Function at 0x1401c0060
Capabilities:
Check if file exists
Create process on windows
Manipulate boot configuration
Read .ini file
Shutdown system

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x67050
call fcn.1401e9500
sub rsp, rax
mov qword [rsp + 0x66bd0], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0x67040], rax
mov dword [rsp + 0x66bc8], 0
mov rax, qword [rsp + 0x67068]
mov qword [rsp + 0x66bd8], rax
cmp qword [rsp + 0x66bd8], 0x808b
ja 0x1401c015e
cmp qword [rsp + 0x66bd8], 0x808b
je 0x1401c036c
cmp qword [rsp + 0x66bd8], 0x8064
ja 0x1401c0135
cmp qword [rsp + 0x66bd8], 0x8064
je 0x1401c039e
cmp qword [rsp + 0x66bd8], 0x108
je 0x1401c2a7e
cmp qword [rsp + 0x66bd8], 0x4cb
je 0x1401c02cc
cmp qword [rsp + 0x66bd8], 0x8004
je 0x1401c01bd
jmp 0x1401c2d21
cmp qword [rsp + 0x66bd8], 0x8069
je 0x1401c1e62
cmp qword [rsp + 0x66bd8], 0x806f
je 0x1401c1e94
jmp 0x1401c2d21
cmp qword [rsp + 0x66bd8], 0x80a0
je 0x1401c02d3
cmp qword [rsp + 0x66bd8], 0x80b7
je 0x1401c1ec6
cmp qword [rsp + 0x66bd8], 0x814e
je 0x1401c1fa6
cmp qword [rsp + 0x66bd8], 0x814f
je 0x1401c2404
cmp qword [rsp + 0x66bd8], 0x815a
je 0x1401c268a
jmp 0x1401c2d21
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7a
lea rcx, [rsp + 0x50]
call fcn.140153b20
nop
lea rcx, [rsp + 0x50]
call fcn.14008b2fc
cmp rax, 1
jne 0x1401c02bb
lea rdx, [0x14025be08]
lea rcx, [rsp + 0x66920]
call fcn.1400f05c0
mov qword [rsp + 0x66be0], rax
mov rax, qword [rsp + 0x66be0]
mov qword [rsp + 0x66be8], rax
lea rdx, [0x14025bdf8]
mov rcx, qword [rsp + 0x66be8]
call fcn.140006e10
movzx eax, al
test eax, eax
je 0x1401c023b
mov dword [rsp + 0x66bf0], 0x9b
jmp 0x1401c0246
mov dword [rsp + 0x66bf0], 0x66
mov rcx, qword [rsp + 0x67060]
add rcx, 0x220
mov edx, dword [rsp + 0x66bf0]
call fcn.1400f1830
nop
lea rcx, [rsp + 0x66920]
call fcn.140007060
mov rcx, qword [rsp + 0x67060]
add rcx, 0xdc8
mov edx, 0x6a
call fcn.1400f15c0
mov rcx, qword [rsp + 0x67060]
add rcx, 0xe70
mov edx, 0xd1
call fcn.1400f15c0
mov rcx, qword [rsp + 0x67060]
add rcx, 0xf18
mov edx, 0xd0
call fcn.1400f15c0
nop
lea rcx, [rsp + 0x50]
call fcn.140152ac0
xor eax, eax
jmp 0x1401c2d26
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x66928]
call fcn.140001000
mov qword [rsp + 0x66bf8], rax
mov rax, qword [rsp + 0x66bf8]
mov qword [rsp + 0x66c00], rax
lea r8, [0x14025be18]
mov rdx, qword [rsp + 0x66c00]
lea rcx, [rsp + 0x66930]
call fcn.1400010b0
mov qword [rsp + 0x66c08], rax
mov rcx, qword [rsp + 0x66c08]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x66930]
call fcn.140007060
nop
lea rcx, [rsp + 0x66928]
call fcn.140007060
xor eax, eax
jmp 0x1401c2d26
xor edx, edx
lea rcx, [rsp + 0x910]
call fcn.140175fa0
nop
lea rcx, [rsp + 0x910]
call fcn.1400830e4
nop
lea rcx, [rsp + 0x910]
call fcn.140175b20
xor eax, eax
jmp 0x1401c2d26
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Account_Files__AccInfo.ini_wks.ini_.csv_nxd.ini_accinfo.ini_wks.ini_.csv_nxd.ini
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0xb50]
call fcn.14008cac0
nop
lea rcx, [rsp + 0xb50]
call fcn.14008d980
cmp rax, 1
je 0x1401c041b
mov dword [rsp + 0x66938], 0
lea rcx, [rsp + 0xb50]
call fcn.14008c9c8
mov eax, dword [rsp + 0x66938]
jmp 0x1401c2d26
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0xb50]
call fcn.14008db38
nop
lea rdx, [rsp + 0x66940]
lea rcx, [rsp + 0xb50]
call fcn.14008def4
mov qword [rsp + 0x66c10], rax
lea rdx, str.wks.ini
mov rcx, qword [rsp + 0x66c10]
call fcn.140006130
test eax, eax
jne 0x1401c0473
mov dword [rsp + 0x66c18], 1
jmp 0x1401c047e
mov dword [rsp + 0x66c18], 0
movzx eax, byte [rsp + 0x66c18]
mov byte [rsp + 0x6693c], al
lea rcx, [rsp + 0x66940]
call fcn.140007060
movzx edx, byte [rsp + 0x6693c]
test edx, edx
je 0x1401c0c2f
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0xf10]
mov qword [rsp + 0x20f10], rdx
mov rax, qword [rsp + 0x20f10]
movzx eax, word [rax]
test eax, eax
je 0x1401c0c0c
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x20f20]
lea r8, [0x14025b9cc]
lea rdx, str.WksName
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x21a60]
lea r8, [0x14025b9dc]
lea rdx, str.IpAddr
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x21720]
call fcn.1401e0790
nop
mov dword [rsp + 0x218b8], 0
lea rcx, [rsp + 0x21720]
call fcn.1401e5810
lea rcx, [rsp + 0x218c0]
lea rdx, [rsp + 0x20f20]
call fcn.140002020
lea rcx, [rsp + 0x218d8]
lea rdx, [rsp + 0x21a60]
call fcn.140002020
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66948]
call fcn.140002050
mov qword [rsp + 0x66c20], rax
mov rax, qword [rsp + 0x66c20]
mov qword [rsp + 0x66c28], rax
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66950]
mov rcx, qword [rsp + 0x66c28]
call fcn.1400021f0
mov qword [rsp + 0x66c30], rax
mov rax, qword [rsp + 0x66c30]
mov qword [rsp + 0x66c38], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66958]
call fcn.140002050
mov qword [rsp + 0x66c40], rax
mov rax, qword [rsp + 0x66c40]
mov qword [rsp + 0x66c48], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66960]
mov rcx, qword [rsp + 0x66c48]
call fcn.1400021f0
mov qword [rsp + 0x66c50], rax
mov rax, qword [rsp + 0x66c50]
mov qword [rsp + 0x66c58], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66968]
call fcn.140002050
mov qword [rsp + 0x66c60], rax
mov rax, qword [rsp + 0x66c60]
mov qword [rsp + 0x66c68], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66970]
mov rcx, qword [rsp + 0x66c68]
call fcn.1400021f0
mov qword [rsp + 0x66c70], rax
mov rax, qword [rsp + 0x66c70]
mov qword [rsp + 0x66c78], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66978]
call fcn.140002050
mov qword [rsp + 0x66c80], rax
mov rax, qword [rsp + 0x66c80]
mov qword [rsp + 0x66c88], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66980]
mov rcx, qword [rsp + 0x66c88]
call fcn.1400021f0
mov qword [rsp + 0x66c90], rax
mov rax, qword [rsp + 0x66c90]
mov qword [rsp + 0x66c98], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66988]
call fcn.140002050
mov qword [rsp + 0x66ca0], rax
mov rax, qword [rsp + 0x66ca0]
mov qword [rsp + 0x66ca8], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66990]
mov rcx, qword [rsp + 0x66ca8]
call fcn.1400021f0
mov qword [rsp + 0x66cb0], rax
mov rax, qword [rsp + 0x66cb0]
mov qword [rsp + 0x66cb8], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66998]
call fcn.140002050
mov qword [rsp + 0x66cc0], rax
mov rax, qword [rsp + 0x66cc0]
mov qword [rsp + 0x66cc8], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x669a0]
mov rcx, qword [rsp + 0x66cc8]
call fcn.1400021f0
mov qword [rsp + 0x66cd0], rax
mov rax, qword [rsp + 0x66cd0]
mov qword [rsp + 0x66cd8], rax
lea r8, [0x14025bc2c]
mov rdx, qword [rsp + 0x66cd8]
lea rcx, [rsp + 0x669a8]
call fcn.1400010b0
mov qword [rsp + 0x66ce0], rax
mov rax, qword [rsp + 0x66ce0]
mov qword [rsp + 0x66ce8], rax
mov r8, qword [rsp + 0x66cb8]
mov rdx, qword [rsp + 0x66ce8]
lea rcx, [rsp + 0x669b0]
call fcn.140006c50
mov qword [rsp + 0x66cf0], rax
mov rax, qword [rsp + 0x66cf0]
mov qword [rsp + 0x66cf8], rax
lea r8, [0x14025bafc]
mov rdx, qword [rsp + 0x66cf8]
lea rcx, [rsp + 0x669b8]
call fcn.1400010b0
mov qword [rsp + 0x66d00], rax
mov rax, qword [rsp + 0x66d00]
mov qword [rsp + 0x66d08], rax
mov r8, qword [rsp + 0x66c98]
mov rdx, qword [rsp + 0x66d08]
lea rcx, [rsp + 0x669c0]
call fcn.140006c50
mov qword [rsp + 0x66d10], rax
mov rax, qword [rsp + 0x66d10]
mov qword [rsp + 0x66d18], rax
lea r8, [0x14025ba3c]
mov rdx, qword [rsp + 0x66d18]
lea rcx, [rsp + 0x669c8]
call fcn.1400010b0
mov qword [rsp + 0x66d20], rax
mov rax, qword [rsp + 0x66d20]
mov qword [rsp + 0x66d28], rax
mov r8, qword [rsp + 0x66c78]
mov rdx, qword [rsp + 0x66d28]
lea rcx, [rsp + 0x669d0]
call fcn.140006c50
mov qword [rsp + 0x66d30], rax
mov rax, qword [rsp + 0x66d30]
mov qword [rsp + 0x66d38], rax
lea r8, [0x14025ba1c]
mov rdx, qword [rsp + 0x66d38]
lea rcx, [rsp + 0x669d8]
call fcn.1400010b0
mov qword [rsp + 0x66d40], rax
mov rax, qword [rsp + 0x66d40]
mov qword [rsp + 0x66d48], rax
mov r8, qword [rsp + 0x66c58]
mov rdx, qword [rsp + 0x66d48]
lea rcx, [rsp + 0x669e0]
call fcn.140006c50
mov qword [rsp + 0x66d50], rax
mov rax, qword [rsp + 0x66d50]
mov qword [rsp + 0x66d58], rax
lea r8, [0x14025b9fc]
mov rdx, qword [rsp + 0x66d58]
lea rcx, [rsp + 0x669e8]
call fcn.1400010b0
mov qword [rsp + 0x66d60], rax
mov rax, qword [rsp + 0x66d60]
mov qword [rsp + 0x66d68], rax
mov r8, qword [rsp + 0x66c38]
mov rdx, qword [rsp + 0x66d68]
lea rcx, [rsp + 0x669f0]
call fcn.140006c50
mov qword [rsp + 0x66d70], rax
mov rax, qword [rsp + 0x66d70]
mov qword [rsp + 0x66d78], rax
lea rcx, [rsp + 0x218e8]
mov rdx, qword [rsp + 0x66d78]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x669f0]
call fcn.140007060
nop
lea rcx, [rsp + 0x669e8]
call fcn.140007060
nop
lea rcx, [rsp + 0x669e0]
call fcn.140007060
nop
lea rcx, [rsp + 0x669d8]
call fcn.140007060
nop
lea rcx, [rsp + 0x669d0]
call fcn.140007060
nop
lea rcx, [rsp + 0x669c8]
call fcn.140007060
nop
lea rcx, [rsp + 0x669c0]
call fcn.140007060
nop
lea rcx, [rsp + 0x669b8]
call fcn.140007060
nop
lea rcx, [rsp + 0x669b0]
call fcn.140007060
nop
lea rcx, [rsp + 0x669a8]
call fcn.140007060
nop
lea rcx, [rsp + 0x669a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66998]
call fcn.140007060
nop
lea rcx, [rsp + 0x66990]
call fcn.140007060
nop
lea rcx, [rsp + 0x66988]
call fcn.140007060
nop
lea rcx, [rsp + 0x66980]
call fcn.140007060
nop
lea rcx, [rsp + 0x66978]
call fcn.140007060
nop
lea rcx, [rsp + 0x66970]
call fcn.140007060
nop
lea rcx, [rsp + 0x66968]
call fcn.140007060
nop
lea rcx, [rsp + 0x66960]
call fcn.140007060
nop
lea rcx, [rsp + 0x66958]
call fcn.140007060
nop
lea rcx, [rsp + 0x66950]
call fcn.140007060
nop
lea rcx, [rsp + 0x66948]
call fcn.140007060
lea rcx, [rsp + 0x218e8]
call fcn.140006990
lea rcx, [rsp + 0x21720]
call fcn.1401cc080
mov rcx, qword [rsp + 0x67060]
add rcx, 0xdc8
call fcn.14000dba0
mov dword [rsp + 0x20f18], eax
mov rdx, qword [rsp + 0x67060]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x218b8]
mov r8d, dword [rsp + 0x20f18]
mov rcx, qword [rsp + 0x67060]
call fcn.1401b2f90
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x20f10]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x20f10], rax
lea rcx, [rsp + 0x21720]
call fcn.140005e30
jmp 0x1401c04dd
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025be58]
call fcn.1400f0bf0
lea rdx, [rsp + 0x66a00]
lea rcx, [rsp + 0xb50]
call fcn.14008def4
mov qword [rsp + 0x66d80], rax
lea rdx, str.accinfo.ini
mov rcx, qword [rsp + 0x66d80]
call fcn.140006130
test eax, eax
jne 0x1401c0c71
mov dword [rsp + 0x66d88], 1
jmp 0x1401c0c7c
mov dword [rsp + 0x66d88], 0
movzx eax, byte [rsp + 0x66d88]
mov byte [rsp + 0x669f8], al
lea rcx, [rsp + 0x66a00]
call fcn.140007060
movzx edx, byte [rsp + 0x669f8]
test edx, edx
je 0x1401c0ecc
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x22260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x22260]
mov qword [rsp + 0x42260], rdx
mov rax, qword [rsp + 0x42260]
movzx eax, word [rax]
test eax, eax
je 0x1401c0ea9
lea rdx, [0x14025bc7c]
mov rcx, qword [rsp + 0x42260]
call fcn.14000f170
test rax, rax
jne 0x1401c0d2f
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
jmp 0x1401c0cdb
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42270]
lea r8, [0x14025bce4]
lea rdx, str.ComputerName
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42db0]
lea r8, [0x14025bcfc]
lea rdx, str.IPAddress
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x42a70]
call fcn.1401e0790
nop
mov dword [rsp + 0x42c08], 0
lea rcx, [rsp + 0x42a70]
call fcn.1401e5810
lea rcx, [rsp + 0x42c10]
lea rdx, [rsp + 0x42270]
call fcn.140002020
lea rcx, [rsp + 0x42c28]
lea rdx, [rsp + 0x42db0]
call fcn.140002020
lea rcx, [rsp + 0x42c38]
mov rdx, qword [rsp + 0x42260]
call fcn.140002020
lea rcx, [rsp + 0x42c38]
call fcn.140006990
lea rcx, [rsp + 0x42a70]
call fcn.1401cc080
mov rcx, qword [rsp + 0x67060]
add rcx, 0xdc8
call fcn.14000dba0
mov dword [rsp + 0x42268], eax
mov rdx, qword [rsp + 0x67060]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x42c08]
mov r8d, dword [rsp + 0x42268]
mov rcx, qword [rsp + 0x67060]
call fcn.1401b2f90
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
lea rcx, [rsp + 0x42a70]
call fcn.140005e30
jmp 0x1401c0cdb
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025beb0]
call fcn.1400f0bf0
lea rdx, [rsp + 0x66a10]
lea rcx, [rsp + 0xb50]
call fcn.14008e148
mov qword [rsp + 0x66d90], rax
lea rdx, [0x14025beb8]
mov rcx, qword [rsp + 0x66d90]
call fcn.140006130
test eax, eax
jne 0x1401c0f0e
mov dword [rsp + 0x66d98], 1
jmp 0x1401c0f19
mov dword [rsp + 0x66d98], 0
movzx eax, byte [rsp + 0x66d98]
mov byte [rsp + 0x66a08], al
lea rcx, [rsp + 0x66a10]
call fcn.140007060
movzx edx, byte [rsp + 0x66a08]
test edx, edx
je 0x1401c1be3
lea rdx, [rsp + 0x66a18]
lea rcx, [rsp + 0xb50]
call fcn.14008db38
mov qword [rsp + 0x66da0], rax
mov rcx, qword [rsp + 0x66da0]
call fcn.140050200
lea rdx, [0x14025bd64]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x435b0], rax
lea rcx, [rsp + 0x66a18]
call fcn.140007060
cmp qword [rsp + 0x435b0], 0
jne 0x1401c0fd0
mov dword [rsp + 0x66a20], 0
lea rcx, [rsp + 0xb40]
call fcn.140007060
nop
lea rcx, [rsp + 0xb50]
call fcn.14008c9c8
mov eax, dword [rsp + 0x66a20]
jmp 0x1401c2d26
mov rcx, qword [rsp + 0x435b0]
call fcn.1400ab63c
test eax, eax
jne 0x1401c1bb3
mov byte [rsp + 0x43950], 0
lea rdi, [rsp + 0x43951]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x435b0]
mov edx, 0x400
lea rcx, [rsp + 0x43950]
call fcn.1400abd44
test rax, rax
jne 0x1401c1022
jmp 0x1401c1bb3
lea rcx, [rsp + 0x43950]
call fcn.1400aa950
test rax, rax
jne 0x1401c1039
jmp 0x1401c1bb3
lea rdx, [rsp + 0x43950]
lea rcx, [rsp + 0x435c0]
call fcn.14000d990
nop
lea rdx, [0x14025bdac]
lea rcx, [rsp + 0x435c0]
call fcn.140006a50
lea rdx, [0x14025bddc]
lea rcx, [rsp + 0x435c0]
call fcn.140006a50
lea rdx, [0x14025bdf4]
lea rcx, [rsp + 0x435c0]
call fcn.140006a50
lea rcx, [rsp + 0x435c0]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1401c10b7
lea rcx, [rsp + 0x435c0]
call fcn.140007060
jmp 0x1401c1bb3
mov dword [rsp + 0x43940], 0
lea rcx, [rsp + 0x43948]
call fcn.140002d10
nop
lea rcx, [rsp + 0x435d0]
call fcn.140002d10
nop
lea rcx, [rsp + 0x435b8]
call fcn.140002d10
nop
lea rcx, [rsp + 0x435d8]
call fcn.140078c60
nop
cmp dword [rsp + 0x43940], 0
jl 0x1401c1914
mov r8d, dword [rsp + 0x43940]
lea rdx, [0x14025beac]
lea rcx, [rsp + 0x435c0]
call fcn.140006800
mov dword [rsp + 0x43d58], eax
lea rcx, [rsp + 0x43d50]
call fcn.140002d10
nop
cmp dword [rsp + 0x43d58], 0
jl 0x1401c11e5
mov eax, dword [rsp + 0x43940]
mov r9d, dword [rsp + 0x43d58]
sub r9d, eax
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x66a28]
lea rcx, [rsp + 0x435c0]
call fcn.1400021f0
mov qword [rsp + 0x66da8], rax
mov rax, qword [rsp + 0x66da8]
mov qword [rsp + 0x66db0], rax
mov rdx, qword [rsp + 0x66db0]
lea rcx, [rsp + 0x43d50]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66a28]
call fcn.140007060
mov eax, dword [rsp + 0x43d58]
add eax, 1
mov dword [rsp + 0x43940], eax
lea rcx, [rsp + 0x435c0]
call fcn.1400019a0
cmp dword [rsp + 0x43940], eax
jl 0x1401c11e3
mov dword [rsp + 0x43940], 0xffffffff
jmp 0x1401c1248
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x66a30]
lea rcx, [rsp + 0x435c0]
call fcn.140006a80
mov qword [rsp + 0x66db8], rax
mov rax, qword [rsp + 0x66db8]
mov qword [rsp + 0x66dc0], rax
mov rdx, qword [rsp + 0x66dc0]
lea rcx, [rsp + 0x43d50]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66a30]
call fcn.140007060
mov dword [rsp + 0x43940], 0xffffffff
lea rdx, [0x14025bec0]
lea rcx, [rsp + 0x43d50]
call fcn.140006a50
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d8]
call fcn.14000d830
lea rcx, [rsp + 0x43d50]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x66a40]
call fcn.140002d40
mov qword [rsp + 0x66dc8], rax
mov rax, qword [rsp + 0x66dc8]
mov qword [rsp + 0x66dd0], rax
mov eax, dword [rsp + 0x66bc8]
or eax, 1
mov dword [rsp + 0x66bc8], eax
mov rcx, qword [rsp + 0x66dd0]
call fcn.140002df0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x1401c12f3
lea rcx, [rsp + 0x435d0]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c12f3
mov dword [rsp + 0x66dd8], 1
jmp 0x1401c12fe
mov dword [rsp + 0x66dd8], 0
movzx eax, byte [rsp + 0x66dd8]
mov byte [rsp + 0x66a38], al
mov eax, dword [rsp + 0x66bc8]
and eax, 1
test eax, eax
je 0x1401c1330
and dword [rsp + 0x66bc8], 0xfffffffe
lea rcx, [rsp + 0x66a40]
call fcn.140002dd0
movzx eax, byte [rsp + 0x66a38]
test eax, eax
je 0x1401c1351
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d0]
call fcn.140002ce0
lea rcx, [rsp + 0x43d50]
call fcn.1400019a0
cmp eax, 0xc
jne 0x1401c1902
lea rcx, [rsp + 0x435b8]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c1902
lea rcx, [rsp + 0x43d50]
call fcn.140006990
mov dword [rsp + 0x43d5c], 0
mov dword [rsp + 0x43d60], 0
jmp 0x1401c13b5
mov eax, dword [rsp + 0x43d60]
add eax, 1
mov dword [rsp + 0x43d60], eax
cmp dword [rsp + 0x43d60], 0xc
jge 0x1401c1458
mov r9d, 1
mov r8d, dword [rsp + 0x43d60]
lea rdx, [rsp + 0x66a50]
lea rcx, [rsp + 0x43d50]
call fcn.1400021f0
mov qword [rsp + 0x66de0], rax
lea rdx, [0x14025bec8]
mov rcx, qword [rsp + 0x66de0]
call fcn.1400068b0
test eax, eax
jge 0x1401c1413
mov dword [rsp + 0x66de8], 1
jmp 0x1401c141e
mov dword [rsp + 0x66de8], 0
movzx eax, byte [rsp + 0x66de8]
mov byte [rsp + 0x66a48], al
lea rcx, [rsp + 0x66a50]
call fcn.140007060
movzx edx, byte [rsp + 0x66a48]
test edx, edx
je 0x1401c1453
mov dword [rsp + 0x43d5c], 1
jmp 0x1401c1458
jmp 0x1401c13a4
cmp dword [rsp + 0x43d5c], 0
jne 0x1401c1902
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435b8]
call fcn.140002ce0
lea rcx, [rsp + 0x43d68]
call fcn.140002d10
nop
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66a58]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66df0], rax
mov rax, qword [rsp + 0x66df0]
mov qword [rsp + 0x66df8], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66a60]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66e00], rax
mov rax, qword [rsp + 0x66e00]
mov qword [rsp + 0x66e08], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66a68]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66e10], rax
mov rax, qword [rsp + 0x66e10]
mov qword [rsp + 0x66e18], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66a70]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66e20], rax
mov rax, qword [rsp + 0x66e20]
mov qword [rsp + 0x66e28], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66a78]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66e30], rax
mov rax, qword [rsp + 0x66e30]
mov qword [rsp + 0x66e38], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x66a80]
lea rcx, [rsp + 0x435b8]
call fcn.1400021f0
mov qword [rsp + 0x66e40], rax
mov rax, qword [rsp + 0x66e40]
mov qword [rsp + 0x66e48], rax
lea r8, [0x14025bef8]
mov rdx, qword [rsp + 0x66e48]
lea rcx, [rsp + 0x66a88]
call fcn.1400010b0
mov qword [rsp + 0x66e50], rax
mov rax, qword [rsp + 0x66e50]
mov qword [rsp + 0x66e58], rax
mov r8, qword [rsp + 0x66e38]
mov rdx, qword [rsp + 0x66e58]
lea rcx, [rsp + 0x66a90]
call fcn.140006c50
mov qword [rsp + 0x66e60], rax
mov rax, qword [rsp + 0x66e60]
mov qword [rsp + 0x66e68], rax
lea r8, [0x14025bef4]
mov rdx, qword [rsp + 0x66e68]
lea rcx, [rsp + 0x66a98]
call fcn.1400010b0
mov qword [rsp + 0x66e70], rax
mov rax, qword [rsp + 0x66e70]
mov qword [rsp + 0x66e78], rax
mov r8, qword [rsp + 0x66e28]
mov rdx, qword [rsp + 0x66e78]
lea rcx, [rsp + 0x66aa0]
call fcn.140006c50
mov qword [rsp + 0x66e80], rax
mov rax, qword [rsp + 0x66e80]
mov qword [rsp + 0x66e88], rax
lea r8, [0x14025bef0]
mov rdx, qword [rsp + 0x66e88]
lea rcx, [rsp + 0x66aa8]
call fcn.1400010b0
mov qword [rsp + 0x66e90], rax
mov rax, qword [rsp + 0x66e90]
mov qword [rsp + 0x66e98], rax
mov r8, qword [rsp + 0x66e18]
mov rdx, qword [rsp + 0x66e98]
lea rcx, [rsp + 0x66ab0]
call fcn.140006c50
mov qword [rsp + 0x66ea0], rax
mov rax, qword [rsp + 0x66ea0]
mov qword [rsp + 0x66ea8], rax
lea r8, str.::::
mov rdx, qword [rsp + 0x66ea8]
lea rcx, [rsp + 0x66ab8]
call fcn.1400010b0
mov qword [rsp + 0x66eb0], rax
mov rax, qword [rsp + 0x66eb0]
mov qword [rsp + 0x66eb8], rax
mov r8, qword [rsp + 0x66e08]
mov rdx, qword [rsp + 0x66eb8]
lea rcx, [rsp + 0x66ac0]
call fcn.140006c50
mov qword [rsp + 0x66ec0], rax
mov rax, qword [rsp + 0x66ec0]
mov qword [rsp + 0x66ec8], rax
lea r8, [0x14025bec4]
mov rdx, qword [rsp + 0x66ec8]
lea rcx, [rsp + 0x66ac8]
call fcn.1400010b0
mov qword [rsp + 0x66ed0], rax
mov rax, qword [rsp + 0x66ed0]
mov qword [rsp + 0x66ed8], rax
mov r8, qword [rsp + 0x66df8]
mov rdx, qword [rsp + 0x66ed8]
lea rcx, [rsp + 0x66ad0]
call fcn.140006c50
mov qword [rsp + 0x66ee0], rax
mov rax, qword [rsp + 0x66ee0]
mov qword [rsp + 0x66ee8], rax
mov rdx, qword [rsp + 0x66ee8]
lea rcx, [rsp + 0x43d68]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66ad0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66ac8]
call fcn.140007060
nop
lea rcx, [rsp + 0x66ac0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66ab8]
call fcn.140007060
nop
lea rcx, [rsp + 0x66ab0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66aa8]
call fcn.140007060
nop
lea rcx, [rsp + 0x66aa0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a98]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a90]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a88]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a80]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a78]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a70]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a68]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a60]
call fcn.140007060
nop
lea rcx, [rsp + 0x66a58]
call fcn.140007060
lea rdx, [rsp + 0x43d68]
lea rcx, [rsp + 0x435b8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x43d68]
call fcn.140007060
nop
lea rcx, [rsp + 0x43d50]
call fcn.140007060
jmp 0x1401c10fa
lea rcx, [rsp + 0x435d0]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c1972
lea rcx, [rsp + 0x435d8]
call fcn.140078f24
nop
lea rcx, [rsp + 0x435b8]
call fcn.140007060
nop
lea rcx, [rsp + 0x435d0]
call fcn.140007060
nop
lea rcx, [rsp + 0x43948]
call fcn.140007060
nop
lea rcx, [rsp + 0x435c0]
call fcn.140007060
jmp 0x1401c0fd0
lea rcx, [rsp + 0x435d8]
call fcn.1400202c0
cmp rax, 3
jl 0x1401c1a28
lea rcx, [rsp + 0x43948]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c19bc
xor edx, edx
lea rcx, [rsp + 0x435d8]
call fcn.140050190
mov rdx, rax
lea rcx, [rsp + 0x43948]
call fcn.140002ce0
lea rcx, [rsp + 0x435d0]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c19f2
mov edx, 1
lea rcx, [rsp + 0x435d8]
call fcn.140050190
mov rdx, rax
lea rcx, [rsp + 0x435d0]
call fcn.140002ce0
lea rcx, [rsp + 0x435b8]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c1a28
mov edx, 2
lea rcx, [rsp + 0x435d8]
call fcn.140050190
mov rdx, rax
lea rcx, [rsp + 0x435b8]
call fcn.140002ce0
lea rcx, [rsp + 0x43600]
call fcn.1401e0790
nop
mov dword [rsp + 0x43798], 0
lea rcx, [rsp + 0x43600]
call fcn.1401e5810
lea rcx, [rsp + 0x43948]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401c1aba
lea rcx, [rsp + 0x43600]
call fcn.140005e30
nop
lea rcx, [rsp + 0x435d8]
call fcn.140078f24
nop
lea rcx, [rsp + 0x435b8]
call fcn.140007060
nop
lea rcx, [rsp + 0x435d0]
call fcn.140007060
nop
lea rcx, [rsp + 0x43948]
call fcn.140007060
nop
lea rcx, [rsp + 0x435c0]
call fcn.140007060
jmp 0x1401c0fd0
lea rcx, [rsp + 0x437a0]
lea rdx, [rsp + 0x43948]
call fcn.140002ce0
lea rcx, [rsp + 0x437b8]
lea rdx, [rsp + 0x435d0]
call fcn.140002ce0
lea rcx, [rsp + 0x437c8]
lea rdx, [rsp + 0x435b8]
call fcn.140002ce0
lea rcx, [rsp + 0x437c8]
call fcn.140006990
lea rcx, [rsp + 0x43600]
call fcn.1401cc080
mov rcx, qword [rsp + 0x67060]
add rcx, 0xdc8
call fcn.14000dba0
mov dword [rsp + 0x435c8], eax
mov rdx, qword [rsp + 0x67060]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x43798]
mov r8d, dword [rsp + 0x435c8]
mov rcx, qword [rsp + 0x67060]
call fcn.1401b2f90
nop
lea rcx, [rsp + 0x43600]
call fcn.140005e30
nop
lea rcx, [rsp + 0x435d8]
call fcn.140078f24
nop
lea rcx, [rsp + 0x435b8]
call fcn.140007060
nop
lea rcx, [rsp + 0x435d0]
call fcn.140007060
nop
lea rcx, [rsp + 0x43948]
call fcn.140007060
nop
lea rcx, [rsp + 0x435c0]
call fcn.140007060
jmp 0x1401c0fd0
mov rcx, qword [rsp + 0x435b0]
call fcn.1400ab86c
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025bf00]
call fcn.1400f0bf0
lea rdx, [rsp + 0x66ae0]
lea rcx, [rsp + 0xb50]
call fcn.14008def4
mov qword [rsp + 0x66ef0], rax
lea rdx, str.nxd.ini
mov rcx, qword [rsp + 0x66ef0]
call fcn.140006130
test eax, eax
jne 0x1401c1c25
mov dword [rsp + 0x66ef8], 1
jmp 0x1401c1c30
mov dword [rsp + 0x66ef8], 0
movzx eax, byte [rsp + 0x66ef8]
mov byte [rsp + 0x66ad8], al
lea rcx, [rsp + 0x66ae0]
call fcn.140007060
movzx edx, byte [rsp + 0x66ad8]
test edx, edx
je 0x1401c1e40
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x43d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x43d70]
mov qword [rsp + 0x63d70], rdx
mov rax, qword [rsp + 0x63d70]
movzx eax, word [rax]
test eax, eax
je 0x1401c1e1c
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x640c0]
lea r8, [0x14025befc]
lea rdx, [0x14025bf18]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x648c0]
lea r8, [0x14025bf20]
lea rdx, [0x14025bf24]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x63d80]
call fcn.1401e0790
nop
mov dword [rsp + 0x63f18], 0
lea rcx, [rsp + 0x63d80]
call fcn.1401e5810
lea rcx, [rsp + 0x63f20]
mov rdx, qword [rsp + 0x63d70]
call fcn.140002020
lea rcx, [rsp + 0x63f38]
lea rdx, [rsp + 0x648c0]
call fcn.140002020
lea rcx, [rsp + 0x63f48]
lea rdx, [rsp + 0x640c0]
call fcn.140002020
lea rcx, [rsp + 0x63f48]
call fcn.140006990
lea rcx, [rsp + 0x63d80]
call fcn.1401cc080
mov rcx, qword [rsp + 0x67060]
add rcx, 0xdc8
call fcn.14000dba0
mov dword [rsp + 0x63d78], eax
mov rdx, qword [rsp + 0x67060]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x63f18]
mov r8d, dword [rsp + 0x63d78]
mov rcx, qword [rsp + 0x67060]
call fcn.1401b2f90
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x63d70]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x63d70], rax
lea rcx, [rsp + 0x63d80]
call fcn.140005e30
jmp 0x1401c1c8f
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025bf30]
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0xb40]
call fcn.140007060
nop
lea rcx, [rsp + 0xb50]
call fcn.14008c9c8
xor eax, eax
jmp 0x1401c2d26
xor edx, edx
lea rcx, [rsp + 0x650c0]
call fcn.14014e8f0
nop
lea rcx, [rsp + 0x650c0]
call fcn.1400830e4
nop
lea rcx, [rsp + 0x650c0]
call fcn.14014e740
xor eax, eax
jmp 0x1401c2d26
xor edx, edx
lea rcx, [rsp + 0x65390]
call fcn.14014c9b0
nop
lea rcx, [rsp + 0x65390]
call fcn.1400830e4
nop
lea rcx, [rsp + 0x65390]
call fcn.14014c960
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x66ae8]
call fcn.140001000
mov qword [rsp + 0x66f00], rax
mov rax, qword [rsp + 0x66f00]
mov qword [rsp + 0x66f08], rax
lea rcx, [rsp + 0x66af0]
call fcn.140001000
mov qword [rsp + 0x66f10], rax
mov rax, qword [rsp + 0x66f10]
mov qword [rsp + 0x66f18], rax
lea r8, str.CCVHDUsb.exe__www.ccboot.com
mov rdx, qword [rsp + 0x66f18]
lea rcx, [rsp + 0x66af8]
call fcn.1400010b0
mov qword [rsp + 0x66f20], rax
mov rax, qword [rsp + 0x66f20]
mov qword [rsp + 0x66f28], rax
mov rcx, qword [rsp + 0x66f08]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0x66f28]
call fcn.140050200
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004880
nop
lea rcx, [rsp + 0x66af8]
call fcn.140007060
nop
lea rcx, [rsp + 0x66af0]
call fcn.140007060
nop
lea rcx, [rsp + 0x66ae8]
call fcn.140007060
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x66b00]
call fcn.140001000
mov qword [rsp + 0x66f30], rax
mov rax, qword [rsp + 0x66f30]
mov qword [rsp + 0x66f38], rax
lea r8, [0x14025bf78]
mov rdx, qword [rsp + 0x66f38]
lea rcx, [rsp + 0x65698]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x66b00]
call fcn.140007060
lea rcx, [rsp + 0x65698]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c2024
lea rcx, [rsp + 0x65698]
call fcn.140050200
mov rcx, rax
call fcn.140004b40
lea rcx, [rsp + 0x656a0]
call fcn.140002d10
nop
lea rcx, [rsp + 0x66b08]
call fcn.14000dd70
lea r8, str._Y_m_d_H_M_S
lea rdx, [rsp + 0x66b10]
mov rcx, rax
call fcn.14000d730
mov qword [rsp + 0x66f40], rax
mov rax, qword [rsp + 0x66f40]
mov qword [rsp + 0x66f48], rax
mov r9, qword [rsp + 0x66f48]
mov r9, qword [r9]
mov r8, qword [rsp + 0x65698]
lea rdx, str._sccboot_config__s.zip
lea rcx, [rsp + 0x656a0]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x66b10]
call fcn.140007060
lea rcx, [rsp + 0x656a0]
call fcn.140050200
mov r9, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Settings_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
lea r8, [0x14025bfd8]
xor edx, edx
lea rcx, [rsp + 0x656b0]
call fcn.14008cac0
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008d980
cmp rax, 1
je 0x1401c214a
mov dword [rsp + 0x66b18], 0
lea rcx, [rsp + 0x656b0]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x65698]
call fcn.140007060
mov eax, dword [rsp + 0x66b18]
jmp 0x1401c2d26
mov dword [rsp + 0x65690], 0
mov edx, 0xa
lea rcx, [rsp + 0x65650]
call fcn.14008ebb8
nop
lea rcx, [rsp + 0x66b20]
call fcn.140001000
mov qword [rsp + 0x66f50], rax
mov rax, qword [rsp + 0x66f50]
mov qword [rsp + 0x66f58], rax
lea r8, [0x14025bfe0]
mov rdx, qword [rsp + 0x66f58]
lea rcx, [rsp + 0x66b28]
call fcn.1400010b0
mov qword [rsp + 0x66f60], rax
mov rax, qword [rsp + 0x66f60]
mov qword [rsp + 0x66f68], rax
mov rdx, qword [rsp + 0x66f68]
lea rcx, [rsp + 0x65650]
call fcn.14008eda4
nop
lea rcx, [rsp + 0x66b28]
call fcn.140007060
nop
lea rcx, [rsp + 0x66b20]
call fcn.140007060
lea rcx, [rsp + 0x66b30]
call fcn.140001000
mov qword [rsp + 0x66f70], rax
mov rax, qword [rsp + 0x66f70]
mov qword [rsp + 0x66f78], rax
lea r8, str.db.xml
mov rdx, qword [rsp + 0x66f78]
lea rcx, [rsp + 0x66b38]
call fcn.1400010b0
mov qword [rsp + 0x66f80], rax
mov rax, qword [rsp + 0x66f80]
mov qword [rsp + 0x66f88], rax
mov rdx, qword [rsp + 0x66f88]
lea rcx, [rsp + 0x65650]
call fcn.14008eda4
nop
lea rcx, [rsp + 0x66b38]
call fcn.140007060
nop
lea rcx, [rsp + 0x66b30]
call fcn.140007060
lea rdx, [rsp + 0x65688]
lea rcx, [rsp + 0x656b0]
call fcn.14008db38
nop
lea rcx, [rsp + 0x66b48]
call fcn.140001000
mov qword [rsp + 0x66f90], rax
mov rax, qword [rsp + 0x66f90]
mov qword [rsp + 0x66f98], rax
lea rcx, [rsp + 0x65688]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0x66f98]
call fcn.140050200
lea r9, [rsp + 0x65690]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x65650]
call fcn.14018ec30
test eax, eax
jne 0x1401c2300
mov dword [rsp + 0x66fa0], 1
jmp 0x1401c230b
mov dword [rsp + 0x66fa0], 0
movzx eax, byte [rsp + 0x66fa0]
mov byte [rsp + 0x66b40], al
lea rcx, [rsp + 0x66b48]
call fcn.140007060
movzx edx, byte [rsp + 0x66b40]
test edx, edx
je 0x1401c23a3
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Backup_of_settings_has_failed_
call fcn.1400f0bf0
mov dword [rsp + 0x66b50], 0
lea rcx, [rsp + 0x65688]
call fcn.140007060
nop
lea rcx, [rsp + 0x65650]
call fcn.14008ed58
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x65698]
call fcn.140007060
mov eax, dword [rsp + 0x66b50]
jmp 0x1401c2d26
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Backup_of_settings_was_successful_
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0x65688]
call fcn.140007060
nop
lea rcx, [rsp + 0x65650]
call fcn.14008ed58
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x65698]
call fcn.140007060
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x66b58]
call fcn.140001000
mov qword [rsp + 0x66fa8], rax
mov rax, qword [rsp + 0x66fa8]
mov qword [rsp + 0x66fb0], rax
lea r8, [0x14025c098]
mov rdx, qword [rsp + 0x66fb0]
lea rcx, [rsp + 0x65a70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x66b58]
call fcn.140007060
lea rcx, [rsp + 0x65a70]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c24b5
lea rcx, [rsp + 0x66b60]
call fcn.140001000
mov qword [rsp + 0x66fb8], rax
mov rax, qword [rsp + 0x66fb8]
mov qword [rsp + 0x66fc0], rax
mov rdx, qword [rsp + 0x66fc0]
lea rcx, [rsp + 0x65a70]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66b60]
call fcn.140007060
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Restore_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14025c0a8]
mov edx, 1
lea rcx, [rsp + 0x65a80]
call fcn.14008cac0
nop
lea rcx, [rsp + 0x65a70]
call fcn.140050200
mov rdi, rax
lea rcx, [rsp + 0x65a80]
call fcn.14008a100
mov qword [rax + 0x50], rdi
lea rcx, [rsp + 0x65a80]
call fcn.14008d980
cmp rax, 1
je 0x1401c2565
mov dword [rsp + 0x66b68], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140007060
mov eax, dword [rsp + 0x66b68]
jmp 0x1401c2d26
lea rdx, [rsp + 0x66b70]
lea rcx, [rsp + 0x65a80]
call fcn.14008db38
mov qword [rsp + 0x66fc8], rax
mov rax, qword [rsp + 0x66fc8]
mov qword [rsp + 0x66fd0], rax
mov rcx, qword [rsp + 0x66fd0]
call fcn.140050200
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8053
mov edx, 0xffffffff
lea rcx, [0x1403c8c50]
call fcn.1400d8250
test rax, rax
jne 0x1401c25d0
mov dword [rsp + 0x66fd8], 1
jmp 0x1401c25db
mov dword [rsp + 0x66fd8], 0
movzx eax, byte [rsp + 0x66fd8]
mov byte [rsp + 0x66b6c], al
lea rcx, [rsp + 0x66b70]
call fcn.140007060
movzx edx, byte [rsp + 0x66b6c]
test edx, edx
je 0x1401c264e
call fcn.1401cb510
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Restoring_settings_has_failed_
call fcn.1400f0bf0
mov dword [rsp + 0x66b78], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140007060
mov eax, dword [rsp + 0x66b78]
jmp 0x1401c2d26
call fcn.1401cb510
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Restoring_settings_was_successful_
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0x65a80]
call fcn.14008c9c8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140007060
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x65e70]
call fcn.1400054b0
nop
lea rcx, [rsp + 0x65e40]
call fcn.140027ff0
nop
lea rcx, [rsp + 0x65e80]
call fcn.140027ff0
nop
lea rdx, [rsp + 0x65e80]
lea rcx, [rsp + 0x65e40]
call fcn.14011eb30
mov dword [rsp + 0x65eb0], 0
mov dword [rsp + 0x65eb4], 0
jmp 0x1401c26f2
mov eax, dword [rsp + 0x65eb4]
add eax, 1
mov dword [rsp + 0x65eb4], eax
movsxd rdi, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.14001d480
cmp rdi, rax
jae 0x1401c293f
movsxd rdx, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.140007280
mov r8, rax
lea rdx, str.SYSTEMCurrentControlSetEnum_
lea rcx, [rsp + 0x66b80]
call fcn.140006d10
mov qword [rsp + 0x66fe0], rax
mov rcx, qword [rsp + 0x66fe0]
call fcn.140050200
mov r9d, 0x20019
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.140005670
test eax, eax
je 0x1401c277f
mov dword [rsp + 0x66fe8], 1
jmp 0x1401c278a
mov dword [rsp + 0x66fe8], 0
movzx eax, byte [rsp + 0x66fe8]
mov byte [rsp + 0x66b7c], al
lea rcx, [rsp + 0x66b80]
call fcn.140007060
movzx edx, byte [rsp + 0x66b7c]
test edx, edx
je 0x1401c27b7
jmp 0x1401c26e1
xor eax, eax
mov word [rsp + 0x65ec0], ax
lea rdi, [rsp + 0x65ec2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x666c0], 0x400
lea r9, [rsp + 0x666c0]
lea r8, [rsp + 0x65ec0]
lea rdx, [0x14025c178]
lea rcx, [rsp + 0x65e70]
call fcn.140005780
lea rcx, [rsp + 0x65e70]
call fcn.140005540
lea rdx, [rsp + 0x65ec0]
lea rcx, [rsp + 0x66b90]
call fcn.140002050
mov qword [rsp + 0x66ff0], rax
mov rax, qword [rsp + 0x66ff0]
mov qword [rsp + 0x66ff8], rax
mov r8, qword [rsp + 0x66ff8]
lea rdx, str.SYSTEMCurrentControlSetControlClass_
lea rcx, [rsp + 0x66b98]
call fcn.140006d10
mov qword [rsp + 0x67000], rax
mov rcx, qword [rsp + 0x67000]
call fcn.140050200
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.140005670
test eax, eax
je 0x1401c289a
mov dword [rsp + 0x67008], 1
jmp 0x1401c28a5
mov dword [rsp + 0x67008], 0
movzx eax, byte [rsp + 0x67008]
mov byte [rsp + 0x66b88], al
lea rcx, [rsp + 0x66b98]
call fcn.140007060
nop
lea rcx, [rsp + 0x66b90]
call fcn.140007060
movzx edx, byte [rsp + 0x66b88]
test edx, edx
je 0x1401c28e0
jmp 0x1401c26e1
mov r9d, 1
lea r8, [0x14025bf74]
lea rdx, str.FlowControl
lea rcx, [rsp + 0x65e70]
call fcn.140005a50
mov r9d, 1
lea r8, [0x14025c1fc]
lea rdx, [0x14025c200]
lea rcx, [rsp + 0x65e70]
call fcn.140005a50
lea rcx, [rsp + 0x65e70]
call fcn.140005540
mov dword [rsp + 0x65eb0], 1
jmp 0x1401c26e1
cmp dword [rsp + 0x65eb0], 0
je 0x1401c2a4e
mov r8d, 0xffffffff
mov edx, 0x44
mov ecx, 0x83
call fcn.1400f2960
cmp eax, 6
jne 0x1401c2a4e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x666c8], rax
lea r8, [rsp + 0x666d0]
mov edx, 0x20
mov rcx, qword [rsp + 0x666c8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x666e0], 1
lea r8, [rsp + 0x666d8]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rdx, qword [rsp + 0x666d8]
mov qword [rsp + 0x666e4], rdx
mov dword [rsp + 0x666ec], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x666e0]
xor edx, edx
mov rcx, qword [rsp + 0x666d0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x80020003
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [rsp + 0x66ba0], 0
lea rcx, [rsp + 0x65e80]
call fcn.140007250
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007250
nop
lea rcx, [rsp + 0x65e70]
call fcn.1400054e0
mov eax, dword [rsp + 0x66ba0]
jmp 0x1401c2d26
lea rcx, [rsp + 0x65e80]
call fcn.140007250
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007250
nop
lea rcx, [rsp + 0x65e70]
call fcn.1400054e0
xor eax, eax
jmp 0x1401c2d26
lea rcx, [rsp + 0x66908]
call fcn.1400054b0
nop
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliCafeMenu_is1
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x66908]
call fcn.140005670
test eax, eax
je 0x1401c2ad5
mov dword [rsp + 0x66ba4], 0
lea rcx, [rsp + 0x66908]
call fcn.1400054e0
mov eax, dword [rsp + 0x66ba4]
jmp 0x1401c2d26
xor eax, eax
mov word [rsp + 0x666f0], ax
lea rdi, [rsp + 0x666f2]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x66918], 0x104
lea r9, [rsp + 0x66918]
lea r8, [rsp + 0x666f0]
lea rdx, [0x14025c2c8]
lea rcx, [rsp + 0x66908]
call fcn.140005780
lea rcx, [rsp + 0x66908]
call fcn.140005540
lea rcx, [rsp + 0x666f0]
call fcn.1400a99d4
test rax, rax
jne 0x1401c2b62
mov dword [rsp + 0x66ba8], 0
lea rcx, [rsp + 0x66908]
call fcn.1400054e0
mov eax, dword [rsp + 0x66ba8]
jmp 0x1401c2d26
lea rdx, [rsp + 0x666f0]
lea rcx, [rsp + 0x66900]
call fcn.140002050
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0x66900]
call fcn.140006280
mov r8d, 1
lea rdx, [rsp + 0x66bb0]
lea rcx, [rsp + 0x66900]
call fcn.140006ae0
mov qword [rsp + 0x67010], rax
lea rdx, [0x14025c2c4]
mov rcx, qword [rsp + 0x67010]
call fcn.140006130
test eax, eax
jne 0x1401c2bd6
mov dword [rsp + 0x67018], 1
jmp 0x1401c2be1
mov dword [rsp + 0x67018], 0
movzx eax, byte [rsp + 0x67018]
mov byte [rsp + 0x66bac], al
lea rcx, [rsp + 0x66bb0]
call fcn.140007060
movzx edx, byte [rsp + 0x66bac]
test edx, edx
je 0x1401c2c70
lea rcx, [rsp + 0x66900]
call fcn.1400019a0
mov r9d, eax
sub r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x66bb8]
lea rcx, [rsp + 0x66900]
call fcn.1400021f0
mov qword [rsp + 0x67020], rax
mov rax, qword [rsp + 0x67020]
mov qword [rsp + 0x67028], rax
mov rdx, qword [rsp + 0x67028]
lea rcx, [rsp + 0x66900]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66bb8]
call fcn.140007060
lea r8, str.iCafeMenuServer.exe
lea rdx, [rsp + 0x66900]
lea rcx, [rsp + 0x66bc0]
call fcn.1400010b0
mov qword [rsp + 0x67030], rax
mov rax, qword [rsp + 0x67030]
mov qword [rsp + 0x67038], rax
mov rdx, qword [rsp + 0x67038]
lea rcx, [rsp + 0x66900]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x66bc0]
call fcn.140007060
lea rcx, [rsp + 0x66900]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c2d02
lea rcx, [rsp + 0x66900]
call fcn.140050200
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140004880
nop
lea rcx, [rsp + 0x66900]
call fcn.140007060
nop
lea rcx, [rsp + 0x66908]
call fcn.1400054e0
xor eax, eax
jmp 0x1401c2d26
mov eax, 1
mov rcx, qword [rsp + 0x67040]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0x67050
pop rdi
ret