Function at 0x1401c4950
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Get disk size
Get local ipv4 addresses
Get socket information
Manipulate boot configuration
Read .ini file
Read file on windows
Read pipe
Set registry value
Set socket configuration
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x165b8
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0x15d18], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x165a0], rax
mov dword [rsp + 0x15d10], 0
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x65
jne 0x1401c49b7
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c2cb0
mov eax, 1
jmp 0x1401cd07d
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x66
jne 0x1401c49dc
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c2190
mov eax, 1
jmp 0x1401cd07d
lea rcx, [rsp + 0x7b0]
call fcn.14000fb00
nop
mov dword [rsp + 0x948], 1
lea rcx, [rsp + 0x7b0]
call fcn.1401d0bc0
mov dword [rsp + 0xaf0], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xaf0]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], 0x4010
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rdx, qword [rsp + 0x165d8]
mov eax, dword [rdx + 0x14]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x470]
call fcn.1401cd320
nop
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d2da0
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401ccff2
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401ccff2
mov byte [rsp + 0xb00], 0
lea rdi, [rsp + 0xb01]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
test eax, eax
jne 0x1401c4b0d
jmp 0x1401ccff2
lea rcx, [0x14021e888]
call fcn.1400a9170
mov r8, rax
lea rdx, str.getservercmd
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c635b
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010ae0
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15518], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15530]
call fcn.140017da0
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x15518]
lea rdx, [rsp + 0x15520]
call fcn.140024830
mov rdx, rdi
mov rcx, rax
call fcn.1400239a0
movzx eax, al
test eax, eax
je 0x1401c4be1
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15540], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15540]
call fcn.140024670
mov rcx, rax
call fcn.140022160
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
lea rdx, [0x14021e8a8]
lea rcx, [rsp + 0x15548]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15544], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15544]
call fcn.140024670
lea rdx, [rsp + 0x15548]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x15548]
call fcn.140001470
lea rdx, [0x14021e8c8]
lea rcx, [rsp + 0x15558]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15550], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15550]
call fcn.140024670
lea rdx, [rsp + 0x15558]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x15558]
call fcn.140001470
lea rcx, [rsp + 0x15568]
call fcn.140001000
mov qword [rsp + 0x15d20], rax
mov rax, qword [rsp + 0x15d20]
mov qword [rsp + 0x15d28], rax
lea r8, [0x14021c9b4]
mov rdx, qword [rsp + 0x15d28]
lea rcx, [rsp + 0x15570]
call fcn.1400010b0
mov qword [rsp + 0x15d30], rax
mov rax, qword [rsp + 0x15d30]
mov qword [rsp + 0x15d38], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x15d38]
lea rcx, [rsp + 0x15578]
call fcn.1400010b0
mov qword [rsp + 0x15d40], rax
mov rax, qword [rsp + 0x15d40]
mov qword [rsp + 0x15d48], rax
lea r8, [0x14021e900]
mov rdx, qword [rsp + 0x15d48]
lea rcx, [rsp + 0x15580]
call fcn.1400010b0
mov qword [rsp + 0x15d50], rax
mov rcx, qword [rsp + 0x15d50]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021e910]
lea rcx, [0x14021e930]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x15560], eax
lea rcx, [rsp + 0x15580]
call fcn.140001470
nop
lea rcx, [rsp + 0x15578]
call fcn.140001470
nop
lea rcx, [rsp + 0x15570]
call fcn.140001470
nop
lea rcx, [rsp + 0x15568]
call fcn.140001470
cmp dword [rsp + 0x15560], 0
je 0x1401c4e2f
lea rdx, [0x14021e940]
lea rcx, [rsp + 0x15590]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15588], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15588]
call fcn.140024670
lea rdx, [rsp + 0x15590]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x15590]
call fcn.140001470
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
lea rcx, [rsp + 0x155a0]
call fcn.140001000
mov qword [rsp + 0x15d58], rax
mov rax, qword [rsp + 0x15d58]
mov qword [rsp + 0x15d60], rax
mov eax, dword [rsp + 0x15d10]
or eax, 1
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021cbcc]
mov rdx, qword [rsp + 0x15d60]
lea rcx, [rsp + 0x155a8]
call fcn.1400010b0
mov qword [rsp + 0x15d68], rax
mov rax, qword [rsp + 0x15d68]
mov qword [rsp + 0x15d70], rax
mov eax, dword [rsp + 0x15d10]
or eax, 2
mov dword [rsp + 0x15d10], eax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x15d70]
lea rcx, [rsp + 0x155b0]
call fcn.1400010b0
mov qword [rsp + 0x15d78], rax
mov rax, qword [rsp + 0x15d78]
mov qword [rsp + 0x15d80], rax
mov eax, dword [rsp + 0x15d10]
or eax, 4
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021e960]
mov rdx, qword [rsp + 0x15d80]
lea rcx, [rsp + 0x155b8]
call fcn.1400010b0
mov qword [rsp + 0x15d88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 8
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15d88]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021e970]
lea rcx, [0x14021e990]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c4f8c
lea rcx, [rsp + 0x6d0]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c4f8c
mov dword [rsp + 0x15d90], 1
jmp 0x1401c4f97
mov dword [rsp + 0x15d90], 0
movzx eax, byte [rsp + 0x15d90]
mov byte [rsp + 0x15598], al
mov eax, dword [rsp + 0x15d10]
and eax, 8
test eax, eax
je 0x1401c4fca
and dword [rsp + 0x15d10], 0xfffffff7
lea rcx, [rsp + 0x155b8]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 4
test eax, eax
je 0x1401c4fee
and dword [rsp + 0x15d10], 0xfffffffb
lea rcx, [rsp + 0x155b0]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 2
test eax, eax
je 0x1401c5012
and dword [rsp + 0x15d10], 0xfffffffd
lea rcx, [rsp + 0x155a8]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 1
test eax, eax
je 0x1401c5035
and dword [rsp + 0x15d10], 0xfffffffe
lea rcx, [rsp + 0x155a0]
call fcn.140001470
movzx eax, byte [rsp + 0x15598]
test eax, eax
je 0x1401c509e
lea rdx, [0x14021e9a0]
lea rcx, [rsp + 0x155c8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155c0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155c0]
call fcn.140024670
lea rdx, [rsp + 0x155c8]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x155c8]
call fcn.140001470
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401c6356
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401c6356
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010ae0
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155d0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155e8]
call fcn.140017da0
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x155d0]
lea rdx, [rsp + 0x155d8]
call fcn.140024830
mov rdx, rdi
mov rcx, rax
call fcn.140023a80
movzx eax, al
test eax, eax
je 0x1401c518d
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401c50bf
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155f8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155f8]
call fcn.140024670
mov rdx, rax
lea rcx, [rsp + 0x1b10]
call fcn.140024920
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155fc], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155fc]
call fcn.140024670
mov rcx, rax
call fcn.140022160
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov dword [rsp + 0x1b08], 0
mov dword [rsp + 0x1b40], 0
jmp 0x1401c5244
mov eax, dword [rsp + 0x1b40]
add eax, 1
mov dword [rsp + 0x1b40], eax
movsxd rdi, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007db0
cmp rdi, rax
jae 0x1401c5d89
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
mov r8, rax
lea rdx, str.servercmd
lea rcx, [rsp + 0x15600]
call fcn.140006c30
mov qword [rsp + 0x15d98], rax
mov rax, qword [rsp + 0x15d98]
mov qword [rsp + 0x15da0], rax
lea r8, [0x14021e1c4]
mov rdx, qword [rsp + 0x15da0]
lea rcx, [rsp + 0x15608]
call fcn.1400010b0
mov qword [rsp + 0x15da8], rax
mov rax, qword [rsp + 0x15da8]
mov qword [rsp + 0x15db0], rax
mov rcx, qword [rsp + 0x15db0]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15610]
call fcn.1400d8950
mov qword [rsp + 0x15db8], rax
mov rax, qword [rsp + 0x15db8]
mov qword [rsp + 0x15dc0], rax
mov rcx, qword [rsp + 0x15dc0]
call fcn.1400012c0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15610]
call fcn.140001470
nop
lea rcx, [rsp + 0x15608]
call fcn.140001470
nop
lea rcx, [rsp + 0x15600]
call fcn.140001470
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
test eax, eax
jne 0x1401c539d
mov dword [rsp + 0x1b08], 1
jmp 0x1401c5d89
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, str.vnc_start
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c5410
lea rcx, [0x14021e9f0]
call fcn.1400a9170
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada60
mov dword [rsp + 0x1b44], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b44]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, str.vnc_monitor
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c5483
lea rcx, str.vnc_ready
call fcn.1400a9170
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada60
mov dword [rsp + 0x1b48], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b48]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, [0x14021ea28]
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c554a
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c554a
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15618]
call fcn.1400dd020
mov qword [rsp + 0x15dc8], rax
mov rax, qword [rsp + 0x15dc8]
mov qword [rsp + 0x15dd0], rax
mov rcx, qword [rsp + 0x15dd0]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15618]
call fcn.140001470
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, [0x14021ea48]
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c5611
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c5611
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15620]
call fcn.1400dd020
mov qword [rsp + 0x15dd8], rax
mov rax, qword [rsp + 0x15dd8]
mov qword [rsp + 0x15de0], rax
mov rcx, qword [rsp + 0x15de0]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8058
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15620]
call fcn.140001470
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, str.getdiagnose_GetProcessInfo
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c56d8
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c56d8
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15628]
call fcn.1400dd020
mov qword [rsp + 0x15de8], rax
mov rax, qword [rsp + 0x15de8]
mov qword [rsp + 0x15df0], rax
mov rcx, qword [rsp + 0x15df0]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15628]
call fcn.140001470
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, str.processinfo
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c579f
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c579f
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15630]
call fcn.1400dd020
mov qword [rsp + 0x15df8], rax
mov rax, qword [rsp + 0x15df8]
mov qword [rsp + 0x15e00], rax
mov rcx, qword [rsp + 0x15e00]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15630]
call fcn.140001470
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, [0x14021ead0]
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c59e7
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c59e7
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rcx, [0x14021eaf0]
call fcn.1400a9170
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada60
mov dword [rsp + 0x1b60], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15638]
call fcn.14001ee10
lea rdi, [rsp + 0x15cf0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15648]
call fcn.140009440
lea rdi, [rsp + 0x15ce0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x608]
lea r8, [rsp + 0x15cf0]
lea rdx, [rsp + 0x15ce0]
lea rcx, [rsp + 0x1b50]
call fcn.140027510
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010ae0
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15658]
call fcn.14001ee10
mov rdx, rax
lea rcx, [rsp + 0x1b50]
call fcn.1400239a0
movzx eax, al
test eax, eax
je 0x1401c5934
lea rdi, [rsp + 0x15668]
lea rsi, [rsp + 0x1b50]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x15d00]
lea rsi, [rsp + 0x15668]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea r8, [rsp + 0x15d00]
lea rdx, [rsp + 0x15678]
call fcn.1400217f0
cmp dword [rsp + 0x1b60], 0
jne 0x1401c595a
lea rdx, [rsp + 0x608]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
call fcn.140022930
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15688]
call fcn.1400dd020
mov qword [rsp + 0x15e08], rax
mov rax, qword [rsp + 0x15e08]
mov qword [rsp + 0x15e10], rax
mov rcx, qword [rsp + 0x15e10]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15688]
call fcn.140001470
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001e980
lea rdx, [0x14021eb00]
mov rcx, rax
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c5d84
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
cmp rax, 2
jbe 0x1401c5aae
lea rcx, [rsp + 0xb00]
call fcn.1400a9170
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15690]
call fcn.1400dd020
mov qword [rsp + 0x15e18], rax
mov rax, qword [rsp + 0x15e18]
mov qword [rsp + 0x15e20], rax
mov rcx, qword [rsp + 0x15e20]
call fcn.1400012c0
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ad8a0]
call fcn.1401bba10
nop
lea rcx, [rsp + 0x15690]
call fcn.140001470
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d2da0
lea rcx, [rsp + 0x7b0]
call fcn.1401d0bc0
lea rcx, [rsp + 0x670]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c5d84
lea rcx, [rsp + 0x9f0]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
cmp eax, 1
jne 0x1401c5d84
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403ab660]
call fcn.140133230
mov qword [rsp + 0x1b70], rax
mov qword [rsp + 0x1b88], 0
mov qword [rsp + 0x1b78], 0
mov qword [rsp + 0x1b68], 0
lea rcx, [rsp + 0x1b90]
call fcn.140002d50
nop
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403ab660]
call fcn.1401347e0
mov dword [rsp + 0x1b80], eax
cmp dword [rsp + 0x1b80], 0
jne 0x1401c5b8a
lea rcx, [rsp + 0x1b90]
call fcn.140001470
jmp 0x1401c5233
mov r8d, dword [rsp + 0x1b80]
lea rdx, [0x14021eb20]
lea rcx, [rsp + 0x1b90]
call fcn.140002be0
lea rcx, [rsp + 0x1b90]
call fcn.1400012c0
lea r9, [rsp + 0x1b68]
lea r8, [rsp + 0x1b78]
lea rdx, [rsp + 0x1b88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1401c5bea
lea rcx, [rsp + 0x1b90]
call fcn.140001470
jmp 0x1401c5233
mov rax, qword [rsp + 0x1b68]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jge 0x1401c5c08
addsd xmm0, qword [0x14025b050]
mulsd xmm0, qword [0x14025b060]
mov rax, qword [rsp + 0x1b78]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jge 0x1401c5c2e
addsd xmm1, qword [0x14025b050]
divsd xmm0, xmm1
comisd xmm0, xmmword [0x14025d0c0]
jbe 0x1401c5c4e
lea rcx, [rsp + 0x1b90]
call fcn.140001470
jmp 0x1401c5233
xor edx, edx
lea rcx, [rsp + 0x1b90]
call fcn.140006d70
movzx edx, ax
lea rcx, [0x1403ab660]
call fcn.140134640
cmp dword [rsp + 0x608], eax
jne 0x1401c5d77
mov rax, qword [rsp + 0x1b68]
imul rax, rax, 0x64
xor edx, edx
div qword [rsp + 0x1b78]
mov rdi, rax
xor edx, edx
mov rax, qword [rsp + 0x1b70]
mov ecx, 0x400
div rcx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov eax, dword [rsp + 0x1b80]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x610]
lea rdx, str.Reboot__s___d_M__avoid_write_back_disk___c:__full__free__d___
xor ecx, ecx
call fcn.1400dc5d0
lea rdx, [0x14021ebb0]
lea rcx, [rsp + 0x15698]
call fcn.1400d8950
mov qword [rsp + 0x15e28], rax
mov rax, qword [rsp + 0x15e28]
mov qword [rsp + 0x15e30], rax
mov rcx, qword [rsp + 0x15e30]
call fcn.1400012c0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15698]
call fcn.140001470
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
test eax, eax
jne 0x1401c5d77
mov dword [rsp + 0x1b08], 1
lea rcx, [rsp + 0x1b90]
call fcn.140001470
jmp 0x1401c5d89
lea rcx, [rsp + 0x1b90]
call fcn.140001470
jmp 0x1401c5233
lea rcx, [rsp + 0x1b10]
call fcn.140022160
cmp dword [rsp + 0x1b08], 0
je 0x1401c5db2
lea rcx, [rsp + 0x1b10]
call fcn.140007d80
jmp 0x1401c6356
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b04]
cmp eax, 0x1e
jbe 0x1401c60a1
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010ae0
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a0]
call fcn.140024670
mov rcx, rax
call fcn.140007db0
cmp rax, 0xa
jae 0x1401c6059
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x156a8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a4], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a4]
call fcn.140024670
lea rdx, [rsp + 0x156a8]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x156a8]
call fcn.140001470
lea rdx, str.getdiagnose_GetHardwareInfo
lea rcx, [rsp + 0x156b8]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156b0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156b0]
call fcn.140024670
lea rdx, [rsp + 0x156b8]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x156b8]
call fcn.140001470
lea rcx, [rsp + 0x156c8]
call fcn.140001000
mov qword [rsp + 0x15e38], rax
mov rax, qword [rsp + 0x15e38]
mov qword [rsp + 0x15e40], rax
lea r8, [0x14021cc24]
mov rdx, qword [rsp + 0x15e40]
lea rcx, [rsp + 0x156d0]
call fcn.1400010b0
mov qword [rsp + 0x15e48], rax
mov rax, qword [rsp + 0x15e48]
mov qword [rsp + 0x15e50], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x15e50]
lea rcx, [rsp + 0x156d8]
call fcn.1400010b0
mov qword [rsp + 0x15e58], rax
mov rax, qword [rsp + 0x15e58]
mov qword [rsp + 0x15e60], rax
lea r8, [0x14021ec40]
mov rdx, qword [rsp + 0x15e60]
lea rcx, [rsp + 0x156e0]
call fcn.1400010b0
mov qword [rsp + 0x15e68], rax
mov rcx, qword [rsp + 0x15e68]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021ec50]
lea rcx, [0x14021ec70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x156c0], eax
lea rcx, [rsp + 0x156e0]
call fcn.140001470
nop
lea rcx, [rsp + 0x156d8]
call fcn.140001470
nop
lea rcx, [rsp + 0x156d0]
call fcn.140001470
nop
lea rcx, [rsp + 0x156c8]
call fcn.140001470
cmp dword [rsp + 0x156c0], 0
je 0x1401c6059
lea rdx, str.gettemperature
lea rcx, [rsp + 0x156f0]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156e8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156e8]
call fcn.140024670
lea rdx, [rsp + 0x156f0]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x156f0]
call fcn.140001470
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d2da0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b00]
cmp eax, 0xe10
jbe 0x1401c6338
lea rcx, [rsp + 0x15700]
call fcn.140001000
mov qword [rsp + 0x15e70], rax
mov rax, qword [rsp + 0x15e70]
mov qword [rsp + 0x15e78], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x10
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021cc34]
mov rdx, qword [rsp + 0x15e78]
lea rcx, [rsp + 0x15708]
call fcn.1400010b0
mov qword [rsp + 0x15e80], rax
mov rax, qword [rsp + 0x15e80]
mov qword [rsp + 0x15e88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x20
mov dword [rsp + 0x15d10], eax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x15e88]
lea rcx, [rsp + 0x15710]
call fcn.1400010b0
mov qword [rsp + 0x15e90], rax
mov rax, qword [rsp + 0x15e90]
mov qword [rsp + 0x15e98], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x40
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021eca0]
mov rdx, qword [rsp + 0x15e98]
lea rcx, [rsp + 0x15718]
call fcn.1400010b0
mov qword [rsp + 0x15ea0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x80
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15ea0]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, str.CheckClientHDD
lea rcx, [0x14021ecd0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c620b
lea rcx, [rsp + 0x6d0]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c620b
mov dword [rsp + 0x15ea8], 1
jmp 0x1401c6216
mov dword [rsp + 0x15ea8], 0
movzx eax, byte [rsp + 0x15ea8]
mov byte [rsp + 0x156f8], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x80
test eax, eax
je 0x1401c624e
and dword [rsp + 0x15d10], 0xffffff7f
lea rcx, [rsp + 0x15718]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x40
test eax, eax
je 0x1401c6272
and dword [rsp + 0x15d10], 0xffffffbf
lea rcx, [rsp + 0x15710]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x20
test eax, eax
je 0x1401c6296
and dword [rsp + 0x15d10], 0xffffffdf
lea rcx, [rsp + 0x15708]
call fcn.140001470
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x10
test eax, eax
je 0x1401c62b9
and dword [rsp + 0x15d10], 0xffffffef
lea rcx, [rsp + 0x15700]
call fcn.140001470
movzx eax, byte [rsp + 0x156f8]
test eax, eax
je 0x1401c6322
lea rdx, str.checklocalhdd
lea rcx, [rsp + 0x15728]
call fcn.140002090
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15720], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15720]
call fcn.140024670
lea rdx, [rsp + 0x15728]
mov rcx, rax
call fcn.140012fe0
nop
lea rcx, [rsp + 0x15728]
call fcn.140001470
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x1b10]
call fcn.140007d80
jmp 0x1401c50bf
jmp 0x1401ccff2
mov r8d, 4
lea rdx, str.Sync
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c639b
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c3d80
jmp 0x1401ccff2
lea rcx, [0x14021ed08]
call fcn.1400a9170
mov r8, rax
lea rdx, str.setpnpid
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c67dd
lea rcx, [rsp + 0x6c8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c6446
lea rcx, [rsp + 0x670]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c6446
lea rdx, [rsp + 0x15738]
lea rcx, [rsp + 0x470]
call fcn.1401cf370
mov qword [rsp + 0x15eb0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x100
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15eb0]
call fcn.1400019f0
test eax, eax
jne 0x1401c6446
mov dword [rsp + 0x15eb8], 1
jmp 0x1401c6451
mov dword [rsp + 0x15eb8], 0
movzx eax, byte [rsp + 0x15eb8]
mov byte [rsp + 0x15730], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x100
test eax, eax
je 0x1401c6488
and dword [rsp + 0x15d10], 0xfffffeff
lea rcx, [rsp + 0x15738]
call fcn.140001470
movzx eax, byte [rsp + 0x15730]
test eax, eax
je 0x1401c64b9
lea r8, [0x14021ed28]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401ccff2
lea r8, [0x14021ed40]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
mov byte [rsp + 0x1fd0], 0
lea rdi, [rsp + 0x1fd1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
test eax, eax
jne 0x1401c6522
jmp 0x1401ccff2
mov byte [rsp + 0x1bb0], 0
lea rdi, [rsp + 0x1bb1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1bb0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
test eax, eax
jne 0x1401c656b
jmp 0x1401ccff2
lea rdx, [rsp + 0x1fd0]
lea rcx, [rsp + 0x15740]
call fcn.140010e20
mov qword [rsp + 0x15ec0], rax
mov rax, qword [rsp + 0x15ec0]
mov qword [rsp + 0x15ec8], rax
mov rcx, qword [rsp + 0x15ec8]
call fcn.140010eb0
mov rdx, rax
lea rcx, [rsp + 0x1b98]
call fcn.140002090
nop
lea rcx, [rsp + 0x15740]
call fcn.140002e10
lea rdx, [rsp + 0x1bb0]
lea rcx, [rsp + 0x15748]
call fcn.140010e20
mov qword [rsp + 0x15ed0], rax
mov rax, qword [rsp + 0x15ed0]
mov qword [rsp + 0x15ed8], rax
mov rcx, qword [rsp + 0x15ed8]
call fcn.140010eb0
mov rdx, rax
lea rcx, [rsp + 0x1fb0]
call fcn.140002090
nop
lea rcx, [rsp + 0x15748]
call fcn.140002e10
lea r8, [0x14021cc5c]
lea rdx, [0x14021ed48]
lea rcx, [rsp + 0x1b98]
call fcn.1400062a0
lea r8, [0x14021ded4]
lea rdx, [0x14021ed50]
lea rcx, [rsp + 0x1fb0]
call fcn.1400062a0
lea r8, [0x14021ed58]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82e0
mov dword [rsp + 0x1fc0], 0
lea rdx, [rsp + 0x15750]
lea rcx, [rsp + 0x470]
call fcn.1401d1940
mov qword [rsp + 0x15ee0], rax
mov rax, qword [rsp + 0x15ee0]
mov qword [rsp + 0x15ee8], rax
lea r9, [rsp + 0x1fc0]
lea r8, [0x14021defc]
lea rdx, [rsp + 0x1fb8]
mov rcx, qword [rsp + 0x15ee8]
call fcn.140006540
nop
lea rcx, [rsp + 0x15750]
call fcn.140001470
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x1fb8]
call fcn.140006840
mov dword [rsp + 0x1ba0], eax
cmp dword [rsp + 0x1ba0], 0
jge 0x1401c6752
lea rcx, [rsp + 0x1fb8]
call fcn.140001470
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140001470
nop
lea rcx, [rsp + 0x1b98]
call fcn.140001470
jmp 0x1401ccff2
mov r8d, dword [rsp + 0x1ba0]
add r8d, 1
lea rdx, [rsp + 0x15758]
lea rcx, [rsp + 0x1fb8]
call fcn.1400069a0
mov qword [rsp + 0x15ef0], rax
mov rax, qword [rsp + 0x15ef0]
mov qword [rsp + 0x15ef8], rax
mov rdx, qword [rsp + 0x15ef8]
lea rcx, [rsp + 0x1fb8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15758]
call fcn.140001470
nop
lea rcx, [rsp + 0x1fb8]
call fcn.140001470
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140001470
nop
lea rcx, [rsp + 0x1b98]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x14021ed60]
call fcn.1400a9170
mov r8, rax
lea rdx, str.getcmd
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c81cd
mov r8d, 0x800
lea rdx, [rsp + 0x3790]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x3790]
call fcn.14000d0b0
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea rdx, [rsp + 0x3790]
lea rcx, [rsp + 0x3788]
call fcn.140002090
nop
lea rdx, [0x14021ed70]
lea rcx, [rsp + 0x3788]
call fcn.140005fa0
lea rcx, [rsp + 0x2f40]
call fcn.140002d50
nop
mov dword [rsp + 0x3780], 0
mov dword [rsp + 0x2f30], 0
lea rcx, [rsp + 0x6f8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c68e9
lea rcx, [rsp + 0x670]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c68e9
lea rcx, [rsp + 0x6c8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
jne 0x1401c68e9
lea rcx, [rsp + 0x6d8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c690b
lea r8, str.setupdate_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c692b
lea r8, str.setupdate_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
lea rcx, [rsp + 0x6f8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c6966
lea r8, str.setsuper_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c6986
lea r8, str.setsuper_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
lea rcx, [rsp + 0x6a8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c6a2b
lea rcx, [rsp + 0x6b0]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15760]
call fcn.140002d80
mov qword [rsp + 0x15f00], rax
mov rax, qword [rsp + 0x15f00]
mov qword [rsp + 0x15f08], rax
mov rcx, qword [rsp + 0x15f08]
call fcn.140002e30
mov r8, rax
lea rdx, str.setdisplay__s_r_n
lea rcx, [rsp + 0x3fa0]
call fcn.1400acc54
nop
lea rcx, [rsp + 0x15760]
call fcn.140002e10
lea r8, [rsp + 0x3fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
lea rcx, [rsp + 0x2f38]
call fcn.140002d50
nop
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021edd8]
lea rcx, [0x14021ee00]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c6a78
lea rdx, str.77.88.8.3_77.88.8.7_
lea rcx, [rsp + 0x2f38]
call fcn.140002060
lea rdx, [rsp + 0x998]
lea rcx, [rsp + 0x2bd8]
call fcn.140001440
nop
lea rcx, [rsp + 0x688]
call fcn.1400019f0
test eax, eax
je 0x1401c6ab4
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x2bd8]
call fcn.140002d20
lea rdx, [rsp + 0x9a0]
lea rcx, [rsp + 0x3f98]
call fcn.140001440
nop
lea rcx, [rsp + 0x690]
call fcn.1400019f0
test eax, eax
je 0x1401c6af0
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x3f98]
call fcn.140002d20
lea rcx, [rsp + 0x2bd8]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x1401c6b20
mov r8, qword [rsp + 0x2bd8]
lea rdx, [0x14021ee40]
lea rcx, [rsp + 0x2f38]
call fcn.14000f8d0
lea rcx, [rsp + 0x3f98]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x1401c6b50
mov r8, qword [rsp + 0x3f98]
lea rdx, [0x14021ee48]
lea rcx, [rsp + 0x2f38]
call fcn.14000f8d0
lea rcx, [rsp + 0x2f38]
call fcn.1400019f0
test eax, eax
je 0x1401c6bf0
lea rcx, [rsp + 0x2f38]
call fcn.1400019f0
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x2f38]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x2c
jne 0x1401c6bf0
lea rcx, [rsp + 0x2f38]
call fcn.1400019f0
mov r8d, eax
sub r8d, 1
lea rdx, [rsp + 0x15768]
lea rcx, [rsp + 0x2f38]
call fcn.140006ac0
mov qword [rsp + 0x15f10], rax
mov rax, qword [rsp + 0x15f10]
mov qword [rsp + 0x15f18], rax
mov rdx, qword [rsp + 0x15f18]
lea rcx, [rsp + 0x2f38]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15768]
call fcn.140001470
mov r8, qword [rsp + 0x2f38]
lea rdx, str.setdns__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15770]
call fcn.140002d80
mov qword [rsp + 0x15f20], rax
mov rax, qword [rsp + 0x15f20]
mov qword [rsp + 0x15f28], rax
mov rcx, qword [rsp + 0x15f28]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15770]
call fcn.140002e10
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x2f80]
lea r8, [0x14021e00c]
lea rdx, [0x14021ee68]
lea rcx, [0x14021ee78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x2f80]
cmp eax, 0x47
jne 0x1401c6cd8
lea rdx, str.setgmenu_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
jmp 0x1401c6cec
lea rdx, str.setgmenu_0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15778]
call fcn.140002d80
mov qword [rsp + 0x15f30], rax
mov rax, qword [rsp + 0x15f30]
mov qword [rsp + 0x15f38], rax
mov rcx, qword [rsp + 0x15f38]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15778]
call fcn.140002e10
lea rcx, [rsp + 0x970]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call fcn.1400a9460
lea rcx, [rsp + 0x680]
call fcn.1400019f0
test eax, eax
je 0x1401c6da4
lea rcx, [rsp + 0x680]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x23d0]
lea rdx, str.route_delete_0.0.0.0_r_nroute_add_0.0.0.0_mask_0.0.0.0__s_metric_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15780]
call fcn.140002d80
mov qword [rsp + 0x15f40], rax
mov rax, qword [rsp + 0x15f40]
mov qword [rsp + 0x15f48], rax
mov rcx, qword [rsp + 0x15f48]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15780]
call fcn.140002e10
lea rcx, [rsp + 0x700]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
test eax, eax
je 0x1401c70c7
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x43a0]
call fcn.140001440
nop
mov dword [rsp + 0x43a8], 0
cmp dword [rsp + 0x43a8], 0xffffffff
je 0x1401c70ba
lea r9, [rsp + 0x43a8]
lea r8, [0x14021e04c]
lea rdx, [rsp + 0x43b8]
lea rcx, [rsp + 0x43a0]
call fcn.140006540
nop
lea rcx, [rsp + 0x43b8]
call fcn.1400019f0
test eax, eax
jne 0x1401c6ec0
lea rcx, [rsp + 0x43b8]
call fcn.140001470
jmp 0x1401c70ba
mov dword [rsp + 0x43ac], 0x10
lea r8, [rsp + 0x43ac]
lea rdx, [rsp + 0x43c0]
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [rsp + 0x43c4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15788]
call fcn.140010e20
mov qword [rsp + 0x15f50], rax
mov rax, qword [rsp + 0x15f50]
mov qword [rsp + 0x15f58], rax
mov rcx, qword [rsp + 0x15f58]
call fcn.140010eb0
mov rdx, rax
lea rcx, [rsp + 0x43b0]
call fcn.140002090
nop
lea rcx, [rsp + 0x15788]
call fcn.140002e10
lea rdx, [rsp + 0x43b0]
lea rcx, [rsp + 0x43b8]
call fcn.14001e6b0
movzx eax, al
test eax, eax
je 0x1401c709a
lea rdx, str.net_start_MSiSCSI_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15790]
call fcn.140002d80
mov qword [rsp + 0x15f60], rax
mov rax, qword [rsp + 0x15f60]
mov qword [rsp + 0x15f68], rax
mov rcx, qword [rsp + 0x15f68]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15790]
call fcn.140002e10
lea r9, [0x14021ef80]
mov r8, qword [rsp + 0x43b8]
lea rdx, str.iscsicli_AddTargetPortal__s_3260_r_niscsicli_LoginTarget__s:00_T______0x00000002__________0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15798]
call fcn.140002d80
mov qword [rsp + 0x15f70], rax
mov rax, qword [rsp + 0x15f70]
mov qword [rsp + 0x15f78], rax
mov rcx, qword [rsp + 0x15f78]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15798]
call fcn.140002e10
nop
lea rcx, [rsp + 0x43b0]
call fcn.140001470
nop
lea rcx, [rsp + 0x43b8]
call fcn.140001470
jmp 0x1401c70ba
lea rcx, [rsp + 0x43b0]
call fcn.140001470
nop
lea rcx, [rsp + 0x43b8]
call fcn.140001470
jmp 0x1401c6e6a
lea rcx, [rsp + 0x43a0]
call fcn.140001470
lea rcx, [rsp + 0x9b8]
lea rdx, [0x14021e074]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c77fa
lea r8, [rsp + 0x3790]
lea rdx, str._sCmdpublic.txt
lea rcx, [rsp + 0x3788]
call fcn.140002be0
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
lea rdx, [0x14021e684]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c7281
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dc0
test eax, eax
jne 0x1401c7254
mov byte [rsp + 0x4730], 0
lea rdi, [rsp + 0x4731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x4730]
call fcn.1400aa4c8
lea rcx, [rsp + 0x4730]
call fcn.1400a9170
test rax, rax
jne 0x1401c7191
jmp 0x1401c7135
mov r8d, 5
lea rdx, [0x14021f0cc]
lea rcx, [rsp + 0x4730]
call fcn.1400ccd78
test eax, eax
jne 0x1401c7202
lea rax, [rsp + 0x157a0]
mov qword [rsp + 0x157a8], rax
lea rdx, [rsp + 0x4735]
mov rcx, qword [rsp + 0x157a8]
call fcn.1400db950
mov qword [rsp + 0x15f80], rax
mov r8, qword [rsp + 0x15f80]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c1d60
jmp 0x1401c7135
lea rcx, [0x14021f0d8]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x14021f0e8]
lea rcx, [rsp + 0x4730]
call fcn.1400ccd78
test eax, eax
jne 0x1401c722e
jmp 0x1401c7135
lea r8, [rsp + 0x4730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c7135
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9ff0
lea r8, [0x14021e74c]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
lea rcx, [rsp + 0x658]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0x43d0], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401cd2b0
nop
mov eax, dword [rsp + 0x43d0]
mov dword [rsp + 0x4588], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401b8330
lea rdx, [rsp + 0x4590]
lea rcx, [rsp + 0x43d8]
call fcn.140001440
nop
cmp dword [rsp + 0x43d0], 0
jne 0x1401c72fa
lea rdx, [0x14021f0f8]
lea rcx, [rsp + 0x43d8]
call fcn.140002060
cmp dword [rsp + 0x43d0], 0xffffffff
jne 0x1401c7318
lea rdx, str.Non_PXE
lea rcx, [rsp + 0x43d8]
call fcn.140002060
mov r9, qword [rsp + 0x43d8]
lea r8, [rsp + 0x3790]
lea rdx, [0x14021f118]
lea rcx, [rsp + 0x3788]
call fcn.140002be0
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
lea rdx, [0x14021e75c]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c7495
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dc0
test eax, eax
jne 0x1401c7468
movzx eax, byte [0x1402122af]
mov byte [rsp + 0x5730], al
lea rdi, [rsp + 0x5731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x5730]
call fcn.1400aa4c8
lea rcx, [rsp + 0x5730]
call fcn.1400a9170
test rax, rax
jne 0x1401c73d1
jmp 0x1401c736f
mov r8d, 5
lea rdx, [0x14021f134]
lea rcx, [rsp + 0x5730]
call fcn.1400ccd78
test eax, eax
jne 0x1401c7442
lea rax, [rsp + 0x157b0]
mov qword [rsp + 0x157b8], rax
lea rdx, [rsp + 0x5735]
mov rcx, qword [rsp + 0x157b8]
call fcn.1400db950
mov qword [rsp + 0x15f88], rax
mov r8, qword [rsp + 0x15f88]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c1d60
jmp 0x1401c736f
lea r8, [rsp + 0x5730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c736f
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9ff0
lea r8, [0x14021e7e4]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x157c0]
call fcn.140010e20
mov qword [rsp + 0x15f90], rax
mov rax, qword [rsp + 0x15f90]
mov qword [rsp + 0x15f98], rax
mov rcx, qword [rsp + 0x15f98]
call fcn.140010eb0
mov r9, rax
lea r8, [rsp + 0x3790]
lea rdx, [0x14021f140]
lea rcx, [rsp + 0x3788]
call fcn.140002be0
nop
lea rcx, [rsp + 0x157c0]
call fcn.140002e10
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
lea rdx, [0x14021e7fc]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c7661
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dc0
test eax, eax
jne 0x1401c7634
movzx eax, byte [0x1402122b3]
mov byte [rsp + 0x6730], al
lea rdi, [rsp + 0x6731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x6730]
call fcn.1400aa4c8
lea rcx, [rsp + 0x6730]
call fcn.1400a9170
test rax, rax
jne 0x1401c759d
jmp 0x1401c753b
mov r8d, 5
lea rdx, [0x14021f15c]
lea rcx, [rsp + 0x6730]
call fcn.1400ccd78
test eax, eax
jne 0x1401c760e
lea rax, [rsp + 0x157c8]
mov qword [rsp + 0x157d0], rax
lea rdx, [rsp + 0x6735]
mov rcx, qword [rsp + 0x157d0]
call fcn.1400db950
mov qword [rsp + 0x15fa0], rax
mov r8, qword [rsp + 0x15fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c1d60
jmp 0x1401c753b
lea r8, [rsp + 0x6730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c753b
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9ff0
lea r8, [0x14021e9bc]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
mov r9, qword [rsp + 0x610]
lea r8, [rsp + 0x3790]
lea rdx, str._sCmd_s.txt
lea rcx, [rsp + 0x3788]
call fcn.140002be0
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
lea rdx, [0x14021e9ec]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c77df
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dc0
test eax, eax
jne 0x1401c77b1
movzx eax, byte [0x1402122b7]
mov byte [rsp + 0x7730], al
lea rdi, [rsp + 0x7731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x7730]
call fcn.1400aa4c8
lea rcx, [rsp + 0x7730]
call fcn.1400a9170
test rax, rax
jne 0x1401c771a
jmp 0x1401c76b8
mov r8d, 5
lea rdx, [0x14021f184]
lea rcx, [rsp + 0x7730]
call fcn.1400ccd78
test eax, eax
jne 0x1401c778b
lea rax, [rsp + 0x157d8]
mov qword [rsp + 0x157e0], rax
lea rdx, [rsp + 0x7735]
mov rcx, qword [rsp + 0x157e0]
call fcn.1400db950
mov qword [rsp + 0x15fa8], rax
mov r8, qword [rsp + 0x15fa8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c1d60
jmp 0x1401c76b8
lea r8, [rsp + 0x7730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c76b8
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9ff0
lea r8, [0x14021eaec]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x43d8]
call fcn.140001470
nop
lea rcx, [rsp + 0x43f0]
call fcn.140005d50
lea rcx, [rsp + 0x9f8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0x3f90], eax
lea rdx, [rsp + 0xa00]
lea rcx, [rsp + 0x2f28]
call fcn.140001440
nop
lea rcx, [rsp + 0x9f8]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401c7a16
lea rcx, [rsp + 0x9b8]
lea rdx, [0x14021ebac]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c7a16
lea rcx, [rsp + 0x157e8]
call fcn.140001000
mov qword [rsp + 0x15fb0], rax
mov rax, qword [rsp + 0x15fb0]
mov qword [rsp + 0x15fb8], rax
lea r8, [0x14021f190]
mov rdx, qword [rsp + 0x15fb8]
lea rcx, [rsp + 0x8738]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157e8]
call fcn.140001470
lea rcx, [rsp + 0x8738]
call fcn.1400012c0
lea rdx, [0x14021edfc]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x8730], rax
cmp qword [rsp + 0x8730], 0
je 0x1401c79be
mov rcx, qword [rsp + 0x8730]
call fcn.1400a9dc0
test eax, eax
jne 0x1401c79b1
xor eax, eax
mov word [rsp + 0x8740], ax
lea rdi, [rsp + 0x8742]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x8730]
mov edx, 0x2000
lea rcx, [rsp + 0x8740]
call fcn.1400a9e30
lea rcx, [rsp + 0x8740]
call fcn.1400a81f4
test rax, rax
jne 0x1401c7943
jmp 0x1401c78e5
lea rcx, [0x14021f1b0]
call fcn.1400a81f4
mov r8, rax
lea rdx, [0x14021f1c8]
lea rcx, [rsp + 0x8740]
call fcn.1400a938c
test eax, eax
jne 0x1401c79ac
mov dword [rsp + 0x3f90], 1
lea rcx, [0x14021f1e0]
call fcn.1400a81f4
lea rdx, [rsp + rax*2 + 0x8740]
lea rcx, [rsp + 0x2f28]
call fcn.140002060
lea rdx, [0x14021f1f8]
lea rcx, [rsp + 0x2f28]
call fcn.140006970
jmp 0x1401c79b1
jmp 0x1401c78e5
mov rcx, qword [rsp + 0x8730]
call fcn.1400a9ff0
lea rcx, [rsp + 0x9f8]
mov r8d, dword [rsp + 0x3f90]
lea rdx, [0x14021f200]
call fcn.140002be0
lea rcx, [rsp + 0xa00]
lea rdx, [rsp + 0x2f28]
call fcn.140002d20
lea rcx, [rsp + 0x7b0]
call fcn.1401b8720
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
nop
lea rcx, [rsp + 0x8738]
call fcn.140001470
cmp dword [rsp + 0x3f90], 0
je 0x1401c7afc
lea r8, [rsp + 0x2f28]
lea rdx, [0x14021f210]
lea rcx, [rsp + 0x157f0]
call fcn.140006c30
mov qword [rsp + 0x15fc0], rax
mov rax, qword [rsp + 0x15fc0]
mov qword [rsp + 0x15fc8], rax
lea r8, [0x14021f208]
mov rdx, qword [rsp + 0x15fc8]
lea rcx, [rsp + 0xa740]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157f0]
call fcn.140001470
lea rcx, [rsp + 0xa740]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x157f8]
call fcn.1400d8910
mov qword [rsp + 0x15fd0], rax
mov rax, qword [rsp + 0x15fd0]
mov qword [rsp + 0x15fd8], rax
mov rcx, qword [rsp + 0x15fd8]
call fcn.1400012c0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x157f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xa740]
call fcn.140001470
lea r8, [rsp + 0x3790]
lea rdx, str._sCCBoot.ini
lea rcx, [rsp + 0x3788]
call fcn.140002be0
lea rcx, [rsp + 0x2bd0]
call fcn.140002d50
nop
lea rcx, [rsp + 0x2be0]
call fcn.14000f930
nop
lea rcx, [rsp + 0x2f48]
call fcn.140007bb0
nop
lea rdx, [rsp + 0x2f48]
lea rcx, [rsp + 0x2be0]
call fcn.1401b8110
lea rdx, [0x14021f0a4]
lea rcx, [rsp + 0x2bd0]
call fcn.140002060
mov dword [rsp + 0xa748], 0
jmp 0x1401c7b89
mov eax, dword [rsp + 0xa748]
add eax, 1
mov dword [rsp + 0xa748], eax
movsxd rdi, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007c30
cmp rdi, rax
jae 0x1401c7db2
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1a8
lea rdx, [0x14021f248]
call fcn.140006050
test eax, eax
je 0x1401c7bd8
jmp 0x1401c7b78
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1c0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15800]
call fcn.140002230
mov qword [rsp + 0x15fe0], rax
mov rax, qword [rsp + 0x15fe0]
mov qword [rsp + 0x15fe8], rax
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1a0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15808]
call fcn.140002230
mov qword [rsp + 0x15ff0], rax
mov rax, qword [rsp + 0x15ff0]
mov qword [rsp + 0x15ff8], rax
mov r8, qword [rsp + 0x15ff8]
lea rdx, [rsp + 0x2bd0]
lea rcx, [rsp + 0x15810]
call fcn.140006b70
mov qword [rsp + 0x16000], rax
mov rax, qword [rsp + 0x16000]
mov qword [rsp + 0x16008], rax
lea r8, [0x14021f0f4]
mov rdx, qword [rsp + 0x16008]
lea rcx, [rsp + 0x15818]
call fcn.1400010b0
mov qword [rsp + 0x16010], rax
mov rax, qword [rsp + 0x16010]
mov qword [rsp + 0x16018], rax
mov r8, qword [rsp + 0x15fe8]
mov rdx, qword [rsp + 0x16018]
lea rcx, [rsp + 0x15820]
call fcn.140006b70
mov qword [rsp + 0x16020], rax
mov rax, qword [rsp + 0x16020]
mov qword [rsp + 0x16028], rax
lea r8, [0x14021f0e4]
mov rdx, qword [rsp + 0x16028]
lea rcx, [rsp + 0x15828]
call fcn.1400010b0
mov qword [rsp + 0x16030], rax
mov rax, qword [rsp + 0x16030]
mov qword [rsp + 0x16038], rax
mov rdx, qword [rsp + 0x16038]
lea rcx, [rsp + 0x2bd0]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15828]
call fcn.140001470
nop
lea rcx, [rsp + 0x15820]
call fcn.140001470
nop
lea rcx, [rsp + 0x15818]
call fcn.140001470
nop
lea rcx, [rsp + 0x15810]
call fcn.140001470
nop
lea rcx, [rsp + 0x15808]
call fcn.140001470
nop
lea rcx, [rsp + 0x15800]
call fcn.140001470
jmp 0x1401c7b78
lea rcx, [rsp + 0x2f20]
call fcn.140002d50
nop
mov dword [rsp + 0x3780], 0
cmp dword [rsp + 0x3780], 0xffffffff
je 0x1401c7f5e
lea r9, [rsp + 0x3780]
lea r8, [0x14021f244]
lea rdx, [rsp + 0xaf60]
lea rcx, [rsp + 0x2bd0]
call fcn.140006540
nop
lea rcx, [rsp + 0xaf60]
call fcn.1400019f0
test eax, eax
jne 0x1401c7e21
lea rcx, [rsp + 0xaf60]
call fcn.140001470
jmp 0x1401c7f5e
mov r8d, 1
lea rdx, [rsp + 0x15830]
lea rcx, [rsp + 0xaf60]
call fcn.140006ac0
mov qword [rsp + 0x16040], rax
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0x16040]
call fcn.1400012c0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xa750]
lea r8, [0x14021f254]
mov rdx, rax
lea rcx, [0x14021f258]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15830]
call fcn.140001470
movzx eax, word [rsp + 0xa750]
test eax, eax
jne 0x1401c7eb8
lea rcx, [rsp + 0xaf60]
call fcn.140001470
jmp 0x1401c7dcb
lea rdx, [rsp + 0xa750]
lea rcx, [rsp + 0x2f20]
call fcn.140005fa0
lea rdx, [0x14021f27c]
lea rcx, [rsp + 0x2f20]
call fcn.140005fa0
mov r8d, 1
lea rdx, [rsp + 0x15838]
lea rcx, [rsp + 0xaf60]
call fcn.140006a00
mov qword [rsp + 0x16048], rax
mov rax, qword [rsp + 0x16048]
mov qword [rsp + 0x16050], rax
mov rdx, qword [rsp + 0x16050]
lea rcx, [rsp + 0x2f20]
call fcn.140005f70
nop
lea rcx, [rsp + 0x15838]
call fcn.140001470
lea rdx, [0x14021f280]
lea rcx, [rsp + 0x2f20]
call fcn.140005fa0
nop
lea rcx, [rsp + 0xaf60]
call fcn.140001470
jmp 0x1401c7dcb
lea rcx, [rsp + 0x2f20]
call fcn.1400019f0
test eax, eax
je 0x1401c7ffb
mov r8, qword [rsp + 0x2f20]
lea rdx, [0x14021f288]
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15840]
call fcn.140002d80
mov qword [rsp + 0x16058], rax
mov rax, qword [rsp + 0x16058]
mov qword [rsp + 0x16060], rax
mov rcx, qword [rsp + 0x16060]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15840]
call fcn.140002e10
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
mov r9, rax
mov r8d, 1
lea rdx, str.SetMkLink
lea rcx, [0x14021f2c8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c8049
lea r8, str.setmklink__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
lea rcx, [rsp + 0x3788]
call fcn.1400012c0
mov r9, rax
xor r8d, r8d
lea rdx, str.USBWriteProtect
lea rcx, [0x14021f308]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c8085
lea rax, [0x14021f284]
mov qword [rsp + 0x16068], rax
jmp 0x1401c8094
lea rax, [0x14021f2c4]
mov qword [rsp + 0x16068], rax
mov r8, qword [rsp + 0x16068]
lea rdx, str.setusbwriteprotect__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002be0
lea rcx, [rsp + 0x2f40]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15848]
call fcn.140002d80
mov qword [rsp + 0x16070], rax
mov rax, qword [rsp + 0x16070]
mov qword [rsp + 0x16078], rax
mov rcx, qword [rsp + 0x16078]
call fcn.140002e30
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x15848]
call fcn.140002e10
lea r8, str._r_n:end_r_n_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x2f20]
call fcn.140001470
nop
lea rcx, [rsp + 0x2f48]
call fcn.140007c00
nop
lea rcx, [rsp + 0x2be0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x2bd0]
call fcn.140001470
nop
lea rcx, [rsp + 0x2f28]
call fcn.140001470
nop
lea rcx, [rsp + 0x3f98]
call fcn.140001470
nop
lea rcx, [rsp + 0x2bd8]
call fcn.140001470
nop
lea rcx, [rsp + 0x2f38]
call fcn.140001470
nop
lea rcx, [rsp + 0x2f40]
call fcn.140001470
nop
lea rcx, [rsp + 0x3788]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x14021f358]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x14021f368]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c88fb
lea rcx, str.superenable
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xb788]
call fcn.1400dd020
nop
lea rdx, [0x14021f388]
lea rcx, [rsp + 0xb788]
call fcn.140006970
mov dword [rsp + 0xaf68], 0
lea rcx, [rsp + 0xb788]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15850]
call fcn.1400db9d0
mov qword [rsp + 0x16080], rax
mov rcx, qword [rsp + 0x16080]
call fcn.1400012c0
lea rdx, [rsp + 0xaf68]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xaf70], rax
lea rcx, [rsp + 0x15850]
call fcn.140001470
cmp dword [rsp + 0xaf68], 1
jge 0x1401c82dc
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [0x14021f390]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xb788]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [0x14021f3a8]
lea rcx, [rsp + 0xb780]
call fcn.140002090
nop
mov dword [rsp + 0xaf6c], 0
mov dword [rsp + 0xb790], 0
jmp 0x1401c831a
mov eax, dword [rsp + 0xb790]
add eax, 1
mov dword [rsp + 0xb790], eax
mov eax, dword [rsp + 0xaf68]
cmp dword [rsp + 0xb790], eax
jge 0x1401c84d1
lea rcx, [0x14021f3c8]
call fcn.1400a81f4
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._Pwd
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400a938c
test eax, eax
jne 0x1401c8402
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15858]
call fcn.1400db990
mov qword [rsp + 0x16088], rax
mov rax, qword [rsp + 0x16088]
mov qword [rsp + 0x16090], rax
mov r8d, 5
lea rdx, [rsp + 0x15860]
mov rcx, qword [rsp + 0x16090]
call fcn.1400069a0
mov qword [rsp + 0x16098], rax
mov rax, qword [rsp + 0x16098]
mov qword [rsp + 0x160a0], rax
mov rdx, qword [rsp + 0x160a0]
lea rcx, [rsp + 0xb780]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15860]
call fcn.140001470
nop
lea rcx, [rsp + 0x15858]
call fcn.140001470
lea rcx, [0x14021f3e8]
call fcn.1400a81f4
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._SuperType
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400a938c
test eax, eax
jne 0x1401c84cc
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15868]
call fcn.1400db990
mov qword [rsp + 0x160a8], rax
mov rax, qword [rsp + 0x160a8]
mov qword [rsp + 0x160b0], rax
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [rsp + 0x15870]
mov rcx, qword [rsp + 0x160b0]
call fcn.1400069a0
mov qword [rsp + 0x160b8], rax
mov rcx, qword [rsp + 0x160b8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xaf6c], eax
lea rcx, [rsp + 0x15870]
call fcn.140001470
nop
lea rcx, [rsp + 0x15868]
call fcn.140001470
jmp 0x1401c8309
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x14021f418]
lea rcx, [rsp + 0xb780]
call fcn.140005fd0
test eax, eax
jne 0x1401c8538
lea r8, [0x14021f438]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xb780]
call fcn.140001470
nop
lea rcx, [rsp + 0xb788]
call fcn.140001470
jmp 0x1401ccff2
xor eax, eax
mov word [rsp + 0xaf80], ax
lea rdi, [rsp + 0xaf82]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15878]
call fcn.140001000
mov qword [rsp + 0x160c0], rax
mov rax, qword [rsp + 0x160c0]
mov qword [rsp + 0x160c8], rax
lea r8, [0x14021f364]
mov rdx, qword [rsp + 0x160c8]
lea rcx, [rsp + 0x15880]
call fcn.1400010b0
mov qword [rsp + 0x160d0], rax
mov rax, qword [rsp + 0x160d0]
mov qword [rsp + 0x160d8], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x160d8]
lea rcx, [rsp + 0x15888]
call fcn.1400010b0
mov qword [rsp + 0x160e0], rax
mov rax, qword [rsp + 0x160e0]
mov qword [rsp + 0x160e8], rax
lea r8, [0x14021f450]
mov rdx, qword [rsp + 0x160e8]
lea rcx, [rsp + 0x15890]
call fcn.1400010b0
mov qword [rsp + 0x160f0], rax
mov rcx, qword [rsp + 0x160f0]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xaf80]
lea r8, [0x14021f374]
lea rdx, [0x14021f460]
lea rcx, [0x14021f478]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15890]
call fcn.140001470
nop
lea rcx, [rsp + 0x15888]
call fcn.140001470
nop
lea rcx, [rsp + 0x15880]
call fcn.140001470
nop
lea rcx, [rsp + 0x15878]
call fcn.140001470
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158a0]
call fcn.140004dc0
mov qword [rsp + 0x160f8], rax
mov rcx, qword [rsp + 0x160f8]
call fcn.140007b70
mov byte [rsp + 0x15898], al
lea rcx, [rsp + 0x158a0]
call fcn.140001470
movzx edx, byte [rsp + 0x15898]
test edx, edx
je 0x1401c8704
lea r8, [0x14021f488]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xb780]
call fcn.140001470
nop
lea rcx, [rsp + 0xb788]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158b0]
call fcn.140004dc0
mov qword [rsp + 0x16100], rax
mov rax, qword [rsp + 0x16100]
mov qword [rsp + 0x16108], rax
mov rcx, qword [rsp + 0x16108]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0xb780]
call fcn.140005fd0
mov dword [rsp + 0x158a8], eax
lea rcx, [rsp + 0x158b0]
call fcn.140001470
cmp dword [rsp + 0x158a8], 0
je 0x1401c87ad
lea r8, [0x14021f4a8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xb780]
call fcn.140001470
nop
lea rcx, [rsp + 0xb788]
call fcn.140001470
jmp 0x1401ccff2
mov r8d, dword [rsp + 0xaf6c]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403ab660]
call fcn.14013a030
mov dword [rsp + 0x16110], eax
cmp dword [rsp + 0x16110], 0xfffffffd
je 0x1401c880a
cmp dword [rsp + 0x16110], 0xfffffffe
je 0x1401c882f
cmp dword [rsp + 0x16110], 0xffffffff
je 0x1401c8854
cmp dword [rsp + 0x16110], 0
je 0x1401c8876
cmp dword [rsp + 0x16110], 1
je 0x1401c8898
jmp 0x1401c88ba
lea r8, str._ERR_DEVICEID_NOT_MATCH_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c88db
lea r8, str._ERR_ALREADY_SUPER_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c88db
lea r8, [0x14021f4f8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c88db
lea r8, [0x14021f518]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c88db
lea r8, [0x14021f530]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c88db
lea r8, [0x14021f538]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xb780]
call fcn.140001470
nop
lea rcx, [rsp + 0xb788]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x14021f558]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x14021f568]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c902b
lea rcx, str.superdisable
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xbfc0]
call fcn.1400dd020
nop
lea rdx, [0x14021f588]
lea rcx, [rsp + 0xbfc0]
call fcn.140006970
mov dword [rsp + 0xb794], 0
lea rcx, [rsp + 0xbfc0]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x158b8]
call fcn.1400db9d0
mov qword [rsp + 0x16118], rax
mov rcx, qword [rsp + 0x16118]
call fcn.1400012c0
lea rdx, [rsp + 0xb794]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xb7a0], rax
lea rcx, [rsp + 0x158b8]
call fcn.140001470
cmp dword [rsp + 0xb794], 3
jge 0x1401c8a0a
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, str._ERR_INVALID_CMD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [0x14021f5a8]
lea rcx, [rsp + 0xbfb0]
call fcn.140002090
nop
mov dword [rsp + 0xbfb8], 0
mov dword [rsp + 0xb798], 0
mov dword [rsp + 0xbfc8], 0
jmp 0x1401c8a53
mov eax, dword [rsp + 0xbfc8]
add eax, 1
mov dword [rsp + 0xbfc8], eax
mov eax, dword [rsp + 0xb794]
cmp dword [rsp + 0xbfc8], eax
jge 0x1401c8c5e
movsxd rax, dword [rsp + 0xbfc8]
mov rdx, qword [rsp + 0xb7a0]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x158c0]
call fcn.1400db990
mov qword [rsp + 0x16120], rax
mov rax, qword [rsp + 0x16120]
mov qword [rsp + 0x16128], rax
mov rdx, qword [rsp + 0x16128]
lea rcx, [rsp + 0xbfc0]
call fcn.140002d20
nop
lea rcx, [rsp + 0x158c0]
call fcn.140001470
lea rcx, [0x14021f5c8]
call fcn.1400a81f4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021f5d8]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a938c
test eax, eax
jne 0x1401c8b51
mov r8d, 5
lea rdx, [rsp + 0x158c8]
lea rcx, [rsp + 0xbfc0]
call fcn.1400069a0
mov qword [rsp + 0x16130], rax
mov rax, qword [rsp + 0x16130]
mov qword [rsp + 0x16138], rax
mov rdx, qword [rsp + 0x16138]
lea rcx, [rsp + 0xbfb0]
call fcn.140002d20
nop
lea rcx, [rsp + 0x158c8]
call fcn.140001470
jmp 0x1401c8a42
lea rcx, [0x14021f5e8]
call fcn.1400a81f4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021f600]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a938c
test eax, eax
jne 0x1401c8bd5
mov r8d, 8
lea rdx, [rsp + 0x158d0]
lea rcx, [rsp + 0xbfc0]
call fcn.1400069a0
mov qword [rsp + 0x16140], rax
mov rcx, qword [rsp + 0x16140]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xbfb8], eax
lea rcx, [rsp + 0x158d0]
call fcn.140001470
jmp 0x1401c8a42
lea rcx, [0x14021f618]
call fcn.1400a81f4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021f630]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a938c
test eax, eax
jne 0x1401c8c59
mov r8d, 0xa
lea rdx, [rsp + 0x158d8]
lea rcx, [rsp + 0xbfc0]
call fcn.1400069a0
mov qword [rsp + 0x16148], rax
mov rcx, qword [rsp + 0x16148]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xb798], eax
lea rcx, [rsp + 0x158d8]
call fcn.140001470
jmp 0x1401c8a42
jmp 0x1401c8a42
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.VERSION_ERROR
lea rcx, [rsp + 0xbfb0]
call fcn.140005fd0
test eax, eax
jne 0x1401c8cc5
lea r8, [0x14021f668]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001470
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001470
jmp 0x1401ccff2
xor eax, eax
mov word [rsp + 0xb7b0], ax
lea rdi, [rsp + 0xb7b2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x158e0]
call fcn.140001000
mov qword [rsp + 0x16150], rax
mov rax, qword [rsp + 0x16150]
mov qword [rsp + 0x16158], rax
lea r8, [0x14021f3c4]
mov rdx, qword [rsp + 0x16158]
lea rcx, [rsp + 0x158e8]
call fcn.1400010b0
mov qword [rsp + 0x16160], rax
mov rax, qword [rsp + 0x16160]
mov qword [rsp + 0x16168], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x16168]
lea rcx, [rsp + 0x158f0]
call fcn.1400010b0
mov qword [rsp + 0x16170], rax
mov rax, qword [rsp + 0x16170]
mov qword [rsp + 0x16178], rax
lea r8, [0x14021f680]
mov rdx, qword [rsp + 0x16178]
lea rcx, [rsp + 0x158f8]
call fcn.1400010b0
mov qword [rsp + 0x16180], rax
mov rcx, qword [rsp + 0x16180]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb7b0]
lea r8, [0x14021f3d4]
lea rdx, [0x14021f690]
lea rcx, [0x14021f6a8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x158f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x158f0]
call fcn.140001470
nop
lea rcx, [rsp + 0x158e8]
call fcn.140001470
nop
lea rcx, [rsp + 0x158e0]
call fcn.140001470
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15908]
call fcn.140004dc0
mov qword [rsp + 0x16188], rax
mov rcx, qword [rsp + 0x16188]
call fcn.140007b70
mov byte [rsp + 0x15900], al
lea rcx, [rsp + 0x15908]
call fcn.140001470
movzx edx, byte [rsp + 0x15900]
test edx, edx
je 0x1401c8e91
lea r8, [0x14021f6b8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001470
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15918]
call fcn.140004dc0
mov qword [rsp + 0x16190], rax
mov rax, qword [rsp + 0x16190]
mov qword [rsp + 0x16198], rax
mov rcx, qword [rsp + 0x16198]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0xbfb0]
call fcn.140005fd0
mov dword [rsp + 0x15910], eax
lea rcx, [rsp + 0x15918]
call fcn.140001470
cmp dword [rsp + 0x15910], 0
je 0x1401c8f3a
lea r8, [0x14021f6d8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001470
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001470
jmp 0x1401ccff2
mov r9d, dword [rsp + 0xb798]
mov r8d, dword [rsp + 0xbfb8]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403ab660]
call fcn.140132870
mov dword [rsp + 0x161a0], eax
cmp dword [rsp + 0x161a0], 0xffffffff
je 0x1401c8f84
cmp dword [rsp + 0x161a0], 0
je 0x1401c8fa6
cmp dword [rsp + 0x161a0], 1
je 0x1401c8fc8
jmp 0x1401c8fea
lea r8, str._ERR_GET_DEVICEID_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c900b
lea r8, str._ERR_INVALID_CLIENTID_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c900b
lea r8, str.OK_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401c900b
lea r8, str._ERR_OPERATION_FAILURE_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001470
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x14021f750]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x14021f758]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401c9d48
lea rcx, str.upload
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xc800]
call fcn.1400dd020
nop
lea rdx, [0x14021f768]
lea rcx, [rsp + 0xc800]
call fcn.140006970
mov dword [rsp + 0xc814], 0
lea r9, [rsp + 0xc814]
lea r8, [0x14021f3e4]
lea rdx, [rsp + 0x15920]
lea rcx, [rsp + 0xc800]
call fcn.140006540
mov qword [rsp + 0x161a8], rax
mov rcx, qword [rsp + 0x161a8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xc810], eax
lea rcx, [rsp + 0x15920]
call fcn.140001470
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c9108
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea r9, [rsp + 0xc814]
lea r8, [0x14021f434]
lea rdx, [rsp + 0x15928]
lea rcx, [rsp + 0xc800]
call fcn.140006540
mov qword [rsp + 0x161b0], rax
mov rcx, qword [rsp + 0x161b0]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xc7f8], eax
lea rcx, [rsp + 0x15928]
call fcn.140001470
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c9179
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xc808]
call fcn.140002d50
nop
mov edx, dword [rsp + 0xc814]
lea rcx, [rsp + 0xc800]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x22
jne 0x1401c9215
mov eax, dword [rsp + 0xc814]
add eax, 1
mov dword [rsp + 0xc814], eax
lea r9, [rsp + 0xc814]
lea r8, [0x14021f5c4]
lea rdx, [rsp + 0x15930]
lea rcx, [rsp + 0xc800]
call fcn.140006540
mov qword [rsp + 0x161b8], rax
mov rax, qword [rsp + 0x161b8]
mov qword [rsp + 0x161c0], rax
mov rdx, qword [rsp + 0x161c0]
lea rcx, [rsp + 0xc808]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15930]
call fcn.140001470
jmp 0x1401c9274
lea r9, [rsp + 0xc814]
lea r8, [0x14021f5d4]
lea rdx, [rsp + 0x15938]
lea rcx, [rsp + 0xc800]
call fcn.140006540
mov qword [rsp + 0x161c8], rax
mov rax, qword [rsp + 0x161c8]
mov qword [rsp + 0x161d0], rax
mov rdx, qword [rsp + 0x161d0]
lea rcx, [rsp + 0xc808]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15938]
call fcn.140001470
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c928f
lea rax, [0x14021f5e4]
mov qword [rsp + 0x161d8], rax
jmp 0x1401c92f3
lea r9, [rsp + 0xc814]
lea r8, [0x14021f664]
lea rdx, [rsp + 0x15940]
lea rcx, [rsp + 0xc800]
call fcn.140006540
mov qword [rsp + 0x161e0], rax
mov rax, qword [rsp + 0x161e0]
mov qword [rsp + 0x161e8], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x200
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x161e8]
call fcn.1400012c0
mov qword [rsp + 0x161d8], rax
mov rdx, qword [rsp + 0x161d8]
lea rcx, [rsp + 0xc7f0]
call fcn.140002090
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x200
test eax, eax
je 0x1401c9331
and dword [rsp + 0x15d10], 0xfffffdff
lea rcx, [rsp + 0x15940]
call fcn.140001470
xor eax, eax
mov word [rsp + 0xbfe0], ax
lea rdi, [rsp + 0xbfe2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15948]
call fcn.140001000
mov qword [rsp + 0x161f0], rax
mov rax, qword [rsp + 0x161f0]
mov qword [rsp + 0x161f8], rax
lea r8, [0x14021f77c]
mov rdx, qword [rsp + 0x161f8]
lea rcx, [rsp + 0x15950]
call fcn.1400010b0
mov qword [rsp + 0x16200], rax
mov rax, qword [rsp + 0x16200]
mov qword [rsp + 0x16208], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x16208]
lea rcx, [rsp + 0x15958]
call fcn.1400010b0
mov qword [rsp + 0x16210], rax
mov rax, qword [rsp + 0x16210]
mov qword [rsp + 0x16218], rax
lea r8, [0x14021f770]
mov rdx, qword [rsp + 0x16218]
lea rcx, [rsp + 0x15960]
call fcn.1400010b0
mov qword [rsp + 0x16220], rax
mov rcx, qword [rsp + 0x16220]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xbfe0]
lea r8, [0x14021f780]
lea rdx, [0x14021f788]
lea rcx, [0x14021f7a0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15960]
call fcn.140001470
nop
lea rcx, [rsp + 0x15958]
call fcn.140001470
nop
lea rcx, [rsp + 0x15950]
call fcn.140001470
nop
lea rcx, [rsp + 0x15948]
call fcn.140001470
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15970]
call fcn.140004dc0
mov qword [rsp + 0x16228], rax
mov rcx, qword [rsp + 0x16228]
call fcn.140007b70
mov byte [rsp + 0x15968], al
lea rcx, [rsp + 0x15970]
call fcn.140001470
movzx edx, byte [rsp + 0x15968]
test edx, edx
je 0x1401c950b
lea r8, [0x14021f7b0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001470
nop
lea rcx, [rsp + 0xc808]
call fcn.140001470
nop
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15980]
call fcn.140004dc0
mov qword [rsp + 0x16230], rax
mov rax, qword [rsp + 0x16230]
mov qword [rsp + 0x16238], rax
mov rcx, qword [rsp + 0x16238]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0xc7f0]
call fcn.140005fd0
mov dword [rsp + 0x15978], eax
lea rcx, [rsp + 0x15980]
call fcn.140001470
cmp dword [rsp + 0x15978], 0
je 0x1401c95c2
lea r8, [0x14021f7d0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001470
nop
lea rcx, [rsp + 0xc808]
call fcn.140001470
nop
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xc7e8]
call fcn.140002230
nop
mov r8d, 1
lea rdx, [rsp + 0x15990]
lea rcx, [rsp + 0xc7e8]
call fcn.140006a00
mov qword [rsp + 0x16240], rax
lea rdx, [0x14021f7e8]
mov rcx, qword [rsp + 0x16240]
call fcn.140006d30
mov byte [rsp + 0x15988], al
lea rcx, [rsp + 0x15990]
call fcn.140001470
movzx edx, byte [rsp + 0x15988]
test edx, edx
je 0x1401c964c
lea rdx, [0x14021f7ec]
lea rcx, [rsp + 0xc7e8]
call fcn.140005fa0
lea rcx, [rsp + 0xc808]
call fcn.1400012c0
lea rdx, [0x14021f7f0]
mov rcx, rax
call fcn.1400a9bac
test rax, rax
jne 0x1401c96c7
lea r8, [rsp + 0xc808]
lea rdx, [rsp + 0xc7e8]
lea rcx, [rsp + 0x15998]
call fcn.140006b70
mov qword [rsp + 0x16248], rax
mov rax, qword [rsp + 0x16248]
mov qword [rsp + 0x16250], rax
mov rdx, qword [rsp + 0x16250]
lea rcx, [rsp + 0xc7e8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15998]
call fcn.140001470
jmp 0x1401c96dc
lea rdx, [rsp + 0xc808]
lea rcx, [rsp + 0xc7e8]
call fcn.140002d20
lea rcx, [rsp + 0xc7e8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c976c
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x14021f810]
mov ecx, 1
call fcn.1400dc5d0
lea r8, [0x14021f7f8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001470
nop
lea rcx, [rsp + 0xc808]
call fcn.140001470
nop
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x14021f870]
xor ecx, ecx
call fcn.1400dc5d0
lea rcx, [rsp + 0xc7e8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movsxd rdi, dword [rsp + 0xc7f8]
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
lea rcx, [rsp + 0xc7e8]
call fcn.1400012c0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140100970
mov dword [rsp + 0xc7e0], eax
cmp dword [rsp + 0xc7e0], 0
jne 0x1401c9871
lea rcx, [rsp + 0xc7e8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rsp + 0xc7e8]
lea rdx, str._ERROR__Ceate_image__s_error
mov ecx, 1
call fcn.1400dc5d0
lea r8, str._ERR_CREATE_VMDK_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001470
nop
lea rcx, [rsp + 0xc808]
call fcn.140001470
nop
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xc820]
call fcn.14000efb0
nop
lea rax, [rsp + 0x159a0]
mov qword [rsp + 0x159a8], rax
lea rdx, [rsp + 0xc7e8]
mov rcx, qword [rsp + 0x159a8]
call fcn.140001440
mov qword [rsp + 0x16258], rax
mov rdx, qword [rsp + 0x16258]
lea rcx, [rsp + 0xc820]
call fcn.1401d05c0
test eax, eax
jne 0x1401c9936
lea rdx, [0x14021f898]
lea rcx, [rsp + 0x159b0]
call fcn.1400eeb20
mov qword [rsp + 0x16260], rax
mov rax, qword [rsp + 0x16260]
mov qword [rsp + 0x16268], rax
lea rcx, [rsp + 0xc9c0]
mov rdx, qword [rsp + 0x16268]
call fcn.140002d20
nop
lea rcx, [rsp + 0x159b0]
call fcn.140001470
lea rcx, [rsp + 0xc9c8]
lea rdx, [rsp + 0xc7e8]
call fcn.140002d20
lea rcx, [rsp + 0xc820]
call fcn.1401cfef0
lea rcx, [rsp + 0xbfd8]
call fcn.140002d50
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140002d50
nop
lea rax, [rsp + 0x159b8]
mov qword [rsp + 0x159c0], rax
lea rdx, [0x14021f7f4]
mov rcx, qword [rsp + 0x159c0]
call fcn.140002090
mov qword [rsp + 0x16270], rax
mov rax, qword [rsp + 0x16270]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xbfd0]
lea rdx, [rsp + 0xbfd8]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140016910
lea rcx, [rsp + 0xbfd0]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401c99d9
lea rdx, [0x14021f918]
lea rcx, [rsp + 0xbfd0]
call fcn.140002060
lea rcx, [rsp + 0xbfd8]
call fcn.1400068b0
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d2da0
test eax, eax
jne 0x1401c9bb3
lea rax, [rsp + 0x159c8]
mov qword [rsp + 0x159d0], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159d0]
call fcn.140001440
mov qword [rsp + 0x16278], rax
mov rdx, qword [rsp + 0x16278]
lea rcx, [rsp + 0x470]
call fcn.1401d2c30
test eax, eax
jne 0x1401c9b2b
lea rax, [rsp + 0x159d8]
mov qword [rsp + 0x159e0], rax
lea rax, [rsp + 0x159e8]
mov qword [rsp + 0x159f0], rax
lea rdx, [rsp + 0xbfd0]
mov rcx, qword [rsp + 0x159e0]
call fcn.140001440
mov qword [rsp + 0x16280], rax
mov rax, qword [rsp + 0x16280]
mov qword [rsp + 0x16288], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159f0]
call fcn.140001440
mov qword [rsp + 0x16290], rax
mov rax, qword [rsp + 0x16288]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x16290]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d2f00
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f928]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c9b19
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f930]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
jmp 0x1401c9bb1
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000f260
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002d20
lea rcx, [rsp + 0x6f0]
lea rdx, [0x14021f934]
call fcn.140002060
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f938]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c9ba4
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f940]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
jmp 0x1401c9c2d
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xbfd8]
call fcn.140002d20
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002d20
lea rcx, [rsp + 0x6f0]
lea rdx, [0x14021f944]
call fcn.140002060
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f948]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401c9c20
lea rcx, [rsp + 0x658]
lea rdx, [0x14021f950]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
lea rcx, [rsp + 0x6f8]
lea rdx, [0x14021f954]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
lea rcx, [0x1403ab660]
call fcn.140022520
mov r8d, eax
lea rdx, str.OK__d_r_n
lea rcx, [rsp + 0xb00]
call fcn.1400acc54
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140001470
nop
lea rcx, [rsp + 0xbfd8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc820]
call fcn.140005d50
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001470
nop
lea rcx, [rsp + 0xc808]
call fcn.140001470
nop
lea rcx, [rsp + 0xc800]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x14021f968]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x14021f978]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401caec1
lea rcx, str.disk2vhd
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xd5f0]
call fcn.1400dd020
nop
lea rdx, [0x14021f994]
lea rcx, [rsp + 0xd5f0]
call fcn.140006970
mov dword [rsp + 0xd604], 0
lea r9, [rsp + 0xd604]
lea r8, [0x14021f99c]
lea rdx, [rsp + 0x159f8]
lea rcx, [rsp + 0xd5f0]
call fcn.140006540
mov qword [rsp + 0x16298], rax
mov rcx, qword [rsp + 0x16298]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xd600], eax
lea rcx, [rsp + 0x159f8]
call fcn.140001470
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401c9e46
lea r8, [0x14021f9a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xd5f8]
call fcn.140002d50
nop
mov edx, dword [rsp + 0xd604]
lea rcx, [rsp + 0xd5f0]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x22
jne 0x1401c9ee2
mov eax, dword [rsp + 0xd604]
add eax, 1
mov dword [rsp + 0xd604], eax
lea r9, [rsp + 0xd604]
lea r8, [0x14021f9b4]
lea rdx, [rsp + 0x15a00]
lea rcx, [rsp + 0xd5f0]
call fcn.140006540
mov qword [rsp + 0x162a0], rax
mov rax, qword [rsp + 0x162a0]
mov qword [rsp + 0x162a8], rax
mov rdx, qword [rsp + 0x162a8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15a00]
call fcn.140001470
jmp 0x1401c9f41
lea r9, [rsp + 0xd604]
lea r8, [0x14021f9b8]
lea rdx, [rsp + 0x15a08]
lea rcx, [rsp + 0xd5f0]
call fcn.140006540
mov qword [rsp + 0x162b0], rax
mov rax, qword [rsp + 0x162b0]
mov qword [rsp + 0x162b8], rax
mov rdx, qword [rsp + 0x162b8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15a08]
call fcn.140001470
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401c9f5c
lea rax, [0x14021f9bc]
mov qword [rsp + 0x162c0], rax
jmp 0x1401c9fc0
lea r9, [rsp + 0xd604]
lea r8, [0x14021f9c0]
lea rdx, [rsp + 0x15a10]
lea rcx, [rsp + 0xd5f0]
call fcn.140006540
mov qword [rsp + 0x162c8], rax
mov rax, qword [rsp + 0x162c8]
mov qword [rsp + 0x162d0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x400
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x162d0]
call fcn.1400012c0
mov qword [rsp + 0x162c0], rax
mov rdx, qword [rsp + 0x162c0]
lea rcx, [rsp + 0xd5c0]
call fcn.140002090
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x400
test eax, eax
je 0x1401c9ffe
and dword [rsp + 0x15d10], 0xfffffbff
lea rcx, [rsp + 0x15a10]
call fcn.140001470
xor eax, eax
mov word [rsp + 0xcdb0], ax
lea rdi, [rsp + 0xcdb2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15a18]
call fcn.140001000
mov qword [rsp + 0x162d8], rax
mov rax, qword [rsp + 0x162d8]
mov qword [rsp + 0x162e0], rax
lea r8, [0x14021f9c4]
mov rdx, qword [rsp + 0x162e0]
lea rcx, [rsp + 0x15a20]
call fcn.1400010b0
mov qword [rsp + 0x162e8], rax
mov rax, qword [rsp + 0x162e8]
mov qword [rsp + 0x162f0], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x162f0]
lea rcx, [rsp + 0x15a28]
call fcn.1400010b0
mov qword [rsp + 0x162f8], rax
mov rax, qword [rsp + 0x162f8]
mov qword [rsp + 0x16300], rax
lea r8, [0x14021f9c8]
mov rdx, qword [rsp + 0x16300]
lea rcx, [rsp + 0x15a30]
call fcn.1400010b0
mov qword [rsp + 0x16308], rax
mov rcx, qword [rsp + 0x16308]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xcdb0]
lea r8, [0x14021f9d4]
lea rdx, [0x14021f9d8]
lea rcx, [0x14021f9f0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15a30]
call fcn.140001470
nop
lea rcx, [rsp + 0x15a28]
call fcn.140001470
nop
lea rcx, [rsp + 0x15a20]
call fcn.140001470
nop
lea rcx, [rsp + 0x15a18]
call fcn.140001470
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a40]
call fcn.140004dc0
mov qword [rsp + 0x16310], rax
mov rcx, qword [rsp + 0x16310]
call fcn.140007b70
mov byte [rsp + 0x15a38], al
lea rcx, [rsp + 0x15a40]
call fcn.140001470
movzx edx, byte [rsp + 0x15a38]
test edx, edx
je 0x1401ca1d8
lea r8, [0x14021fa00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a50]
call fcn.140004dc0
mov qword [rsp + 0x16318], rax
mov rax, qword [rsp + 0x16318]
mov qword [rsp + 0x16320], rax
mov rcx, qword [rsp + 0x16320]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0xd5c0]
call fcn.140005fd0
mov dword [rsp + 0x15a48], eax
lea rcx, [rsp + 0x15a50]
call fcn.140001470
cmp dword [rsp + 0x15a48], 0
je 0x1401ca28f
lea r8, [0x14021fa20]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xd5b8]
call fcn.140002230
nop
mov r8d, 1
lea rdx, [rsp + 0x15a60]
lea rcx, [rsp + 0xd5b8]
call fcn.140006a00
mov qword [rsp + 0x16328], rax
lea rdx, [0x14021fa38]
mov rcx, qword [rsp + 0x16328]
call fcn.140006d30
mov byte [rsp + 0x15a58], al
lea rcx, [rsp + 0x15a60]
call fcn.140001470
movzx edx, byte [rsp + 0x15a58]
test edx, edx
je 0x1401ca319
lea rdx, [0x14021fa3c]
lea rcx, [rsp + 0xd5b8]
call fcn.140005fa0
lea rcx, [rsp + 0xd5f8]
call fcn.1400012c0
lea rdx, [0x14021fa40]
mov rcx, rax
call fcn.1400a9bac
test rax, rax
jne 0x1401ca394
lea r8, [rsp + 0xd5f8]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0x15a68]
call fcn.140006b70
mov qword [rsp + 0x16330], rax
mov rax, qword [rsp + 0x16330]
mov qword [rsp + 0x16338], rax
mov rdx, qword [rsp + 0x16338]
lea rcx, [rsp + 0xd5b8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15a68]
call fcn.140001470
jmp 0x1401ca3a9
lea rdx, [rsp + 0xd5f8]
lea rcx, [rsp + 0xd5b8]
call fcn.140002d20
lea rcx, [rsp + 0xd5b8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401ca439
mov r8, qword [rsp + 0xd5b8]
lea rdx, str._ERROR__Cannot_create_image___s_exists
mov ecx, 1
call fcn.1400dc5d0
lea r8, str._ERR_FILE_EXISTS_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
mov r8, qword [rsp + 0xd5b8]
lea rdx, str.Create_new_image__s
xor ecx, ecx
call fcn.1400dc5d0
lea rcx, [rsp + 0xd5b8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14021fa44]
lea rcx, [rsp + 0xcda0]
call fcn.140002090
nop
lea rdx, str._echo_off_r_n_t_t_t_t_t_t_t___REM_CCBootShare_Required_Services_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:rpc_endpoint_mapper_r_n_t_t_t_t_t_t_t___REM_RPC_Endpoint_Mapper_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_mapper_service_r_n_t_t_t_t_t_t_t___sc_config_nsi_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_nsi_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:dcom_server_process_launcher_r_n_t_t_t_t_t_t_t___REM_DCOM_Server_Process_Launcher_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_dcom_service_r_n_t_t_t_t_t_t_t___sc_config_DcomLaunch_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_DcomLaunch_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:remote_procedure_call_r_n_t_t_t_t_t_t_t___REM_Remote_Procedure_Call__RPC__r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_service_r_n_t_t_t_t_t_t_t___sc_config_RpcSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_RpcSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:security_accounts_manager_r_n_t_t_t_t_t_t_t___REM_Security_Accounts_Manager_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_security_service_r_n_t_t_t_t_t_t_t___sc_config_SamSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_SamSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:server_service_r_n_t_t_t_t_t_t_t___REM_Server_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_server_service_r_n_t_t_t_t_t_t_t___sc_config_LanmanServer_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_LanmanServer_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:bat_exit_r_n_t_t_t_t_t_t_t___echo_12__get_sid_gust_variable_r_n_t_t_t_t_t_t_t___for__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_t_t_t_t_t_t_t___if_not____a__SID____r_n_t_t_t_t_t_t_t___set_sid_guest__a_r_n_t_t_t_t_t_t_t___goto_loop_end_r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:loop_end_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_13__create_script_for_regini_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_14__add_permission_for_machine_security_r_n_t_t_t_t_t_t_t___net_user_guest__active:yes_r_n_t_t_t_t_t_t_t___regini_x_r_n_t_t_t_t_t_t_t___del_x_r_n_t_t_t_t_t_t_t____echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_t_t_t_t_t_t_t____echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_t_t_t_t_t_t_t____echo__hex_0_:42_00_00_00____y.reg_r_n_t_t_t_t_t_t_t___reg_import_y.reg_r_n_t_t_t_t_t_t_t___del_y.reg_r_n_t_t_t_t_t_t_t____echo_on_r_n
lea rcx, [rsp + 0xcda0]
call fcn.140002060
mov rdx, qword [rsp + 0x165d0]
add rdx, 0x228
lea r8, [0x140221298]
lea rcx, [rsp + 0xd5c8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0xd5d0]
call fcn.140092664
nop
lea rcx, [rsp + 0xd5c8]
call fcn.1400012c0
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.140092dec
test eax, eax
je 0x1401ca61c
lea rcx, [rsp + 0xd5d0]
call fcn.140027820
lea rcx, [rsp + 0xcda0]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15a70]
call fcn.1400d8910
mov qword [rsp + 0x16340], rax
mov rax, qword [rsp + 0x16340]
mov qword [rsp + 0x16348], rax
lea rcx, [rsp + 0xcda0]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15a78]
call fcn.1400d8910
mov qword [rsp + 0x16350], rax
mov rax, qword [rsp + 0x16350]
mov qword [rsp + 0x16358], rax
mov rcx, qword [rsp + 0x16348]
call fcn.1400019f0
mov edi, eax
mov rcx, qword [rsp + 0x16358]
call fcn.1400012c0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.1400922e4
nop
lea rcx, [rsp + 0x15a78]
call fcn.140001470
nop
lea rcx, [rsp + 0x15a70]
call fcn.140001470
lea rcx, [rsp + 0xd5d0]
call fcn.1400925dc
lea rcx, [rsp + 0xd5c8]
call fcn.1400012c0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.1400048c0
lea rcx, [rsp + 0xd5c8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0xcb98]
call fcn.140001440
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0xcb98]
call fcn.1400061a0
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xcb98]
call fcn.140006840
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x15a80]
lea rcx, [rsp + 0xcb98]
call fcn.140002230
mov qword [rsp + 0x16360], rax
mov rax, qword [rsp + 0x16360]
mov qword [rsp + 0x16368], rax
mov rdx, qword [rsp + 0x16368]
lea rcx, [rsp + 0xcb98]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15a80]
call fcn.140001470
lea rcx, [rsp + 0xcb98]
call fcn.1400019f0
cmp eax, 2
jne 0x1401ca732
mov edx, 1
lea rcx, [rsp + 0xcb98]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x3a
jne 0x1401ca732
lea r8, [0x140221294]
lea rdx, [rsp + 0xcb98]
lea rcx, [rsp + 0x15a88]
call fcn.1400010b0
mov qword [rsp + 0x16370], rax
mov rax, qword [rsp + 0x16370]
mov qword [rsp + 0x16378], rax
mov rdx, qword [rsp + 0x16378]
lea rcx, [rsp + 0xcb98]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15a88]
call fcn.140001470
mov r8, qword [rsp + 0xcb98]
lea rdx, str.SetAcl___s__start
xor ecx, ecx
call fcn.1400dc5d0
xor edx, edx
lea rcx, [rsp + 0xcbc0]
call fcn.140176dc0
nop
lea rax, [rsp + 0x15a90]
mov qword [rsp + 0x15a98], rax
lea rax, [rsp + 0x15aa0]
mov qword [rsp + 0x15aa8], rax
lea rax, [rsp + 0x15ab0]
mov qword [rsp + 0x15ab8], rax
lea rdx, [0x1402212e8]
mov rcx, qword [rsp + 0x15a98]
call fcn.140002090
mov qword [rsp + 0x16380], rax
mov rax, qword [rsp + 0x16380]
mov qword [rsp + 0x16388], rax
lea rdx, [0x1402212f8]
mov rcx, qword [rsp + 0x15aa8]
call fcn.140002090
mov qword [rsp + 0x16390], rax
mov rax, qword [rsp + 0x16390]
mov qword [rsp + 0x16398], rax
lea rdx, [rsp + 0xcb98]
mov rcx, qword [rsp + 0x15ab8]
call fcn.140001440
mov qword [rsp + 0x163a0], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x16388]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x16398]
mov r8d, 1
mov rdx, qword [rsp + 0x163a0]
lea rcx, [rsp + 0xcbc0]
call fcn.140182210
mov dword [rsp + 0xd5b0], eax
mov r9, qword [rsp + 0xcb98]
mov r8d, dword [rsp + 0xd5b0]
lea rdx, str.SetAcl___d____s_
xor ecx, ecx
call fcn.1400dc5d0
xor r8d, r8d
lea rdx, [0x140221338]
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea rcx, [0x140221350]
call fcn.14001a0a0
mov qword [rsp + 0xcb60], rax
mov dword [rsp + 0xcb68], 0
mov qword [rsp + 0xcb70], 0
mov dword [rsp + 0xcb78], 0x7f
mov dword [rsp + 0xcb7c], 0xffffffff
mov dword [rsp + 0xcb80], 0
lea rcx, [rsp + 0xcb98]
call fcn.1400245f0
mov rcx, rax
call fcn.14001a0a0
mov qword [rsp + 0xcb88], rax
lea rcx, [0x140221368]
call fcn.14001a0a0
mov qword [rsp + 0xcb90], rax
xor r9d, r9d
lea r8, [rsp + 0xcb60]
mov edx, 2
xor ecx, ecx
call sub.NETAPI32.dll_NetShareAdd
mov dword [rsp + 0xcba8], eax
cmp dword [rsp + 0xcba8], 0
je 0x1401ca9c8
lea rdx, str._ERROR__Sharing_of_image_file_failed.
mov ecx, 1
call fcn.1400dc5d0
lea r8, str._ERR_SHARE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140176cd0
nop
lea rcx, [rsp + 0xcb98]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5d0]
call fcn.1400928b0
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140001470
nop
lea rcx, [rsp + 0xcda0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xd610]
call fcn.14000efb0
nop
lea rax, [rsp + 0x15ac0]
mov qword [rsp + 0x15ac8], rax
lea rdx, [rsp + 0xd5b8]
mov rcx, qword [rsp + 0x15ac8]
call fcn.140001440
mov qword [rsp + 0x163a8], rax
mov rdx, qword [rsp + 0x163a8]
lea rcx, [rsp + 0xd610]
call fcn.1401d05c0
test eax, eax
jne 0x1401caa8d
lea rdx, [0x1402213f0]
lea rcx, [rsp + 0x15ad0]
call fcn.1400eeb20
mov qword [rsp + 0x163b0], rax
mov rax, qword [rsp + 0x163b0]
mov qword [rsp + 0x163b8], rax
lea rcx, [rsp + 0xd7b0]
mov rdx, qword [rsp + 0x163b8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15ad0]
call fcn.140001470
lea rcx, [rsp + 0xd7b8]
lea rdx, [rsp + 0xd5b8]
call fcn.140002d20
lea rcx, [rsp + 0xd610]
call fcn.1401cfef0
lea rcx, [rsp + 0xcbb0]
call fcn.140002d50
nop
lea rcx, [rsp + 0xcba0]
call fcn.140002d50
nop
lea rax, [rsp + 0x15ad8]
mov qword [rsp + 0x15ae0], rax
lea rdx, [0x1402212e4]
mov rcx, qword [rsp + 0x15ae0]
call fcn.140002090
mov qword [rsp + 0x163c0], rax
mov rax, qword [rsp + 0x163c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xcba0]
lea rdx, [rsp + 0xcbb0]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140016910
lea rcx, [rsp + 0xcba0]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401cab30
lea rdx, str.Master
lea rcx, [rsp + 0xcba0]
call fcn.140002060
lea rcx, [rsp + 0xcbb0]
call fcn.1400068b0
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d2da0
test eax, eax
jne 0x1401cad0a
lea rax, [rsp + 0x15ae8]
mov qword [rsp + 0x15af0], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15af0]
call fcn.140001440
mov qword [rsp + 0x163c8], rax
mov rdx, qword [rsp + 0x163c8]
lea rcx, [rsp + 0x470]
call fcn.1401d2c30
test eax, eax
jne 0x1401cac82
lea rax, [rsp + 0x15af8]
mov qword [rsp + 0x15b00], rax
lea rax, [rsp + 0x15b08]
mov qword [rsp + 0x15b10], rax
lea rdx, [rsp + 0xcba0]
mov rcx, qword [rsp + 0x15b00]
call fcn.140001440
mov qword [rsp + 0x163d0], rax
mov rax, qword [rsp + 0x163d0]
mov qword [rsp + 0x163d8], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15b10]
call fcn.140001440
mov qword [rsp + 0x163e0], rax
mov rax, qword [rsp + 0x163d8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x163e0]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d2f00
lea rcx, [rsp + 0x658]
lea rdx, [0x140221418]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401cac70
lea rcx, [rsp + 0x658]
lea rdx, [0x1402213ec]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
jmp 0x1401cad08
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000f260
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002d20
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140221420]
call fcn.140002060
lea rcx, [rsp + 0x658]
lea rdx, [0x140221424]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401cacfb
lea rcx, [rsp + 0x658]
lea rdx, [0x14022142c]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
jmp 0x1401cad84
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xcbb0]
call fcn.140002d20
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002d20
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140221430]
call fcn.140002060
lea rcx, [rsp + 0x658]
lea rdx, [0x140221434]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401cad77
lea rcx, [rsp + 0x658]
lea rdx, [0x14022143c]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
lea rcx, [rsp + 0x6f8]
lea rdx, [0x140221440]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
lea r8, [0x140221444]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xcba0]
call fcn.140001470
nop
lea rcx, [rsp + 0xcbb0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd610]
call fcn.140005d50
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140176cd0
nop
lea rcx, [rsp + 0xcb98]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5d0]
call fcn.1400928b0
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140001470
nop
lea rcx, [rsp + 0xcda0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x140221450]
call fcn.1400a9170
mov r8, rax
lea rdx, str.endupload
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401cb163
cmp dword [rsp + 0x608], 0
jbe 0x1401cb12d
lea rcx, [rsp + 0x6f8]
lea rdx, [0x14022146c]
call fcn.140006cf0
movzx eax, al
test eax, eax
je 0x1401cb12d
lea rcx, [rsp + 0x6f8]
lea rdx, [0x140221470]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
lea rcx, [0x140221478]
call fcn.1400a9170
mov r8, rax
lea rdx, str.endupload_ok
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401cb0de
lea rcx, [rsp + 0xd950]
call fcn.14000efb0
nop
lea rax, [rsp + 0x15b18]
mov qword [rsp + 0x15b20], rax
lea rdx, [0x140221498]
mov rcx, qword [rsp + 0x15b20]
call fcn.1400eeb20
mov qword [rsp + 0x163e8], rax
mov rdx, qword [rsp + 0x163e8]
lea rcx, [rsp + 0xd950]
call fcn.1401d0460
test eax, eax
je 0x1401cb0d1
lea rcx, [rsp + 0x15b28]
call fcn.14000f6f0
lea r8, str._m_d_H_M
lea rdx, [rsp + 0x15b30]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0x163f0], rax
mov rax, qword [rsp + 0x163f0]
mov qword [rsp + 0x163f8], rax
mov r8, qword [rsp + 0x163f8]
lea rdx, [0x1402214c8]
lea rcx, [rsp + 0x15b38]
call fcn.140006c30
mov qword [rsp + 0x16400], rax
mov rax, qword [rsp + 0x16400]
mov qword [rsp + 0x16408], rax
lea rcx, [rsp + 0xdaf0]
mov rdx, qword [rsp + 0x16408]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15b38]
call fcn.140001470
nop
lea rcx, [rsp + 0x15b30]
call fcn.140001470
lea rcx, [rsp + 0xd950]
call fcn.1401b8720
lea rcx, [rsp + 0x660]
mov r8d, dword [rsp + 0xdae8]
lea rdx, [0x1402214d0]
call fcn.140002be0
lea rcx, [rsp + 0x668]
lea rdx, [0x140221474]
call fcn.140002060
lea rcx, [rsp + 0x470]
call fcn.1401cfa40
lea rcx, [rsp + 0x950]
mov r8d, dword [rsp + 0x608]
lea rdx, [0x1402214d8]
call fcn.140002be0
lea rcx, [rsp + 0x7b0]
call fcn.1401b8720
nop
lea rcx, [rsp + 0xd950]
call fcn.140005d50
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
xor r8d, r8d
lea rdx, str.Disk2VHD
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea r8, [0x1402214f4]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401ccff2
lea rcx, [0x140221500]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x140221510]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401cb896
lea rcx, str.multisyncto
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xe4a8]
call fcn.1400dd020
nop
lea rdx, [0x140221530]
lea rcx, [rsp + 0xe4a8]
call fcn.140006970
mov dword [rsp + 0xe4b0], 0
lea r9, [rsp + 0xe4b0]
lea r8, [0x140221538]
lea rdx, [rsp + 0x15b40]
lea rcx, [rsp + 0xe4a8]
call fcn.140006540
mov qword [rsp + 0x16410], rax
mov rcx, qword [rsp + 0x16410]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xdc98], eax
lea rcx, [rsp + 0x15b40]
call fcn.140001470
cmp dword [rsp + 0xe4b0], 0xffffffff
jne 0x1401cb261
lea r8, [0x140221540]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
lea r9, [rsp + 0xe4b0]
lea r8, [0x14022153c]
lea rdx, [rsp + 0xe4a0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006540
nop
xor eax, eax
mov word [rsp + 0xdca0], ax
lea rdi, [rsp + 0xdca2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15b48]
call fcn.140001000
mov qword [rsp + 0x16418], rax
mov rax, qword [rsp + 0x16418]
mov qword [rsp + 0x16420], rax
lea r8, [0x140221564]
mov rdx, qword [rsp + 0x16420]
lea rcx, [rsp + 0x15b50]
call fcn.1400010b0
mov qword [rsp + 0x16428], rax
mov rax, qword [rsp + 0x16428]
mov qword [rsp + 0x16430], rax
call fcn.140010a50
mov r8, rax
mov rdx, qword [rsp + 0x16430]
lea rcx, [rsp + 0x15b58]
call fcn.1400010b0
mov qword [rsp + 0x16438], rax
mov rax, qword [rsp + 0x16438]
mov qword [rsp + 0x16440], rax
lea r8, [0x140221558]
mov rdx, qword [rsp + 0x16440]
lea rcx, [rsp + 0x15b60]
call fcn.1400010b0
mov qword [rsp + 0x16448], rax
mov rcx, qword [rsp + 0x16448]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xdca0]
lea r8, [0x140221568]
lea rdx, [0x140221570]
lea rcx, [0x140221588]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15b60]
call fcn.140001470
nop
lea rcx, [rsp + 0x15b58]
call fcn.140001470
nop
lea rcx, [rsp + 0x15b50]
call fcn.140001470
nop
lea rcx, [rsp + 0x15b48]
call fcn.140001470
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b70]
call fcn.140004dc0
mov qword [rsp + 0x16450], rax
mov rcx, qword [rsp + 0x16450]
call fcn.140007b70
mov byte [rsp + 0x15b68], al
lea rcx, [rsp + 0x15b70]
call fcn.140001470
movzx edx, byte [rsp + 0x15b68]
test edx, edx
je 0x1401cb452
lea r8, str._ERR_NEED_SET_ADMIN_PASSWORD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b80]
call fcn.140004dc0
mov qword [rsp + 0x16458], rax
mov rax, qword [rsp + 0x16458]
mov qword [rsp + 0x16460], rax
mov rcx, qword [rsp + 0x16460]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0xe4a0]
call fcn.140005fd0
mov dword [rsp + 0x15b78], eax
lea rcx, [rsp + 0x15b80]
call fcn.140001470
cmp dword [rsp + 0x15b78], 0
je 0x1401cb4fb
lea r8, str._ERR_NO_PERMISSION_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xdc90]
call fcn.140002d50
nop
cmp dword [rsp + 0xdc98], 0
jne 0x1401cb847
mov edx, dword [rsp + 0xe4b0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x22
jne 0x1401cb5a5
mov eax, dword [rsp + 0xe4b0]
add eax, 1
mov dword [rsp + 0xe4b0], eax
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402215d0]
lea rdx, [rsp + 0x15b88]
lea rcx, [rsp + 0xe4a8]
call fcn.140006540
mov qword [rsp + 0x16468], rax
mov rax, qword [rsp + 0x16468]
mov qword [rsp + 0x16470], rax
mov rdx, qword [rsp + 0x16470]
lea rcx, [rsp + 0xdc90]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15b88]
call fcn.140001470
jmp 0x1401cb604
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402215d4]
lea rdx, [rsp + 0x15b90]
lea rcx, [rsp + 0xe4a8]
call fcn.140006540
mov qword [rsp + 0x16478], rax
mov rax, qword [rsp + 0x16478]
mov qword [rsp + 0x16480], rax
mov rdx, qword [rsp + 0x16480]
lea rcx, [rsp + 0xdc90]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15b90]
call fcn.140001470
lea rcx, [rsp + 0xe4c0]
call fcn.14000efb0
nop
lea rax, [rsp + 0x15b98]
mov qword [rsp + 0x15ba0], rax
lea rdx, [rsp + 0xdc90]
mov rcx, qword [rsp + 0x15ba0]
call fcn.140001440
mov qword [rsp + 0x16488], rax
mov rdx, qword [rsp + 0x16488]
lea rcx, [rsp + 0xe4c0]
call fcn.1401d0460
test eax, eax
je 0x1401cb83a
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xeb40]
call fcn.14000eef0
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007bb0
nop
lea rdx, [rsp + 0xeeb0]
lea rcx, [rsp + 0xeb40]
call fcn.1401b8110
lea rcx, [rsp + 0xeeb0]
call fcn.140007c30
test rax, rax
jbe 0x1401cb71f
lea r8, str._ERR_CHILD_IMAGE_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005d50
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xe800]
call fcn.1401cd210
nop
lea rcx, [rsp + 0xee80]
call fcn.140007bb0
nop
lea rdx, [rsp + 0xee80]
lea rcx, [rsp + 0xe800]
call fcn.1401b8110
lea rcx, [rsp + 0xee80]
call fcn.140007c30
test rax, rax
jbe 0x1401cb802
lea r8, str._ERR_RECOVERY_POINT_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xee80]
call fcn.140007c00
nop
lea rcx, [rsp + 0xe800]
call fcn.140005d50
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005d50
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xee80]
call fcn.140007c00
nop
lea rcx, [rsp + 0xe800]
call fcn.140005d50
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005d50
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005d50
lea r8, [0x140221618]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x140221620]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x140221630]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401cc69a
lea rcx, str.robocopyready
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xf288]
call fcn.1400dd020
nop
lea rdx, [0x140221650]
lea rcx, [rsp + 0xf288]
call fcn.140006970
mov dword [rsp + 0xf2a0], 0
lea rcx, [rsp + 0xf298]
call fcn.140002d50
nop
lea rcx, [rsp + 0xf258]
call fcn.140002d50
nop
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x22
jne 0x1401cb9ac
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x140221658]
lea rdx, [rsp + 0x15ba8]
lea rcx, [rsp + 0xf288]
call fcn.140006540
mov qword [rsp + 0x16490], rax
mov rax, qword [rsp + 0x16490]
mov qword [rsp + 0x16498], rax
mov rdx, qword [rsp + 0x16498]
lea rcx, [rsp + 0xf298]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15ba8]
call fcn.140001470
jmp 0x1401cba0b
lea r9, [rsp + 0xf2a0]
lea r8, [0x14022165c]
lea rdx, [rsp + 0x15bb0]
lea rcx, [rsp + 0xf288]
call fcn.140006540
mov qword [rsp + 0x164a0], rax
mov rax, qword [rsp + 0x164a0]
mov qword [rsp + 0x164a8], rax
mov rdx, qword [rsp + 0x164a8]
lea rcx, [rsp + 0xf298]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15bb0]
call fcn.140001470
cmp dword [rsp + 0xf2a0], 0xffffffff
jne 0x1401cba64
lea r8, [0x140221660]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xf258]
call fcn.140001470
nop
lea rcx, [rsp + 0xf298]
call fcn.140001470
nop
lea rcx, [rsp + 0xf288]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0xf298]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401cbac7
lea r8, [0x140221678]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0xf258]
call fcn.140001470
nop
lea rcx, [rsp + 0xf298]
call fcn.140001470
nop
lea rcx, [rsp + 0xf288]
call fcn.140001470
jmp 0x1401ccff2
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x22
jne 0x1401cbb55
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x14022168c]
lea rdx, [rsp + 0x15bb8]
lea rcx, [rsp + 0xf288]
call fcn.140006540
mov qword [rsp + 0x164b0], rax
mov rax, qword [rsp + 0x164b0]
mov qword [rsp + 0x164b8], rax
mov rdx, qword [rsp + 0x164b8]
lea rcx, [rsp + 0xf258]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15bb8]
call fcn.140001470
jmp 0x1401cbbb4
lea r9, [rsp + 0xf2a0]
lea r8, [0x140221690]
lea rdx, [rsp + 0x15bc0]
lea rcx, [rsp + 0xf288]
call fcn.140006540
mov qword [rsp + 0x164c0], rax
mov rax, qword [rsp + 0x164c0]
mov qword [rsp + 0x164c8], rax
mov rdx, qword [rsp + 0x164c8]
lea rcx, [rsp + 0xf258]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15bc0]
call fcn.140001470
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15bc8]
call fcn.140010e20
mov qword [rsp + 0x164d0], rax
mov rax, qword [rsp + 0x164d0]
mov qword [rsp + 0x164d8], rax
mov rcx, qword [rsp + 0x164d8]
call fcn.140010eb0
mov rdx, rax
lea rcx, [rsp + 0xef00]
call fcn.140002090
nop
lea rcx, [rsp + 0x15bc8]
call fcn.140002e10
lea r8, [rsp + 0xef00]
lea rdx, [0x1402216b4]
lea rcx, [rsp + 0x15bd0]
call fcn.140006c30
mov qword [rsp + 0x164e0], rax
mov rax, qword [rsp + 0x164e0]
mov qword [rsp + 0x164e8], rax
lea r8, [0x140221698]
mov rdx, qword [rsp + 0x164e8]
lea rcx, [rsp + 0xeef8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15bd0]
call fcn.140001470
lea r8, [rsp + 0xf298]
lea rdx, [0x1402216c0]
lea rcx, [rsp + 0xf278]
call fcn.140006c30
nop
lea rcx, [rsp + 0xef10]
call fcn.14000f930
nop
lea rax, [rsp + 0x15bd8]
mov qword [rsp + 0x15be0], rax
lea rdx, [0x1402216c8]
mov rcx, qword [rsp + 0x15be0]
call fcn.140002090
mov qword [rsp + 0x164f0], rax
mov rdx, qword [rsp + 0x164f0]
lea rcx, [rsp + 0xef10]
call fcn.1401d2300
test eax, eax
je 0x1401cbd84
lea rdx, [rsp + 0xf0b0]
lea r8, [0x140221694]
lea rcx, [rsp + 0x15be8]
call fcn.1400010b0
mov qword [rsp + 0x164f8], rax
mov rax, qword [rsp + 0x164f8]
mov qword [rsp + 0x16500], rax
lea r8, [rsp + 0xf298]
mov rdx, qword [rsp + 0x16500]
lea rcx, [rsp + 0x15bf0]
call fcn.140006b70
mov qword [rsp + 0x16508], rax
mov rax, qword [rsp + 0x16508]
mov qword [rsp + 0x16510], rax
mov rdx, qword [rsp + 0x16510]
lea rcx, [rsp + 0xf278]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15bf0]
call fcn.140001470
nop
lea rcx, [rsp + 0x15be8]
call fcn.140001470
mov dword [rsp + 0xeee8], 1
lea rcx, [rsp + 0xf2b0]
call fcn.14000efb0
nop
lea rax, [rsp + 0x15bf8]
mov qword [rsp + 0x15c00], rax
lea rdx, [rsp + 0xf258]
mov rcx, qword [rsp + 0x15c00]
call fcn.140001440
mov qword [rsp + 0x16518], rax
mov rdx, qword [rsp + 0x16518]
lea rcx, [rsp + 0xf2b0]
call fcn.1401d0460
test eax, eax
je 0x1401cbe03
lea rdx, [rsp + 0xf458]
lea rcx, [rsp + 0xf278]
call fcn.140002d20
mov dword [rsp + 0xeee8], 0
call fcn.140185900
lea rdx, [0x1402216d8]
mov qword [rsp + 0x20], rdx
lea r9, [0x1402216f8]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x140221718]
lea rcx, [rsp + 0xf288]
call fcn.140002be0
lea rcx, [rsp + 0xf288]
call fcn.1400012c0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.1400048c0
xor r8d, r8d
lea rdx, [0x1402216d4]
lea rcx, [rsp + 0xeef8]
call fcn.140006720
cmp eax, 0xffffffff
je 0x1401cbf10
lea r8, [rsp + 0xeef8]
lea rdx, [0x140221754]
lea rcx, [rsp + 0x15c08]
call fcn.140006c30
mov qword [rsp + 0x16520], rax
mov rax, qword [rsp + 0x16520]
mov qword [rsp + 0x16528], rax
lea r8, [0x140221750]
mov rdx, qword [rsp + 0x16528]
lea rcx, [rsp + 0x15c10]
call fcn.1400010b0
mov qword [rsp + 0x16530], rax
mov rax, qword [rsp + 0x16530]
mov qword [rsp + 0x16538], rax
mov rdx, qword [rsp + 0x16538]
lea rcx, [rsp + 0xeef8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15c10]
call fcn.140001470
nop
lea rcx, [rsp + 0x15c08]
call fcn.140001470
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xf278]
call fcn.140006840
mov r9d, eax
add r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xf280]
lea rcx, [rsp + 0xf278]
call fcn.140002230
nop
xor r8d, r8d
lea rdx, [0x140221758]
lea rcx, [rsp + 0xf280]
call fcn.140006720
cmp eax, 0xffffffff
je 0x1401cbffa
lea r8, [rsp + 0xf280]
lea rdx, [0x140221760]
lea rcx, [rsp + 0x15c18]
call fcn.140006c30
mov qword [rsp + 0x16540], rax
mov rax, qword [rsp + 0x16540]
mov qword [rsp + 0x16548], rax
lea r8, [0x14022175c]
mov rdx, qword [rsp + 0x16548]
lea rcx, [rsp + 0x15c20]
call fcn.1400010b0
mov qword [rsp + 0x16550], rax
mov rax, qword [rsp + 0x16550]
mov qword [rsp + 0x16558], rax
mov rdx, qword [rsp + 0x16558]
lea rcx, [rsp + 0xf280]
call fcn.140002d20
nop
lea rcx, [rsp + 0x15c20]
call fcn.140001470
nop
lea rcx, [rsp + 0x15c18]
call fcn.140001470
mov rax, qword [rsp + 0xf298]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf280]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x140221768]
lea rcx, [rsp + 0xf288]
call fcn.140002be0
lea rcx, [rsp + 0xf288]
call fcn.1400012c0
mov rdx, rax
xor ecx, ecx
call fcn.1400dc5d0
mov qword [rsp + 0xeef0], 0
mov qword [rsp + 0xeee0], 0
mov dword [rsp + 0xf260], 0x18
mov qword [rsp + 0xf268], 0
mov dword [rsp + 0xf270], 1
xor r9d, r9d
lea r8, [rsp + 0xf260]
lea rdx, [rsp + 0xeee0]
lea rcx, [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1401cc0b2
lea rdx, str.Failed_to_create_pipe_
mov ecx, 1
call fcn.1400dc5d0
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0xf290], 0
mov dword [rsp + 0xf250], 0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x11610]
call fcn.1400a8070
mov dword [rsp + 0x11610], 0x68
lea rcx, [rsp + 0x11610]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdx, qword [rsp + 0xeee0]
mov qword [rsp + 0x11670], rdx
mov rax, qword [rsp + 0xeee0]
mov qword [rsp + 0x11668], rax
xor eax, eax
mov word [rsp + 0x11650], ax
lea rax, str.winsta0default
mov qword [rsp + 0x11620], rax
mov dword [rsp + 0x1164c], 0x101
xor eax, eax
mov word [rsp + 0xf5f0], ax
lea rdi, [rsp + 0xf5f2]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
lea rcx, [rsp + 0xf288]
call fcn.1400012c0
mov r8d, 0x1000
mov rdx, rax
lea rcx, [rsp + 0xf5f0]
call fcn.1400a9218
lea rdx, [rsp + 0x115f0]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x11610]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xf5f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0xf290], eax
cmp dword [rsp + 0xf290], 0
jne 0x1401cc293
lea rdx, str.Failed_to_CreateProcessAsUser_
mov ecx, 1
call fcn.1400dc5d0
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0xf280]
call fcn.140001470
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xef10]
call fcn.140005d50
nop
lea rcx, [rsp + 0xf278]
call fcn.140001470
nop
lea rcx, [rsp + 0xeef8]
call fcn.140001470
nop
lea rcx, [rsp + 0xef00]
call fcn.140001470
nop
lea rcx, [rsp + 0xf258]
call fcn.140001470
nop
lea rcx, [rsp + 0xf298]
call fcn.140001470
nop
lea rcx, [rsp + 0xf288]
call fcn.140001470
jmp 0x1401ccff2
xor eax, eax
cmp eax, 1
je 0x1401cc504
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x11680], eax
cmp dword [rsp + 0x11680], 0
jne 0x1401cc2c4
jmp 0x1401cc504
mov byte [rsp + 0x116a0], 0
lea rdi, [rsp + 0x116a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x11694], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, 0xfff
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x11694], 1
jae 0x1401cc338
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401cc293
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, dword [rsp + 0x11694]
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x11690], eax
cmp dword [rsp + 0x11690], 0
je 0x1401cc382
cmp dword [rsp + 0x11694], 0
jne 0x1401cc3a3
lea rdx, str.Failed_to_ReadFile_in_piple_
mov ecx, 1
call fcn.1400dc5d0
mov dword [rsp + 0xf250], 1
jmp 0x1401cc504
lea rdx, [rsp + 0x116a0]
lea rcx, [rsp + 0x11688]
call fcn.1400db950
nop
lea rcx, [rsp + 0x11688]
call fcn.140012fc0
lea rcx, [rsp + 0x11688]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x1401cc4e6
lea rcx, [rsp + 0x11688]
call fcn.1400019f0
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x11688]
call fcn.140006d70
movzx eax, ax
cmp eax, 0x25
jne 0x1401cc4e6
mov dx, 0x25
lea rcx, [rsp + 0x11688]
call fcn.140024480
mov byte [rsp + 0x126a0], 0
lea rdi, [rsp + 0x126a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11688]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x15c28]
call fcn.1400d8910
mov qword [rsp + 0x16560], rax
mov r9, qword [rsp + 0x16560]
mov r9, qword [r9]
lea r8, str.__s_r_n
mov edx, 0x1000
lea rcx, [rsp + 0x126a0]
call fcn.1400accf0
lea rcx, [rsp + 0x15c28]
call fcn.140001470
lea r8, [rsp + 0x126a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
test eax, eax
jne 0x1401cc4e6
lea rdx, str.terminate_robocopy_because_another_server_exit_sync
xor ecx, ecx
call fcn.1400dc5d0
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0x11688]
call fcn.140001470
jmp 0x1401cc504
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x11688]
call fcn.140001470
jmp 0x1401cc293
mov rcx, qword [rsp + 0xeee0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.CCBootSyncTo
lea rdx, str.NET_SHARE__s__DELETE
lea rcx, [rsp + 0xf288]
call fcn.140002be0
lea rcx, [rsp + 0xf288]
call fcn.1400012c0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.1400048c0
cmp dword [rsp + 0xf250], 0
je 0x1401cc58a
lea r8, [0x140221928]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401cc618
cmp dword [rsp + 0xeee8], 0
je 0x1401cc5d7
lea rcx, [rsp + 0xf450]
lea rdx, [rsp + 0xf258]
call fcn.140002d20
lea rcx, [rsp + 0xf458]
lea rdx, [rsp + 0xf278]
call fcn.140002d20
lea rcx, [rsp + 0xf2b0]
call fcn.1401cfef0
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
lea r8, [0x140221940]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
nop
lea rcx, [rsp + 0xf280]
call fcn.140001470
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xef10]
call fcn.140005d50
nop
lea rcx, [rsp + 0xf278]
call fcn.140001470
nop
lea rcx, [rsp + 0xeef8]
call fcn.140001470
nop
lea rcx, [rsp + 0xef00]
call fcn.140001470
nop
lea rcx, [rsp + 0xf258]
call fcn.140001470
nop
lea rcx, [rsp + 0xf298]
call fcn.140001470
nop
lea rcx, [rsp + 0xf288]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [0x140221948]
call fcn.1400a9170
mov r8, rax
lea rdx, [0x140221960]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd78
test eax, eax
jne 0x1401ccfcb
lea rcx, str.multisynctofile
call fcn.1400a9170
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0x14e50]
call fcn.1400db950
nop
lea rdx, [0x14022198c]
lea rcx, [rsp + 0x14e50]
call fcn.140006970
mov dword [rsp + 0x14e60], 0
lea r9, [rsp + 0x14e60]
lea r8, [0x140221764]
lea rdx, [rsp + 0x15c30]
lea rcx, [rsp + 0x14e50]
call fcn.140006540
mov qword [rsp + 0x16568], rax
mov rcx, qword [rsp + 0x16568]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a9488
mov qword [rsp + 0x13a00], rax
lea rcx, [rsp + 0x15c30]
call fcn.140001470
cmp dword [rsp + 0x14e60], 0xffffffff
jne 0x1401cc799
lea r8, str._ERR_PARAM_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0x15c38]
call fcn.140001000
mov qword [rsp + 0x16570], rax
mov rax, qword [rsp + 0x16570]
mov qword [rsp + 0x16578], rax
lea r8, str._syncdb.xml
mov rdx, qword [rsp + 0x16578]
lea rcx, [rsp + 0x139f8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15c38]
call fcn.140001470
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x139f8]
call fcn.140006840
mov dword [rsp + 0x139f0], eax
cmp dword [rsp + 0x139f0], 0xffffffff
je 0x1401cc862
mov r8d, dword [rsp + 0x139f0]
lea rdx, [rsp + 0x15c40]
lea rcx, [rsp + 0x139f8]
call fcn.140006ac0
mov qword [rsp + 0x16580], rax
mov rax, qword [rsp + 0x16580]
mov qword [rsp + 0x16588], rax
mov rcx, qword [rsp + 0x16588]
call fcn.1400012c0
mov rcx, rax
call fcn.140004b80
nop
lea rcx, [rsp + 0x15c40]
call fcn.140001470
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
lea rdx, [0x1402219c8]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x14e58], rax
cmp qword [rsp + 0x14e58], 0
jne 0x1401cc8d2
lea r8, [0x1402219d0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001470
jmp 0x1401ccff2
mov byte [rsp + 0x13d50], 0
lea rdi, [rsp + 0x13d51]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x14e64], 0
jmp 0x1401cc909
mov eax, dword [rsp + 0x14e64]
add eax, 1
mov dword [rsp + 0x14e64], eax
mov edi, dword [rsp + 0x14e64]
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
cmp rdi, rax
jae 0x1401cc992
mov qword [rsp + 0x14e68], 0x1000
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x14e68]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80b0
test eax, eax
jne 0x1401cc96a
jmp 0x1401cc992
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x14e68]
lea rcx, [rsp + 0x13d50]
call fcn.1400ac434
jmp 0x1401cc8f8
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
mov qword [rsp + 0x136a0], rdx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x136a0]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80b0
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x136a0]
lea rcx, [rsp + 0x13d50]
call fcn.1400ac434
mov rcx, qword [rsp + 0x14e58]
call fcn.1400a9ff0
lea rcx, [rsp + 0x14d80]
call fcn.1400e7ca0
nop
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov dword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rax
lea rdx, [rsp + 0x15c48]
lea rcx, [rsp + 0x14d80]
call fcn.1400eb070
mov rcx, rax
call fcn.1400e4da0
movzx eax, al
test eax, eax
jne 0x1401ccadc
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401cca8d
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [0x1402219e8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6570
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001470
jmp 0x1401ccff2
xor r9d, r9d
lea r8, [0x140221a00]
lea rdx, [rsp + 0x14d50]
lea rcx, [rsp + 0x14d80]
call fcn.1400eb9d0
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4100
test rax, rax
jne 0x1401ccb9f
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401ccb42
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._ERR_COPY_FILE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4150
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6570
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001470
jmp 0x1401ccff2
lea rcx, [rsp + 0x13a10]
call fcn.1401cd320
nop
lea rcx, [rsp + 0x13a10]
call fcn.1401b8530
mov dword [rsp + 0x14e70], 0
jmp 0x1401ccbd8
mov eax, dword [rsp + 0x14e70]
add eax, 1
mov dword [rsp + 0x14e70], eax
mov edi, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4100
cmp rdi, rax
jae 0x1401cccf6
lea rcx, [rsp + 0x14e80]
call fcn.1401cd320
nop
mov dword [rsp + 0x15018], 0
lea rcx, [rsp + 0x14e80]
call fcn.1401d1f50
mov dword [rsp + 0x151c0], 0
jmp 0x1401ccc39
mov eax, dword [rsp + 0x151c0]
add eax, 1
mov dword [rsp + 0x151c0], eax
mov eax, dword [rsp + 0x151b0]
cmp dword [rsp + 0x151c0], eax
jae 0x1401cccd6
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x14e88]
call fcn.1400012c0
mov rdi, rax
mov edx, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e40d0
lea rdx, [rsp + 0x15c60]
mov rcx, rax
call fcn.1400e7370
mov r8, rdi
lea rdx, [rsp + 0x15c68]
mov rcx, rax
call fcn.1400e6880
lea r8, [0x140221a58]
lea rdx, [rsp + 0x15c70]
mov rcx, rax
call fcn.1400e67d0
mov rcx, rax
call fcn.1400e5100
mov rdx, rax
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x15020]
call fcn.140002060
jmp 0x1401ccc28
lea rcx, [rsp + 0x14e80]
call fcn.1401b8b50
nop
lea rcx, [rsp + 0x14e80]
call fcn.140005d50
jmp 0x1401ccbc7
lea rcx, [rsp + 0x136b0]
call fcn.1401cd2b0
nop
lea rcx, [rsp + 0x136b0]
call fcn.1401b8530
xor r9d, r9d
lea r8, [0x140221a68]
lea rdx, [rsp + 0x15c78]
lea rcx, [rsp + 0x14d80]
call fcn.1400eb9d0
mov qword [rsp + 0x16590], rax
mov rax, qword [rsp + 0x16590]
mov qword [rsp + 0x16598], rax
mov rdx, qword [rsp + 0x16598]
lea rcx, [rsp + 0x14d50]
call fcn.1400e5d20
nop
lea rcx, [rsp + 0x15c78]
call fcn.1400e4150
mov dword [rsp + 0x151c4], 0
jmp 0x1401ccd89
mov eax, dword [rsp + 0x151c4]
add eax, 1
mov dword [rsp + 0x151c4], eax
mov edi, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4100
cmp rdi, rax
jae 0x1401ccef9
lea rcx, [rsp + 0x151d0]
call fcn.1401cd2b0
nop
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e40d0
lea rdx, [rsp + 0x15ca0]
mov rcx, rax
call fcn.1400e7370
lea r8, [0x140221a94]
lea rdx, [rsp + 0x15ca8]
mov rcx, rax
call fcn.1400e6880
lea r8, [0x140221aa0]
lea rdx, [rsp + 0x15cb0]
mov rcx, rax
call fcn.1400e67d0
xor edx, edx
mov rcx, rax
call fcn.1400e7ce0
mov dword [rsp + 0x15510], eax
mov dword [rsp + 0x15514], 0
jmp 0x1401cce35
mov eax, dword [rsp + 0x15514]
add eax, 1
mov dword [rsp + 0x15514], eax
mov eax, dword [rsp + 0x15500]
cmp dword [rsp + 0x15514], eax
jae 0x1401cced2
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x151d8]
call fcn.1400012c0
mov rdi, rax
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e40d0
lea rdx, [rsp + 0x15cb8]
mov rcx, rax
call fcn.1400e7370
mov r8, rdi
lea rdx, [rsp + 0x15cc0]
mov rcx, rax
call fcn.1400e6880
lea r8, [0x140221ab0]
lea rdx, [rsp + 0x15cc8]
mov rcx, rax
call fcn.1400e67d0
mov rcx, rax
call fcn.1400e5100
mov rdx, rax
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x15370]
call fcn.140002060
jmp 0x1401cce24
mov edx, dword [rsp + 0x15510]
lea rcx, [rsp + 0x151d0]
call fcn.1401cef90
nop
lea rcx, [rsp + 0x151d0]
call fcn.140005d50
jmp 0x1401ccd78
mov edx, 1
xor ecx, ecx
call fcn.1401b8f10
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8056
xor edx, edx
lea rcx, [0x1403ad8a0]
call fcn.1401bbcb0
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401ccf55
lea rcx, [rsp + 0x139f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str.OK__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
nop
lea rcx, [rsp + 0x136b0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x13a10]
call fcn.140005d50
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4150
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6570
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001470
jmp 0x1401ccff2
lea r8, str._ERR_VERSION_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c00
jmp 0x1401ccff2
mov edx, 1
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_shutdown]
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x60], 0x400
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80b0
mov dword [rsp + 0x15cd0], 0
lea rcx, [rsp + 0x470]
call fcn.140005d50
nop
lea rcx, [rsp + 0x7b0]
call fcn.140005d50
mov eax, dword [rsp + 0x15cd0]
mov rcx, qword [rsp + 0x165a0]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x165b8
pop rdi
pop rsi
ret