Function at 0x140023a10
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0xb48]
sub rsp, 0xc48
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0xb30], rax
mov r13, rcx
mov qword [rsp + 0x30], rcx
mov ecx, __WSAFDIsSet
mov qword [rsp + 0x70], rdx
mov r14, rdx
call fcn.14013132c
mov ecx, __WSAFDIsSet
mov rbx, rax
call fcn.14013132c
mov ecx, __WSAFDIsSet
mov rdi, rax
call fcn.14013132c
mov ecx, __WSAFDIsSet
mov rsi, rax
call fcn.14013132c
mov r9, r13
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov byte [rbp + 0x130], 0
lea rdx, str.UseRegistry
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.UseRegistry
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x140023b05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov ecx, eax
call fcn.140149d20
mov r8, rax
mov r9d, reloc.WS2_32.dll_recv
mov rdx, r14
call fcn.1400208f0
xor al, al
jmp 0x140025539
mov qword [rsp + 0xc90], r12
lea rdx, str.SendExtraMouse
mov r9, r13
mov qword [rsp + 0xc40], r15
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.SendExtraMouse
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.Secure
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.Secure
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.MSLogonRequired
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.MSLogonRequired
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.NewMSLogon
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.NewMSLogon
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.ReverseAuthRequired
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.ReverseAuthRequired
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, rbx
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], __WSAFDIsSet
lea rdx, str.group1
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], __WSAFDIsSet
mov r9, rdi
lea r8, [0x14019526c]
lea rdx, str.group2
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, rsi
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], __WSAFDIsSet
lea rdx, str.group3
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, r14
lea rdx, str.group1
mov r8, rbx
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r14
lea rdx, str.group2
mov r8, rdi
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r14
lea rdx, str.group3
mov r8, rsi
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.locdom1
xor r8d, r8d
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.locdom2
xor r8d, r8d
lea rcx, str.admin_auth
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.locdom3
xor r8d, r8d
lea rcx, str.admin_auth
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov esi, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.locdom1
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.locdom2
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, str.locdom3
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.DebugMode
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.Avilog
mov r14d, eax
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0x330]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
mov r12d, eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r9, [rbp + 0x730]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x400
lea rdx, str.service_commandline
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r9, [rbp + 0x530]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.accept_reject_mesg
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, r13
lea rdx, str.DebugLevel
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, [0x1401c4a20]
xor r8d, r8d
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.rdpmode
xor r8d, r8d
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.noscreensaver
xor r8d, r8d
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, [0x1401c4a48]
xor r8d, r8d
lea rcx, str.admin
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r13d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
lea rdx, str.DebugMode
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r12d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r12, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
mov r9, r12
lea rdx, str.Avilog
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r12
lea r8, [rbp + 0x330]
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r12
lea r8, [rbp + 0x730]
lea rdx, str.service_commandline
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r12
lea r8, [rbp + 0x530]
lea rdx, str.accept_reject_mesg
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.DebugLevel
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, [0x1401c4a20]
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.rdpmode
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r15d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.noscreensaver
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r13d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, [0x1401c4a48]
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r13, qword [rsp + 0x30]
lea rdx, str.UseDSMPlugin
mov r9, r13
lea rcx, str.admin
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbp + 0x130]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.DSMPluginConfig
mov edi, eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, r13
lea rdx, str.AllowLoopback
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.AuthRequired
mov r8d, 1
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.ConnectPriority
mov esi, eax
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.UseDSMPlugin
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r12
lea r8, [rbp + 0x130]
lea rdx, str.DSMPluginConfig
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AllowLoopback
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AuthRequired
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.ConnectPriority
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x80
lea rdx, str.DSMPlugin
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, qword [rsp + 0x48]
lea r8, [0x14019526c]
lea rdx, str.AuthHosts
mov qword [rsp + 0x28], r13
lea rcx, str.admin
mov dword [rsp + 0x20], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, r12
lea r8, [rbp - 0x50]
lea rdx, str.DSMPlugin
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8, qword [rsp + 0x48]
lea rdx, str.AuthHosts
mov r9, r12
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.AllowShutdown
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.AllowProperties
mov r8d, 1
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
mov r9, r13
xor r8d, r8d
lea rdx, str.AllowInjection
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.AllowEditClients
mov r8d, 1
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AllowShutdown
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AllowProperties
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AllowInjection
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, str.AllowEditClients
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.FileTransferEnabled
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.FTUserImpersonation
mov r8d, 1
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.BlankMonitorEnabled
mov r8d, 1
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.BlankInputsOnly
xor r8d, r8d
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.DefaultScale
mov r8d, 1
lea rcx, str.admin
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.FileTransferTimeout
mov r15d, eax
lea rcx, str.admin
mov r8d, 0x1e
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.primary
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.secondary
xor r8d, r8d
lea rcx, str.admin
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r13d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
mov r9, rbx
lea rdx, str.FileTransferEnabled
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.FTUserImpersonation
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.BlankMonitorEnabled
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.BlankInputsOnly
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r15d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.DefaultScale
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, 0x1e
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.FileTransferTimeout
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r12d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.primary
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r13d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.secondary
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r13, qword [rsp + 0x30]
lea rdx, str.SocketConnect
mov r9, r13
lea rcx, str.admin
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.HTTPConnect
mov r8d, 1
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.AutoPortSelect
mov r8d, 1
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.PortNumber
mov r8d, 0x170c
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.HTTPPortNumber
mov r8d, 0x16a8
lea rcx, str.admin
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.IdleTimeout
xor r8d, r8d
lea rcx, str.admin
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.IdleInputTimeout
xor r8d, r8d
lea rcx, str.admin
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r13d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
mov r9, rbx
lea rdx, str.SocketConnect
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.HTTPConnect
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.AutoPortSelect
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.PortNumber
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r15d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.HTTPPortNumber
mov r15, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r12d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.IdleTimeout
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r13d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.IdleInputTimeout
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r13, qword [rsp + 0x30]
lea rdx, str.RemoveWallpaper
mov r9, r13
lea rcx, str.admin
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.RemoveWallpaper
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.QuerySetting
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.QueryTimeout
mov r8d, 0xa
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.QueryDisableTime
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.QueryAccept
mov r8d, 4
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.QueryIfNoLogon
mov r8d, 1
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.QuerySetting
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.QueryTimeout
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor r8d, r8d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.QueryDisableTime
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.QueryAccept
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.QueryIfNoLogon
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.MaxViewerSetting
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.MaxViewerSetting
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.MaxViewers
mov r8d, 0x80
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.MaxViewers
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.Collabo
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.Collabo
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.Frame
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.Notification
xor r8d, r8d
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, [0x1401c4ca8]
xor r8d, r8d
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.NotificationSelection
xor r8d, r8d
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.Frame
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.Notification
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, [0x1401c4ca8]
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.NotificationSelection
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x80]
lea rdx, str.passwd
lea rcx, str.UltraVNC
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x80]
lea rdx, str.passwd
lea rcx, str.UltraVNC
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
mov r9d, 8
mov qword [rbp - 0x80], 0
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], r13
lea rdx, str.passwd2
lea rcx, str.UltraVNC
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x80]
lea rdx, str.passwd2
lea rcx, str.UltraVNC
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x28], r13
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0xfa
lea rdx, str.cloudServer
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r9, r15
lea r8, [rbp + 0x30]
lea rdx, str.cloudServer
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.cloudEnabled
xor r8d, r8d
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, eax
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, r15
lea r8, [rsp + 0x50]
lea rdx, str.cloudEnabled
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, r13
lea rdx, str.InputsEnabled
mov r8d, 1
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.LockSetting
xor r8d, r8d
lea rcx, str.admin
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.LocalInputsDisabled
xor r8d, r8d
lea rcx, str.admin
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.EnableJapInput
xor r8d, r8d
lea rcx, str.admin
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.EnableUnicodeInput
xor r8d, r8d
lea rcx, str.admin
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.EnableWin8Helper
xor r8d, r8d
lea rcx, str.admin
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.kickrdp
xor r8d, r8d
lea rcx, str.admin
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.clearconsole
xor r8d, r8d
lea rcx, str.admin
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rsp + 0x38], eax
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
mov r9, rbx
lea rdx, str.InputsEnabled
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.LockSetting
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.LocalInputsDisabled
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableJapInput
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r15d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableUnicodeInput
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r12d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableWin8Helper
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r13d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.kickrdp
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x38]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.clearconsole
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r13, qword [rsp + 0x30]
lea rdx, str.TurboMode
mov r9, r13
lea rcx, str.poll
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.PollUnderCursor
mov ebx, eax
xor r8d, r8d
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.PollForeground
xor r8d, r8d
lea rcx, str.poll
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.PollFullScreen
mov r8d, 1
lea rcx, str.poll
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.OnlyPollConsole
xor r8d, r8d
lea rcx, str.poll
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.OnlyPollOnEvent
xor r8d, r8d
lea rcx, str.poll
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, r13
lea rdx, str.MaxCpu2
mov r8d, Ordinal_102
lea rcx, str.poll
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.MaxFPS
mov r8d, 0x19
lea rcx, str.poll
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.EnableDriver
xor r8d, r8d
mov dword [rsp + 0x38], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.EnableHook
mov r8d, 1
mov dword [rsp + 0x3c], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.EnableVirtual
xor r8d, r8d
mov dword [rsp + 0x40], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, qword [rsp + 0x30]
lea rdx, str.SingleWindow
xor r8d, r8d
mov dword [rsp + 0x44], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rsp + 0x48], eax
lea r9, [rbp - 0x78]
mov rax, qword [rsp + 0x30]
lea r8, [0x14019526c]
mov qword [rsp + 0x28], rax
lea rdx, str.SingleWindowName
lea rcx, str.poll
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, ebx
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
mov r9, rbx
lea rdx, str.TurboMode
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, edi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.PollUnderCursor
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, esi
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.PollForeground
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r14d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.PollFullScreen
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r15d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.OnlyPollConsole
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r12d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.OnlyPollOnEvent
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, r13d
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.MaxCpu2
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x38]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.MaxFPS
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x3c]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableDriver
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x40]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableHook
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x44]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.EnableVirtual
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r8d, dword [rsp + 0x48]
lea rdx, [0x1401c7208]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, str.SingleWindow
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r9, rbx
lea r8, [rbp - 0x78]
lea rdx, str.SingleWindowName
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r15, qword [rsp + 0xc40]
mov al, 1
mov r12, qword [rsp + 0xc90]
mov rcx, qword [rbp + 0xb30]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0xc48
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret