsp + 0x130]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x280], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012ba0
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x288]
mov qword [rsp + 0x598], rax
lea rdx, str.manage_bde__status
lea rcx, [rsp + 0x138]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x288]
call fcn.14000bc20
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0x138]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x290], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012c23
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x18c], eax
test eax, eax
js 0x140012c68
lea rdx, str.ERROR
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5a0], rax
test rax, rax
je 0x140012c68
sub rax, qword [rsp + 0x58]
sar rax, 1
mov dword [rsp + 0x190], eax
cmp eax, 0xffffffff
jne 0x1400135c2
lea rax, [rsp + 0x298]
mov qword [rsp + 0x5a8], rax
lea rdx, str.wmic_logicaldisk_get_caption_description_filesystem
lea rcx, [rsp + 0x298]
call fcn.14000c8e0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x380]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x194], eax
test eax, eax
js 0x140012ce4
lea rdx, str.__Conversion_Status:____Fully_Encrypted
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5b0], rax
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x140012ce4
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x198], eax
test eax, eax
jns 0x140012d22
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x19c], eax
test eax, eax
js 0x140012d2c
lea rdx, str.__Conversion_Status:____Used_Space_Only_Encrypted
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5b8], rax
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x140012d2c
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x1a0], eax
test eax, eax
js 0x140012d2c
mov byte [rsp + 0x7a8], 1
jmp 0x140012d34
mov byte [rsp + 0x7a8], 0
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x1a4], eax
test eax, eax
js 0x1400131a3
lea rdx, str._Conversion_Status:____Unknown
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5c0], rax
test rax, rax
je 0x1400131a3
mov rcx, qword [rsp + 0x58]
sub rax, rcx
sar rax, 1
mov dword [rsp + 0x1a8], eax
test eax, eax
js 0x1400131a3
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x1ac], eax
test eax, eax
js 0x1400131a3
lea rdx, str.Lock_Status:__________Locked
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x5c8], rax
test rax, rax
je 0x1400131a3
sub rax, qword [rsp + 0x58]
sar rax, 1
mov dword [rsp + 0x1b0], eax
test eax, eax
js 0x1400131a3
lea rdx, str.manage_bde__protectors__get
lea rcx, [rsp + 0x60]
call fcn.14000c8e0
nop
mov rdi, qword [rsp + 0x30]
movsxd rcx, dword [rdi - 0x10]
mov dword [rsp + 0x1b4], ecx
mov qword [rsp + 0x2a0], rdi
mov rsi, rdi
mov rax, qword [rsp + 0x60]
sub rsi, rax
sar rsi, 1
mov qword [rsp + 0x5d0], rsi
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140013f81
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r15, rax
mov dword [rsp + 0x1b8], r15d
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140013f8b
lea ebx, [r12 + rax]
mov dword [rsp + 0x1c0], ebx
test ebx, ebx
js 0x140013f95
mov rax, qword [rsp + 0x60]
lea rcx, [rax - 0x18]
mov qword [rsp + 0x5d8], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x200], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x1c4], ecx
or ecx, edx
jge 0x140012e8c
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.14000d2f0
mov rax, qword [rsp + 0x60]
cmp rsi, r12
ja 0x140012e9d
lea rdi, [rax + rsi*2]
mov qword [rsp + 0x2a0], rdi
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000dc80
mov rax, qword [rsp + 0x60]
cmp ebx, dword [rax - 0xc]
jg 0x140013fab
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x60]
xor r15d, r15d
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0x140]
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x5e8], rax
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
call fcn.14000d260
mov qword [rsp + 0x5f8], rax
add rax, 0x18
mov qword [rsp + 0x140], rax
lea rdx, str._Bitlocker_Recovery_solution_in_working
lea rcx, [rsp + 0x2a8]
call fcn.14000c8e0
nop
mov r8d, r14d
lea rdx, [rsp + 0x140]
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x600], rax
lea rdx, str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea rcx, [rsp + 0xa8]
call fcn.14000c8e0
nop
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b0]
call fcn.14000bc20
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x2f8]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140012fcb
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a8f4]
lea rcx, [rsp + 0xb0]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e0]
call fcn.14000bc20
nop
lea r8, [rsp + 0xb0]
mov rdx, rax
lea rcx, [rsp + 0x2d0]
call fcn.14000bc20
mov qword [rsp + 0x608], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x610], rcx
mov rbx, qword [rsp + 0x50]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2c0], rbx
cmp rcx, rbx
je 0x1400130a8
cmp dword [rbx + 0x10], 0
jl 0x140013089
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013089
call fcn.14000d260
mov qword [rsp + 0x2c8], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140013076
mov rdx, qword [rsp + 0x2c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x2c8]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x1400130a8
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1c8], r8d
mov qword [rsp + 0x618], rdx
lea rcx, [rsp + 0x50]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x2d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400130db
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x2e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2e8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001310e
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013141
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x2f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x300], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013174
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x308], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400131a3
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp byte [rsp + 0x7a8], 1
jne 0x140013590
lea rdx, str.manage_bde__protectors__get
lea rcx, [rsp + 0x68]
call fcn.14000c8e0
nop
mov rdi, qword [rsp + 0x30]
movsxd rcx, dword [rdi - 0x10]
mov dword [rsp + 0x1cc], ecx
mov qword [rsp + 0x310], rdi
mov rsi, rdi
mov rax, qword [rsp + 0x68]
sub rsi, rax
sar rsi, 1
mov qword [rsp + 0x620], rsi
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140013fa0
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r15, rax
mov dword [rsp + 0x1d0], r15d
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140013fb6
lea ebx, [rax + r12]
mov dword [rsp + 0x1d8], ebx
test ebx, ebx
js 0x140013fc0
mov rax, qword [rsp + 0x68]
lea rcx, [rax - 0x18]
mov qword [rsp + 0x628], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x1dc], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x1e0], ecx
or ecx, edx
jge 0x140013278
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.14000d2f0
mov rax, qword [rsp + 0x68]
cmp rsi, r12
ja 0x140013289
lea rdi, [rax + rsi*2]
mov qword [rsp + 0x310], rdi
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000dc80
mov rax, qword [rsp + 0x68]
cmp ebx, dword [rax - 0xc]
jg 0x140013fca
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x68]
xor r15d, r15d
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x630], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x638], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
call fcn.14000d260
mov qword [rsp + 0x648], rax
add rax, 0x18
mov qword [rsp + 0xb8], rax
lea rdx, str._Bitlocker_Recovery_solution_in_working
lea rcx, [rsp + 0x318]
call fcn.14000c8e0
nop
mov r8d, r14d
lea rdx, [rsp + 0xb8]
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0x320]
mov qword [rsp + 0x650], rax
lea rdx, str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea rcx, [rsp + 0xc0]
call fcn.14000c8e0
nop
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x320]
call fcn.14000bc20
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x368]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x328], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400133b7
mov rdx, qword [rsp + 0x328]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a8f4]
lea rcx, [rsp + 0xc8]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x350]
call fcn.14000bc20
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x340]
call fcn.14000bc20
mov qword [rsp + 0x658], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x758], rcx
mov rbx, qword [rsp + 0x48]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x330], rbx
cmp rcx, rbx
je 0x140013494
cmp dword [rbx + 0x10], 0
jl 0x140013475
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013475
call fcn.14000d260
mov qword [rsp + 0x338], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140013462
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x338]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x140013494
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1e4], r8d
mov qword [rsp + 0x668], rdx
lea rcx, [rsp + 0x48]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x348], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400134c7
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x358], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400134fa
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x360], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001352d
mov rdx, qword [rsp + 0x360]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x370], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013560
mov rdx, qword [rsp + 0x370]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x378], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013590
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x388], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400135c2
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1e8], r8d
sub r8d, dword [rsp + 0x38]
dec r8d
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x40]
call fcn.14000bd70
mov qword [rsp + 0x670], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x678], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x390], rbx
cmp rcx, rbx
je 0x140013680
cmp dword [rbx + 0x10], 0
jl 0x140013661
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013661
call fcn.14000d260
mov qword [rsp + 0x398], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14001364e
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x398]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x140013680
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1ec], r8d
mov qword [rsp + 0x680], rdx
lea rcx, [rsp + 0x40]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x3a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3a8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400136b3
mov rdx, qword [rsp + 0x3a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3b0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400136e3
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x3b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013715
mov rdx, qword [rsp + 0x3c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp dword [rsp + 0x38], 0
jg 0x1400127f0
lea rcx, [rsp + 0x48]
call fcn.14005a950
test al, al
je 0x1400139e7
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1f0], r8d
add r8d, 0xfffffffe
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x48]
call fcn.14000bcd0
mov qword [rsp + 0x688], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x690], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x3c8], rbx
cmp rcx, rbx
je 0x1400137ec
cmp dword [rbx + 0x10], 0
jl 0x1400137cd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400137cd
call fcn.14000d260
mov qword [rsp + 0x3d0], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400137ba
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x3d0]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x1400137ec
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1f4], r8d
mov qword [rsp + 0x698], rdx
lea rcx, [rsp + 0x48]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x3d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14001381e
mov rdx, qword [rsp + 0x3e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x6a0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x6a8], rax
lea rdx, str.working
lea rcx, [rsp + 0x3e8]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str._Bitlocker_Recovery_solution_finally
lea rcx, [rsp + 0x3f0]
call fcn.14000c8e0
nop
mov r8d, r14d
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0x3f8]
mov qword [rsp + 0x6b0], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x6b8], rax
lea rdx, str._.The_recovery_and_password_key_has_been_saved_to__C:WinBDERecoveryKey_.Please_review_and__Click_on_NEXT_STEP
lea rcx, [rsp + 0xd8]
call fcn.14000c8e0
nop
lea rdx, str.The_drives_with_bitlocker_enabled_are
lea rcx, [rsp + 0xd0]
call fcn.14000c8e0
nop
lea rax, [rsp + 0x408]
mov qword [rsp + 0x6c0], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x3f8]
call fcn.14000c8e0
mov rdi, rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x410]
call fcn.14000bc20
nop
lea r8, [rsp + 0xd8]
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.14000bc20
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0x408]
call fcn.14000c8e0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d360
nop
mov rcx, qword [rsp + 0x410]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x418], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013979
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x420], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400139ac
mov rdx, qword [rsp + 0x420]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x428], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013dbc
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140013dbc
lea rcx, [rsp + 0x50]
call fcn.14005a950
test al, al
je 0x140013cae
mov rbx, qword [rsp + 0x50]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x1f8], r8d
add r8d, 0xfffffffe
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x50]
call fcn.14000bcd0
mov qword [rsp + 0x6c8], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x6d0], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x430], rbx
cmp rcx, rbx
je 0x140013ab3
cmp dword [rbx + 0x10], 0
jl 0x140013a94
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013a94
call fcn.14000d260
mov qword [rsp + 0x438], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140013a81
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x438]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x140013ab3
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1fc], r8d
mov qword [rsp + 0x6d8], rdx
lea rcx, [rsp + 0x50]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x440]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013ae5
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x450]
mov qword [rsp + 0x6e0], rax
lea rax, [rsp + 0x458]
mov qword [rsp + 0x6e8], rax
lea rdx, str.working
lea rcx, [rsp + 0x450]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str._Bitlocker_Recovery_solution_finally
lea rcx, [rsp + 0x458]
call fcn.14000c8e0
nop
mov r8d, r14d
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0x460]
mov qword [rsp + 0x6f0], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x6f8], rax
lea rdx, str._is_locked.Please_unlock_them_in_order_to_save_complete_extraction_keys._Click_on_NEXT_STEP
lea rcx, [rsp + 0xe8]
call fcn.14000c8e0
nop
lea rdx, str.The_drive
lea rcx, [rsp + 0xe0]
call fcn.14000c8e0
nop
lea rax, [rsp + 0x470]
mov qword [rsp + 0x700], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x460]
call fcn.14000c8e0
mov rdi, rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x478]
call fcn.14000bc20
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x468]
call fcn.14000bc20
mov rbx, rax
lea rdx, str.DLocked
lea rcx, [rsp + 0x470]
call fcn.14000c8e0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d360
nop
mov rcx, qword [rsp + 0x478]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013c40
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xe0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013c73
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013dbc
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140013dbc
lea rdx, str.Please_contact_IT_Support_for_your_problem.
lea rcx, [rsp + 0x98]
call fcn.14000c670
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x708], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x710], rax
mov rcx, qword [rsp + 0x128]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x718], rcx
call fcn.14000d260
mov qword [rsp + 0x720], rax
add rax, 0x18
mov qword [rsp + 0xf0], rax
lea rdx, str._Bitlocker_Recovery_key_Extraction_Error
lea rcx, [rsp + 0x498]
call fcn.14000c8e0
nop
mov r8d, r14d
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x728], rax
lea rax, [rsp + 0x4a8]
mov qword [rsp + 0x730], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x738], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x4a0]
call fcn.14000c8e0
mov rdi, rax
lea rdx, str.Bitlocker_is_not_enabled_on_any_drive
lea rcx, [rsp + 0x4a8]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.Failure
lea rcx, [rsp + 0x4b0]
call fcn.14000c8e0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r13d
call fcn.14005d360
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140013dec
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140013df4
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140013ebb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x760
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
int3