Function at 0x14013d410
Capabilities:
Compress data via winapi
Get common file path
Log keystrokes via polling
Print debug messages
Switch active desktop

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe70]
sub rsp, 0xf70
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0xe40], rax
mov rbx, r8
call fcn.140147c40
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, r15d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.1402bc184
xor esi, esi
mov qword [rbp + 0x68], rsi
call fcn.140111f80
mov qword [rbp - 0x30], rsi
xorps xmm0, xmm0
movzx r14d, al
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0xc8], rsi
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x100], rax
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov dword [rbp + 0x120], esi
mov qword [rbp + 0x108], rax
or rax, 0xffffffffffffffff
lea r12, [0x140346ce0]
test rbx, rbx
jne 0x14013d4d0
mov edi, esi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], r12
jmp 0x14013d511
mov rdi, rax
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013d4d3
mov qword [rsp + 0x78], rsi
test edi, edi
jne 0x14013d4ec
mov qword [rsp + 0x70], r12
jmp 0x14013d511
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1401fcb40
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402ba94c
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1401fde50
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.1401135c0
cmp dword [rsp + 0x78], esi
jle 0x14013d53e
mov rcx, qword [rsp + 0x70]
call fcn.1402b7350
lea rbx, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
test r14b, r14b
je 0x14013d62d
mov ecx, 0x18
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x14013d574
mov qword [rax], rbx
lea rax, [rbp + 0x100]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 8], rax
jmp 0x14013d577
mov rdi, rsi
mov rbx, rsi
test rdi, rdi
je 0x14013d59b
mov ecx, 4
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x14013d595
mov dword [rax], esi
jmp 0x14013d598
mov rbx, rsi
mov dword [rbx], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
je 0x14013d60a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, str._crusader
xor r8d, r8d
mov rcx, rax
mov r14, rax
call fcn.1401ff2c0
test al, al
jne 0x14013d60a
lea rdx, str._kickstart
xor r8d, r8d
mov rcx, r14
call fcn.1401fce20
test al, al
je 0x14013d5fe
call fcn.140112080
test al, al
jne 0x14013d60a
call fcn.140112150
test al, al
jne 0x14013d60a
call fcn.14013ced0
test al, al
jne 0x14013d756
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test al, al
jne 0x14013d5a7
test rbx, rbx
je 0x14013d62d
mov eax, dword [rbx]
test eax, eax
jle 0x14013d619
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x14013d62d
mov rcx, rdi
call fcn.1402150f0
mov rcx, rbx
call fcn.1402150f0
mov qword [rsp + 0xfa0], r13
call fcn.14013c9c0
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, esi
lea rdi, [0x140417388]
mov r14, rax
mov edx, dword [rdi - 8]
mov rcx, r14
call fcn.140146fb0
mov rcx, qword [rdi]
inc ebx
mov qword [rcx], rax
movsxd rcx, ebx
lea rdi, [rdi + 0x10]
cmp rcx, 0xa
jb 0x14013d653
mov rcx, r14
call fcn.1401471e0
lea rcx, [0x140428cc8]
mov dword [0x140428bac], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea rdi, [0x140428cf0]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14013d6c7
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140428d58], rax
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [0x140416ee8]
xor r14b, r14b
shr eax, 0xf
mov byte [rsp + 0x41], sil
mov byte [rsp + 0x40], sil
and al, r15b
mov byte [rsp + 0x45], r15b
mov byte [rsp + 0x4f], sil
mov byte [rsp + 0x43], sil
mov byte [rsp + 0x4e], sil
mov byte [rsp + 0x49], sil
mov dword [rbp - 0x80], eax
mov byte [rsp + 0x50], sil
mov byte [rsp + 0x4b], sil
mov byte [rsp + 0x4d], sil
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x4a], r15b
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x42], r15b
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x47], sil
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], esi
mov r13d, esi
test rbx, rbx
jne 0x14013d786
mov edi, esi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], r12
jmp 0x14013d7c9
test rbx, rbx
je 0x14013f83f
mov eax, dword [rbx]
test eax, eax
jle 0x14013d769
dec eax
mov dword [rbx], eax
cmp dword [rbx], esi
jne 0x14013f83f
mov rcx, rdi
call fcn.1402150f0
mov rcx, rbx
call fcn.1402150f0
jmp 0x14013f83f
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013d790
mov qword [rbp - 0x48], rsi
test edi, edi
jne 0x14013d7a7
mov qword [rbp - 0x50], r12
jmp 0x14013d7c9
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1401fcb40
mov eax, dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402ba94c
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.1401fde50
mov rbx, qword [0x140416ee8]
test rbx, rbx
jne 0x14013d7ec
mov edi, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
jmp 0x14013d829
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14013d7f0
mov qword [rbp - 0x20], rsi
test edi, edi
jne 0x14013d807
mov qword [rbp - 0x28], r12
jmp 0x14013d829
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.1401fcb40
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
inc eax
movsxd r9, edi
mov r8, rbx
movsxd rdx, eax
call fcn.1402ba94c
lea rcx, [rbp - 0x28]
mov edx, edi
call fcn.1401fde50
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
call fcn.14000a340
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x38], rax
call fcn.14000a340
mov ecx, 0x18
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x90], rsi
call fcn.1402b6dbc
mov r12, rax
test rax, rax
je 0x14013d8a2
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [r12 + 0x10], rsi
mov qword [r12], rax
lea rax, [rbp + 0x100]
mov qword [r12 + 8], rax
jmp 0x14013d8a5
mov r12, rsi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0xe8], rax
test r12, r12
je 0x14013d8e6
mov ecx, 4
call fcn.1402b6dbc
test rax, rax
je 0x14013d8d9
mov dword [rax], esi
jmp 0x14013d8dc
mov rax, rsi
mov qword [rbp + 0xf8], rax
mov dword [rax], r15d
mov rax, qword [r12]
mov rcx, r12
movaps xmmword [rsp + 0xf60], xmm6
movaps xmmword [rsp + 0xf50], xmm7
call qword [rax]
test al, al
je 0x14013e708
movsd xmm7, qword [0x140371fc8]
mov rax, qword [r12]
mov rcx, r12
mov edi, 2
call qword [rax + 0x10]
lea rdx, str._kickstart
mov r8d, r15d
mov rcx, rax
mov rbx, rax
call fcn.1401fce20
test al, al
je 0x14013da5b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x10000000
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rcx, rax
mov qword [rbp + 0xc8], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, 0xe0
call fcn.1402b6dbc
mov rbx, rax
mov qword [rbp + 0x68], rax
test rax, rax
je 0x14013d9aa
mov rcx, rax
call fcn.1402097f0
lea rax, vtable.HitmanPro35::UI::KickstartDesktop.0
mov qword [rcx + 0xc0], rsi
mov qword [rcx], rax
mov qword [rcx + 0xc8], rsi
call fcn.1401329b0
jmp 0x14013d9ae
mov qword [rbp + 0x68], rsi
lea rcx, [0x140352218]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov rcx, rax
mov qword [0x140428c90], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov qword [rsp + 0x30], rsi
lea rcx, str..hmpkick
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14013da49
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x22e260
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140428c90]
call qword [sym.imp.USER32.dll_SwitchDesktop]
jmp 0x14013e6f7
lea rdx, str._debug
mov r8d, r15d
mov rcx, rbx
call fcn.1401ff2c0
mov r8d, r15d
mov rcx, rbx
test al, al
je 0x14013dab9
lea rdx, str.:full
call fcn.1401fc9f0
mov ecx, dword [0x140428b84]
test al, al
cmovne ecx, edi
mov dword [0x140428b84], ecx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x14013c6f0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp 0x14013e6f7
lea rdx, str._console
call fcn.1401fce20
test al, al
je 0x14013db0a
test r14b, r14b
jne 0x14013e6f7
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x14013e6f7
call fcn.1402b8600
lea r8, [0x140352f08]
lea rdx, [0x140352f28]
lea r9, [rax + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1402bc12c
movzx r14d, r15b
jmp 0x14013e6f7
lea rdx, str._crusader
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f562
lea rdx, str._crusader:boot
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f536
lea rdx, str._installservice
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f525
lea rdx, str._uninstallservice
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f516
lea rdx, str._listen
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f4b2
lea rdx, [0x14034f170]
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f49c
lea rdx, str._deactivate
mov r8d, r15d
mov rcx, rbx
call fcn.1401fce20
test al, al
jne 0x14013f481
lea rdx, str._update:
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
jne 0x14013f404
lea rdx, str._updated:
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013dc75
lea rdx, [rbp + 0xa8]
mov r8d, 9
call fcn.1401feab0
lea rcx, [rbp + 0xa8]
xor edx, edx
call fcn.1401fb010
cmp ax, 0x22
jne 0x14013dc58
lea rcx, [rbp + 0xa8]
call fcn.1401fde40
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0xa8]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rbp + 0xa8]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x1b8]
call fcn.140005eb0
lea rcx, [rbp + 0xa8]
call fcn.140107690
lea rcx, [rbp + 0xa8]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._upgraded:
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013dd10
lea rdx, [rbp + 0x98]
mov r8d, 0xa
call fcn.1401feab0
lea rcx, [rbp + 0x98]
xor edx, edx
call fcn.1401fb010
cmp ax, 0x22
jne 0x14013dcf3
lea rcx, [rbp + 0x98]
call fcn.1401fde40
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x98]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rbp + 0x98]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x1c8]
call fcn.140005eb0
lea rcx, [rbp + 0x98]
call fcn.1401094e0
lea rcx, [rbp + 0x98]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._xtdl
call fcn.1401fce10
test al, al
jne 0x14013f3fa
lea rdx, str._miniport
mov rcx, rbx
call fcn.1401fce10
test al, al
jne 0x14013f361
lea rdx, str._rfs
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
jne 0x14013f336
lea rdx, str._sr
call fcn.1401ff2b0
test al, al
jne 0x14013f294
lea rdx, str._lcn
mov rcx, rbx
call fcn.1401ff2b0
test al, al
je 0x14013ddbe
test r14b, r14b
jne 0x14013dd8a
call fcn.14013c5d0
movzx r14d, al
lea rdx, [rsp + 0x60]
mov r8d, 5
mov rcx, rbx
call fcn.1401feab0
lea rcx, [rsp + 0x60]
call fcn.1401fde40
lea rcx, [rsp + 0x60]
test eax, eax
jg 0x14013e8a0
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._write
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013f102
lea rdx, str._clone
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013ee99
lea rdx, str._swap
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013ecd9
lea rdx, str._overwrite
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013eab2
lea rdx, str._protectmbr
mov rcx, rbx
call fcn.1401fce10
test al, al
jne 0x14013eaa8
lea rdx, str._lic
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013de76
lea rdx, [rbp + 0x168]
mov r8d, 5
call fcn.1401feab0
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x168]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._renew
call fcn.1401fce10
test al, al
je 0x14013de90
call fcn.140176c80
jmp 0x14013e6f7
lea rdx, str._checklic
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013e97d
lea rdx, str._scan
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013dec4
mov byte [rsp + 0x40], r15b
jmp 0x14013e6f7
lea rdx, str._scan:boot
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013dfe1
mov byte [rbp - 0x80], sil
call fcn.140111e90
test al, al
je 0x14013e948
xor ecx, ecx
mov byte [rsp + 0x40], r15b
call fcn.1400f1cf0
mov rbx, rax
test rax, rax
je 0x14013dfd2
lea rcx, [rbp - 0x60]
call fcn.1401faa60
lea r8, [rbp - 0x60]
lea rdx, [0x14034ea30]
mov rcx, rbx
call fcn.1400d8ae0
mov rdi, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rdi]
lea rcx, [rbp + 0x70]
call fcn.1400ce7d0
lea rcx, [rbp - 0x60]
call fcn.1401fde40
cmp eax, 0x13
jl 0x14013dfc0
lea rdx, str.yyyy_MM_dd_HH:mm:ss
lea rcx, [rbp + 0x148]
call fcn.1401faae0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x148]
lea rcx, [rbp - 0x60]
xor r9d, r9d
call fcn.1400ea350
lea rcx, [rbp + 0x148]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013dfc0
lea rcx, [rbp - 8]
call fcn.1400cafe0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x198]
mov rcx, rax
call fcn.1400cb050
mov rcx, rax
call fcn.1400e3f10
lea rcx, [rbp + 0x198]
movaps xmm6, xmm0
call fcn.1400cae80
comisd xmm7, xmm6
ja 0x14013e931
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
call fcn.140113e30
call fcn.140113c80
jmp 0x14013e6f7
lea rdx, str._installsophos
mov rcx, rbx
call fcn.1401fce10
test al, al
jne 0x14013e970
lea rdx, str._uninstallsophos
mov rcx, rbx
call fcn.1401fce10
test al, al
jne 0x14013e963
lea rdx, str._sophos
mov rcx, rbx
call fcn.1401fce10
test al, al
jne 0x14013e959
lea rdx, str._quiet
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e043
mov byte [rsp + 0x41], r15b
jmp 0x14013e6f7
lea rdx, str._noscan
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e060
mov byte [rsp + 0x4b], r15b
jmp 0x14013e6f7
lea rdx, str._noinstall
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e07d
mov byte [rsp + 0x43], r15b
jmp 0x14013e6f7
lea rdx, str._nostartboot
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e09a
mov byte [rsp + 0x4e], r15b
jmp 0x14013e6f7
lea rdx, str._nodesktopshortcut
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e0b7
mov byte [rsp + 0x49], r15b
jmp 0x14013e6f7
lea rdx, str._nostartmenushortcut
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e0d4
mov byte [rsp + 0x50], r15b
jmp 0x14013e6f7
lea rdx, str._noupdate
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e0f1
mov byte [rsp + 0x45], sil
jmp 0x14013e6f7
lea rdx, str._noupload
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e10e
mov byte [rsp + 0x48], sil
jmp 0x14013e6f7
lea rdx, str._noremnants
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e12b
mov byte [rsp + 0x4a], sil
jmp 0x14013e6f7
lea rdx, str._nocookies
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e148
mov byte [rsp + 0x4c], sil
jmp 0x14013e6f7
lea rdx, str._nopups
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e165
mov byte [rsp + 0x42], sil
jmp 0x14013e6f7
lea rdx, str._pup
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e1ea
lea rdx, [rbp + 0x58]
mov r8d, 5
call fcn.1401feab0
lea rdx, [0x140353a40]
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401fce20
test al, al
je 0x14013e1b7
lea rcx, [rbp + 0x58]
mov dword [rsp + 0x58], 4
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str.ignore
lea rcx, [rbp + 0x58]
xor r8d, r8d
call fcn.1401fce20
mov edi, dword [rsp + 0x58]
lea rcx, [rbp + 0x58]
test al, al
mov eax, 8
cmovne edi, eax
mov dword [rsp + 0x58], edi
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._scanonly
call fcn.1401fce10
test al, al
je 0x14013e213
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x41], r15b
mov byte [rsp + 0x43], r15b
mov byte [rsp + 0x44], r15b
jmp 0x14013e6f7
lea rdx, str._clean
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e23a
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x4f], r15b
mov byte [rsp + 0x45], sil
jmp 0x14013e6f7
lea rdx, str._ews
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e257
mov byte [rsp + 0x46], r15b
jmp 0x14013e6f7
lea rdx, str._quick
mov rcx, rbx
call fcn.1401fce10
test al, al
je 0x14013e274
mov byte [rsp + 0x47], r15b
jmp 0x14013e6f7
lea rdx, str._log
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e35a
lea rdx, [rbp + 0x158]
mov r8d, 5
call fcn.1401feab0
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x158]
call fcn.140005eb0
lea rdx, [0x14034f2fc]
lea rcx, [rbp - 0x50]
call fcn.1401ff2b0
test al, al
je 0x14013e318
lea rdx, [0x14034f2fc]
lea rcx, [rbp - 0x50]
call fcn.1401fc9e0
test al, al
je 0x14013e318
lea rcx, [rbp - 0x50]
call fcn.1401fde40
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x50]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x1d8]
call fcn.140005eb0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x128]
call fcn.1400e3270
test r13d, r13d
jne 0x14013e349
lea rdx, str..txt
lea rcx, [rbp + 0x128]
xor r8d, r8d
call fcn.1401fce20
test al, al
cmovne r13d, edi
lea rcx, [rbp + 0x128]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._logtype
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e3cb
lea rdx, [rbp - 0x18]
mov r8d, 9
call fcn.1401feab0
lea rdx, [0x140353ad0]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401fce20
test al, al
je 0x14013e3a4
lea rcx, [rbp - 0x18]
mov r13d, edi
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, [0x14034bfb0]
lea rcx, [rbp - 0x18]
xor r8d, r8d
call fcn.1401fce20
lea rcx, [rbp - 0x18]
test al, al
cmovne r13d, r15d
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._nologs
call fcn.1401fce10
test al, al
je 0x14013e3e5
mov byte [rsp + 0x4d], r15b
jmp 0x14013e6f7
lea rdx, [0x140353ae8]
mov rcx, rbx
call fcn.1401ff2b0
test al, al
je 0x14013e401
mov byte [rbp - 0x80], r15b
jmp 0x14013e6f7
lea rdx, str._ecat
mov rcx, rbx
call fcn.1401ff2b0
test al, al
jne 0x14013e6f7
lea rdx, str._diskmode
mov rcx, rbx
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e475
lea rdx, [rbp + 0x138]
mov r8d, 0xa
call fcn.1401feab0
lea rdx, str.compatible
lea rcx, [rbp + 0x138]
xor r8d, r8d
call fcn.1401fce20
mov ecx, dword [rsp + 0x54]
test al, al
cmovne ecx, r15d
mov dword [rsp + 0x54], ecx
lea rcx, [rbp + 0x138]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._excludelist
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e519
lea rdx, [rbp + 0x48]
mov r8d, 0xd
call fcn.1401feab0
lea rdx, [0x14034f2fc]
lea rcx, [rbp + 0x48]
call fcn.1401ff2b0
test al, al
je 0x14013e4fb
lea rdx, [0x14034f2fc]
lea rcx, [rbp + 0x48]
call fcn.1401fc9e0
test al, al
je 0x14013e4fb
lea rcx, [rbp + 0x48]
call fcn.1401fde40
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x48]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rbp + 0x48]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x1a8]
call fcn.140005eb0
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
xor r8d, r8d
call fcn.14013cb00
lea rcx, [rbp + 0x48]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._filelist
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e5be
lea rdx, [rbp - 0x78]
mov r8d, 0xa
call fcn.1401feab0
lea rdx, [0x14034f2fc]
lea rcx, [rbp - 0x78]
call fcn.1401ff2b0
test al, al
je 0x14013e59f
lea rdx, [0x14034f2fc]
lea rcx, [rbp - 0x78]
call fcn.1401fc9e0
test al, al
je 0x14013e59f
lea rcx, [rbp - 0x78]
call fcn.1401fde40
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x78]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rbp - 0x78]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x178]
call fcn.140005eb0
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x78]
movzx r8d, r15b
call fcn.14013cb00
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, [0x140353b70]
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e603
lea rdx, [rbp + 0x188]
mov r8d, 7
call fcn.1401feab0
lea rcx, [rbp + 0xb8]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0x188]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, str._proxycred
call fcn.1401ff2b0
mov rcx, rbx
test al, al
je 0x14013e648
lea rdx, [rbp + 0xd8]
mov r8d, 0xb
call fcn.1401feab0
lea rcx, [rbp + 0x88]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, [0x14034cfc4]
call fcn.1401ff2b0
test al, al
jne 0x14013e6f7
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1401ff680
mov rcx, rax
call fcn.1401fde40
lea rcx, [rbp - 0x40]
test eax, eax
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013e6f7
lea rdx, [0x14034f2fc]
mov rcx, rbx
call fcn.1401ff2b0
test al, al
je 0x14013e6e4
lea rdx, [0x14034f2fc]
mov rcx, rbx
call fcn.1401fc9e0
test al, al
je 0x14013e6e4
mov rcx, rbx
call fcn.1401fde40
lea rdx, [rbp + 0x28]
mov r8d, r15d
lea r9d, [rax - 2]
mov rcx, rbx
call fcn.1401fed70
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x18]
call fcn.1400e7ec0
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x14013e6f7
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
mov r8, rbx
call fcn.1400e7ec0
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
test al, al
jne 0x14013d90f
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
jne 0x14013e721
cmp byte [rbp - 0x80], sil
je 0x14013e721
call fcn.140138480
call fcn.140107810
lea rcx, [rbp + 0x210]
call fcn.1400ed6f0
lea rcx, [rbp + 0x210]
movzx edx, r14b
call fcn.14013c510
mov rdi, qword [rbp + 0x68]
lea rcx, [rbp + 0x210]
mov rdx, rdi
call fcn.14013c520
lea rcx, [rbp + 0x88]
call fcn.1401fde40
test eax, eax
jle 0x14013e778
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x210]
call fcn.1400f0210
lea rcx, [rbp + 0xb8]
call fcn.1401fde40
test eax, eax
jle 0x14013e794
lea rcx, [rbp + 0xb8]
call fcn.14013d220
cmp byte [rsp + 0x45], sil
jne 0x14013e7a7
lea rcx, [rbp + 0x210]
call fcn.14013c500
movzx ebx, byte [rsp + 0x43]
test bl, bl
je 0x14013e7c0
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011c480
cmp byte [rsp + 0x4e], sil
je 0x14013e7d7
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011c490
cmp byte [rsp + 0x49], sil
je 0x14013e7ee
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011c4a0
cmp byte [rsp + 0x50], sil
je 0x14013e805
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.14011c4b0
movzx r12d, byte [rsp + 0x41]
test r12b, r12b
je 0x14013e81c
lea rcx, [rbp + 0x210]
call fcn.14013c540
lea rcx, [rbp - 0x50]
call fcn.1401fde40
test eax, eax
jle 0x14013e839
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x210]
call fcn.1400ff070
test r13d, r13d
je 0x14013e84d
lea rcx, [rbp + 0x210]
mov edx, r13d
call fcn.14013c5c0
cmp byte [rsp + 0x4d], sil
je 0x14013e860
lea rcx, [rbp + 0x210]
call fcn.14013c5b0
lea rcx, [rbp - 0x28]
call fcn.1401fde40
test eax, eax
jle 0x14013f5bb
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x210]
call fcn.140100660
lea rcx, [rbp + 0x210]
cmp eax, 0xffffffff
jne 0x14013f5a2
call fcn.1400eeb50
mov esi, 7
jmp 0x14013f7df
xor edx, edx
call fcn.1401fb010
xor r8d, r8d
movzx ecx, ax
call fcn.140184e30
mov rdi, rax
test rax, rax
je 0x14013e911
lea rcx, [rsp + 0x60]
call fcn.14012d8f0
lea rcx, str._s_r_n_t
mov rdx, rax
call fcn.1402b9694
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140188290
test al, al
jne 0x14013e8f6
lea rcx, str.Could_not_locate_file_r_n
call fcn.1402b7a88
jmp 0x14013e906
mov rdx, qword [rbp - 0x30]
lea rcx, str.LCN_I64u_r_n
call fcn.1402b7a88
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x14013f7df
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x60]
call fcn.140005eb0
jmp 0x14013f7df
lea rcx, str.Need_administrator_rights_r_n
call fcn.1402b7a88
jmp 0x14013f7df
call fcn.1401704b0
jmp 0x14013f7df
call fcn.140170cb0
movzx esi, al
jmp 0x14013f7df
call fcn.1401704f0
movzx esi, al
jmp 0x14013f7df
lea rcx, [rbp - 0x60]
call fcn.1401faa60
lea rcx, [rbp + 0x58]
call fcn.1401faa60
lea rcx, [rbp - 0x18]
call fcn.1401faa60
lea rcx, [rbp + 0x70]
call fcn.1400ce7d0
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.1401781a0
cmp eax, r15d
jne 0x14013e9f8
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x14013e9ea
mov edi, 2
jmp 0x14013e9f0
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x14013e9f8
neg edi
lea rcx, [rbp - 0x28]
call fcn.1401fde40
test eax, eax
jle 0x14013ea7d
test edi, edi
jle 0x14013ea1d
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
xor r8d, r8d
call fcn.1401fcf80
test al, al
jne 0x14013ea7d
lea rcx, [rbp - 0x28]
call fcn.140176fd0
lea rax, [rsp + 0x54]
lea r9, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x60]
mov edi, esi
mov qword [rsp + 0x20], rax
call fcn.1401781a0
cmp eax, r15d
jne 0x14013ea7d
mov eax, dword [rsp + 0x58]
test r15b, al
je 0x14013ea6f
mov edi, 2
jmp 0x14013ea75
test al, 2
cmovne edi, r15d
bt eax, 8
jae 0x14013ea7d
neg edi
lea rcx, [rbp + 0x70]
call fcn.1400caf50
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x58]
call fcn.140005eb0
lea rcx, [rbp - 0x60]
call fcn.140005eb0
mov esi, edi
jmp 0x14013f7df
call fcn.1401bb3c0
jmp 0x14013f7df
test r14b, r14b
jne 0x14013eabc
call fcn.14013c5d0
lea rcx, [rsp + 0x70]
call fcn.1401faa60
lea rcx, [rbp - 0x78]
call fcn.1401faa60
lea rcx, [rbp - 8]
call fcn.1400d29a0
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x21]
mov rcx, rbx
call fcn.1401feab0
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x70]
mov rcx, rax
movzx edx, di
call fcn.1401fe990
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013ec9b
lea rcx, [rsp + 0x70]
call fcn.1401fde40
test eax, eax
je 0x14013ec9b
lea rcx, [rbp - 0x78]
call fcn.1401fde40
test eax, eax
je 0x14013ec9b
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401fb010
lea rcx, [rsp + 0x70]
xor edx, edx
movzx edi, ax
call fcn.1401fb010
cmp ax, di
je 0x14013eb88
lea rcx, [rbp - 0x78]
call fcn.14012d8f0
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.14012d8f0
lea rcx, str.Files_must_be_on_the_same_drive_r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402b7a88
jmp 0x14013eca7
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x70]
call fcn.140206130
test al, al
jne 0x14013ebb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140353670]
mov edx, eax
call fcn.1402b7a88
jmp 0x14013eca7
call fcn.1400fe750
test rax, rax
jne 0x14013ebc9
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x14013eca2
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401fb010
movzx ecx, ax
movzx edi, ax
call fcn.1401bb660
mov r14, rax
test rax, rax
jne 0x14013ebfc
lea rcx, str.No_file_system_for_drive__c:_r_n
movzx edx, di
call fcn.1402b9694
jmp 0x14013eca7
mov rax, qword [rax]
mov rcx, r14
call qword [rax + 0x68]
test al, al
jne 0x14013ec1d
lea rcx, str.File_system__c:_does_not_support_overwrite_r_n
movzx edx, di
call fcn.1402b9694
jmp 0x14013eca7
lea rcx, [rbp - 0x78]
call fcn.14012d8f0
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.14012d8f0
lea rcx, str.Are_you_sure_you_want_to_overwrite__Y_N___r_nSource_ls_r_nTarget_ls_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402b7a88
call fcn.1402bc19c
add eax, 0xffffffa7
test eax, 0xffffffdf
jne 0x14013eca7
mov rbx, qword [r14]
lea rcx, [rbp - 8]
call fcn.1400d2a80
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2a90
lea rdx, [rbp - 0x78]
mov r9d, edi
mov rcx, r14
mov r8, rax
call qword [rbx + 0x70]
test al, al
jne 0x14013ec8d
lea rcx, str.Overwrite_failed__r_n
call fcn.1402b9694
jmp 0x14013eca7
lea rcx, str.Overwrite_successful_r_n
call fcn.1402b9694
jmp 0x14013eca7
lea rcx, str.Invalid_arguments_r_n
call fcn.1402b7a88
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rbp - 8]
call fcn.1400d2a40
lea rcx, [rbp - 0x78]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x14013f7df
test r14b, r14b
jne 0x14013ece3
call fcn.14013c5d0
lea rcx, [rbp - 0x78]
call fcn.1401faa60
lea rcx, [rsp + 0x60]
call fcn.1401faa60
mov edi, 0x2c
lea rdx, [rbp - 0x40]
lea r8d, [rdi - 0x26]
mov rcx, rbx
call fcn.1401feab0
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x78]
mov rcx, rax
movzx edx, di
call fcn.1401fe990
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
jne 0x14013ee64
lea rcx, [rbp - 0x78]
call fcn.1401fde40
test eax, eax
je 0x14013ee64
lea rcx, [rsp + 0x60]
call fcn.1401fde40
test eax, eax
je 0x14013ee64
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401fb010
lea rcx, [rbp - 0x78]
xor edx, edx
movzx edi, ax
call fcn.1401fb010
cmp ax, di
je 0x14013ed85
lea rcx, str.Files_must_be_on_the_same_drive_r_n
jmp 0x14013ee6b
call fcn.1400fe750
mov r14, rax
test rax, rax
jne 0x14013ed9e
lea rcx, str.Failed_to_deploy_driver_r_n
jmp 0x14013ee6b
lea rcx, [rbp - 0x78]
xor edx, edx
call fcn.1401fb010
movzx ecx, ax
call fcn.1401bb660
mov rbx, rax
test rax, rax
jne 0x14013edd8
lea rcx, str.Failed_to_open_File_System_r_n
call fcn.1402b7a88
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400febd0
jmp 0x14013ee70
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x38]
test al, al
jne 0x14013edee
lea rcx, str.File_System_cannot_swap_files_r_n
jmp 0x14013ee44
lea rcx, [rsp + 0x60]
call fcn.14012d8f0
lea rcx, [rbp - 0x78]
mov rdi, rax
call fcn.14012d8f0
lea rcx, str.Are_you_sure_you_want_to_swap__y_n__r_n_t_ws_r_n_t_ws_r_n
mov rdx, rax
mov r8, rdi
call fcn.1402b7a88
call fcn.1402bc19c
cmp eax, 0x79
jne 0x14013ee49
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x78]
mov rcx, rbx
call qword [rax + 0x40]
lea rcx, str.Successfully_swapped_files_r_n
test al, al
jne 0x14013ee44
lea rcx, str.Failed_to_swap_files_r_n
call fcn.1402b7a88
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400febd0
jmp 0x14013ee70
lea rcx, str.Invalid_arguments_r_n
call fcn.1402b7a88
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rsp + 0x60]
call fcn.140005eb0
lea rcx, [rbp - 0x78]
call fcn.140005eb0
jmp 0x14013f7df
test r14b, r14b
jne 0x14013eea3
call fcn.14013c5d0
lea rdx, [rsp + 0x70]
mov r8d, 7
mov rcx, rbx
call fcn.1401feab0
lea rdx, [0x14034f2fc]
lea rcx, [rsp + 0x70]
call fcn.1401ff2b0
test al, al
je 0x14013ef00
lea rcx, [rsp + 0x70]
call fcn.1401fde40
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1401fb010
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call fcn.1401f48e0
mov r13, rax
test rax, rax
je 0x14013f0e2
lea rcx, [rbp + 0x70]
call fcn.1400ce7d0
lea rcx, [rsp + 0x70]
call fcn.14012d8f0
lea rcx, [0x14034bad8]
mov rdx, rax
call fcn.1402b9694
mov rdi, qword [r13]
lea rax, [rsp + 0x46]
lea r9, [rbp + 0x70]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test al, al
jne 0x14013ef80
lea rcx, str.Failed_:__n
call fcn.1402b9694
jmp 0x14013f0d6
mov rdx, qword [rbp - 0x30]
lea rcx, str.Size_:__I64u_bytes_n
call fcn.1402b9694
mov rax, qword [r13]
lea rdx, [rsp + 0x70]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x14013f0d6
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400e32f0
lea rdx, str..clone
mov rcx, rax
call fcn.1401fb190
lea rcx, [rbp + 0x28]
mov rdx, rax
call fcn.1401faa80
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rbp + 0xd8]
call fcn.140208400
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x18]
mov rdx, rax
call fcn.1400d2ba0
lea rcx, [rbp + 0xd8]
call fcn.140005eb0
lea rcx, [rbp - 0x18]
call fcn.140205ec0
mov r14, rax
test rax, rax
je 0x14013f0b9
mov ecx, 0xa00000
call fcn.1402b2274
mov rdi, qword [rbx]
lea r9, [rsp + 0x54]
mov rdx, rax
mov r8d, 0xa00000
mov rcx, rbx
mov r12, rax
mov r15d, esi
call qword [rdi + 8]
test al, al
je 0x14013f07f
nop dword [rax + rax]
mov rdi, qword [r14]
mov r8d, dword [rsp + 0x54]
mov rdx, r12
mov rcx, r14
call qword [rdi + 0x48]
lea r9, [rsp + 0x54]
mov r8d, 0xa00000
add r15d, eax
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x14013f050
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
lea rcx, str.Wrote:__u_bytes_n
mov edx, r15d
call fcn.1402b9694
lea rcx, [rbp - 0x18]
call fcn.14012d8f0
lea rcx, str._n_____s_n
mov rdx, rax
call fcn.1402b9694
mov r15d, 1
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
lea rcx, [rbp - 0x18]
call fcn.140005eb0
lea rcx, [rbp + 0x28]
call fcn.140005eb0
mov rax, qword [r13]
mov edx, r15d
mov rcx, r13
call qword [rax]
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rsp + 0x70]
call fcn.140005eb0
jmp 0x14013f7df
lea rcx, [rsp + 0x60]
call fcn.1401faa60
lea rcx, [rbp - 0x60]
call fcn.1401faa60
lea rcx, [rbp - 8]
call fcn.1400d29a0
test r14b, r14b
jne 0x14013f128
call fcn.14013c5d0
mov edi, 0x2c
lea rdx, [rbp - 0x40]
mov rcx, rbx
lea r8d, [rdi - 0x25]
call fcn.1401feab0
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x60]
mov rcx, rax
movzx edx, di
call fcn.1401fe990
lea rcx, [rbp - 0x40]
test al, al
sete dil
call fcn.140005eb0
test dil, dil
je 0x14013f171
lea rcx, str.Invalid_argument_s__r_n
jmp 0x14013f269
lea rcx, [rsp + 0x60]
call fcn.1401fde40
test eax, eax
je 0x14013f262
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14013c450
test al, al
je 0x14013f262
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x60]
call fcn.140206130
test al, al
jne 0x14013f1c8
movaps xmm0, xmmword [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, str.Failed_to_read_file__ws_r_n
movdqa xmmword [rbp - 0x40], xmm0
call fcn.1402b7a88
jmp 0x14013f26e
lea rcx, [rbp + 0xc30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rbp + 0xc30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1401f48e0
mov rdi, rax
test rax, rax
jne 0x14013f1ff
lea rcx, str.File_system_failed_r_n
jmp 0x14013f269
mov rax, qword [rax]
mov rdx, qword [rbp - 0x30]
lea r8, [rbp - 8]
mov rcx, rdi
call qword [rax + 0x60]
mov rcx, rdi
test al, al
mov rax, qword [rdi]
jne 0x14013f23e
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2a80
lea rcx, str.Failed_to_write__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402b7a88
jmp 0x14013f26e
call qword [rax + 0x88]
lea rcx, [rbp - 8]
mov edi, eax
call fcn.1400d2a80
lea rcx, str.Wrote__d_sectors_r_n
cdq
idiv edi
mov edx, eax
call fcn.1402b7a88
jmp 0x14013f26e
lea rcx, str.Conversion_error_r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rbp - 8]
call fcn.1400d2a40
lea rcx, [rbp - 0x60]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140005eb0
jmp 0x14013f7df
test r14b, r14b
jne 0x14013f29e
call fcn.14013c5d0
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
call fcn.1401feab0
call fcn.1400fe750
mov rdi, rax
test rax, rax
jne 0x14013f2cf
lea rcx, str.Failed_to_deploy_driver_r_n
call fcn.1402b7a88
jmp 0x14013e911
lea rdx, [0x14034f2fc]
lea rcx, [rsp + 0x60]
call fcn.1401ff2b0
test al, al
je 0x14013f319
lea rcx, [rsp + 0x60]
call fcn.1401fde40
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rcx, [rsp + 0x60]
call fcn.140185150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400febd0
jmp 0x14013e911
lea rdx, [rbp + 0x28]
mov r8d, 5
call fcn.1401feab0
lea rcx, [rbp + 0x28]
call fcn.1401bb7e0
call fcn.1402bc19c
lea rcx, [rbp + 0x28]
call fcn.140005eb0
jmp 0x14013f7df
lea rcx, [rbp + 0x210]
call fcn.1400ed6f0
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013c4d0
lea rcx, [rbp + 0x210]
call fcn.140142d10
mov rdi, rax
test rax, rax
jne 0x14013f3b2
lea rcx, str.Miniport_failed_r_n
call fcn.1402b9694
call fcn.1402bc19c
lea rcx, [rbp + 0x210]
call fcn.1400eeb50
jmp 0x14013f7df
mov rcx, rax
call fcn.140143100
mov rcx, rdi
call fcn.1400ed620
mov rcx, rax
call fcn.14012d8f0
lea rcx, [0x140346b9c]
mov rdx, rax
call fcn.1402b9694
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax]
call fcn.1402bc19c
lea rcx, [rbp + 0x210]
call fcn.1400eeb50
jmp 0x14013f7df
call fcn.1401bae60
jmp 0x14013f7da
lea rdx, [rsp + 0x60]
mov r8d, 8
call fcn.1401feab0
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1401fb010
cmp ax, 0x22
jne 0x14013f45b
lea rcx, [rsp + 0x60]
call fcn.1401fde40
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
lea r9d, [rax - 2]
mov r8d, r15d
call fcn.1401fed70
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1401faf50
lea rcx, [rbp - 0x40]
call fcn.140005eb0
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.1401073c0
lea rcx, [rsp + 0x60]
test al, al
sete sil
call fcn.140005eb0
jmp 0x14013f7df
call fcn.140176ac0
test al, al
je 0x14013f50e
call fcn.140109bb0
test al, al
je 0x14013f50e
jmp 0x14013f7df
call fcn.140109bb0
mov r15d, esi
test al, al
sete r15b
mov esi, r15d
jmp 0x14013f7df
cmp dword [0x140428dc0], esi
lea rdi, vtable.HitmanPro35::CrusaderService.0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rdi
jne 0x14013f4d2
lea rcx, [rbp - 0x60]
call fcn.1401bd790
lea rcx, [rbp - 0x60]
call fcn.1401bdd70
test r14b, r14b
jne 0x14013f4e5
call fcn.14013c5d0
lea rcx, str.Press_a_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x60], rdi
test rcx, rcx
je 0x14013f50b
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov r15d, esi
mov esi, r15d
jmp 0x14013f7df
xor ecx, ecx
call fcn.1401be770
movzx esi, al
jmp 0x14013f7df
xor edx, edx
xor ecx, ecx
call fcn.1401be1a0
movzx esi, al
jmp 0x14013f7df
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, [0x1401bded0]
mov dword [0x140428dc0], r15d
mov qword [rbp], rax
lea rax, str.HitmanPro38CrusaderBoot
mov qword [rbp - 8], rax
jmp 0x14013f58b
lea rcx, str.CrusaderService:_Start_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, str.HitmanPro38Crusader
mov dword [0x140428dc0], esi
mov qword [rbp - 8], rax
lea rax, [0x1401bded0]
mov qword [rbp], rax
lea rcx, [rbp - 8]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x14013f7df
call fcn.1401395b0
test al, al
jne 0x14013f5bb
test bl, bl
jne 0x14013f5bb
lea rcx, [rbp + 0x210]
call fcn.1401065f0
cmp byte [rsp + 0x4b], sil
jne 0x14013f74f
lea rcx, [rbp + 0x18]
call fcn.1400181b0
test rax, rax
je 0x14013f5ea
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x210]
call fcn.14013c530
movzx ebx, r15b
jmp 0x14013f5ef
movzx ebx, byte [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.1400181b0
test rax, rax
je 0x14013f616
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x210]
call fcn.1400f07e0
lea rcx, [rbp + 0x38]
call fcn.140009e30
test bl, bl
je 0x14013f626
lea rcx, [rbp + 0x210]
call fcn.14013c4e0
cmp byte [rsp + 0x4f], sil
je 0x14013f639
lea rcx, [rbp + 0x210]
call fcn.14013c4f0
test r12b, r12b
je 0x14013f64a
lea rcx, [rbp + 0x210]
call fcn.14013c4e0
movzx r12d, byte [rsp + 0x44]
test r12b, r12b
je 0x14013f661
lea rcx, [rbp + 0x210]
call fcn.14013c5a0
cmp byte [rsp + 0x48], sil
jne 0x14013f674
lea rcx, [rbp + 0x210]
call fcn.14013c550
cmp byte [rsp + 0x4a], sil
jne 0x14013f69a
lea rcx, [rbp + 0x210]
call fcn.14013c560
lea rcx, [rbp + 0x210]
call fcn.14013c580
movzx ebx, byte [rsp + 0x42]
jmp 0x14013f6af
movzx ebx, byte [rsp + 0x42]
test bl, bl
jne 0x14013f6af
lea rcx, [rbp + 0x210]
call fcn.14013c580
cmp byte [rsp + 0x4c], sil
jne 0x14013f6c2
lea rcx, [rbp + 0x210]
call fcn.14013c570
test bl, bl
jne 0x14013f6d2
lea rcx, [rbp + 0x210]
call fcn.14013c580
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14013f6e8
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013c590
cmp byte [rsp + 0x47], sil
je 0x14013f6fe
lea rcx, [rbp + 0x210]
mov edx, r15d
call fcn.14013c4c0
cmp byte [rsp + 0x46], sil
je 0x14013f715
lea rcx, [rbp + 0x210]
movzx edx, r15b
call fcn.1400f2650
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x14013f72b
lea rcx, [rbp + 0x210]
mov edx, eax
call fcn.14013c4d0
lea rcx, [rbp + 0x210]
call fcn.1400ff0d0
lea rcx, [rbp + 0x210]
call fcn.1400eb3a0
test al, al
mov eax, 5
cmovne esi, eax
jmp 0x14013f755
movzx r12d, byte [rsp + 0x44]
call fcn.1400f13c0
lea rcx, [rbp + 0x210]
test al, al
mov rax, 0xffffffffffffffff
cmove esi, eax
call fcn.1400eeb50
call fcn.14013c9c0
call fcn.1400f47e0
cmp qword [0x140428c90], 0
je 0x14013f7b3
movzx ecx, r15b
call fcn.14010f6d0
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, qword [0x140428c90]
call qword [sym.imp.USER32.dll_CloseDesktop]
test rdi, rdi
je 0x14013f7c4
mov rax, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [rax + 8]
test r14b, r14b
je 0x14013f7df
test r12b, r12b
jne 0x14013f7df
lea rcx, str.Press_any_key_to_quit..._r_n
call fcn.1402b7a88
call fcn.1402bc19c
lea rcx, [rbp + 0xe8]
call fcn.1401197a0
lea rcx, [rbp + 0x88]
call fcn.140005eb0
lea rcx, [rbp + 0xb8]
call fcn.140005eb0
lea rcx, [rbp + 0x18]
call fcn.140003e60
lea rcx, [rbp + 0x38]
call fcn.140003e60
lea rcx, [rbp - 0x28]
call fcn.140005eb0
lea rcx, [rbp - 0x50]
call fcn.140005eb0
mov r13, qword [rsp + 0xfa0]
movaps xmm7, xmmword [rsp + 0xf50]
movaps xmm6, xmmword [rsp + 0xf60]
lea rcx, [rbp + 0x100]
call fcn.140119500
mov eax, esi
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0xf70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret