Function at 0x1401bb550
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get disk information
Link many functions at runtime
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0xd2b0
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0xd100], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0xd2a8], rax
mov rax, qword [rsp + 0xd2c8]
mov qword [rsp + 0xd108], rax
cmp qword [rsp + 0xd108], 0x8156
ja 0x1401bb606
cmp qword [rsp + 0xd108], 0x8156
je 0x1401be6ad
mov rax, qword [rsp + 0xd108]
sub rax, 0x804f
mov qword [rsp + 0xd108], rax
cmp qword [rsp + 0xd108], 0xa6
ja case.0x1401bb604.32848
lea rcx, [0x140000000]
mov rax, qword [rsp + 0xd108]
movzx eax, byte [rcx + rax + 0x1be7a0]
mov eax, dword [rcx + rax*4 + 0x1be774]
add rax, rcx
jmp rax
jmp case.0x1401bb604.32848
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14015f750
nop
lea rcx, [rsp + 0x40]
call fcn.140082174
cmp rax, 1
je 0x1401bb649
mov dword [rsp + 0xcf30], 0
lea rcx, [rsp + 0x40]
call fcn.14015f510
mov eax, dword [rsp + 0xcf30]
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
call fcn.14000cd90
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x250]
mov r8d, eax
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
nop
lea rcx, [rsp + 0x40]
call fcn.14015f510
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
jge 0x1401bb6cd
xor eax, eax
jmp 0x1401be75a
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.14015f750
nop
mov dword [rsp + 0x494], 1
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x270]
call fcn.140082c64
mov dword [rsp + 0x490], eax
lea rcx, [rsp + 0x280]
call fcn.140082174
cmp rax, 1
je 0x1401bb741
mov dword [rsp + 0xcf34], 0
lea rcx, [rsp + 0x280]
call fcn.14015f510
mov eax, dword [rsp + 0xcf34]
jmp 0x1401be75a
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x490]
mov r8d, dword [rsp + 0x270]
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
nop
lea rcx, [rsp + 0x280]
call fcn.14015f510
xor eax, eax
jmp 0x1401be75a
xor r8d, r8d
lea rdx, [rsp + 0xcf40]
mov rcx, qword [rsp + 0xd2c0]
call fcn.140193f10
mov qword [rsp + 0xd110], rax
lea rdx, [0x14024b048]
mov rcx, qword [rsp + 0xd110]
call fcn.140006d90
mov byte [rsp + 0xcf38], al
lea rcx, [rsp + 0xcf40]
call fcn.140001490
movzx edx, byte [rsp + 0xcf38]
test edx, edx
je 0x1401bb7dd
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 0
jge 0x1401bb814
xor eax, eax
jmp 0x1401be75a
cmp dword [rsp + 0x4b0], 0
jl 0x1401bb8d2
lea rcx, [rsp + 0x4c0]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.140082c64
mov dword [rsp + 0x658], eax
lea rcx, [rsp + 0x4c0]
call fcn.1401d4e80
test eax, eax
je 0x1401bb898
xor r8d, r8d
xor edx, edx
lea rcx, str.Error__The_image_is_being_used_by_a_super_client.
call fcn.1400ef950
mov dword [rsp + 0xcf48], 1
lea rcx, [rsp + 0x4c0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf48]
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, dword [rsp + 0x4b0]
call fcn.14000c920
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x4c0]
call fcn.140014ec0
jmp 0x1401bb814
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x4b0], eax
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_delete_the_image_
call fcn.1400ef950
cmp eax, 7
jne 0x1401bb918
xor eax, eax
jmp 0x1401be75a
cmp dword [rsp + 0x4b0], 0
jl 0x1401bbb88
lea rcx, [rsp + 0xb70]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.140082c64
mov dword [rsp + 0xd08], eax
lea rcx, [rsp + 0xb70]
call fcn.1401bf080
lea rcx, [rsp + 0x800]
call fcn.1401d19d0
nop
lea rcx, [rsp + 0xb40]
call fcn.140006ef0
nop
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x800]
call fcn.1401d4680
mov dword [rsp + 0xeb0], 0
jmp 0x1401bb9b2
mov eax, dword [rsp + 0xeb0]
add eax, 1
mov dword [rsp + 0xeb0], eax
mov edi, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006f70
cmp rdi, rax
jae 0x1401bbb0c
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1f0
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
cmp eax, dword [rsp + 0xd08]
je 0x1401bba3c
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1f8
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
cmp eax, dword [rsp + 0xd08]
je 0x1401bba3c
jmp 0x1401bb9a1
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006fa0
mov eax, dword [rax + 0x198]
mov dword [rsp + 0x998], eax
lea rcx, [rsp + 0x800]
call fcn.1401d6a40
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1f0
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
cmp eax, dword [rsp + 0xd08]
jne 0x1401bbab2
lea rcx, [rsp + 0x9f0]
lea rdx, [0x140249b14]
call fcn.1400020d0
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1f8
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
cmp eax, dword [rsp + 0xd08]
jne 0x1401bbafa
lea rcx, [rsp + 0x9f8]
lea rdx, [0x140249b34]
call fcn.1400020d0
lea rcx, [rsp + 0x800]
call fcn.1401d4410
jmp 0x1401bb9a1
lea rcx, [rsp + 0xb70]
call fcn.1401bf390
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.14000c850
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0xb40]
call fcn.140006f40
nop
lea rcx, [rsp + 0x800]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xb70]
call fcn.140014ec0
jmp 0x1401bb918
mov edx, 1
mov ecx, 1
call fcn.1401bfc60
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0xeb4], eax
cmp dword [rsp + 0xeb4], 0
jge 0x1401bbbd5
xor eax, eax
jmp 0x1401be75a
xor r8d, r8d
lea rdx, [rsp + 0xcf50]
mov rcx, qword [rsp + 0xd2c0]
call fcn.140193f10
mov qword [rsp + 0xd118], rax
lea rdx, [0x14024b128]
mov rcx, qword [rsp + 0xd118]
call fcn.140006d50
mov byte [rsp + 0xcf4c], al
lea rcx, [rsp + 0xcf50]
call fcn.140001490
movzx edx, byte [rsp + 0xcf4c]
test edx, edx
je 0x1401bbe1d
lea rcx, [rsp + 0xed0]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0xeb4]
call fcn.140082c64
mov dword [rsp + 0x1068], eax
lea rcx, [rsp + 0xed0]
call fcn.1401bf080
test eax, eax
jne 0x1401bbc92
mov dword [rsp + 0xcf58], 0
lea rcx, [rsp + 0xed0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf58]
jmp 0x1401be75a
lea rdx, [rsp + 0x1078]
lea rcx, [rsp + 0xec0]
call fcn.140001430
nop
lea rcx, [rsp + 0xec0]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0xeb8], eax
cmp dword [rsp + 0xeb8], 5
jne 0x1401bbd35
lea rcx, [0x14024b148]
call fcn.1400a8944
mov r8d, eax
lea rdx, [rsp + 0xcf60]
lea rcx, [rsp + 0xec0]
call fcn.140006a00
mov qword [rsp + 0xd120], rax
mov rcx, qword [rsp + 0xd120]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xcf60]
call fcn.140001490
cmp dword [rsp + 0xeb8], 1
je 0x1401bbd57
cmp dword [rsp + 0xeb8], 2
je 0x1401bbd57
cmp dword [rsp + 0xeb8], 8
jne 0x1401bbe02
lea r8, [rsp + 0xec0]
lea rdx, [0x14024b158]
lea rcx, [rsp + 0xcf68]
call fcn.140006c90
mov qword [rsp + 0xd128], rax
mov rax, qword [rsp + 0xd128]
mov qword [rsp + 0xd130], rax
lea r8, [0x140249b54]
mov rdx, qword [rsp + 0xd130]
lea rcx, [rsp + 0xcf70]
call fcn.1400010b0
mov qword [rsp + 0xd138], rax
mov rcx, qword [rsp + 0xd138]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14024b178]
lea rdx, [0x14024b198]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xcf70]
call fcn.140001490
nop
lea rcx, [rsp + 0xcf68]
call fcn.140001490
nop
lea rcx, [rsp + 0xec0]
call fcn.140001490
nop
lea rcx, [rsp + 0xed0]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
xor r8d, r8d
lea rdx, [rsp + 0xcf80]
mov rcx, qword [rsp + 0xd2c0]
call fcn.140193f10
mov qword [rsp + 0xd140], rax
lea rdx, [0x14024b1a8]
mov rcx, qword [rsp + 0xd140]
call fcn.140006d50
mov byte [rsp + 0xcf78], al
lea rcx, [rsp + 0xcf80]
call fcn.140001490
movzx edx, byte [rsp + 0xcf78]
test edx, edx
je 0x1401bbfc1
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x1560], eax
cmp dword [rsp + 0x1560], 0
jge 0x1401bbeb3
xor eax, eax
jmp 0x1401be75a
lea rcx, [rsp + 0x1220]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x1560]
call fcn.140082c64
mov dword [rsp + 0x13b8], eax
lea rcx, [rsp + 0x1220]
call fcn.1401bf080
lea rcx, [rsp + 0x13c8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0x1210], eax
cmp dword [rsp + 0x1210], 3
je 0x1401bbf2a
cmp dword [rsp + 0x1210], 4
je 0x1401bbf2a
cmp dword [rsp + 0x1210], 5
jne 0x1401bbf4e
mov dword [rsp + 0xcf88], 0
lea rcx, [rsp + 0x1220]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf88]
jmp 0x1401be75a
xor edx, edx
lea rcx, [rsp + 0x1570]
call fcn.140161890
nop
mov eax, dword [rsp + 0x13b8]
mov dword [rsp + 0x1848], eax
lea rcx, [rsp + 0x1570]
call fcn.140082174
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x13b8]
mov r8d, dword [rsp + 0x1560]
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
nop
lea rcx, [rsp + 0x1570]
call fcn.1401617e0
nop
lea rcx, [rsp + 0x1220]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xd2c0]
lea r8, [0x1401b9dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1401be75a
mov rax, qword [rsp + 0xd2c0]
cmp dword [rax + 0x978], 0
je 0x1401bc01a
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x2434], eax
cmp dword [rsp + 0x2434], 0
jge 0x1401bc051
xor eax, eax
jmp 0x1401be75a
lea rcx, [rsp + 0x20f0]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x2434]
call fcn.140082c64
mov dword [rsp + 0x2288], eax
lea rcx, [rsp + 0x20f0]
call fcn.1401bf080
test eax, eax
jne 0x1401bc0b6
mov dword [rsp + 0xcf8c], 0
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf8c]
jmp 0x1401be75a
lea rcx, [rsp + 0x2298]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0x1914], eax
cmp dword [rsp + 0x1914], 2
je 0x1401bc100
mov dword [rsp + 0xcf90], 0
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf90]
jmp 0x1401be75a
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_add_nic_driver_to_the_image_
call fcn.1400ef950
cmp eax, 7
jne 0x1401bc161
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xcf94], 0
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf94]
jmp 0x1401be75a
lea rdx, [rsp + 0x2298]
lea r8, [0x14024b228]
lea rcx, [rsp + 0x2c50]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rdi, rax
lea rcx, [rsp + 0x2298]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140107430
lea rcx, [0x14024b240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x2438], rax
cmp qword [rsp + 0x2438], 0
jne 0x1401bc237
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024b260]
call fcn.1400ef950
mov dword [rsp + 0xcf98], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf98]
jmp 0x1401be75a
lea rdx, [0x14024b2b8]
mov rcx, qword [rsp + 0x2438]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2c58], rax
lea rdx, [0x14024b2d0]
mov rcx, qword [rsp + 0x2438]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2c60], rax
lea rdx, [0x14024b2e0]
mov rcx, qword [rsp + 0x2438]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20e0], rax
lea rdx, [0x14024b2f8]
mov rcx, qword [rsp + 0x2438]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2c68], rax
mov qword [rsp + 0x20d8], 0xffffffffffffffff
mov dword [rsp + 0x20c0], 2
mov dword [rsp + 0x20c4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x20c8], ax
mov eax, 0x47e9
mov word [rsp + 0x20ca], ax
mov byte [rsp + 0x20cc], 0x90
mov byte [rsp + 0x20cd], 0x1f
mov byte [rsp + 0x20ce], 0x71
mov byte [rsp + 0x20cf], 0x41
mov byte [rsp + 0x20d0], 0x5a
mov byte [rsp + 0x20d1], 0x66
mov byte [rsp + 0x20d2], 0x34
mov byte [rsp + 0x20d3], 0x5b
mov dword [rsp + 0x2440], 1
lea rdi, [rsp + 0x2444]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x2444], 1
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rdx, rax
lea rax, [rsp + 0x20d8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2440]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x20c0]
call qword [rsp + 0x2c60]
test eax, eax
je 0x1401bc402
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b318]
call fcn.1400ef950
mov dword [rsp + 0xcf9c], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcf9c]
jmp 0x1401be75a
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x20e0]
test eax, eax
je 0x1401bc4ab
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b340]
call fcn.1400ef950
mov dword [rsp + 0xcfa0], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcfa0]
jmp 0x1401be75a
xor eax, eax
mov word [rsp + 0x2450], ax
lea rdi, [rsp + 0x2452]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x20b0], 0x800
lea r8, [rsp + 0x2450]
lea rdx, [rsp + 0x20b0]
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c68]
lea rcx, [0x14024b368]
call fcn.1400a8944
lea rcx, [rsp + rax*2 + 0x2450]
call fcn.1400a99f8
mov dword [rsp + 0x1910], eax
mov eax, 0x43
mov word [rsp + 0x2430], ax
mov dword [rsp + 0x2c70], 0
jmp 0x1401bc53b
mov eax, dword [rsp + 0x2c70]
add eax, 1
mov dword [rsp + 0x2c70], eax
cmp dword [rsp + 0x2c70], 0x14
jge 0x1401bc802
movzx eax, word [rsp + 0x2430]
cmp eax, 0x43
jne 0x1401bc802
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x2c74], eax
mov byte [rsp + 0x2c78], 0x43
jmp 0x1401bc58d
movzx eax, byte [rsp + 0x2c78]
add al, 1
mov byte [rsp + 0x2c78], al
movsx eax, byte [rsp + 0x2c78]
cmp eax, 0x5a
jg 0x1401bc7fd
movzx eax, word [rsp + 0x2430]
cmp eax, 0x43
jne 0x1401bc7fd
movsx ecx, byte [rsp + 0x2c78]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x2c74]
and eax, ecx
test eax, eax
jne 0x1401bc5d2
jmp 0x1401bc57c
lea rcx, [rsp + 0x6c98]
call fcn.140002de0
nop
movsx r8d, byte [rsp + 0x2c78]
lea rdx, [0x14024b390]
lea rcx, [rsp + 0x6c98]
call fcn.140002c70
lea rcx, [rsp + 0x6c98]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401bc62a
lea rcx, [rsp + 0x6c98]
call fcn.140001490
jmp 0x1401bc57c
movsx r8d, byte [rsp + 0x2c78]
lea rdx, [0x14024b398]
lea rcx, [rsp + 0x6c98]
call fcn.140002c70
lea rcx, [rsp + 0x6c98]
call fcn.14000f8f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2c80], rax
cmp qword [rsp + 0x2c80], 0xffffffffffffffff
jne 0x1401bc6a9
lea rcx, [rsp + 0x6c98]
call fcn.140001490
jmp 0x1401bc57c
mov dword [rsp + 0x6c90], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x6c90]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x2c90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x2c80]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401bc7dc
mov dword [rsp + 0x6ca0], 0
mov dword [rsp + 0x6ca0], 0
jmp 0x1401bc729
mov eax, dword [rsp + 0x6ca0]
add eax, 1
mov dword [rsp + 0x6ca0], eax
mov eax, dword [rsp + 0x2c90]
cmp dword [rsp + 0x6ca0], eax
jge 0x1401bc7dc
cmp dword [rsp + 0x1910], 0xffffffff
je 0x1401bc765
movsxd rax, dword [rsp + 0x6ca0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x2c98]
cmp dword [rsp + 0x1910], eax
je 0x1401bc765
jmp 0x1401bc718
lea rcx, [rsp + 0x6ca8]
call fcn.140002de0
nop
movsx r8d, byte [rsp + 0x2c78]
lea rdx, [0x14024b3a8]
lea rcx, [rsp + 0x6ca8]
call fcn.140002c70
lea rcx, [rsp + 0x6ca8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401bc7ca
movsx ax, byte [rsp + 0x2c78]
mov word [rsp + 0x2430], ax
lea rcx, [rsp + 0x6ca8]
call fcn.140001490
jmp 0x1401bc7dc
lea rcx, [rsp + 0x6ca8]
call fcn.140001490
jmp 0x1401bc718
mov rcx, qword [rsp + 0x2c80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x6c98]
call fcn.140001490
jmp 0x1401bc57c
jmp 0x1401bc52a
movzx eax, word [rsp + 0x2430]
cmp eax, 0x43
jne 0x1401bc8ba
cmp qword [rsp + 0x20d8], 0xffffffffffffffff
je 0x1401bc84c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20d8], 0xffffffffffffffff
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b3c0]
call fcn.1400ef950
mov dword [rsp + 0xcfa4], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcfa4]
jmp 0x1401be75a
call fcn.1400d7f30
test eax, eax
jne 0x1401bc96e
cmp qword [rsp + 0x20d8], 0xffffffffffffffff
je 0x1401bc900
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20d8], 0xffffffffffffffff
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b3e8]
call fcn.1400ef950
mov dword [rsp + 0xcfa8], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcfa8]
jmp 0x1401be75a
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xcfb0]
call fcn.140005ec0
mov qword [rsp + 0xd148], rax
mov rax, qword [rsp + 0xd148]
mov qword [rsp + 0xd150], rax
lea r8, [0x14024b420]
mov rdx, qword [rsp + 0xd150]
lea rcx, [rsp + 0xcfb8]
call fcn.1400010b0
mov qword [rsp + 0xd158], rax
mov rcx, qword [rsp + 0xd158]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xcfb8]
call fcn.140001490
nop
lea rcx, [rsp + 0xcfb0]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xcfc0]
call fcn.140005ec0
mov qword [rsp + 0xd160], rax
mov rax, qword [rsp + 0xd160]
mov qword [rsp + 0xd168], rax
lea r8, [0x14024b430]
mov rdx, qword [rsp + 0xd168]
lea rcx, [rsp + 0xcfc8]
call fcn.1400010b0
mov qword [rsp + 0xd170], rax
mov rcx, qword [rsp + 0xd170]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xcfc8]
call fcn.140001490
nop
lea rcx, [rsp + 0xcfc0]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xcfd8]
call fcn.140005ec0
mov qword [rsp + 0xd178], rax
mov rax, qword [rsp + 0xd178]
mov qword [rsp + 0xd180], rax
lea r8, [0x14024b450]
mov rdx, qword [rsp + 0xd180]
lea rcx, [rsp + 0xcfe0]
call fcn.1400010b0
mov qword [rsp + 0xd188], rax
mov rax, qword [rsp + 0xd188]
mov qword [rsp + 0xd190], rax
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xcfe8]
call fcn.140005ec0
mov qword [rsp + 0xd198], rax
mov rax, qword [rsp + 0xd198]
mov qword [rsp + 0xd1a0], rax
lea r8, [0x14024b498]
mov rdx, qword [rsp + 0xd1a0]
lea rcx, [rsp + 0xcff0]
call fcn.1400010b0
mov qword [rsp + 0xd1a8], rax
mov rcx, qword [rsp + 0xd190]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0xd1a8]
call fcn.14000f8f0
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xcfd0], eax
lea rcx, [rsp + 0xcff0]
call fcn.140001490
nop
lea rcx, [rsp + 0xcfe8]
call fcn.140001490
nop
lea rcx, [rsp + 0xcfe0]
call fcn.140001490
nop
lea rcx, [rsp + 0xcfd8]
call fcn.140001490
cmp dword [rsp + 0xcfd0], 0
je 0x1401bcc6d
cmp qword [rsp + 0x20d8], 0xffffffffffffffff
je 0x1401bcbff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20d8], 0xffffffffffffffff
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b4a8]
call fcn.1400ef950
mov dword [rsp + 0xcff8], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xcff8]
jmp 0x1401be75a
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd000]
call fcn.140005ec0
mov qword [rsp + 0xd1b0], rax
mov rax, qword [rsp + 0xd1b0]
mov qword [rsp + 0xd1b8], rax
lea r8, [0x14024b4e0]
mov rdx, qword [rsp + 0xd1b8]
lea rcx, [rsp + 0xd008]
call fcn.1400010b0
mov qword [rsp + 0xd1c0], rax
mov rax, qword [rsp + 0xd1c0]
mov qword [rsp + 0xd1c8], rax
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd010]
call fcn.140005ec0
mov qword [rsp + 0xd1d0], rax
mov rax, qword [rsp + 0xd1d0]
mov qword [rsp + 0xd1d8], rax
lea r8, [0x14024b528]
mov rdx, qword [rsp + 0xd1d8]
lea rcx, [rsp + 0xd018]
call fcn.1400010b0
mov qword [rsp + 0xd1e0], rax
mov rcx, qword [rsp + 0xd1c8]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0xd1e0]
call fcn.14000f8f0
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xcffc], eax
lea rcx, [rsp + 0xd018]
call fcn.140001490
nop
lea rcx, [rsp + 0xd010]
call fcn.140001490
nop
lea rcx, [rsp + 0xd008]
call fcn.140001490
nop
lea rcx, [rsp + 0xd000]
call fcn.140001490
cmp dword [rsp + 0xcffc], 0
je 0x1401bcedd
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd020]
call fcn.140005ec0
mov qword [rsp + 0xd1e8], rax
mov rax, qword [rsp + 0xd1e8]
mov qword [rsp + 0xd1f0], rax
lea r8, [0x14024b540]
mov rdx, qword [rsp + 0xd1f0]
lea rcx, [rsp + 0xd028]
call fcn.1400010b0
mov qword [rsp + 0xd1f8], rax
mov rcx, qword [rsp + 0xd1f8]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd028]
call fcn.140001490
nop
lea rcx, [rsp + 0xd020]
call fcn.140001490
cmp qword [rsp + 0x20d8], 0xffffffffffffffff
je 0x1401bce6f
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20d8], 0xffffffffffffffff
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b550]
call fcn.1400ef950
mov dword [rsp + 0xd030], 0
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xd030]
jmp 0x1401be75a
xor edx, edx
lea rcx, [rsp + 0x1920]
call fcn.1401528b0
nop
movzx eax, word [rsp + 0x2430]
mov word [rsp + 0x1be4], ax
lea rcx, [rsp + 0x1920]
call fcn.140082174
cmp rax, 1
jne 0x1401bd336
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd038]
call fcn.140005ec0
mov qword [rsp + 0xd200], rax
mov rax, qword [rsp + 0xd200]
mov qword [rsp + 0xd208], rax
lea r8, [0x14024b588]
mov rdx, qword [rsp + 0xd208]
lea rcx, [rsp + 0xd040]
call fcn.1400010b0
mov qword [rsp + 0xd210], rax
mov rcx, qword [rsp + 0xd210]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd040]
call fcn.140001490
nop
lea rcx, [rsp + 0xd038]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd048]
call fcn.140005ec0
mov qword [rsp + 0xd218], rax
mov rax, qword [rsp + 0xd218]
mov qword [rsp + 0xd220], rax
lea r8, [0x14024b598]
mov rdx, qword [rsp + 0xd220]
lea rcx, [rsp + 0xd050]
call fcn.1400010b0
mov qword [rsp + 0xd228], rax
mov rcx, qword [rsp + 0xd228]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd050]
call fcn.140001490
nop
lea rcx, [rsp + 0xd048]
call fcn.140001490
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x2288]
lea rcx, [rsp + 0x6cb0]
call fcn.1401d18c0
nop
lea rcx, [rsp + 0x2298]
call fcn.14000f8f0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x6ff8]
call fcn.1400fa8d0
nop
mov dx, 0x2e
lea rcx, [rsp + 0x6ff8]
call fcn.1400068a0
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd058]
lea rcx, [rsp + 0x6ff8]
call fcn.140006a00
mov qword [rsp + 0xd230], rax
mov rcx, qword [rsp + 0xd230]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0x6ff0], eax
lea rcx, [rsp + 0xd058]
call fcn.140001490
lea rcx, [rsp + 0x6e50]
mov r8d, dword [rsp + 0x6ff0]
lea rdx, [0x14024b064]
call fcn.140002c70
lea rcx, [rsp + 0x6e58]
lea rdx, [0x14024b5b0]
call fcn.1400020d0
lea rcx, [rsp + 0xd060]
call fcn.14000e290
lea r8, [0x14024b5e0]
lea rdx, [rsp + 0xd068]
mov rcx, rax
call fcn.14000c960
mov qword [rsp + 0xd238], rax
mov rax, qword [rsp + 0xd238]
mov qword [rsp + 0xd240], rax
lea rcx, [rsp + 0x6e60]
mov rdx, qword [rsp + 0xd240]
call fcn.140002db0
nop
lea rcx, [rsp + 0xd068]
call fcn.140001490
lea rcx, [rsp + 0x6cb0]
call fcn.1401bf8a0
mov edx, 1
mov ecx, 1
call fcn.1401bfc60
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x968], 0
je 0x1401bd1c8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x970], 0
je 0x1401bd212
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call fcn.14007d104
xor edx, edx
mov rcx, rax
call fcn.14007c7e4
mov edx, 5
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x6ff8]
call fcn.14000f8f0
mov rdi, rax
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov r8, qword [rsp + 0xd2c0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140106b10
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x970], 0
je 0x1401bd288
xor edx, edx
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Add_nic_to_the_image_success
call fcn.1400ef950
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x2288]
mov r8d, dword [rsp + 0x2434]
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
mov dword [rsp + 0xd070], 0
lea rcx, [rsp + 0x6ff8]
call fcn.140001490
nop
lea rcx, [rsp + 0x6cb0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x1920]
call fcn.140152830
nop
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
mov eax, dword [rsp + 0xd070]
jmp 0x1401be75a
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd078]
call fcn.140005ec0
mov qword [rsp + 0xd248], rax
mov rax, qword [rsp + 0xd248]
mov qword [rsp + 0xd250], rax
lea r8, [0x14024b648]
mov rdx, qword [rsp + 0xd250]
lea rcx, [rsp + 0xd080]
call fcn.1400010b0
mov qword [rsp + 0xd258], rax
mov rcx, qword [rsp + 0xd258]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd080]
call fcn.140001490
nop
lea rcx, [rsp + 0xd078]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2430]
lea rcx, [rsp + 0xd088]
call fcn.140005ec0
mov qword [rsp + 0xd260], rax
mov rax, qword [rsp + 0xd260]
mov qword [rsp + 0xd268], rax
lea r8, [0x14024b658]
mov rdx, qword [rsp + 0xd268]
lea rcx, [rsp + 0xd090]
call fcn.1400010b0
mov qword [rsp + 0xd270], rax
mov rcx, qword [rsp + 0xd270]
call fcn.14000f8f0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd090]
call fcn.140001490
nop
lea rcx, [rsp + 0xd088]
call fcn.140001490
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20d8]
call qword [rsp + 0x2c58]
mov rcx, qword [rsp + 0x20d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2c50]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
mov qword [rsp + 0x20d8], 0xffffffffffffffff
lea rcx, [rsp + 0x1920]
call fcn.140152830
nop
lea rcx, [rsp + 0x2c50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20f0]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0x7034], eax
cmp dword [rsp + 0x7034], 0
jge 0x1401bd511
xor eax, eax
jmp 0x1401be75a
lea rcx, [rsp + 0x7870]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0x7034]
call fcn.140082c64
mov dword [rsp + 0x7a08], eax
lea rcx, [rsp + 0x7870]
call fcn.1401bf080
test eax, eax
jne 0x1401bd576
mov dword [rsp + 0xd098], 0
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd098]
jmp 0x1401be75a
lea rcx, [rsp + 0x7a18]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0x7004], eax
cmp dword [rsp + 0x7004], 2
je 0x1401bd5d4
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024b670]
call fcn.1400ef950
mov dword [rsp + 0xd09c], 0
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd09c]
jmp 0x1401be75a
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_mount_this_image_
call fcn.1400ef950
cmp eax, 7
jne 0x1401bd611
mov dword [rsp + 0xd0a0], 0
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0a0]
jmp 0x1401be75a
lea rdx, [rsp + 0x7a18]
lea r8, [0x14024b748]
lea rcx, [rsp + 0x7850]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rdi, rax
lea rcx, [rsp + 0x7a18]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140107430
lea rcx, [0x14024b760]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x7038], rax
cmp qword [rsp + 0x7038], 0
jne 0x1401bd6d5
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024b780]
call fcn.1400ef950
mov dword [rsp + 0xd0a4], 0
lea rcx, [rsp + 0x7850]
call fcn.140001490
nop
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0a4]
jmp 0x1401be75a
lea rdx, [0x14024b7d8]
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7858], rax
lea rdx, [0x14024b7f0]
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7860], rax
lea rdx, [0x14024b800]
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7028], rax
lea rdx, [0x14024b818]
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7868], rax
mov rax, qword [rsp + 0xd2c0]
mov qword [rax + 0x1320], 0xffffffffffffffff
mov dword [rsp + 0x7010], 2
mov dword [rsp + 0x7014], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x7018], ax
mov eax, 0x47e9
mov word [rsp + 0x701a], ax
mov byte [rsp + 0x701c], 0x90
mov byte [rsp + 0x701d], 0x1f
mov byte [rsp + 0x701e], 0x71
mov byte [rsp + 0x701f], 0x41
mov byte [rsp + 0x7020], 0x5a
mov byte [rsp + 0x7021], 0x66
mov byte [rsp + 0x7022], 0x34
mov byte [rsp + 0x7023], 0x5b
mov dword [rsp + 0x7040], 1
lea rdi, [rsp + 0x7044]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x7044], 1
mov rdi, qword [rsp + 0xd2c0]
add rdi, 0x1320
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rdx, rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x7040]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x7010]
call qword [rsp + 0x7860]
test eax, eax
je 0x1401bd8aa
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b838]
call fcn.1400ef950
mov dword [rsp + 0xd0a8], 0
lea rcx, [rsp + 0x7850]
call fcn.140001490
nop
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0a8]
jmp 0x1401be75a
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7028]
test eax, eax
je 0x1401bd974
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xd2c0]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b860]
call fcn.1400ef950
mov dword [rsp + 0xd0ac], 0
lea rcx, [rsp + 0x7850]
call fcn.140001490
nop
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0ac]
jmp 0x1401be75a
xor eax, eax
mov word [rsp + 0x7050], ax
lea rdi, [rsp + 0x7052]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x7008], 0x800
lea r8, [rsp + 0x7050]
lea rdx, [rsp + 0x7008]
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7868]
lea rcx, [0x14024b888]
call fcn.1400a8944
lea rcx, [rsp + rax*2 + 0x7050]
call fcn.1400a99f8
mov dword [rsp + 0x7000], eax
mov eax, 0x43
mov word [rsp + 0x7030], ax
mov dword [rsp + 0x7bb0], 0
jmp 0x1401bda0b
mov eax, dword [rsp + 0x7bb0]
add eax, 1
mov dword [rsp + 0x7bb0], eax
cmp dword [rsp + 0x7bb0], 0x14
jge 0x1401bdcd2
movzx eax, word [rsp + 0x7030]
cmp eax, 0x43
jne 0x1401bdcd2
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x7bb4], eax
mov byte [rsp + 0x7bb8], 0x43
jmp 0x1401bda5d
movzx eax, byte [rsp + 0x7bb8]
add al, 1
mov byte [rsp + 0x7bb8], al
movsx eax, byte [rsp + 0x7bb8]
cmp eax, 0x5a
jg 0x1401bdccd
movzx eax, word [rsp + 0x7030]
cmp eax, 0x43
jne 0x1401bdccd
movsx ecx, byte [rsp + 0x7bb8]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x7bb4]
and eax, ecx
test eax, eax
jne 0x1401bdaa2
jmp 0x1401bda4c
lea rcx, [rsp + 0xbbd8]
call fcn.140002de0
nop
movsx r8d, byte [rsp + 0x7bb8]
lea rdx, [0x14024b8b0]
lea rcx, [rsp + 0xbbd8]
call fcn.140002c70
lea rcx, [rsp + 0xbbd8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401bdafa
lea rcx, [rsp + 0xbbd8]
call fcn.140001490
jmp 0x1401bda4c
movsx r8d, byte [rsp + 0x7bb8]
lea rdx, [0x14024b8b8]
lea rcx, [rsp + 0xbbd8]
call fcn.140002c70
lea rcx, [rsp + 0xbbd8]
call fcn.14000f8f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x7bc0], rax
cmp qword [rsp + 0x7bc0], 0xffffffffffffffff
jne 0x1401bdb79
lea rcx, [rsp + 0xbbd8]
call fcn.140001490
jmp 0x1401bda4c
mov dword [rsp + 0xbbd0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0xbbd0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x7bd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x7bc0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401bdcac
mov dword [rsp + 0xbbe0], 0
mov dword [rsp + 0xbbe0], 0
jmp 0x1401bdbf9
mov eax, dword [rsp + 0xbbe0]
add eax, 1
mov dword [rsp + 0xbbe0], eax
mov eax, dword [rsp + 0x7bd0]
cmp dword [rsp + 0xbbe0], eax
jge 0x1401bdcac
cmp dword [rsp + 0x7000], 0xffffffff
je 0x1401bdc35
movsxd rax, dword [rsp + 0xbbe0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x7bd8]
cmp dword [rsp + 0x7000], eax
je 0x1401bdc35
jmp 0x1401bdbe8
lea rcx, [rsp + 0xbbe8]
call fcn.140002de0
nop
movsx r8d, byte [rsp + 0x7bb8]
lea rdx, [0x14024b8c8]
lea rcx, [rsp + 0xbbe8]
call fcn.140002c70
lea rcx, [rsp + 0xbbe8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401bdc9a
movsx ax, byte [rsp + 0x7bb8]
mov word [rsp + 0x7030], ax
lea rcx, [rsp + 0xbbe8]
call fcn.140001490
jmp 0x1401bdcac
lea rcx, [rsp + 0xbbe8]
call fcn.140001490
jmp 0x1401bdbe8
mov rcx, qword [rsp + 0x7bc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xbbd8]
call fcn.140001490
jmp 0x1401bda4c
jmp 0x1401bd9fa
movzx eax, word [rsp + 0x7030]
cmp eax, 0x43
jne 0x1401bdda2
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x1320], 0xffffffffffffffff
je 0x1401bdd38
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7858]
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xd2c0]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7850]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14024b8d8]
call fcn.1400ef950
mov dword [rsp + 0xd0b0], 0
lea rcx, [rsp + 0x7850]
call fcn.140001490
nop
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0b0]
jmp 0x1401be75a
mov rcx, qword [rsp + 0x7038]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7a20]
lea rdx, [0x140249dbc]
call fcn.1400020d0
lea rcx, [rsp + 0x7a28]
mov r8d, dword [rsp + 0x7000]
lea rdx, [0x14024b0d4]
call fcn.140002c70
lea rcx, [rsp + 0x7870]
call fcn.1401bf470
mov edx, 1
mov ecx, 1
call fcn.1401bfc60
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Image_mounting_successful.
call fcn.1400ef950
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x7a08]
mov r8d, dword [rsp + 0x7034]
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
mov r8d, 1
movzx edx, word [rsp + 0x7030]
lea rcx, [rsp + 0xd0b8]
call fcn.140005ec0
mov qword [rsp + 0xd278], rax
mov rax, qword [rsp + 0xd278]
mov qword [rsp + 0xd280], rax
lea r8, [0x14024b1c4]
mov rdx, qword [rsp + 0xd280]
lea rcx, [rsp + 0xd0c0]
call fcn.1400010b0
mov qword [rsp + 0xd288], rax
mov rcx, qword [rsp + 0xd288]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd0c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd0b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x7850]
call fcn.140001490
nop
lea rcx, [rsp + 0x7870]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
mov rax, qword [rsp + 0xd2c0]
cmp dword [rax + 0x978], 0
je 0x1401bdf17
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0xbbf4], eax
cmp dword [rsp + 0xbbf4], 0
jge 0x1401bdf4e
xor eax, eax
jmp 0x1401be75a
lea rcx, [rsp + 0xbc10]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0xbbf4]
call fcn.140082c64
mov dword [rsp + 0xbda8], eax
lea rcx, [rsp + 0xbc10]
call fcn.1401bf080
test eax, eax
jne 0x1401bdfb3
mov dword [rsp + 0xd0c8], 0
lea rcx, [rsp + 0xbc10]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0c8]
jmp 0x1401be75a
lea rcx, [rsp + 0xbdb8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0xbbf0], eax
cmp dword [rsp + 0xbbf0], 2
je 0x1401be011
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024b940]
call fcn.1400ef950
mov dword [rsp + 0xd0cc], 0
lea rcx, [rsp + 0xbc10]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0cc]
jmp 0x1401be75a
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_unmount_this_image_
call fcn.1400ef950
cmp eax, 7
jne 0x1401be072
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd0d0], 0
lea rcx, [rsp + 0xbc10]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0d0]
jmp 0x1401be75a
lea rdx, [rsp + 0xbdb8]
lea r8, [0x14024ba18]
lea rcx, [rsp + 0xbc00]
call fcn.1400010b0
nop
lea rcx, [0x14024ba30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xbbf8], rax
cmp qword [rsp + 0xbbf8], 0
jne 0x1401be107
mov rax, qword [rsp + 0xd2c0]
mov dword [rax + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024ba50]
call fcn.1400ef950
mov dword [rsp + 0xd0d4], 0
lea rcx, [rsp + 0xbc00]
call fcn.140001490
nop
lea rcx, [rsp + 0xbc10]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0d4]
jmp 0x1401be75a
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x1320], 0xffffffffffffffff
je 0x1401be179
lea rdx, [0x14024baa8]
mov rcx, qword [rsp + 0xbbf8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xbf50], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0xbf50]
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xd2c0]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0xbbf8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_save_the_changes_
call fcn.1400ef950
cmp eax, 6
jne 0x1401be3cf
mov edx, dword [rsp + 0xbda8]
lea rcx, [rsp + 0xbf60]
call fcn.1401d18c0
nop
lea rcx, [rsp + 0xbdb8]
call fcn.14000f8f0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc2a8]
call fcn.1400fa8d0
nop
mov dx, 0x2e
lea rcx, [rsp + 0xc2a8]
call fcn.1400068a0
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd0d8]
lea rcx, [rsp + 0xc2a8]
call fcn.140006a00
mov qword [rsp + 0xd290], rax
mov rcx, qword [rsp + 0xd290]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xc2a0], eax
lea rcx, [rsp + 0xd0d8]
call fcn.140001490
lea rcx, [rsp + 0xc100]
mov r8d, dword [rsp + 0xc2a0]
lea rdx, [0x14024b444]
call fcn.140002c70
lea rcx, [rsp + 0xc108]
lea rdx, [0x14024bb08]
call fcn.1400020d0
lea rcx, [rsp + 0xd0e0]
call fcn.14000e290
lea r8, [0x14024bb20]
lea rdx, [rsp + 0xd0e8]
mov rcx, rax
call fcn.14000c960
mov qword [rsp + 0xd298], rax
mov rax, qword [rsp + 0xd298]
mov qword [rsp + 0xd2a0], rax
lea rcx, [rsp + 0xc110]
mov rdx, qword [rsp + 0xd2a0]
call fcn.140002db0
nop
lea rcx, [rsp + 0xd0e8]
call fcn.140001490
lea rcx, [rsp + 0xbf60]
call fcn.1401bf8a0
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x968], 0
je 0x1401be309
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x970], 0
je 0x1401be353
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call fcn.14007d104
xor edx, edx
mov rcx, rax
call fcn.14007c7e4
mov edx, 5
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0xc2a8]
call fcn.14000f8f0
mov rdi, rax
lea rcx, [rsp + 0xbc00]
call fcn.14000f8f0
mov r8, qword [rsp + 0xd2c0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140106b10
mov rax, qword [rsp + 0xd2c0]
cmp qword [rax + 0x970], 0
je 0x1401be3b4
xor edx, edx
mov rcx, qword [rsp + 0xd2c0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rsp + 0xc2a8]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf60]
call fcn.140014ec0
lea rcx, [rsp + 0xbdc0]
lea rdx, [0x140249fbc]
call fcn.1400020d0
lea rcx, [rsp + 0xbdc8]
call fcn.1400019b0
lea rcx, [rsp + 0xbc10]
call fcn.1401bf470
mov edx, 1
mov ecx, 1
call fcn.1401bfc60
lea rcx, [rsp + 0xbc00]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xd2c0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14024bb48]
call fcn.1400ef950
mov rdx, qword [rsp + 0xd2c0]
add rdx, 0xf18
mov r9d, dword [rsp + 0xbda8]
mov r8d, dword [rsp + 0xbbf4]
mov rcx, qword [rsp + 0xd2c0]
call fcn.1401a96a0
nop
lea rcx, [rsp + 0xbc00]
call fcn.140001490
nop
lea rcx, [rsp + 0xbc10]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0xc600], eax
cmp dword [rsp + 0xc600], 0
jge 0x1401be4ce
xor eax, eax
jmp 0x1401be75a
lea rcx, [rsp + 0xc910]
call fcn.14000c880
nop
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0xc600]
call fcn.140082c64
mov dword [rsp + 0xcaa8], eax
lea rcx, [rsp + 0xc910]
call fcn.1401bf080
test eax, eax
jne 0x1401be533
mov dword [rsp + 0xd0f0], 0
lea rcx, [rsp + 0xc910]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0f0]
jmp 0x1401be75a
lea rcx, [rsp + 0xcab8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400f9330
mov dword [rsp + 0xc2b0], eax
cmp dword [rsp + 0xc2b0], 3
je 0x1401be56d
cmp dword [rsp + 0xc2b0], 4
je 0x1401be56d
cmp dword [rsp + 0xc2b0], 5
jne 0x1401be5a5
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Child_disk_can_not_be_created_with_this_image_format._nPlease_select_.vhd_or_.vmdk_format.
call fcn.1400ef950
mov dword [rsp + 0xd0f4], 0
lea rcx, [rsp + 0xc910]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0f4]
jmp 0x1401be75a
mov edx, dword [rsp + 0xcaa8]
lea rcx, [rsp + 0xc2c0]
call fcn.1401d18c0
nop
lea rcx, [rsp + 0xc8e0]
call fcn.140006ef0
nop
lea rdx, [rsp + 0xc8e0]
lea rcx, [rsp + 0xc2c0]
call fcn.1401bee60
lea rcx, [rsp + 0xc8e0]
call fcn.140006f70
test rax, rax
jbe 0x1401be643
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Please_merge_all_your_recovery_first_
call fcn.1400ef950
mov dword [rsp + 0xd0f8], 0
lea rcx, [rsp + 0xc8e0]
call fcn.140006f40
nop
lea rcx, [rsp + 0xc2c0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xc910]
call fcn.140014ec0
mov eax, dword [rsp + 0xd0f8]
jmp 0x1401be75a
xor edx, edx
lea rcx, [rsp + 0xc610]
call fcn.140170520
nop
mov eax, dword [rsp + 0xcaa8]
mov dword [rsp + 0xc820], eax
lea rcx, [rsp + 0xc610]
call fcn.140082174
nop
lea rcx, [rsp + 0xc610]
call fcn.1401704c0
nop
lea rcx, [rsp + 0xc8e0]
call fcn.140006f40
nop
lea rcx, [rsp + 0xc2c0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xc910]
call fcn.140014ec0
xor eax, eax
jmp 0x1401be75a
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000c920
mov dword [rsp + 0xcc50], eax
xor edx, edx
lea rcx, [rsp + 0xcc60]
call fcn.14014aa90
nop
mov dword [rsp + 0xce80], 0
mov rcx, qword [rsp + 0xd2c0]
add rcx, 0xf18
mov edx, dword [rsp + 0xcc50]
call fcn.140082c64
mov dword [rsp + 0xce84], eax
lea rcx, [rsp + 0xcc60]
call fcn.140082174
cmp rax, 1
je 0x1401be744
mov dword [rsp + 0xd0fc], 0
lea rcx, [rsp + 0xcc60]
call fcn.14014aa20
mov eax, dword [rsp + 0xd0fc]
jmp 0x1401be75a
lea rcx, [rsp + 0xcc60]
call fcn.14014aa20
xor eax, eax
jmp 0x1401be75a
mov eax, 1
mov rcx, qword [rsp + 0xd2a8]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0xd2b0
pop rdi
ret