Function at 0x140006f80
Capabilities:
Check os version
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rcx, qword [rbp + 0x220]
xor ebx, ebx
mov rax, qword [0x1400c9140]
mov esi, r9d
mov r15, qword [rbp + 0x230]
mov r12d, ebx
mov dword [rsp + 0x74], edx
mov r13d, ebx
mov rdx, qword [rbp + 0x228]
lea edi, [rbx + 1]
mov qword [rsp + 0x60], r8
mov r14d, ebx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rdx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
test r8, r8
je 0x1400072f4
test rcx, rcx
je 0x1400072f4
test rdx, rdx
je 0x1400072f4
test r15, r15
je 0x1400072f4
test byte [0x1400c9180], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], 0xf0003
mov dword [rsp + 0x34], ebx
je 0x140007078
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400aa228]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.140057c44
mov dword [rsp + 0x28], edi
lea r8, [rbp - 0x58]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
lea rdx, [rbp - 0x78]
xor ecx, ecx
call fcn.140008410
test byte [0x1400c9180], 2
mov ebx, eax
je 0x1400070bf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [0x1400aa248]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.140057c44
test ebx, ebx
je 0x1400072e9
lea rcx, [0x1400c8ed8]
mov dword [rsp + 0x34], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x1400072c5
cmp dword [rbx], 0x6060
jne 0x1400072c5
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140007110
test byte [rax + 0xc], 2
je 0x140007110
xor edx, edx
mov rcx, rbx
call fcn.140050b90
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp qword [rbx + 0x60], r12
je 0x140007166
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140007157
test byte [rcx + 0x44], 4
je 0x140007157
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa800]
mov edx, 0x16
call fcn.14001c1cc
mov rcx, qword [rbx + 0x60]
call fcn.140010f34
xor eax, eax
mov qword [rbx + 0x60], rax
mov rax, qword [rbx + 8]
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbx + 0x10]
mov rax, qword [rax + 0x118]
call qword [0x1400a83f0]
test eax, eax
je 0x1400072e9
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1400071bd
xor ecx, ecx
nop dword [rax + rax]
mov qword [rax + 8], rcx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400071b0
xor eax, eax
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x50], eax
mov rax, qword [0x1400c8510]
cmp rax, rbx
jne 0x1400071de
mov rax, qword [rbx + 0x28]
mov qword [0x1400c8510], rax
jmp 0x1400071fe
test rax, rax
je 0x1400071fe
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, rbx
je 0x1400071f7
test rax, rax
jne 0x1400071e3
jmp 0x1400071fe
mov rax, qword [rbx + 0x28]
mov qword [rcx], rax
cmp qword [rbx + 0x18], r12
je 0x14000720d
lea rcx, [rbx + 0x18]
call fcn.140051084
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140007236
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140007284
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140007265
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400c9130]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbx + 0x40], rax
mov r8, qword [rbx + 0x48]
test r8, r8
je 0x1400072a2
mov rcx, qword [0x1400c9130]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [0x1400c9130]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.1400083f0
mov edi, eax
jmp 0x1400072f9
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor ecx, ecx
call fcn.1400083f0
mov edi, eax
jmp 0x1400072f9
mov edi, 0x80070057
mov rax, qword [rsp + 0x78]
mov rbx, qword [rax + 0x60]
mov rcx, rbx
mov qword [rbp - 0x70], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [rbx + 0x2c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rbx + 0x28], eax
test edi, edi
js 0x1400082c3
mov rcx, qword [rsp + 0x78]
lea rax, [rcx + 0x38]
test rax, rax
je 0x1400082be
xor r9d, r9d
lea r10, [rcx + 0x40]
mov eax, r9d
test r10, r10
je 0x140007354
mov rax, qword [r10 + 0x10]
mov rcx, rax
mov rdx, rax
mov r8, r9
test r10, r10
je 0x14000739d
mov r11d, dword [rsp + 0x74]
cmp rcx, r10
je 0x14000739d
mov rcx, rdx
mov edx, r11d
sub edx, dword [rcx + 0x24]
js 0x14000739d
test edx, edx
je 0x14000738f
mov rdx, rcx
test rax, rax
je 0x140007367
mov rax, qword [rax + 0x10]
mov rcx, rax
mov rdx, rax
jmp 0x140007367
mov r8, rcx
mov edi, r9d
test esi, esi
je 0x140008331
test r8, r8
je 0x1400073e8
mov r14, qword [r8 + 0x28]
mov qword [rsp + 0x38], r14
test r14, r14
je 0x1400073bd
dec dword [r14 + 0x24]
mov edi, r9d
mov qword [r8 + 0x28], r9
jmp 0x1400073c2
mov edi, 0x80004003
mov rax, qword [r8]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
mov rcx, r8
call qword [0x1400a83f0]
test edi, edi
js 0x14000783e
mov rcx, qword [0x1400c9130]
xor eax, eax
mov r14d, eax
mov qword [rsp + 0x50], rax
mov esi, eax
mov dword [rsp + 0x40], eax
lea edx, [rax + 8]
lea r8d, [rax + 0x58]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140007461
lea ecx, [rax + 8]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140007461
test byte [rcx + 0x44], 0x20
je 0x140007461
mov rcx, qword [rcx + 0x38]
lea edx, [rdi + 0xa]
lea r9d, [r14 + 0x58]
lea r8, [0x1400aa7e0]
call fcn.14001c23c
lea esi, [rdi + 8]
jmp 0x140007578
test rdi, rdi
jne 0x14000746e
lea esi, [rdi + 8]
jmp 0x140007578
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
mov r8, rdi
lea edx, [r9 - 0x57]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x140007522
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x1400074b8
lea esi, [rax + 5]
jmp 0x140007578
cmp eax, 0x7a
jne 0x140007578
mov rcx, qword [0x1400c9130]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov esi, dword [rsp + 0x40]
mov ecx, esi
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
jne 0x1400074f4
lea esi, [rax + 8]
jmp 0x140007578
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x140007560
xor eax, eax
mov esi, eax
mov r14, rdi
mov rcx, qword [r14]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
jne 0x1400075cf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140007556
lea esi, [rax + 8]
mov r9, qword [rsp + 0x50]
jmp 0x14000764a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, 5
test eax, eax
cmove eax, esi
mov esi, eax
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400075a9
test byte [rcx + 0x44], 0x20
je 0x1400075a9
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa820]
mov edx, 0x31
mov r9d, esi
call fcn.14001c1f8
test rdi, rdi
je 0x1400075c6
mov rcx, qword [0x1400c9130]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
jne 0x140007556
jmp 0x140007525
mov r9, qword [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [r9 + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400075e0
lea eax, [rax*2 + 2]
cmp eax, 0x200
ja 0x140007645
lea rax, [rbp - 0x40]
mov r8, r9
sub r8, rax
lea rcx, [rbp - 0x40]
mov edx, 0x100
nop dword [rax]
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x140007633
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140007633
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140007610
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
jmp 0x14000764a
mov esi, 0x7a
test r9, r9
je 0x14000765e
mov rcx, r9
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [0x1400c9130]
mov r8, r14
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
je 0x1400076ab
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400076ab
test byte [rcx + 0x44], 0x20
je 0x1400076ab
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa820]
mov edx, 0xe
mov r9d, esi
call fcn.14001c1f8
mov ecx, esi
call fcn.1400083f0
mov edi, eax
test eax, eax
js 0x140007839
mov rcx, 0xffffffffffffffff
lea rax, [rbp - 0x40]
mov rsi, rcx
nop word [rax + rax]
inc rsi
cmp word [rax + rsi*2], r12w
jne 0x1400076d0
inc rsi
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ecd8
mov r14, rax
test rax, rax
je 0x140007758
lea rax, [rsi - 1]
cmp rax, 0x7ffffffe
ja 0x140007744
lea r9, [rbp - 0x40]
mov rdx, rsi
mov rcx, r14
call fcn.1400109d0
mov edi, eax
test eax, eax
js 0x14000775d
mov rcx, qword [r15]
lea rax, [0x1400c8f30]
cmp rcx, rax
je 0x14000773a
lea rax, [0x1400c8f32]
cmp rcx, rax
je 0x14000773a
call fcn.14000eccc
xor esi, esi
mov qword [r15], r14
mov r14d, esi
jmp 0x140007777
mov eax, 0x80070057
mov edi, eax
test rsi, rsi
je 0x140007714
xor esi, esi
mov word [r14], si
jmp 0x14000775f
mov edi, 0x8007000e
xor esi, esi
lea rax, [0x1400c8f30]
cmp r14, rax
je 0x14000777f
lea rax, [0x1400c8f32]
cmp r14, rax
je 0x14000777f
mov rcx, r14
call fcn.14000eccc
test edi, edi
js 0x140007839
mov rax, qword [rsp + 0x78]
mov r12, rsi
add rax, 8
je 0x140007834
lea r13, [rax + 8]
mov edi, 1
test r13, r13
je 0x1400077ab
mov rsi, qword [r13 + 0x10]
mov rdx, qword [rsp + 0x38]
mov rax, rsi
mov qword [rsp + 0x38], rdx
mov rcx, rsi
test r13, r13
je 0x140007a42
mov r14, rdx
mov r15, r12
cmp rax, r13
je 0x140007a38
mov rdx, qword [rcx + 0x28]
mov r12, rcx
lea rcx, [rbp - 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
js 0x140007825
je 0x140007817
mov rdx, r14
mov rax, r12
mov qword [rsp + 0x38], rdx
mov rcx, r12
mov r12, r15
test rsi, rsi
je 0x1400077c4
mov rsi, qword [rsi + 0x10]
mov rax, rsi
mov qword [rsp + 0x38], rdx
mov rcx, rsi
jmp 0x1400077c4
xor eax, eax
mov qword [rsp + 0x38], r14
mov edi, eax
mov r13d, eax
jmp 0x14000783e
mov r13, qword [rsp + 0x68]
mov r12, r15
mov qword [rsp + 0x38], r14
jmp 0x14000783e
mov edi, 0x80070057
mov r14, qword [rsp + 0x38]
mov r15d, 0x80004005
test edi, edi
jne 0x140007aa3
mov r15, qword [rsp + 0x60]
mov r13, r12
mov qword [rsp + 0x68], r12
test r15, r15
je 0x140007a99
lea ecx, [rdi + 0x18]
call fcn.14000ecd8
mov rsi, rax
test rax, rax
je 0x140007a80
mov qword [rax + 0x10], r15
lea rdx, [0x14008c068]
mov qword [rax], rdx
mov ecx, 1
mov dword [rax + 8], ecx
xor eax, eax
mov edi, eax
cmp r15, 0xffffffffffffffff
mov eax, 0x80004005
cmove edi, eax
je 0x140007a4f
mov r8, qword [r12 + 0x30]
mov edx, dword [r8 + 8]
cmp edx, 0x7fffffff
je 0x1400078cc
lea ecx, [rdx - 1]
mov eax, edx
lock cmpxchg dword [r8 + 8], ecx
je 0x1400078cc
mov edx, dword [r8 + 8]
cmp edx, 0x7fffffff
jne 0x1400078b3
lea eax, [rdx - 1]
test eax, eax
jne 0x1400078ed
mov rax, qword [r8]
movabs r10, 0xca34bf075ed23170
mov rax, qword [rax + 8]
mov rcx, r8
call qword [0x1400a83f0]
mov eax, dword [rsp + 0x34]
mov dword [r12 + 0x40], eax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [r12 + 0x30], rsi
mov r14d, dword [rsp + 0x30]
mov r15d, 1
xor r12d, r12d
mov dword [rsp + 0x34], r14d
mov rsi, r13
test edi, edi
js 0x1400082af
mov ecx, 0x38
call fcn.14000ecd8
mov qword [rsp + 0x58], rax
mov r9, rax
test rax, rax
je 0x140008298
mov dword [rax + 8], 0x6b6e6c74
test rsi, rsi
mov qword [rax + 0x10], rax
mov edi, r12d
mov qword [rax + 0x18], rax
lea rax, [0x14008c060]
mov qword [r9], rax
mov eax, dword [rsp + 0x74]
mov dword [r9 + 0x24], eax
lea rax, [0x1400c8f30]
mov qword [r9 + 0x30], rax
mov eax, 0x80004005
cmove edi, eax
mov dword [r9 + 0x20], 0x746e6573
mov qword [r9 + 0x28], r13
je 0x14000828b
mov rax, qword [r13 + 0x30]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov rdi, qword [rax + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
xor r8d, r8d
lea r9, [rsp + 0x48]
mov rcx, rax
lea edx, [r8 + 0xe]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x140007a17
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
jne 0x140007a01
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
lea r9, [rsp + 0x48]
mov r8d, r15d
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x140007a17
call fcn.14000b290
mov esi, eax
test eax, eax
jns 0x140007a17
cmp si, 0x3f0
jne 0x140007d61
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140007d0b
mov esi, r12d
jmp 0x140007d12
mov r13, qword [rsp + 0x68]
jmp 0x140007839
mov r13, qword [rsp + 0x68]
mov r14, rdx
jmp 0x14000783e
mov rax, qword [rdx]
movabs r10, 0xef3537fb7e56b870
mov edx, ecx
mov rcx, rsi
call qword [0x1400a83f0]
mov rcx, r15
mov qword [rsp + 0x38], r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140007902
mov rcx, r15
mov edi, 0x8007000e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140007902
mov edi, 0x80070057
jmp 0x140007902
cmp edi, 1
jne 0x140007902
lea ecx, [rdi + 0x47]
call fcn.14000ecd8
mov rsi, rax
test rax, rax
je 0x140007ceb
mov r12, qword [rsp + 0x60]
xor r13d, r13d
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rax, [0x14008c058]
mov qword [rsi], rax
lea rax, [0x1400c8f30]
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], 0x746e6575
mov qword [rsi + 0x30], r13
mov qword [rsi + 0x38], r13
test r12, r12
je 0x140007c3c
mov rcx, 0xffffffffffffffff
lea rax, [rbp - 0x40]
mov rdi, rcx
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x140007b13
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ecd8
mov r15, rax
test rax, rax
je 0x140007b97
mov rdx, rdi
call fcn.140010ae4
mov r14d, eax
test eax, eax
js 0x140007b8c
lea r9, [rbp - 0x40]
mov rdx, rdi
mov rcx, r15
call fcn.1400109d0
mov r14d, eax
test r14d, r14d
js 0x140007b9d
mov rcx, qword [rsi + 0x28]
lea rax, [0x1400c8f30]
cmp rcx, rax
je 0x140007b83
lea rax, [0x1400c8f32]
cmp rcx, rax
je 0x140007b83
call fcn.14000eccc
mov qword [rsi + 0x28], r15
mov r15, r13
jmp 0x140007bb5
test rdi, rdi
je 0x140007b5d
mov word [r15], r13w
jmp 0x140007b9d
mov r14d, 0x8007000e
lea rax, [0x1400c8f30]
cmp r15, rax
je 0x140007bbd
lea rax, [0x1400c8f32]
cmp r15, rax
je 0x140007bbd
mov rcx, r15
call fcn.14000eccc
test r14d, r14d
js 0x140007c44
mov ecx, 0x18
call fcn.14000ecd8
mov rcx, rax
mov r15d, 0x80004005
test rax, rax
je 0x140007c34
cmp r12, 0xffffffffffffffff
mov qword [rax + 0x10], r12
mov edi, 1
lea rdx, [0x14008c068]
mov r14d, r13d
mov dword [rax + 8], edi
cmove r14d, r15d
mov qword [rax], rdx
je 0x140007c0e
mov qword [rsi + 0x30], rax
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x40], eax
jmp 0x140007c7b
mov rax, qword [rdx]
movabs r10, 0xef3537fb7e56b870
mov edx, edi
call qword [0x1400a83f0]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
test r14d, r14d
js 0x140007c4a
jmp 0x140007c7b
mov r14d, 0x8007000e
jmp 0x140007c4a
mov r14d, 0x80070057
jmp 0x140007c4a
mov r15d, 0x80004005
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140007c7b
test byte [rcx + 0x44], 0x20
je 0x140007c7b
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aab50]
mov edx, 0x11
mov r9d, r14d
call fcn.14001c23c
mov rax, qword [rsi + 0x30]
xor r12d, r12d
test rax, rax
mov qword [rsp + 0x68], rsi
mov edi, r12d
mov r13, rsi
cmove edi, r15d
mov r15d, 1
mov r14d, r15d
mov dword [rsp + 0x30], r15d
je 0x140007910
mov r15, qword [rsp + 0x78]
lea rdx, [rbp - 0x40]
mov r8, rsi
mov qword [rsp + 0x60], r12
lea rcx, [r15 + 8]
call fcn.14000cc00
mov qword [rsp + 0x68], rsi
mov edi, eax
test eax, eax
js 0x140007ce3
inc dword [r15 + 0x30]
mov r15d, r14d
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x68], rsi
jmp 0x140007920
mov r15d, r14d
jmp 0x140007910
xor r12d, r12d
mov edi, 0x8007000e
mov r13d, r12d
mov esi, r12d
mov r15d, r12d
lea r14d, [r12 + 1]
mov r12d, dword [rsp + 0x70]
jmp 0x1400082c9
call fcn.14000b290
mov esi, eax
test esi, esi
js 0x140007d3f
lea r8, [rsp + 0x50]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
nop dword [rax + rax]
test eax, eax
je 0x140007d38
mov esi, r12d
jmp 0x140007d3f
call fcn.14000b290
mov esi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x140007d61
test esi, esi
js 0x140007d61
call fcn.14000b290
mov esi, eax
mov rcx, qword [rsp + 0x48]
mov edi, esi
test rcx, rcx
je 0x140007d79
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r14, qword [rsp + 0x50]
test esi, esi
jns 0x140007ddc
test r14, r14
je 0x140007dd4
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r14, r12
mov qword [rsp + 0x50], r12
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140007dd4
test byte [rcx + 0x44], 0x20
je 0x140007dd4
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aab50]
mov edx, 0x12
mov r9d, esi
call fcn.14001c23c
jmp 0x1400080fc
test esi, esi
js 0x140008101
mov qword [rbp - 0x78], r12
mov r13, r12
mov qword [rsp + 0x48], r12
mov rsi, r12
test r14, r14
jne 0x140007e0c
lea rcx, [rsp + 0x48]
call fcn.14004bedc
mov r12d, eax
test eax, eax
je 0x140007f85
mov rcx, qword [rsp + 0x48]
jmp 0x140007e14
mov rcx, r14
mov qword [rsp + 0x48], rcx
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x140007f85
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140007f85
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
mov rsi, rax
test rax, rax
jne 0x140007e93
lea ecx, [rax + 0xe]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140007f85
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x80], rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
je 0x140007f85
mov edx, dword [rdi]
xor eax, eax
mov r12d, eax
mov ecx, eax
test edx, edx
je 0x140007f85
lea rax, [rdi + 8]
nop
mov rdi, qword [rax]
cmp byte [rdi + 1], 3
jne 0x140007eef
cmp dword [rdi + 8], 5
je 0x140007efe
inc ecx
add rax, 0x10
cmp ecx, edx
jb 0x140007ee0
jmp 0x140007f85
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, eax
mov r15d, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov r13, rax
test rax, rax
jne 0x140007f4a
lea ecx, [rax + 0xe]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140007f81
mov r8, rdi
mov rdx, rsi
mov ecx, r15d
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x140007f81
lea rdx, [rbp - 0x78]
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
mov eax, 1
cmovne r12d, eax
mov rsi, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007fa0
test r14, r14
jne 0x140007fa0
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test r13, r13
je 0x140007fc3
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140007fe6
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r12d, r12d
jne 0x140008008
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400083f0
mov edi, eax
test eax, eax
js 0x1400080f4
mov r15, qword [rbp - 0x78]
test r15, r15
je 0x1400080e0
mov rcx, 0xffffffffffffffff
mov rsi, rcx
nop
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140008020
inc rsi
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ecd8
mov r14, rax
test rax, rax
je 0x1400080b5
mov rdx, rsi
call fcn.140010ae4
mov edi, eax
test eax, eax
js 0x1400080a8
mov r9, r15
mov rdx, rsi
mov rcx, r14
call fcn.1400109d0
mov edi, eax
test eax, eax
js 0x1400080ba
mov rsi, qword [rsp + 0x58]
lea rax, [0x1400c8f30]
mov rcx, qword [rsi + 0x30]
cmp rcx, rax
je 0x140008092
lea rax, [0x1400c8f32]
cmp rcx, rax
je 0x140008092
call fcn.14000eccc
xor eax, eax
mov qword [rsi + 0x30], r14
mov ecx, eax
mov r14d, eax
call fcn.14000eccc
mov r15, qword [rbp - 0x78]
jmp 0x1400080e5
test rsi, rsi
je 0x140008066
xor eax, eax
mov word [r14], ax
jmp 0x1400080ba
mov edi, 0x8007000e
lea rax, [0x1400c8f30]
cmp r14, rax
je 0x1400080da
lea rax, [0x1400c8f32]
cmp r14, rax
je 0x1400080da
mov rcx, r14
call fcn.14000eccc
mov r15, qword [rbp - 0x78]
jmp 0x1400080e5
mov edi, 0x80070057
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r13, qword [rsp + 0x68]
xor r12d, r12d
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x140008115
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
js 0x1400082aa
mov r11, qword [rsp + 0x78]
mov rsi, r12
mov rdx, r12
lea r14, [r11 + 0x40]
test r14, r14
je 0x140008135
mov rdx, qword [r14 + 0x10]
mov rcx, rdx
mov rax, rdx
test r14, r14
je 0x1400081ca
mov r15d, dword [rsp + 0x34]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov r11d, dword [rsp + 0x30]
cmp rcx, r14
je 0x1400081be
mov rcx, rax
mov dword [rsp + 0x30], r11d
mov eax, dword [rsp + 0x74]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x34], r15d
sub eax, dword [rcx + 0x24]
mov qword [rsp + 0x38], r12
test eax, eax
jle 0x1400081be
mov dword [rsp + 0x30], r11d
mov rsi, rcx
mov qword [rsp + 0x60], rbx
mov rax, rcx
mov dword [rsp + 0x34], r15d
mov qword [rsp + 0x38], r12
test rdx, rdx
je 0x140008158
mov rdx, qword [rdx + 0x10]
mov rcx, rdx
mov dword [rsp + 0x30], r11d
mov rax, rdx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x34], r15d
mov qword [rsp + 0x38], r12
jmp 0x140008158
mov rbx, qword [rbp - 0x70]
xor r12d, r12d
mov r11, qword [rsp + 0x78]
mov r9, qword [rsp + 0x58]
mov r8, qword [r9 + 0x10]
test r8, r8
je 0x14000823d
mov rdx, qword [r9 + 0x18]
test rdx, rdx
je 0x14000823d
test rsi, rsi
je 0x1400081fe
mov rcx, rsi
call fcn.1400438f8
test eax, eax
js 0x1400081fe
mov rdx, r9
call fcn.140043914
mov edi, eax
jmp 0x140008242
cmp r8, r9
je 0x140008220
cmp rdx, r9
je 0x140008220
mov qword [r8 + 0x18], rdx
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 0x10]
mov qword [rcx + 0x10], rax
mov qword [r9 + 0x10], r9
mov qword [r9 + 0x18], r9
mov rax, qword [r14 + 0x10]
mov edi, r12d
mov qword [rax + 0x18], r9
mov rax, qword [r14 + 0x10]
mov qword [r9 + 0x10], rax
mov qword [r9 + 0x18], r14
mov qword [r14 + 0x10], r9
jmp 0x140008242
mov edi, 0x80004005
test edi, edi
js 0x1400082aa
inc dword [r13 + 0x24]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140008279
cmp dword [rcx + 0x24], 0
jne 0x140008279
dec dword [r11 + 0x30]
mov rax, qword [rcx]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, 1
call qword [0x1400a83f0]
mov r15d, dword [rsp + 0x30]
xor eax, eax
mov r14d, r12d
mov esi, eax
lea r12d, [rax + 1]
jmp 0x1400082c9
mov r15d, r12d
mov rsi, r9
mov r12d, dword [rsp + 0x70]
jmp 0x1400082c9
mov rsi, r12
mov r15d, r12d
mov r12d, dword [rsp + 0x70]
mov edi, 0x8007000e
jmp 0x1400082c9
mov r14d, dword [rsp + 0x34]
mov rsi, qword [rsp + 0x58]
mov r15d, r12d
mov r12d, dword [rsp + 0x70]
jmp 0x1400082c9
mov edi, 0x80070057
mov r15d, r12d
mov rsi, r12
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400082e2
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x1400082ee
mov dword [rax], r12d
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400082fa
mov dword [rax], r15d
test r14d, r14d
je 0x14000833c
mov rax, qword [rsp + 0x78]
dec dword [rax + 0x30]
test r13, r13
je 0x14000833c
mov rax, qword [r13]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov r14d, 1
mov edx, r14d
mov rcx, r13
call qword [0x1400a83f0]
jmp 0x140008342
mov rsi, rdi
mov r15d, edi
mov r12d, edi
jmp 0x1400082c9
mov r14d, 1
test rsi, rsi
je 0x140008363
mov rax, qword [rsi]
movabs r10, 0xda74867c1459e070
mov rax, qword [rax]
mov edx, r14d
mov rcx, rsi
call qword [0x1400a83f0]
test edi, edi
jns 0x140008398
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140008398
test byte [rcx + 0x44], 0x20
je 0x140008398
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aab50]
mov edx, 0xc
mov r9d, edi
call fcn.14001c23c
add dword [rbx + 0x2c], 0xffffffff
mov eax, dword [rbx + 0x2c]
jne 0x1400083a6
xor eax, eax
mov dword [rbx + 0x28], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000f060
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret