Function at 0x14000c880
Capabilities:
Acquire debug privileges
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rax, qword [0x1400e6010]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
xor r12d, r12d
mov r14d, r12d
mov dword [rsp + 0x40], r12d
cmp byte [0x1400e8818], r12b
je 0x14000dc23
mov dword [rbp + 0x170], r12d
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
mov dword [rbp + 0x168], 4
mov dword [rbp + 0x16c], r12d
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x158], 0x400
mov qword [rsp + 0x58], r12
mov qword [rbp + 0xa0], r12
lea r9, [rbp + 0x98]
lea r8, [rbp + 0x170]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.wlanapi.dll_WlanOpenHandle]
test eax, eax
jne 0x14000dc23
lea r8, [rbp + 0xb0]
xor edx, edx
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.wlanapi.dll_WlanEnumInterfaces]
test eax, eax
jne 0x14000dc0f
mov rdx, qword [rbp + 0xb0]
mov eax, dword [rdx]
test eax, eax
jne 0x14000c9ac
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14000c995
xor edx, edx
call qword [sym.imp.wlanapi.dll_WlanCloseHandle]
mov qword [rbp + 0x98], r12
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x14000dc23
mov rcx, rdx
call qword [sym.imp.wlanapi.dll_WlanFreeMemory]
jmp 0x14000dc23
mov ebx, r12d
mov dword [rsp + 0x54], ebx
test eax, eax
je 0x14000dbff
mov rsi, qword [rbp - 0x28]
nop
mov eax, ebx
imul rcx, rax, 0x214
lea r15, [rdx + 8]
add r15, rcx
mov qword [rbp - 0x68], r15
lea r9, [rbp + 0xb8]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.wlanapi.dll_WlanGetProfileList]
test eax, eax
jne 0x14000dbea
mov eax, r12d
mov dword [rsp + 0x50], eax
mov rcx, qword [rbp + 0xb8]
cmp dword [rcx], 0
jbe 0x14000dbdd
nop dword [rax]
imul rdi, rax, 0x204
lea rbx, [rcx + 8]
lea rdx, str.WLAN_Profile_Name:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009890
mov rcx, rax
lea rdx, [rbx + rdi]
call fcn.14000f0a0
mov rcx, rax
lea rdx, [0x140009b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8, qword [rbp + 0xb8]
add r8, 8
add r8, rdi
lea rax, [rbp + 0x16c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, r15
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.wlanapi.dll_WlanGetProfile]
test eax, eax
jne 0x14000db77
mov qword [rbp + 0x150], r12
lea rdx, str.__pf:WLANProfile_pf:MSM_pf:security_pf:authEncryption
lea rcx, [rbp + 0x58]
call fcn.140004820
mov r8, rax
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x150]
call fcn.140011050
nop
lea rax, [rsp + 0x68]
mov qword [rbp + 0xc0], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14000cb0f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.pf:authentication
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000cb12
mov rbx, r12
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x14000dc5e
mov rbx, qword [rbp + 0x150]
test rbx, rbx
je 0x14000dc53
mov qword [rbp + 0x100], r12
mov rax, qword [rbx]
lea r8, [rbp + 0x100]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x38]
test eax, eax
jns 0x14000cb5e
lea r8, [0x1400d08a0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rcx, qword [rbp + 0x100]
mov qword [rbp - 0x18], rcx
bts r14d, 7
test rcx, rcx
je 0x14000dd66
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x30]
call fcn.1400083c0
nop
mov rbx, qword [rax]
test rbx, rbx
je 0x14000dd5b
mov qword [rbp + 0xc0], r12
mov rax, qword [rbx]
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call qword [rax + 0xd0]
test eax, eax
jns 0x14000cbc1
lea r8, [0x1400d08b0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rdi, qword [rbp + 0xc0]
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000cbfb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov qword [rbx], rdi
jmp 0x14000cbfe
mov rbx, r12
mov qword [rbp - 0x10], rbx
test rbx, rbx
je 0x14000dd50
bts r14d, 8
mov dword [rsp + 0x40], r14d
mov rdi, qword [rbx + 8]
test rdi, rdi
jne 0x14000cc2d
mov rcx, qword [rbx]
call fcn.1400c7830
mov rdi, rax
mov qword [rbx + 8], rax
lea rdx, str.Authentication:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009890
mov rcx, rax
mov rdx, rdi
call fcn.140009890
mov rcx, rax
lea rdx, [0x140009b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000cc9c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000cc7c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000cc8e
call fcn.1400c6a2c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400c6a2c
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000ccac
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rax, [rsp + 0x70]
mov qword [rbp + 0xf8], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp - 8], rax
test rax, rax
je 0x14000cd04
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.pf:encryption
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000cd07
mov rbx, r12
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x14000dd45
mov qword [rbp + 0x108], r12
mov rbx, qword [rbp + 0x150]
mov rax, qword [rbx]
lea r8, [rbp + 0x108]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x38]
test eax, eax
jns 0x14000cd4a
lea r8, [0x1400d08a0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rcx, qword [rbp + 0x108]
mov qword [rbp], rcx
mov edi, dword [rsp + 0x40]
bts edi, 9
test rcx, rcx
je 0x14000dd3a
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x38]
call fcn.1400083c0
nop
mov rbx, qword [rax]
test rbx, rbx
je 0x14000dd2f
mov qword [rbp + 0xf8], r12
mov rax, qword [rbx]
lea rdx, [rbp + 0xf8]
mov rcx, rbx
call qword [rax + 0xd0]
test eax, eax
jns 0x14000cdb0
lea r8, [0x1400d08b0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov r14, qword [rbp + 0xf8]
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000cdea
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov qword [rbx], r14
jmp 0x14000cded
mov rbx, r12
mov qword [rbp + 8], rbx
test rbx, rbx
je 0x14000dd24
bts edi, 0xa
mov dword [rsp + 0x40], edi
mov rdi, qword [rbx + 8]
test rdi, rdi
jne 0x14000ce1a
mov rcx, qword [rbx]
call fcn.1400c7830
mov rdi, rax
mov qword [rbx + 8], rax
lea rdx, str.Encryption:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009890
mov rcx, rax
mov rdx, rdi
call fcn.140009890
mov rcx, rax
lea rdx, [0x140009b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000ce89
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000ce69
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000ce7b
call fcn.1400c6a2c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400c6a2c
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000ce99
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x108]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x110], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14000cef0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.pf:useOneX
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000cef3
mov rbx, r12
mov qword [rbp - 0x80], rbx
test rbx, rbx
je 0x14000dd19
mov qword [rbp + 0xe0], r12
mov rbx, qword [rbp + 0x150]
mov rax, qword [rbx]
lea r8, [rbp + 0xe0]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x38]
test eax, eax
jns 0x14000cf35
lea r8, [0x1400d08a0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rcx, qword [rbp + 0xe0]
mov qword [rbp + 0x18], rcx
mov edi, dword [rsp + 0x40]
bts edi, 0xb
test rcx, rcx
je 0x14000dd0e
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x40]
call fcn.1400083c0
nop
mov rbx, qword [rax]
test rbx, rbx
je 0x14000dd03
mov qword [rbp + 0x110], r12
mov rax, qword [rbx]
lea rdx, [rbp + 0x110]
mov rcx, rbx
call qword [rax + 0xd0]
test eax, eax
jns 0x14000cf9a
lea r8, [0x1400d08b0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov r14, qword [rbp + 0x110]
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000cfd4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov qword [rbx], r14
jmp 0x14000cfd7
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x14000dcf8
bts edi, 0xc
mov dword [rsp + 0x40], edi
mov rdi, qword [rbx + 8]
test rdi, rdi
jne 0x14000d004
mov rcx, qword [rbx]
call fcn.1400c7830
mov rdi, rax
mov qword [rbx + 8], rax
lea rdx, str.useOneX:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009890
mov rcx, rax
mov rdx, rdi
call fcn.140009890
mov rcx, rax
lea rdx, [0x140009b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000d073
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d053
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000d065
call fcn.1400c6a2c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400c6a2c
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14000d083
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0xd8], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp + 0x28], rax
test rax, rax
je 0x14000d0da
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.pf:useOneX
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000d0dd
mov rbx, r12
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x14000dced
mov qword [rbp + 0xa8], r12
mov rdi, qword [rbp + 0x150]
mov rax, qword [rdi]
lea r8, [rbp + 0xa8]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x14000d11f
lea r8, [0x1400d08a0]
mov rdx, rdi
mov ecx, eax
call fcn.1400c7770
mov r13, qword [rbp + 0xa8]
mov qword [rbp + 0x30], r13
mov r14d, dword [rsp + 0x40]
bts r14d, 0xd
or r14d, 1
mov dword [rsp + 0x40], r14d
test r13, r13
je 0x14000dce2
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x48]
mov rcx, r13
call fcn.1400083c0
nop
or r14d, 2
mov dword [rsp + 0x40], r14d
mov rbx, qword [rax]
test rbx, rbx
je 0x14000dcd7
mov qword [rbp + 0xd8], r12
mov rax, qword [rbx]
lea rdx, [rbp + 0xd8]
mov rcx, rbx
call qword [rax + 0xd0]
test eax, eax
jns 0x14000d19b
lea r8, [0x1400d08b0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rbx, qword [rbp + 0xd8]
mov ecx, 0x18
call fcn.1400c69f0
mov r12, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000d1df
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], rax
xor r15d, r15d
mov qword [r12 + 8], r15
mov dword [r12 + 0x10], 1
mov qword [r12], rbx
jmp 0x14000d1e5
xor r15d, r15d
mov r12d, r15d
mov qword [rbp + 0x38], r12
test r12, r12
je 0x14000dccc
or r14d, 0x40
or r14d, 4
mov dword [rsp + 0x40], r14d
mov rcx, r15
mov rdx, qword [r12]
lea r8, [0x1400ca9c0]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000d39c
cmp rcx, 6
jne 0x14000d210
lea rax, [rbp - 0x70]
mov qword [rbp + 0x118], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14000d272
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.pf:authentication
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000d275
mov rbx, r15
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14000dc8a
mov qword [rbp + 0x128], r15
mov rax, qword [rdi]
lea r8, [rbp + 0x128]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x14000d2b0
lea r8, [0x1400d08a0]
mov rdx, rdi
mov ecx, eax
call fcn.1400c7770
mov rbx, qword [rbp + 0x128]
mov qword [rsp + 0x78], rbx
bts r14d, 0xe
or r14d, 8
mov dword [rsp + 0x40], r14d
test rbx, rbx
je 0x14000dc7f
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083c0
nop
or r14d, 0x10
mov dword [rsp + 0x40], r14d
mov rsi, qword [rax]
test rsi, rsi
je 0x14000dc74
mov qword [rbp + 0x118], r15
mov rax, qword [rsi]
lea rdx, [rbp + 0x118]
mov rcx, rsi
call qword [rax + 0xd0]
test eax, eax
jns 0x14000d328
lea r8, [0x1400d08b0]
mov rdx, rsi
mov ecx, eax
call fcn.1400c7770
mov r15, qword [rbp + 0x118]
mov ecx, 0x18
call fcn.1400c69f0
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000d362
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 1
mov qword [rsi], r15
jmp 0x14000d364
xor esi, esi
test rsi, rsi
je 0x14000dc69
or r14d, 0x8020
xor ecx, ecx
mov rdx, qword [rsi]
lea r8, str.open
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000d397
cmp rcx, 5
jne 0x14000d380
jmp 0x14000d3a1
mov r15b, 1
jmp 0x14000d3a4
mov rbx, qword [rsp + 0x78]
xor r15b, r15b
test r14b, 0x20
je 0x14000d419
and r14d, 0xffffffdf
mov dword [rsp + 0x40], r14d
test rsi, rsi
je 0x14000d419
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14000d3ff
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000d3dc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000d3f2
call fcn.1400c6a2c
mov qword [rsi + 8], 0
mov edx, 0x18
mov rcx, rsi
call fcn.1400c6a2c
xor esi, esi
mov rdi, qword [rbp + 0x150]
mov rbx, qword [rsp + 0x78]
mov r14d, dword [rsp + 0x40]
mov r13, qword [rbp + 0xa8]
test r14b, 0x10
je 0x14000d438
and r14d, 0xffffffef
mov dword [rsp + 0x40], r14d
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000d438
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test r14b, 8
je 0x14000d456
and r14d, 0xfffffff7
mov dword [rsp + 0x40], r14d
test rbx, rbx
je 0x14000d456
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
test r14b, 4
je 0x14000d4c5
and r14d, 0xfffffffb
mov dword [rsp + 0x40], r14d
mov eax, 0xffffffff
lock xadd dword [r12 + 0x10], eax
cmp eax, 1
jne 0x14000d4b2
mov rcx, qword [r12]
test rcx, rcx
je 0x14000d48d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000d4a5
call fcn.1400c6a2c
mov qword [r12 + 8], 0
mov edx, 0x18
mov rcx, r12
call fcn.1400c6a2c
mov r13, qword [rbp + 0xa8]
mov r14d, dword [rsp + 0x40]
mov rdi, qword [rbp + 0x150]
test r14b, 2
je 0x14000d4e4
and r14d, 0xfffffffd
mov dword [rsp + 0x40], r14d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000d4e4
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test r14b, 1
je 0x14000d4f9
and r14d, 0xfffffffe
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
nop
test r15b, r15b
je 0x14000db6a
lea rdx, str.__pf:WLANProfile_pf:MSM_pf:security_pf:sharedKey
lea rcx, [rbp + 0x78]
call fcn.140004820
mov r8, rax
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp - 0x58]
call fcn.140011050
nop
mov rdx, qword [rax]
xor r12d, r12d
cmp rdi, rdx
je 0x14000d54d
mov rcx, rdi
mov rdi, rdx
mov qword [rbp + 0x150], rdx
mov qword [rax], r12
test rcx, rcx
je 0x14000d54d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000d55d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0xd0], rax
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14000d5a7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.pf:keyMaterial
call fcn.1400c7950
mov qword [rbx], rax
jmp 0x14000d5aa
mov rbx, r12
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x14000dcc1
test rdi, rdi
je 0x14000dcb6
mov qword [rbp + 0xe8], r12
mov rax, qword [rdi]
lea r8, [rbp + 0xe8]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x14000d5ef
lea r8, [0x1400d08a0]
mov rdx, rdi
mov ecx, eax
call fcn.1400c7770
mov rcx, qword [rbp + 0xe8]
mov qword [rbp + 0x48], rcx
bts r14d, 0x10
test rcx, rcx
je 0x14000dcab
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
call fcn.1400083c0
nop
mov rbx, qword [rax]
test rbx, rbx
je 0x14000dca0
mov qword [rbp + 0xd0], r12
mov rax, qword [rbx]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call qword [rax + 0xd0]
test eax, eax
jns 0x14000d652
lea r8, [0x1400d08b0]
mov rdx, rbx
mov ecx, eax
call fcn.1400c7770
mov rdi, qword [rbp + 0xd0]
mov ecx, 0x18
call fcn.1400c69f0
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000d68c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov qword [rbx], rdi
jmp 0x14000d68f
mov rbx, r12
test rbx, rbx
je 0x14000dc95
bts r14d, 0x11
mov dword [rsp + 0x40], r14d
mov rdi, qword [rbx]
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000d6e5
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d6c5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000d6d7
call fcn.1400c6a2c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400c6a2c
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000d6f5
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
call fcn.14000f770
mov r15d, eax
test eax, eax
jne 0x14000d727
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
mov dword [rbp + 0x15c], 0x10
mov r14d, r12d
lea r8, [rbp + 0x178]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14000db12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0xc8]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000db12
mov dword [rbp + 0x190], 1
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x194], rax
mov dword [rbp + 0x19c], r12d
lea rax, [rbp + 0x15c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000d835
mov dword [rbp + 0x180], 1
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x184], rax
or dword [rbp + 0x18c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 0x15c]
lea r8, [rbp + 0x180]
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
sete r14b
jmp 0x14000d852
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x14000db12
mov r8d, r15d
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14000d890
mov rcx, qword [rbp + 0x150]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
lea r8, [rbp + 0xa0]
mov edx, 0x2000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000d8cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r12
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14000d91f
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14000d8f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa0], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r12
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
mov dword [rbp + 0x160], r12d
mov qword [rbp + 0xf0], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0xf0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000daf6
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x164]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, r12d
test eax, eax
cmovne ebx, dword [rbp + 0x164]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14000daf6
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14000d9a2
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x158]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x14000da21
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005220
mov rcx, rax
lea rdx, str._encrypted_
call fcn.140005220
mov rcx, rax
lea rdx, [0x1400053f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14000da30
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x158]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a0]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x14000dae8
mov eax, dword [rbp + 0x158]
mov dword [rbp + 0x130], eax
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x130]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14000dae8
mov rbx, qword [rbp + 0x148]
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005220
mov rdx, rbx
mov rcx, rax
call fcn.140005220
mov rcx, rax
lea rdx, [0x1400053f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbp + 0x150]
mov r14d, dword [rsp + 0x40]
jmp 0x14000db6d
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005220
lea rdx, str._encrypted_
jmp 0x14000dad0
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005220
mov rcx, rax
lea rdx, str._encrypted_
call fcn.140005220
mov rcx, rax
lea rdx, [0x1400053f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400053f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov r14d, dword [rsp + 0x40]
jmp 0x14000dbbc
xor r12d, r12d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
lea rdx, [0x140009b00]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14000dba3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r12
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14000dbbc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa0], r12
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rcx, qword [rbp + 0xb8]
cmp eax, dword [rcx]
mov r15, qword [rbp - 0x68]
jb 0x14000ca10
mov ebx, dword [rsp + 0x54]
call qword [sym.imp.wlanapi.dll_WlanFreeMemory]
mov qword [rbp + 0xb8], r12
inc ebx
mov dword [rsp + 0x54], ebx
mov rdx, qword [rbp + 0xb0]
cmp ebx, dword [rdx]
jb 0x14000c9c0
mov rcx, rdx
call qword [sym.imp.wlanapi.dll_WlanFreeMemory]
mov qword [rbp + 0xb0], r12
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14000dc23
xor edx, edx
call qword [sym.imp.wlanapi.dll_WlanCloseHandle]
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.1400c69d0
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
nop
mov ecx, 0x8007000e
call fcn.1400c7760
int3
mov ecx, 0x80004003
call fcn.1400c7760
nop
mov ecx, 0x80004003
call fcn.1400c7760
int3