Function at 0x14004f030
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe68]
sub rsp, 0xf40
mov qword [rbp + 0x4a0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rbp + 0xe30], rax
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rcx, [rbp + 0x480]
call fcn.140063d20
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054026
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x78], rax
lea rdx, str.C:Windowsiassistinformation.txt
lea rcx, [rbp + 0x78]
call fcn.14000cc80
test al, al
jne 0x14004f0cb
lea rdx, str.C:Windowsiassistinformation.txt
lea rcx, [rbp + 0x78]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054031
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005403c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054047
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054052
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005405d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054068
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], r15
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x78]
lea rcx, [rbp + 0x4b0]
call fcn.14000aaa0
nop
cmp qword [rbp + 0x540], 0
je 0x1400503e8
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x4b0]
mov dl, 0xa
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x4b0]
call fcn.14005aaa0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400503e8
lea r14, [rbp + 0x5c0]
mov rdi, qword [rbp + 0x5c0]
mov rsi, qword [rbp + 0x5d8]
cmp rsi, 0x10
cmovae r14, rdi
mov rbx, qword [rbp + 0x5d0]
cmp rbx, 9
jb 0x14004f29a
lea r15, [r14 + rbx]
lea r8, [r15 - 8]
sub r8, r14
mov edx, 0x46
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f297
movzx r12d, byte [0x1400a4a38]
mov r13, qword [str.FilePath]
nop dword [rax]
cmp qword [rax], r13
jne 0x14004f27b
cmp byte [rax + 8], r12b
je 0x14004f2d4
inc rax
lea r8, [r15 - 8]
sub r8, rax
mov edx, 0x46
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004f270
xor r15d, r15d
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004f520
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000c480
mov rax, qword [rsp + 0x58]
cmp dword [rax - 0x10], 0
jge 0x14004f2dc
mov ecx, 0xffffffff
jmp 0x14004f306
sub rax, r14
xor r15d, r15d
jmp 0x14004f2a1
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x58]
jne 0x14004f300
mov ecx, 0xffffffff
jmp 0x14004f306
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x488]
lea rcx, [rsp + 0x58]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004f383
cmp dword [rbx + 0x10], 0
jl 0x14004f374
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004f374
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004f369
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14004f383
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x488]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f3a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov rdi, r15
movzx eax, word [rbx]
test ax, ax
je 0x14004f443
nop word [rax + rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f3dc
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004f3df
mov rdi, r15
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004f3c0
test rdi, rdi
je 0x14004f43e
mov rax, qword [rsp + 0x58]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x14005407e
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004f425
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14000d100
mov rax, qword [rsp + 0x58]
cmp edi, dword [rax - 0xc]
jg 0x140054073
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x58]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f461
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004f450
mov rax, qword [rsp + 0x58]
cmp rbx, rax
je 0x14004f50b
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400540c0
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004f4a3
lea rcx, [rsp + 0x58]
call fcn.14000d100
mov rax, qword [rsp + 0x58]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004f4ea
test rdx, rdx
je 0x140054098
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054089
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x58]
test edi, edi
js 0x1400540b5
cmp edi, dword [rax - 0xc]
jg 0x1400540b5
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], r15w
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0xb
jb 0x14004f597
lea r15, [r14 + rbx]
lea r8, [r15 - 0xa]
sub r8, r14
mov edx, 0x53
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f597
movzx r12d, byte [0x1400a4a4a]
movzx r13d, word [0x1400a4a48]
mov rcx, qword [str.StepNumber]
cmp qword [rax], rcx
jne 0x14004f57b
cmp word [rax + 8], r13w
jne 0x14004f57b
cmp byte [rax + 0xa], r12b
je 0x14004f5cf
inc rax
lea r8, [r15 - 0xa]
sub r8, rax
mov edx, 0x53
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004f562
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004f80a
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.14000c480
mov rax, qword [rbp - 0x80]
cmp dword [rax - 0x10], 0
jge 0x14004f5d4
mov ecx, 0xffffffff
jmp 0x14004f5fd
sub rax, r14
jmp 0x14004f59e
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rbp - 0x80]
jne 0x14004f5f7
mov ecx, 0xffffffff
jmp 0x14004f5fd
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x80]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x80]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004f676
cmp dword [rbx + 0x10], 0
jl 0x14004f668
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004f668
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004f65e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x80], rax
jmp 0x14004f676
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x80]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x490]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f699
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x80]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004f72d
nop dword [rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f6cc
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004f6cf
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004f6b0
test rdi, rdi
je 0x14004f729
mov rax, qword [rbp - 0x80]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400540d6
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004f712
mov edx, edi
lea rcx, [rbp - 0x80]
call fcn.14000d100
mov rax, qword [rbp - 0x80]
cmp edi, dword [rax - 0xc]
jg 0x1400540cb
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x80]
mov word [rax + rcx*2], si
mov rbx, qword [rbp - 0x80]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f751
nop word [rax + rax]
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004f740
mov rax, qword [rbp - 0x80]
cmp rbx, rax
je 0x14004f7f5
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054118
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004f790
lea rcx, [rbp - 0x80]
call fcn.14000d100
mov rax, qword [rbp - 0x80]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004f7d6
test rdx, rdx
je 0x1400540f0
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x1400540e1
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x80]
test edi, edi
js 0x14005410d
cmp edi, dword [rax - 0xc]
jg 0x14005410d
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x80]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0xc
jb 0x14004f877
lea r15, [r14 + rbx]
lea r8, [r15 - 0xb]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f877
mov r12d, dword [0x1400a4a58]
mov r13, qword [str.AdminNeeded]
nop word [rax + rax]
cmp qword [rax], r13
jne 0x14004f85b
cmp dword [rax + 8], r12d
je 0x14004f8b1
inc rax
lea r8, [r15 - 0xb]
sub r8, rax
mov edx, 0x41
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004f850
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004faff
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000c480
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], 0
jge 0x14004f8b6
mov ecx, 0xffffffff
jmp 0x14004f8e0
sub rax, r14
jmp 0x14004f87e
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x60]
jne 0x14004f8da
mov ecx, 0xffffffff
jmp 0x14004f8e0
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x498]
lea rcx, [rsp + 0x60]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004f95d
cmp dword [rbx + 0x10], 0
jl 0x14004f94e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004f94e
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004f943
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14004f95d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x498]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f980
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004fa17
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004f9b1
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004f9b4
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004f995
test rdi, rdi
je 0x14004fa12
mov rax, qword [rsp + 0x60]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x14005412e
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004f9fa
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.14000d100
mov rax, qword [rsp + 0x60]
cmp edi, dword [rax - 0xc]
jg 0x140054123
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x60]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fa41
nop dword [rax]
nop dword [rax + rax]
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004fa30
mov rax, qword [rsp + 0x60]
cmp rbx, rax
je 0x14004faea
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054170
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004fa83
lea rcx, [rsp + 0x60]
call fcn.14000d100
mov rax, qword [rsp + 0x60]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004faca
test rdx, rdx
je 0x140054148
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054139
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x60]
test edi, edi
js 0x140054165
cmp edi, dword [rax - 0xc]
jg 0x140054165
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x12
jb 0x14004fb75
lea r15, [r14 + rbx]
lea r8, [r15 - 0x11]
sub r8, r14
mov edx, 0x61
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004fb75
movzx r12d, word [0x1400a4a70]
mov r13, qword [0x1400a4a68]
mov rcx, qword [str.ankscptFolderPath]
cmp qword [rax], rcx
jne 0x14004fb59
cmp qword [rax + 8], r13
jne 0x14004fb59
cmp word [rax + 0x10], r12w
je 0x14004fbaf
inc rax
lea r8, [r15 - 0x11]
sub r8, rax
mov edx, 0x61
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004fb40
mov rax, 0xffffffffffffffff
test eax, eax
js 0x14004fdf1
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14000c480
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
jge 0x14004fbb4
mov ecx, 0xffffffff
jmp 0x14004fbde
sub rax, r14
jmp 0x14004fb7c
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x68]
jne 0x14004fbd8
mov ecx, 0xffffffff
jmp 0x14004fbde
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x68]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004fc5b
cmp dword [rbx + 0x10], 0
jl 0x14004fc4c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004fc4c
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004fc41
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x14004fc5b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x250]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fc7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x68]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x14004fd15
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fcaf
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004fcb2
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004fc93
test rdi, rdi
je 0x14004fd10
mov rax, qword [rsp + 0x68]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x140054186
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004fcf8
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.14000d100
mov rax, qword [rsp + 0x68]
cmp edi, dword [rax - 0xc]
jg 0x14005417b
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x68]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004fd33
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x14004fd22
mov rax, qword [rsp + 0x68]
cmp rbx, rax
je 0x14004fddc
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400541c8
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14004fd75
lea rcx, [rsp + 0x68]
call fcn.14000d100
mov rax, qword [rsp + 0x68]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x14004fdbc
test rdx, rdx
je 0x1400541a0
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054191
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x68]
test edi, edi
js 0x1400541bd
cmp edi, dword [rax - 0xc]
jg 0x1400541bd
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x14
jb 0x14004fe74
lea r15, [r14 + rbx]
lea r8, [r15 - 0x13]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004fe74
mov r12d, dword [0x1400a4a88]
mov r13, qword [0x1400a4a80]
nop word [rax + rax]
mov rcx, qword [str.ActionStrForTestBtn]
cmp qword [rax], rcx
jne 0x14004fe58
cmp qword [rax + 8], r13
jne 0x14004fe58
cmp dword [rax + 0x10], r12d
je 0x14004feae
inc rax
lea r8, [r15 - 0x13]
sub r8, rax
mov edx, 0x41
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004fe40
mov rax, 0xffffffffffffffff
test eax, eax
js 0x1400500f0
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.14000c480
mov rax, qword [rsp + 0x78]
cmp dword [rax - 0x10], 0
jge 0x14004feb3
mov ecx, 0xffffffff
jmp 0x14004fedd
sub rax, r14
jmp 0x14004fe7b
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x78]
jne 0x14004fed7
mov ecx, 0xffffffff
jmp 0x14004fedd
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x258]
lea rcx, [rsp + 0x78]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x78]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004ff5a
cmp dword [rbx + 0x10], 0
jl 0x14004ff4b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ff4b
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004ff40
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x14004ff5a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x258]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ff7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
movzx eax, word [rbx]
test ax, ax
je 0x140050014
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14004ffae
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x14004ffb1
mov rdi, rsi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14004ff92
test rdi, rdi
je 0x14005000f
mov rax, qword [rsp + 0x78]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400541de
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14004fff7
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.14000d100
mov rax, qword [rsp + 0x78]
cmp edi, dword [rax - 0xc]
jg 0x1400541d3
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x78]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140050032
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140050021
mov rax, qword [rsp + 0x78]
cmp rbx, rax
je 0x1400500db
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054220
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x140050074
lea rcx, [rsp + 0x78]
call fcn.14000d100
mov rax, qword [rsp + 0x78]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x1400500bb
test rdx, rdx
je 0x1400541f8
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x1400541e9
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x78]
test edi, edi
js 0x140054215
cmp edi, dword [rax - 0xc]
jg 0x140054215
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x5c0]
mov rbx, qword [rbp + 0x5d0]
mov rsi, qword [rbp + 0x5d8]
lea r14, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae r14, rdi
cmp rbx, 0x16
jb 0x140050168
lea r15, [r14 + rbx]
lea r8, [r15 - 0x15]
sub r8, r14
mov edx, 0x41
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140050168
nop word [rax + rax]
mov r8d, 0x16
lea rdx, str.ActionParamForTestBtn
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400501a2
inc rbx
lea r8, [r15 - 0x15]
sub r8, rbx
mov edx, 0x41
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140050130
mov rbx, 0xffffffffffffffff
test ebx, ebx
js 0x1400503e0
lea rdx, [rbp + 0x5c0]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14000c480
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0
jge 0x1400501a7
mov ecx, 0xffffffff
jmp 0x1400501d1
sub rbx, r14
jmp 0x14005016f
lea rdx, [0x1400992b4]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x70]
jne 0x1400501cb
mov ecx, 0xffffffff
jmp 0x1400501d1
sub rcx, rax
sar rcx, 1
mov r8d, dword [rax - 0x10]
sub r8d, ecx
dec r8d
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x70]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005024e
cmp dword [rbx + 0x10], 0
jl 0x14005023f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005023f
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050234
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14005024e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x260]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050271
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x70]
xor r15d, r15d
mov edi, r15d
movzx eax, word [rbx]
test ax, ax
je 0x140050313
nop dword [rax + rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x1400502ac
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400502af
mov rdi, r15
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140050290
test rdi, rdi
je 0x14005030e
mov rax, qword [rsp + 0x70]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x140054236
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400502f5
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.14000d100
mov rax, qword [rsp + 0x70]
cmp edi, dword [rax - 0xc]
jg 0x14005422b
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x70]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140050331
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140050320
mov rax, qword [rsp + 0x70]
cmp rbx, rax
je 0x14004f1d0
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140054278
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x140050373
lea rcx, [rsp + 0x70]
call fcn.14000d100
mov rax, qword [rsp + 0x70]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r8d, dword [rax - 0x10]
mov edi, r8d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r9, ecx
add r9, r9
je 0x1400503ba
test rdx, rdx
je 0x140054250
lea ecx, [r8 + 1]
movsxd r8, ecx
add r8, r8
cmp r8, r9
jb 0x140054241
mov r8, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x70]
test edi, edi
js 0x14005426d
cmp edi, dword [rax - 0xc]
jg 0x14005426d
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r15w
jmp 0x14004f1d0
xor r15d, r15d
jmp 0x14004f1d0
lea rcx, [rbp + 0x4c0]
call fcn.14000cab0
test rax, rax
jne 0x14005041b
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x4b0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r15w
mov rdx, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140050450
lea rcx, [rbp + 0x640]
call fcn.14000e6a0
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054283
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rbx, str.C:WindowsiassistdecrFile.ankscpt
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000cc80
test al, al
jne 0x1400504bf
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400504a5
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000d160
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x630], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r15w
mov rdx, qword [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400504f0
lea rcx, [rbp + 0x620]
call fcn.14000e6a0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x610], xmm0
movdqa xmm1, xmmword [0x1400a89e0]
movdqu xmmword [rbp + 0x610], xmm1
mov word [rbp + 0x600], r15w
mov r8d, 0xb
lea rdx, str.ANKRPY4_13
lea rcx, [rbp + 0x600]
call fcn.14000e6a0
nop
lea rax, [rbp + 0x80]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x268]
mov qword [rsp + 0x50], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005428e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x90], rax
lea rdx, str._OutputFilePath_
lea rcx, [rbp + 0x90]
call fcn.14000cc80
test al, al
jne 0x1400505a9
lea rdx, str._OutputFilePath_
lea rcx, [rbp + 0x90]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054299
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa0], rax
lea rdx, str.Decrypt_Solution_File:_InputFilePath_
lea rcx, [rbp + 0xa0]
call fcn.14000cc80
test al, al
jne 0x1400505f6
lea rdx, str.Decrypt_Solution_File:_InputFilePath_
lea rcx, [rbp + 0xa0]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542a4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x80]
call fcn.14000cc80
test al, al
jne 0x140050643
lea rdx, [0x140099090]
lea rcx, [rbp + 0x80]
call fcn.14000c480
nop
mov rbx, qword [rbp + 0xa0]
lea rdi, [rbx - 0x18]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140050664
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140050675
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400542af
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
mov dword [rsp + 0x30], 0x40
mov r9, qword [rsp + 0x58]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.14000ce60
nop
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400506d6
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400506e7
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400542ba
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x100], rax
mov ebx, 0xc0
mov dword [rsp + 0x30], ebx
mov r9, qword [rbp + 0x90]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x88]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x100]
call fcn.14000ce60
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x268]
call fcn.14000ba30
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.14005c670
btr ebx, 7
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050788
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xffffffbf
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400507b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x1400507cd
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400507f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x640]
call fcn.140065320
test al, al
je 0x1400508b8
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
mov qword [rbp - 0x60], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542c5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 8], rax
lea rdx, [0x140099090]
lea rcx, [rbp - 8]
call fcn.14000cc80
test al, al
jne 0x140050867
lea rdx, [0x140099090]
lea rcx, [rbp - 8]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542d0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, str.File_decrypted_successfully.
lea rcx, [rbp]
call fcn.14000cc80
test al, al
jne 0x1400508ab
lea rdx, str.File_decrypted_successfully.
lea rcx, [rbp]
call fcn.14000c480
nop
lea rdx, [rbp - 8]
lea rcx, [rbp]
jmp 0x140050959
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x60], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542db
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 8], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 8]
call fcn.14000cc80
test al, al
jne 0x14005090d
lea rdx, [0x140099090]
lea rcx, [rbp + 8]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542e6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x10], rax
lea rdx, str.Failed_to_decrypt_the_file.
lea rcx, [rbp + 0x10]
call fcn.14000cc80
test al, al
jne 0x140050951
lea rdx, str.Failed_to_decrypt_the_file.
lea rcx, [rbp + 0x10]
call fcn.14000c480
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x10]
mov r8d, 0xffffffff
call fcn.14005c670
mov qword [rbp + 0x5f0], r15
mov qword [rbp + 0x5f8], r15
mov qword [rbp + 0x5f0], r15
mov qword [rbp + 0x5f8], 7
mov word [rbp + 0x5e0], r15w
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542f1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400542fc
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054307
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
mov r14d, 1
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054312
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, str.r__ccsUTF_8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r8, qword [rbp + 0x108]
test r8, r8
je 0x140051160
mov edx, 0x3e8
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
je 0x140051153
lea r12, str.______
lea r13, str.needadminright_
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005431d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x18]
call fcn.14000cc80
test al, al
jne 0x140050ac0
lea rcx, [rbp + 0x660]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140050aa2
mov r8d, eax
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x18]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x18]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x28]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050b1f
cmp dword [rbx + 0x10], 0
jl 0x140050b11
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050b11
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050b07
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x28], rax
jmp 0x140050b1f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x28]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050b3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140050b50
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x5e0]
call fcn.14000e6a0
lea r10, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 8
cmovae r10, qword [rbp + 0x5e0]
mov rax, qword [rbp + 0x5f0]
cmp rax, 6
jb 0x140050bf2
add rax, 0xfffffffffffffffb
lea r11, [r10 + rax*2]
mov rax, r10
nop word [rax + rax]
mov rcx, r11
sub rcx, rax
sar rcx, 1
je 0x140050bf2
cmp word [rax], 0x2d
je 0x140050bbb
add rax, 2
sub rcx, 1
jmp 0x140050ba9
test rax, rax
je 0x140050bf2
mov r8d, 6
mov rdx, r12
mov r9, rax
sub r9, r12
nop
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x140050bec
add rdx, 2
sub r8, 1
jne 0x140050bd0
sub rax, r10
sar rax, 1
jmp 0x140050bf9
add rax, 2
jmp 0x140050ba0
mov rax, 0xffffffffffffffff
lea ecx, [r14 + 1]
test eax, eax
cmovs ecx, r14d
mov r14d, ecx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
cmp r14d, eax
jne 0x14005112c
lea r10, [rbp + 0x5e0]
mov rsi, qword [rbp + 0x5e0]
mov rdi, qword [rbp + 0x5f8]
cmp rdi, 8
cmovae r10, rsi
mov rbx, qword [rbp + 0x5f0]
cmp rbx, 0xb
jb 0x140050ca8
lea r11, [rbx - 0xa]
lea r11, [r10 + r11*2]
mov rcx, r10
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140050ca8
cmp word [rcx], 0x61
je 0x140050c6b
add rcx, 2
sub rax, 1
jmp 0x140050c59
test rcx, rcx
je 0x140050ca8
mov r8d, 0xb
lea rax, str.actionstr_
mov rdx, rax
mov r9, rcx
sub r9, rax
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x140050ca2
add rdx, 2
sub r8, 1
jne 0x140050c86
sub rcx, r10
sar rcx, 1
jmp 0x140050caf
add rcx, 2
jmp 0x140050c50
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x140050de5
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x140050cd1
mov rdx, rsi
test rsi, rsi
jne 0x140050cd1
mov eax, r15d
jmp 0x140050cea
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140050ce0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000d160
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
jge 0x140050d09
mov eax, 0xffffffff
jmp 0x140050d2b
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140050d25
mov eax, 0xffffffff
jmp 0x140050d2b
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x40]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050da3
cmp dword [rbx + 0x10], 0
jl 0x140050d94
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050d94
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050d89
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140050da3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x270]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050dc6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14000bd40
mov rdi, qword [rbp + 0x5f8]
mov rbx, qword [rbp + 0x5f0]
mov rsi, qword [rbp + 0x5e0]
lea r10, [rbp + 0x5e0]
cmp rdi, 8
cmovae r10, rsi
cmp rbx, 0x14
jb 0x140050e62
lea r11, [rbx - 0x13]
lea r11, [r10 + r11*2]
mov rcx, r10
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140050e62
cmp word [rcx], 0x61
je 0x140050e20
add rcx, 2
sub rax, 1
jmp 0x140050e0e
test rcx, rcx
je 0x140050e62
mov r8d, 0x14
lea rax, str.actionparameterstr_
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x140050e5c
add rdx, 2
sub r8, 1
jne 0x140050e40
sub rcx, r10
sar rcx, 1
jmp 0x140050e69
add rcx, 2
jmp 0x140050e05
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x140050f97
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x140050e8b
mov rdx, rsi
test rsi, rsi
jne 0x140050e8b
mov eax, r15d
jmp 0x140050e9c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140050e92
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000d160
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jge 0x140050ebb
mov eax, 0xffffffff
jmp 0x140050edd
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140050ed7
mov eax, 0xffffffff
jmp 0x140050edd
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x48]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050f55
cmp dword [rbx + 0x10], 0
jl 0x140050f46
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050f46
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050f3b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140050f55
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x278]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050f78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.14000bd40
mov rdi, qword [rbp + 0x5f8]
mov rbx, qword [rbp + 0x5f0]
mov rsi, qword [rbp + 0x5e0]
lea r10, [rbp + 0x5e0]
cmp rdi, 8
cmovae r10, rsi
cmp rbx, 0x10
jb 0x140051012
lea r11, [rbx - 0xf]
lea r11, [r10 + r11*2]
mov rcx, r10
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140051012
cmp word [rcx], 0x6e
je 0x140050fdb
add rcx, 2
sub rax, 1
jmp 0x140050fc9
test rcx, rcx
je 0x140051012
mov r8d, 0x10
mov rdx, r13
mov r9, rcx
sub r9, r13
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x14005100c
add rdx, 2
sub r8, 1
jne 0x140050ff0
sub rcx, r10
sar rcx, 1
jmp 0x140051019
add rcx, 2
jmp 0x140050fc0
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x14005112c
lea rdx, [rbp + 0x5e0]
cmp rdi, 8
jb 0x14005103b
mov rdx, rsi
test rsi, rsi
jne 0x14005103b
mov eax, r15d
jmp 0x14005104c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140051042
mov r8d, eax
lea rcx, [rbp - 0x78]
call fcn.14000d160
mov rbx, qword [rbp - 0x78]
cmp dword [rbx - 0x10], 0
jge 0x140051069
mov eax, 0xffffffff
jmp 0x14005108b
lea rdx, [0x1400992b4]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140051085
mov eax, 0xffffffff
jmp 0x14005108b
sub rax, rbx
sar rax, 1
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x78]
call fcn.14000bb80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051100
cmp dword [rbx + 0x10], 0
jl 0x1400510f2
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400510f2
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400510e8
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x78], rax
jmp 0x140051100
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x280]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051123
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp - 0x78]
call fcn.14000bd40
mov r8, qword [rbp + 0x108]
mov edx, 0x3e8
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
jne 0x140050a61
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x1400511dc
mov rdx, qword [rsp + 0x78]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x40]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400511dc
cmp dword [rdi + 0x10], 0
jl 0x1400511ce
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400511ce
call fcn.14000d070
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400511be
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1400511dc
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000d160
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x58]
call fcn.14000b750
test al, al
je 0x140051258
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140051258
cmp dword [rdi + 0x10], 0
jl 0x14005124a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14005124a
call fcn.14000d070
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14005123a
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x48]
jmp 0x140051258
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.14000d160
lea rax, [rbp + 0x238]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x60], rax
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x238], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054328
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rdx, str.actionString
lea rcx, [rbp + 0x20]
call fcn.14000cc80
test al, al
jne 0x1400512c9
lea rdx, str.actionString
lea rcx, [rbp + 0x20]
call fcn.14000c480
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x20]
call fcn.14005c670
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x48]
call fcn.14000b750
test al, al
je 0x140051356
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140051356
cmp dword [rdi + 0x10], 0
jl 0x140051343
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140051343
call fcn.14000d070
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140051338
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x140051356
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000d160
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x240]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x60], rax
lea rdi, [rbx - 0x18]
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x240], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054333
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
lea rdx, str.actionParameterString
lea rcx, [rbp + 0x28]
call fcn.14000cc80
test al, al
jne 0x1400513c5
lea rdx, str.actionParameterString
lea rcx, [rbp + 0x28]
call fcn.14000c480
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x28]
call fcn.14005c670
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x78]
call fcn.14000b750
test al, al
mov rax, qword [rsp + 0x60]
je 0x14005145b
lea rcx, [rax - 0x18]
mov rsi, qword [rbp - 0x78]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x14005145b
cmp dword [rsi + 0x10], 0
jl 0x140051446
mov rdx, qword [rsi]
cmp qword [rcx], rdx
jne 0x140051446
call fcn.14000d070
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140051437
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x78], rax
mov rbx, qword [rsp + 0x48]
jmp 0x140051456
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000d160
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14005433e
mov rcx, qword [rbp - 0x78]
sub rax, rcx
nop dword [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x140051485
add rcx, 2
test edx, edx
jne 0x140051470
test r8d, r8d
jne 0x140053f07
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054349
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x140099090]
lea rcx, [rsp + 0x38]
call fcn.14000cc80
test al, al
jne 0x1400514d5
lea rdx, [0x140099090]
lea rcx, [rsp + 0x38]
call fcn.14000c480
nop
lea rdx, str.Start_Restart_Service
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x14005158e
lea rax, [rbp + 0x248]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x248], rax
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x288]
call fcn.1400021f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051582
cmp dword [rbx + 0x10], 0
jl 0x140051573
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051573
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051568
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051582
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x288]
jmp 0x1400538da
lea rdx, str.Stop_Service
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051647
lea rax, [rbp + 0x118]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x290]
call fcn.1400024b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005163b
cmp dword [rbx + 0x10], 0
jl 0x14005162c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005162c
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051621
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005163b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x290]
jmp 0x1400538da
lea rdx, str.Force_Close_Application
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051703
lea rax, [rbp + 0x120]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x120], rax
xor r8d, r8d
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x298]
call fcn.140007740
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400516f7
cmp dword [rbx + 0x10], 0
jl 0x1400516e8
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400516e8
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400516dd
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400516f7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x298]
jmp 0x1400538da
lea rdx, str.Force_Close_Application_and_Child_Processes
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x1400517bf
lea rax, [rbp + 0x128]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x128], rax
mov r8b, 1
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x2a0]
call fcn.140007740
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400517b3
cmp dword [rbx + 0x10], 0
jl 0x1400517a4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400517a4
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051799
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400517b3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2a0]
jmp 0x1400538da
lea rdx, str.Install_Application
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x1400518a3
lea rax, [rbp + 0x130]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x138]
mov qword [rbp - 0x60], rax
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x130], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x138], rax
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x2a8]
call fcn.140007a20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051897
cmp dword [rbx + 0x10], 0
jl 0x140051888
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051888
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005187d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051897
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2a8]
jmp 0x1400538da
lea rdx, str.Uninstall_Application
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x14005195c
lea rax, [rbp + 0x140]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x2b0]
call fcn.140008620
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051950
cmp dword [rbx + 0x10], 0
jl 0x140051941
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051941
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051936
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051950
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2b0]
jmp 0x1400538da
lea rdx, str.Delete_Specific_File_from_folder
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051a86
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
test rax, rax
jne 0x140051990
lea edi, [rax - 1]
jmp 0x140051996
sub rdi, rbx
sar rdi, 1
mov r8d, dword [rbx - 0x10]
sub r8d, edi
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x48]
call fcn.14000bb80
nop
mov r8d, edi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.14000bae0
nop
mov rcx, qword [rbp - 0x38]
cmp dword [rcx - 0x10], 0
jl 0x140051a38
lea rdx, str._username_
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051a34
mov rcx, qword [rbp - 0x38]
sub rax, rcx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051a38
lea rcx, [rbp + 0x148]
call fcn.140063d20
nop
mov r8, qword [rbp + 0x148]
lea rdx, str._username_
lea rcx, [rbp - 0x38]
call fcn.14000bfb0
nop
mov rdx, qword [rbp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051a34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp + 0x150]
call fcn.14005f2f0
mov r8d, eax
lea rdx, [0x14009a138]
lea rcx, [rsp + 0x38]
call fcn.14000d390
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051a7a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x150]
jmp 0x1400538da
lea rdx, str.Rename_Folder
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051b3f
lea rax, [rbp + 0x158]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x2b8]
call fcn.140001cf0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051b33
cmp dword [rbx + 0x10], 0
jl 0x140051b24
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051b24
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051b19
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051b33
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2b8]
jmp 0x1400538da
lea rdx, str.Rename_File
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051bf8
lea rax, [rbp + 0x160]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x2c0]
call fcn.140001820
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051bec
cmp dword [rbx + 0x10], 0
jl 0x140051bdd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051bdd
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051bd2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051bec
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2c0]
jmp 0x1400538da
lea rdx, str.Delete_File
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051d26
cmp dword [rbx - 0x10], 0
jl 0x140051c85
lea rdx, str._username_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051c85
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051c85
lea rcx, [rbp + 0x168]
call fcn.140063d20
nop
mov r8, qword [rbp + 0x168]
lea rdx, str._username_
lea rcx, [rsp + 0x48]
call fcn.14000bfb0
nop
mov rdx, qword [rbp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051c80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x2c8]
call fcn.140001330
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051d1a
cmp dword [rbx + 0x10], 0
jl 0x140051d0b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051d0b
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051d00
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051d1a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2c8]
jmp 0x1400538da
lea rdx, str.Delete_Folder
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140051e54
cmp dword [rbx - 0x10], 0
jl 0x140051db3
lea rdx, str._username_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140051db3
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140051db3
lea rcx, [rbp + 0x178]
call fcn.140063d20
nop
mov r8, qword [rbp + 0x178]
lea rdx, str._username_
lea rcx, [rsp + 0x48]
call fcn.14000bfb0
nop
mov rdx, qword [rbp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051dae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x180]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x2d0]
call fcn.1400015d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051e48
cmp dword [rbx + 0x10], 0
jl 0x140051e39
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051e39
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140051e2e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051e48
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2d0]
jmp 0x1400538da
lea rdx, str.Add_new_Registry_Key
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Add_new_Registry_String_value
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Add_new_Registry_Binary_value
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Delete_Registry_Subkey
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Delete_Registry_Entry_in_a_Subkey
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Custom_Registry_Command
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Release_the_IPv4_Address_of_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Releases_the_IPv4_Address_for_a_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Get_a_New_IPv4_Address_for_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Get_a_New_IPv4_Address_for_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Release_the_IPv6_Address_of_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Releases_the_IPv6_Address_for_a_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Get_a_New_IPv6_Address_for_All_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Get_a_New_IPv6_Address_for_Specific_Network_Adapters
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Flush_DNS_Cache
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Registering_DNS_Records
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x14005383c
lea rdx, str.Add_new_Registry_DWORD_value
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x14005216f
cmp dword [rbx - 0x10], 0
jl 0x140052071
lea rdx, str._officeversion_
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052071
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140052071
lea rcx, [rbp + 0x188]
call fcn.140060390
nop
mov r8, qword [rbp + 0x188]
lea rdx, str._officeversion_
lea rcx, [rsp + 0x48]
call fcn.14000bfb0
nop
mov rdx, qword [rbp + 0x188]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005206c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rcx, [rbx - 0x18]
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x190]
mov qword [rbp - 0x60], rax
mov rcx, qword [rbp + 0x30]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x190], rax
mov r8d, 1
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2d8]
call fcn.140002820
mov rbx, rax
or dword [rsp + 0x30], 0x4000
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400520fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbx]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005215b
cmp dword [rbx + 0x10], 0
jl 0x14005214d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005214d
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052142
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005215b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
and dword [rsp + 0x30], 0xffffbfff
mov rdx, qword [rbp + 0x2d8]
jmp 0x1400538da
lea rdx, str.Office_Repair_ClickToRun_
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140052aa6
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054354
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x58]
call fcn.14000cc80
test al, al
jne 0x1400521cc
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x58]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005435f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov edx, 0x5c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
jne 0x140052207
mov eax, 0xffffffff
jmp 0x14005220f
sub rax, qword [rsp + 0x58]
sar rax, 1
mov r8d, eax
lea rdx, [rbp + 0x2e0]
lea rcx, [rsp + 0x58]
call fcn.14000bae0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052282
cmp dword [rbx + 0x10], 0
jl 0x140052274
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052274
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005226a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140052282
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2e0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400522a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x140099d78]
lea rcx, [rbp - 0x58]
call fcn.14000c2e0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xc0]
call fcn.14000ba30
nop
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jl 0x140052a05
lea rdx, str..ps1
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052612
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140052612
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005436a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x40]
call fcn.14000cc80
test al, al
jne 0x140052345
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x40]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054375
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x98], rax
lea rdx, str.powershell__ExecutionPolicy_ByPass__File__
lea rcx, [rbp + 0x98]
call fcn.14000cc80
test al, al
jne 0x140052392
lea rdx, str.powershell__ExecutionPolicy_ByPass__File__
lea rcx, [rbp + 0x98]
call fcn.14000c480
nop
mov rbx, qword [rbp + 0x98]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400523b3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400523c4
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140054380
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x11
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xc0]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.14000ce60
nop
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140052422
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052433
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005438b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd8], rax
bts edi, 0x12
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x40]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.14000ce60
mov rdx, qword [rbp + 0xd8]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400524da
cmp dword [rbx + 0x10], 0
jl 0x1400524cd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400524cd
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400524bf
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x68], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400524da
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.14000d160
btr edi, 0x12
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052505
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfffdffff
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005252e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14005254a
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005256a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x198]
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x198], rax
mov r8b, 1
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x2e8]
call fcn.14005e3e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140052606
cmp dword [rbx + 0x10], 0
jl 0x1400525f7
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400525f7
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400525ec
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140052606
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2e8]
jmp 0x1400529e7
cmp dword [rbx - 0x10], 0
jl 0x140052a05
lea rdx, str..bat
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140052a05
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140052a05
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054396
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x50]
call fcn.14000cc80
test al, al
jne 0x140052687
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x50]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400543a1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa8], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xa8]
call fcn.14000cc80
test al, al
jne 0x1400526d4
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xa8]
call fcn.14000c480
nop
mov rbx, qword [rbp + 0xa8]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400526f5
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052706
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400543ac
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x13
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xc0]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.14000ce60
nop
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140052764
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140052775
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400543b7
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb0], rax
bts edi, 0x14
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x50]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x48]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000ce60
mov rdx, qword [rbp + 0xb0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005281c
cmp dword [rbx + 0x10], 0
jl 0x14005280f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005280f
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052801
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x68], rax
mov edi, dword [rsp + 0x30]
jmp 0x14005281c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.14000d160
btr edi, 0x14
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052847
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfff7ffff
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052870
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14005288c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400528ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x68]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400528d3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400528e4
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400543c2
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb8], rax
or dword [rsp + 0x30], 0x200000
mov ecx, 0x22
mov word [rbp - 0x48], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb8]
call fcn.14000ce60
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x2f0]
call fcn.14005a850
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x2f8]
call fcn.14005e3e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400529b5
cmp dword [rbx + 0x10], 0
jl 0x1400529a6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400529a6
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005299b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400529b5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x2f8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400529d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xffdfffff
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140052a58
lea rax, [rbp + 0x300]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x308]
mov qword [rbp - 0x60], rax
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x300]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Incorrect_extension
lea rcx, [rbp + 0x308]
call fcn.14000c6f0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052a9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
jmp 0x1400538da
lea rdx, str.Run_VB_Script
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x140052ede
lea rdx, str.Run_BAT_File
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
jne 0x140052ede
lea rdx, str.Run_PowerShell_Script
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140052da2
lea rax, [rbp + 0x310]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x318]
mov qword [rbp - 0x60], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x310]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Run_Powershell_Script_started
lea rcx, [rbp + 0x318]
call fcn.14000c6f0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400543cd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x30]
call fcn.14000cc80
test al, al
jne 0x140052b87
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x30]
call fcn.14000c480
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
lea rcx, [rax + 0x18]
mov qword [rbp + 0x348], rcx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x18]
call fcn.140006910
nop
mov rax, qword [rbp - 0x18]
movzx ecx, word [rax]
cmp cx, word [0x14009a104]
jne 0x140052c3c
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x140052c3c
cmp dword [rbx + 0x10], 0
jl 0x140052c2f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052c2f
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052c25
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x18], rax
jmp 0x140052c3c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x18]
call fcn.14000d160
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1b0]
call fcn.14000ba30
nop
xor r8d, r8d
lea rdx, str..ps1
lea rcx, [rsp + 0x48]
call fcn.14000bf60
test eax, eax
js 0x140052d5e
lea rdx, str.powershell__ExecutionPolicy_ByPass__File
lea rcx, [rbp + 0x1a8]
call fcn.14000c6f0
nop
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x320]
call fcn.14000ba30
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000cfb0
nop
lea rcx, [rbp + 0x320]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1a8]
call fcn.14000d040
lea rax, [rbp + 0x328]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x330]
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x328]
call fcn.14000c800
mov rbx, rax
lea rdx, str.Run_Powershell_Script__:
lea rcx, [rbp + 0x330]
call fcn.14000c6f0
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
lea rax, [rbp + 0x338]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x338]
call fcn.14000c800
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x340]
call fcn.14005e3e0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000cfb0
nop
lea rcx, [rbp + 0x340]
call fcn.14000d040
jmp 0x140052d70
lea rdx, str.Incorrect_extension.
lea rcx, [rsp + 0x38]
call fcn.14000c480
nop
lea rcx, [rbp + 0x1b0]
call fcn.14000d040
nop
lea rcx, [rbp - 0x18]
call fcn.14000d040
nop
lea rcx, [rbp + 0x348]
call fcn.14000d040
nop
lea rcx, [rbp - 0x30]
call fcn.14000d040
jmp 0x1400538f6
lea rdx, str.Run_Powershell_Command
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140052e0a
lea rax, [rbp + 0x350]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x350]
call fcn.14000c800
nop
mov r8d, 2
mov rdx, rax
lea rcx, [rbp + 0x358]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000cfb0
nop
lea rcx, [rbp + 0x358]
call fcn.14000d040
jmp 0x1400538f6
lea rdx, str.Run_Command_Line_Script
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x140052e72
lea rax, [rbp + 0x360]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x360]
call fcn.14000c800
nop
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x368]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000cfb0
nop
lea rcx, [rbp + 0x368]
call fcn.14000d040
jmp 0x1400538f6
lea rdx, str.Run_WMIC_Command
lea rcx, [rsp + 0x40]
call fcn.14000b750
test al, al
je 0x1400538f6
lea rax, [rbp + 0x370]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x370]
call fcn.14000c800
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rbp + 0x378]
call fcn.140002820
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000cfb0
nop
lea rcx, [rbp + 0x378]
call fcn.14000d040
jmp 0x1400538f6
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400543d8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x70]
call fcn.14000cc80
test al, al
jne 0x140052f22
lea rdx, [0x140098d49]
lea rcx, [rbp - 0x70]
call fcn.14000c480
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000d070
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x1b8]
mov qword [rsp + 0x50], rcx
lea r14, [rax - 0x18]
mov rcx, r14
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp - 0x10]
call fcn.140006910
nop
mov rax, qword [rbp - 0x10]
movzx ecx, word [rax]
cmp cx, word [0x14009a104]
jne 0x140052fdc
mov rdx, qword [rsp + 0x68]
lea rcx, [rdx - 0x18]
lea rdi, [rax - 0x18]
cmp rcx, rdi
je 0x140052fdc
cmp dword [rdi + 0x10], 0
jl 0x140052fcf
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140052fcf
call fcn.14000d070
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140052fc0
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x10], rax
mov rbx, qword [rsp + 0x48]
jmp 0x140052fdc
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14000d160
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf8]
call fcn.14000ba30
nop
cmp dword [rbx - 0x10], 0
jl 0x1400537bf
lea rdx, str..vbs
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400533cc
sub rax, rbx
sar rax, 1
test eax, eax
js 0x1400533cc
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400543e3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x60]
call fcn.14000cc80
test al, al
jne 0x140053067
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x60]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400543ee
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xc8], rax
lea rdx, str.CScript___NOLOGO__
lea rcx, [rbp + 0xc8]
call fcn.14000cc80
test al, al
jne 0x1400530b4
lea rdx, str.CScript___NOLOGO__
lea rcx, [rbp + 0xc8]
call fcn.14000c480
nop
mov rbx, qword [rbp + 0xc8]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400530d5
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400530e6
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400543f9
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x18
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xf8]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.14000ce60
nop
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140053144
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140053155
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140054404
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd0], rax
bts edi, 0x19
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x60]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xd0]
call fcn.14000ce60
mov rdx, qword [rbp + 0xd0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400531fc
cmp dword [rbx + 0x10], 0
jl 0x1400531ef
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400531ef
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400531e1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x70], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400531fc
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d160
btr edi, 0x19
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053227
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfeffffff
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053250
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14005326c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005328c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x380]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400532b3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400532c4
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005440f
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x110], rax
or dword [rsp + 0x30], 0x4000000
mov ecx, 0x22
mov word [rbp - 0x50], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x110]
call fcn.14000ce60
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x380]
call fcn.14005a850
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x388]
call fcn.14005e3e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140053395
cmp dword [rbx + 0x10], 0
jl 0x140053386
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140053386
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005337b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140053395
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x388]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400533b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xfbffffff
mov rdx, qword [rbp + 0x110]
jmp 0x1400537a1
cmp dword [rbx - 0x10], 0
jl 0x1400537bf
lea rdx, str..bat
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400537bf
sub rax, rbx
sar rax, 1
test eax, eax
js 0x1400537bf
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005441a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x70]
call fcn.14000cc80
test al, al
jne 0x140053441
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0x70]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140054425
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe0], rax
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xe0]
call fcn.14000cc80
test al, al
jne 0x14005348e
lea rdx, [0x1400992e0]
lea rcx, [rbp + 0xe0]
call fcn.14000c480
nop
mov rbx, qword [rbp + 0xe0]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400534af
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400534c0
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140054430
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
mov edi, dword [rsp + 0x30]
bts edi, 0x1c
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0xf8]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.14000ce60
nop
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14005351e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14005352f
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005443b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe8], rax
bts edi, 0x1d
mov dword [rsp + 0x30], edi
mov r9, qword [rbp + 0x70]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x68]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xe8]
call fcn.14000ce60
mov rdx, qword [rbp + 0xe8]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400535d6
cmp dword [rbx + 0x10], 0
jl 0x1400535c9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400535c9
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400535bb
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x70], rax
mov edi, dword [rsp + 0x30]
jmp 0x1400535d6
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d160
btr edi, 0x1d
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053601
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xefffffff
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005362a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140053646
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053666
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp + 0x390]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14005368d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14005369e
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14005401b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf0], rax
or dword [rsp + 0x30], 0x40000000
mov ecx, 0x22
mov word [rbp - 0x4c], cx
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8d, [rcx - 0x21]
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0xf0]
call fcn.14000ce60
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x390]
call fcn.14005a850
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rbp + 0x398]
call fcn.14005e3e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005376f
cmp dword [rbx + 0x10], 0
jl 0x140053760
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140053760
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140053755
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14005376f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x398]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053792
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and dword [rsp + 0x30], 0xbfffffff
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400537d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400537d1
lea rdx, str.Incorrect_extension.
lea rcx, [rsp + 0x38]
call fcn.14000c480
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400537f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053816
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140053833
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
jmp 0x1400538da
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x50], rax
mov rcx, rdi
call fcn.14000d070
add rax, 0x18
mov qword [rbp + 0x1c0], rax
mov r8b, 1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x3a0]
call fcn.14005e3e0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400538d3
cmp dword [rbx + 0x10], 0
jl 0x1400538c4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400538c4
call fcn.14000d070
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400538b9
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400538d3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d160
nop
mov rdx, qword [rbp + 0x3a0]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400538f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x14009a104]
lea rcx, [rsp + 0x38]
call fcn.14000b850
test al, al
je 0x140053ac7
lea rax, [rbp + 0x3a8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x1d0]
call fcn.14000c6f0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1c8]
call fcn.14000c6f0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x3a8]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x3c0]
call fcn.14000ba30
nop
lea r8, [rbp + 0x1d0]
mov rdx, rax
lea rcx, [rbp + 0x3b8]
call fcn.14000ba30
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14000ba30
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cd10
nop
lea rcx, [rbp + 0x3b8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x3c0]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1c8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1d0]
call fcn.14000d040
lea rax, [rbp + 0x3c8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x1e0]
call fcn.14000c6f0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1d8]
call fcn.14000c6f0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x3c8]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x3e0]
call fcn.14000ba30
nop
lea r8, [rbp + 0x1e0]
mov rdx, rax
lea rcx, [rbp + 0x3d8]
call fcn.14000ba30
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.14000ba30
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
nop
lea rcx, [rbp + 0x3d8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x3e0]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1d8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1e0]
jmp 0x140053ef7
lea rdx, [0x1400a521c]
lea rcx, [rsp + 0x38]
call fcn.14000b850
test al, al
je 0x140053c76
lea rax, [rbp + 0x3e8]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x50], rax
lea rdx, str._Is_Not_Availabe_For_Administrator_Right.
lea rcx, [rbp + 0x1f0]
call fcn.14000c6f0
nop
lea rdx, str.Action_String_
lea rcx, [rbp + 0x1e8]
call fcn.14000c6f0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x3e8]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x3f8]
call fcn.14000ba30
nop
lea r8, [rbp + 0x1f0]
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.14000ba30
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cd10
nop
lea rcx, [rbp + 0x3f8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1e8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1f0]
call fcn.14000d040
lea rax, [rbp + 0x400]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x408]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x200]
call fcn.14000c6f0
nop
lea rdx, str.Result:_Operation_Performed_Successfully.__nAction_String:
lea rcx, [rbp + 0x1f8]
call fcn.14000c6f0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x400]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x418]
call fcn.14000ba30
nop
lea r8, [rbp + 0x200]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.14000ba30
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.14000ba30
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
nop
lea rcx, [rbp + 0x410]
call fcn.14000d040
nop
lea rcx, [rbp + 0x418]
call fcn.14000d040
nop
lea rcx, [rbp + 0x1f8]
call fcn.14000d040
nop
lea rcx, [rbp + 0x200]
jmp 0x140053ef7
lea rax, [rbp + 0x420]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x428]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x218]
call fcn.14000c6f0
nop
lea rdx, str._nAction_String:
lea rcx, [rbp + 0x210]
call fcn.14000c6f0
nop
lea rdx, str.Result:
lea rcx, [rbp + 0x208]
call fcn.14000c6f0
nop
lea rdx, [0x140099090]
lea rcx, [rbp + 0x420]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x448]
call fcn.14000ba30
nop
lea r8, [rbp + 0x210]
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.14000ba30
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x438]
call fcn.14000ba30
nop
lea r8, [rbp + 0x218]
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.14000ba30
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x428]
call fcn.14000ba30
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
nop
lea rcx, [rbp + 0x430]
call fcn.14000d040
nop
lea rcx, [rbp + 0x438]
call fcn.14000d040
nop
lea rcx, [rbp + 0x440]
call fcn.14000d040
nop
lea rcx, [rbp + 0x448]
call fcn.14000d040
nop
lea rcx, [rbp + 0x208]
call fcn.14000d040
nop
lea rcx, [rbp + 0x210]
call fcn.14000d040
nop
lea rcx, [rbp + 0x218]
call fcn.14000d040
lea rax, [rbp + 0x450]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x458]
mov qword [rsp + 0x50], rax
lea rdx, str._nAction_Parameter_String:
lea rcx, [rbp + 0x230]
call fcn.14000c6f0
nop
lea rdx, str._nAction_String:
lea rcx, [rbp + 0x228]
call fcn.14000c6f0
nop
lea rdx, str.Result:
lea rcx, [rbp + 0x220]
call fcn.14000c6f0
nop
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x450]
call fcn.14000c6f0
mov rbx, rax
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x478]
call fcn.14000ba30
nop
lea r8, [rbp + 0x228]
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.14000ba30
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x468]
call fcn.14000ba30
nop
lea r8, [rbp + 0x230]
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.14000ba30
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x458]
call fcn.14000ba30
nop
mov rdx, rbx
mov rcx, rax
call fcn.14005cd10
nop
lea rcx, [rbp + 0x460]
call fcn.14000d040
nop
lea rcx, [rbp + 0x468]
call fcn.14000d040
nop
lea rcx, [rbp + 0x470]
call fcn.14000d040
nop
lea rcx, [rbp + 0x478]
call fcn.14000d040
nop
lea rcx, [rbp + 0x220]
call fcn.14000d040
nop
lea rcx, [rbp + 0x228]
call fcn.14000d040
nop
lea rcx, [rbp + 0x230]
call fcn.14000d040
nop
lea rcx, [rsp + 0x38]
call fcn.14000d040
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp - 0x28]
call fcn.14000d040
nop
lea rcx, [rbp - 0x78]
call fcn.14000d040
nop
lea rcx, [rsp + 0x48]
call fcn.14000d040
nop
lea rcx, [rsp + 0x40]
call fcn.14000d040
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000e470
nop
lea rcx, [rbp + 0x600]
call fcn.14000e470
nop
lea rcx, [rbp + 0x620]
call fcn.14000e470
nop
lea rcx, [rbp - 0x40]
call fcn.14000d040
nop
lea rcx, [rbp + 0x640]
call fcn.14000e470
nop
lea rcx, [rbp + 0x4b0]
call fcn.140006aa0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa30
nop
lea rcx, [rsp + 0x70]
call fcn.14000d040
nop
lea rcx, [rsp + 0x78]
call fcn.14000d040
nop
lea rcx, [rsp + 0x68]
call fcn.14000d040
nop
lea rcx, [rsp + 0x60]
call fcn.14000d040
nop
lea rcx, [rbp - 0x80]
call fcn.14000d040
nop
lea rcx, [rsp + 0x58]
call fcn.14000d040
nop
lea rcx, [rbp + 0x78]
call fcn.14000d040
nop
lea rcx, [rbp + 0x480]
call fcn.14000d040
mov rcx, qword [rbp + 0xe30]
xor rcx, rsp
call fcn.1400691f0
lea r11, [rsp + 0xf40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x1400540a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x1400540fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x140054154
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x1400541ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x140054204
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x22
mov dword [rax], ecx
jmp 0x14005425c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
int3
mov ecx, 0x80070057
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3