Function at 0x140068970
Capabilities:
Compare security identifiers
Delete file
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14032b320]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x10], rcx
lea rcx, [0x140489988]
call fcn.14018e0c0
test rax, rax
je 0x140069c46
mov r9d, 0xa
lea r8, vtable.CVolCommonBaseWithMemManager.0
mov edx, 0x1f6
lea rcx, [0x140489950]
mov rax, qword [0x140489950]
call qword [rax + 0x30]
lea rax, [0x14003c120]
mov qword [rsp + 0x38], rax
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, str.EX_Timer
call fcn.1401a1b10
lea rax, [0x1400357f0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x18
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, str.VolPainter
call fcn.1401a1b10
lea rax, [0x140010670]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, [0x1402adf48]
call fcn.1401a1b10
lea rax, [0x140048970]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, [0x1402b1700]
call fcn.1401a1b10
lea rax, [0x14004aab0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, [0x1402b1780]
call fcn.1401a1b10
lea rax, [0x14004a2c0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, [0x1402b1798]
call fcn.1401a1b10
lea rax, [0x14004b080]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, str.ibU_
call fcn.1401a1b10
lea rax, [0x1400490c0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov edx, 0x10000000
lea r9d, [rdi + 5]
mov r8d, 0x18000000
lea rcx, [0x1402b17b0]
call fcn.1401a1b10
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
test rax, rax
je 0x140068cb7
lea r8, [rbp + 0x28]
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140068cae
mov dword [rbp + 0x168], edi
mov word [rbp + 0x16c], 0x500
lea rax, [rbp + 0x20]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x220
lea r8d, [rdi + 0x20]
mov dl, 2
lea rcx, [rbp + 0x168]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140068ca4
mov dword [rbp + 0x18], edi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp + 0x18]
call fcn.140251c14
mov rsi, rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x18]
mov r8, rsi
lea edx, [rdi + 2]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, edi
cmp dword [rsi], edi
jbe 0x140068c92
nop word [rax + rax]
mov edi, ebx
add rdi, rdi
mov rdx, qword [rsi + rdi*8 + 8]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140068c80
inc ebx
cmp ebx, dword [rsi]
jb 0x140068c60
jmp 0x140068c90
mov r14d, dword [rsi + rdi*8 + 0x10]
shr r14d, 4
not r14d
and r14d, 1
xor edi, edi
mov rcx, rsi
call fcn.140247bf8
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
jne 0x140068ce7
lea rcx, [rbp + 0x90]
call fcn.14005e4c0
nop
mov rcx, rax
call fcn.14005d570
nop
lea rcx, [rbp + 0x90]
call fcn.14000aee0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r14, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x30], r14
lea rsi, vtable.CVolObject.0
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rdi
lea r13, vtable.CWString.0
mov qword [rbp + 0x30], r13
lea rax, [rbp + 0x50]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
lea r15, vtable.CVolMem.0
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], 0x40
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x80], 0xfe
lea rcx, [rbp - 0x48]
call fcn.1400869a0
mov rbx, rax
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx + 0x88]
lea r12, [fcn.140008770]
cmp rax, r12
je 0x140068d82
lea rcx, [rbp + 0x30]
call rax
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x38], rcx
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax + 0x88]
cmp rdx, r12
je 0x140068db0
lea rcx, [rbp + 0x50]
call rdx
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x50]
call fcn.14000b740
nop
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], r13
lea rax, [rbp - 0x80]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x50], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x60], rax
lea rax, str.WindowsApps
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x110]
call fcn.1400869a0
mov r13, rax
mov rbx, qword [rsp + 0x78]
test rbx, rbx
jne 0x140068e64
lea rbx, [0x1402ac8c0]
cmp qword [rbp - 0x58], 0
cmovne rbx, qword [rbp - 0x68]
mov r15, qword [rax + 0x18]
lea r12, [rax + 0x48]
test r15, r15
je 0x140068e8d
mov rsi, r15
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [r15 + rdi*2], 0
jne 0x140068e80
jmp 0x140068ecd
cmp qword [rax + 0x48], 0
jne 0x140068ebf
lea rsi, [0x1402ac8c0]
test rbx, rbx
je 0x140068fb8
cmp word [rbx], 0
je 0x140068fb8
test rdi, rdi
jne 0x140068ee1
lea rsi, [rdi - 1]
xor r15d, r15d
jmp 0x140068fbe
mov rsi, qword [rax + 0x38]
mov rdi, qword [rax + 0x48]
shr rdi, 1
dec rdi
test rdi, rdi
jns 0x140068e9b
mov rsi, 0xffffffffffffffff
xor r15d, r15d
jmp 0x140068fbe
mov r11, 0xffffffffffffffff
nop dword [rax + rax]
inc r11
cmp word [rbx + r11*2], 0
jne 0x140068ef0
test r11, r11
jns 0x140068f1e
mov r11, 0xffffffffffffffff
nop word [rax + rax]
inc r11
cmp word [rbx + r11*2], 0
jne 0x140068f10
test r11, r11
jle 0x140068ed2
sub rdi, r11
inc rdi
test rdi, rdi
jle 0x140068ed2
xor r14d, r14d
sub rbx, rsi
mov r9, rsi
xor r10d, r10d
cmp r10, r11
je 0x140068f8e
movzx ecx, word [r9]
movzx r8d, word [r9 + rbx]
lea eax, [rcx - 0x61]
lea edx, [rcx - 0x20]
cmp ax, 0x19
cmova dx, cx
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp ax, 0x19
cmova cx, r8w
cmp dx, cx
jne 0x140068f72
inc r10
add r9, 2
jmp 0x140068f37
inc r14
add rsi, 2
sub rbx, 2
cmp r14, rdi
jl 0x140068f31
mov rsi, 0xffffffffffffffff
xor r15d, r15d
jmp 0x140068fbe
test rsi, rsi
je 0x140068ed2
test r15, r15
jne 0x140068fad
cmp qword [r12], r15
lea r15, [0x1402ac8c0]
je 0x140068fad
mov r15, qword [r13 + 0x38]
sub rsi, r15
sar rsi, 1
xor r15d, r15d
jmp 0x140068fbe
xor r15d, r15d
mov esi, r15d
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
lea r14, vtable.CVolObject.0
mov qword [rbp + 0x110], r14
lea rax, [rbp - 0x80]
mov qword [rbp + 0x20], rax
lea r13, vtable.CVolMem.0
mov qword [rbp - 0x80], r13
lea rcx, [fcn.14018de50]
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x14006901e
mov rax, qword [rbp - 0x80]
mov r8, qword [rax + 0x18]
cmp r8, rcx
jne 0x140069017
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x14006901e
lea rcx, [rbp - 0x80]
call r8
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x60], r14
mov rdi, qword [rbp + 0x10]
cmp esi, 0xffffffff
je 0x140069046
mov dword [rdi + 0x8c25c], 1
lea rsi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
lea rcx, vtable.CWString.0
mov qword [rbp - 0x48], rcx
lea rax, [rbp - 0x28]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp + 8], 0x40
mov qword [rbp - 0x30], r15
mov qword [rbp + 8], 0xfe
lea rdx, vtable.CWConstString.0
mov qword [rbp - 0x48], rdx
lea rax, [0x1402b2890]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x60], rcx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x50], 0xfe
mov qword [rsp + 0x60], rdx
lea r12, [0x1402ac8c0]
mov qword [rsp + 0x78], r12
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x60]
call fcn.140062500
mov rbx, rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x140069170
mov rax, qword [rbp - 0x80]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x140069169
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069170
lea rcx, [rbp - 0x80]
call r8
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x60], r14
lea rax, [rbp - 0x28]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x28], r13
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1400691c3
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x1400691bc
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x1400691c3
lea rcx, [rbp - 0x28]
call r8
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x48], r14
test rbx, rbx
je 0x140069204
mov rcx, rbx
call fcn.14005d8b0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x1400691fb
mov ecx, eax
call fcn.14005d860
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea rcx, vtable.CWString.0
mov qword [rsp + 0x60], rcx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x50], 0xfe
lea rdx, vtable.CWConstString.0
mov qword [rsp + 0x60], rdx
lea rax, [0x1402b2930]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x48], rcx
lea rax, [rbp - 0x28]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp + 8], 0x40
mov qword [rbp - 0x30], r15
mov qword [rbp + 8], 0xfe
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x30], r12
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140062500
mov rbx, rax
lea rax, [rbp - 0x28]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x28], r13
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140069320
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x140069319
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069320
lea rcx, [rbp - 0x28]
call r8
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x48], r14
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x140069372
mov rax, qword [rbp - 0x80]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x14006936b
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069372
lea rcx, [rbp - 0x80]
call r8
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x60], r14
test rbx, rbx
je 0x1400693b4
mov rcx, rbx
call fcn.14005d8b0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x1400693ab
mov ecx, eax
call fcn.14005d860
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea rcx, vtable.CWString.0
mov qword [rsp + 0x60], rcx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x50], 0xfe
lea rdx, vtable.CWConstString.0
mov qword [rsp + 0x60], rdx
lea rax, [0x1402b2918]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x48], rcx
lea rax, [rbp - 0x28]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp + 8], 0x40
mov qword [rbp - 0x30], r15
mov qword [rbp + 8], 0xfe
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x30], r12
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140062500
mov rbx, rax
lea rax, [rbp - 0x28]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x28], r13
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1400694d0
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x1400694c9
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x1400694d0
lea rcx, [rbp - 0x28]
call r8
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x48], r14
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x140069522
mov rax, qword [rbp - 0x80]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14018de50]
cmp r8, rax
jne 0x14006951b
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069522
lea rcx, [rbp - 0x80]
call r8
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x60], r14
test rbx, rbx
je 0x140069564
mov rcx, rbx
call fcn.14005d8b0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x14006955b
mov ecx, eax
call fcn.14005d860
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea rcx, vtable.CWString.0
mov qword [rsp + 0x60], rcx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x50], 0xfe
lea rdx, vtable.CWConstString.0
mov qword [rsp + 0x60], rdx
lea rax, [0x1402b2908]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x48], rcx
lea rax, [rbp - 0x28]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp + 8], 0x40
mov qword [rbp - 0x30], r15
mov qword [rbp + 8], 0xfe
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x30], r12
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140062500
mov rbx, rax
lea rax, [rbp - 0x28]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x28], r13
mov rdx, qword [rbp - 0x10]
lea rsi, [fcn.14018de50]
test rdx, rdx
je 0x140069680
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x18]
cmp r8, rsi
jne 0x140069679
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069680
lea rcx, [rbp - 0x28]
call r8
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x48], r14
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x1400696cb
mov rax, qword [rbp - 0x80]
mov r8, qword [rax + 0x18]
cmp r8, rsi
jne 0x1400696c4
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x1400696cb
lea rcx, [rbp - 0x80]
call r8
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x60], r14
test rbx, rbx
je 0x14006970d
mov rcx, rbx
call fcn.14005d8b0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x140069704
mov ecx, eax
call fcn.14005d860
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x48]
call fcn.1400932e0
nop
lea r8, [0x1402b28f8]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140069744
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x140069744
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
mov qword [rbp + 0x110], r14
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], r14
call fcn.14008cae0
lea rcx, [rbp + 0x90]
call fcn.1400932e0
nop
lea r8, str.RestartExplorer.vbs
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400697aa
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x1400697aa
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp - 0x80]
call fcn.14000bbb0
nop
mov qword [rsp + 0x60], r14
lea rcx, [rbp + 0xb0]
call fcn.14000bbb0
nop
mov qword [rbp + 0x90], r14
lea rcx, [rbp - 0x48]
call fcn.1400932e0
nop
lea r8, [0x1402b2990]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14006980b
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x14006980b
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
mov qword [rbp + 0x110], r14
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], r14
lea rcx, [rsp + 0x60]
call fcn.1400932e0
nop
lea r8, [0x1402b2970]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14006986c
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x14006986c
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0xb0]
call fcn.14000bbb0
nop
mov qword [rbp + 0x90], r14
lea rcx, [rbp - 0x80]
call fcn.14000bbb0
nop
mov qword [rsp + 0x60], r14
lea rcx, [rbp - 0x48]
call fcn.1400932e0
nop
lea r8, [0x1402b2950]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400698cd
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x1400698cd
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
mov qword [rbp + 0x110], r14
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], r14
lea rcx, [rsp + 0x60]
call fcn.1400932e0
nop
lea r8, [0x1402b2a30]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14006992e
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x14006992e
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0xb0]
call fcn.14000bbb0
nop
mov qword [rbp + 0x90], r14
lea rcx, [rbp - 0x80]
call fcn.14000bbb0
nop
mov qword [rsp + 0x60], r14
lea rcx, [rbp - 0x48]
call fcn.1400932e0
nop
lea r8, [0x1402b2a10]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14006998f
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x14006998f
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
mov qword [rbp + 0x110], r14
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], r14
lea rcx, [rsp + 0x60]
call fcn.1400932e0
nop
lea r8, [0x1402b29f0]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400699f0
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x1400699f0
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0xb0]
call fcn.14000bbb0
nop
mov qword [rbp + 0x90], r14
lea rcx, [rbp - 0x80]
call fcn.14000bbb0
nop
mov qword [rsp + 0x60], r14
lea rcx, [rbp - 0x48]
call fcn.1400932e0
nop
lea r8, [0x1402b29d0]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140069a51
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x140069a51
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x130]
call fcn.14000bbb0
nop
mov qword [rbp + 0x110], r14
lea rcx, [rbp - 0x28]
call fcn.14000bbb0
nop
mov qword [rbp - 0x48], r14
lea rcx, [rsp + 0x60]
call fcn.1400932e0
nop
lea r8, str.ResourcemonitoringCtrip.exe
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14019a090
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140069ab2
cmp qword [rax + 0x48], rcx
mov rcx, r12
je 0x140069ab2
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0xb0]
call fcn.14000bbb0
nop
mov qword [rbp + 0x90], r14
lea rcx, [rbp - 0x80]
call fcn.14000bbb0
nop
mov qword [rsp + 0x60], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x502
call fcn.1401ac480
test eax, eax
je 0x140069bfb
movss xmm0, dword [0x1402c7c68]
call fcn.1401ad020
divss xmm0, dword [0x1402c7c68]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x1402c7ff0]
xor edx, edx
call fcn.140191d20
cvttsd2si ecx, xmm0
call fcn.1401ad760
lea rcx, [rdi + 0xa400]
mov rax, qword [rcx + 0x18]
or dword [rax + 0x80], 0x20000
mov qword [rbp + 0x90], r15
movdqa xmm0, xmmword [0x1402c80f0]
movdqa xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], r15d
mov dword [rbp + 0xb4], 0xffffffff
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], r15
mov dword [rbp + 0x108], 1
mov dword [rbp + 0x10c], 1
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
call qword [rax + 0x130]
call fcn.1401b7740
call fcn.1401ad1f0
nop
lea rax, [rbp + 0x50]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x140069c32
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + 0x18]
cmp r8, rsi
jne 0x140069c2b
lea rcx, [0x140489958]
call fcn.140196cd0
jmp 0x140069c32
lea rcx, [rbp + 0x50]
call r8
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x30], r14
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14023ba10
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret