Function at 0x1401aa430
Capabilities:
Create process on windows
Create thread
Get disk information
Get disk size
Get networking parameters
Manipulate boot configuration
Read .ini file
Self delete

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x3200
call fcn.1401e9500
sub rsp, rax
mov qword [rsp + 0x2ee0], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0x31f8], rax
mov rcx, qword [rsp + 0x3210]
call fcn.1400f55b0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x15c0
mov edx, reloc.WS2_32.dll___WSAFDIsSet
call fcn.14000ec00
mov rcx, qword [rsp + 0x3210]
add rcx, 0x15c0
call fcn.1400f0db0
lea rcx, [rsp + 0xb0]
call fcn.140002d10
nop
lea rcx, [rsp + 0x1438]
call fcn.1400020b0
nop
mov r9d, 4
mov r8d, 4
lea rdx, [rsp + 0x2c80]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2ee8], rax
mov rax, qword [rsp + 0x2ee8]
mov qword [rsp + 0x2ef0], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x2c88]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2ef8], rax
mov rax, qword [rsp + 0x2ef8]
mov qword [rsp + 0x2f00], rax
mov edx, 0xd4
lea rcx, [rsp + 0x2c90]
call fcn.1400f1540
mov qword [rsp + 0x2f08], rax
mov rax, qword [rsp + 0x2f08]
mov qword [rsp + 0x2f10], rax
mov rcx, qword [rsp + 0x2f10]
call fcn.140050200
mov r9, qword [rsp + 0x2ef0]
mov r9, qword [r9]
mov r8, qword [rsp + 0x2f00]
mov r8, qword [r8]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x2c90]
call fcn.140007060
nop
lea rcx, [rsp + 0x2c88]
call fcn.140007060
nop
lea rcx, [rsp + 0x2c80]
call fcn.140007060
lea rcx, [rsp + 0x2ca0]
call fcn.14018ffa0
mov qword [rsp + 0x2f18], rax
mov rax, qword [rsp + 0x2f18]
mov qword [rsp + 0x2f20], rax
mov rcx, qword [rsp + 0x2f20]
call fcn.140050200
mov rcx, rax
call fcn.140005170
test eax, eax
jmp 0x1401aa5f8
mov dword [rsp + 0x2f28], 0
movzx eax, byte [rsp + 0x2f28]
mov byte [rsp + 0x2c98], al
lea rcx, [rsp + 0x2ca0]
call fcn.140007060
movzx edx, byte [rsp + 0x2c98]
test edx, edx
je 0x1401aa85e
mov ecx, 0xffffff
call fcn.1400da320
mov dword [rsp + 0x1818], eax
cmp dword [rsp + 0x1818], 0xffffffff
jne 0x1401aa75d
xor r8d, r8d
mov edx, 0x40
lea rcx, str.The_trial_version_has_expired_
call fcn.1400f0bf0
mov r9d, 4
mov r8d, 4
lea rdx, [rsp + 0x2ca8]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2f30], rax
mov rax, qword [rsp + 0x2f30]
mov qword [rsp + 0x2f38], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x2cb0]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2f40], rax
mov rax, qword [rsp + 0x2f40]
mov qword [rsp + 0x2f48], rax
mov edx, 0xd5
lea rcx, [rsp + 0x2cb8]
call fcn.1400f1540
mov qword [rsp + 0x2f50], rax
mov rax, qword [rsp + 0x2f50]
mov qword [rsp + 0x2f58], rax
mov rcx, qword [rsp + 0x2f58]
call fcn.140050200
mov r9, qword [rsp + 0x2f38]
mov r9, qword [r9]
mov r8, qword [rsp + 0x2f48]
mov r8, qword [r8]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x2cb8]
call fcn.140007060
nop
lea rcx, [rsp + 0x2cb0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2ca8]
call fcn.140007060
jmp 0x1401aa85e
mov r9d, 4
mov r8d, 4
lea rdx, [rsp + 0x2cc0]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2f60], rax
mov rax, qword [rsp + 0x2f60]
mov qword [rsp + 0x2f68], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x2cc8]
lea rcx, [rsp + 0x1438]
call fcn.1400021f0
mov qword [rsp + 0x2f70], rax
mov rax, qword [rsp + 0x2f70]
mov qword [rsp + 0x2f78], rax
mov edx, 0xd6
lea rcx, [rsp + 0x2cd0]
call fcn.1400f1540
mov qword [rsp + 0x2f80], rax
mov rax, qword [rsp + 0x2f80]
mov qword [rsp + 0x2f88], rax
mov rcx, qword [rsp + 0x2f88]
call fcn.140050200
mov rdx, rax
mov eax, dword [rsp + 0x1818]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x2f68]
mov r9, qword [r9]
mov r8, qword [rsp + 0x2f78]
mov r8, qword [r8]
lea rcx, [rsp + 0xb0]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x2cd0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2cc8]
call fcn.140007060
nop
lea rcx, [rsp + 0x2cc0]
call fcn.140007060
lea rdx, [0x14025aa38]
lea rcx, [rsp + 0x2ce0]
call fcn.1400f05c0
mov qword [rsp + 0x2f90], rax
lea rdx, [0x14025aa28]
mov rcx, qword [rsp + 0x2f90]
call fcn.140006e10
mov byte [rsp + 0x2cd8], al
lea rcx, [rsp + 0x2ce0]
call fcn.140007060
movzx edx, byte [rsp + 0x2cd8]
test edx, edx
je 0x1401aa8fd
lea rdx, [0x14025aa48]
lea rcx, [rsp + 0x2ce8]
call fcn.1400f05c0
mov qword [rsp + 0x2f98], rax
mov rax, qword [rsp + 0x2f98]
mov qword [rsp + 0x2fa0], rax
mov rdx, qword [rsp + 0x2fa0]
lea rcx, [rsp + 0xb0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2ce8]
call fcn.140007060
lea rcx, [rsp + 0xb0]
call fcn.140050200
mov rdx, rax
mov rcx, qword [rsp + 0x3210]
call fcn.140079b78
lea rcx, [rsp + 0xb0]
call fcn.140050200
mov rdx, rax
xor ecx, ecx
call fcn.1400de020
mov dword [rsp + 0x17e8], 0x8004
mov dword [rsp + 0x17ec], 0
mov dword [rsp + 0x17f0], 0x800c
mov dword [rsp + 0x17f4], 0x800d
mov dword [rsp + 0x17f8], 0x8030
mov dword [rsp + 0x17fc], 0
mov dword [rsp + 0x1800], 0x108
mov dword [rsp + 0x1804], 0x10f
mov dword [rsp + 0x1808], 0x8011
mov dword [rsp + 0x180c], 0
mov dword [rsp + 0x1810], 0x8003
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [rsp + 0x17e8]
mov rcx, qword [rsp + 0x3210]
call fcn.1400f3a20
lea rcx, [rsp + 0x50]
call fcn.140020b60
mov edx, 0x53f
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
test rax, rax
je 0x1401aaa45
mov edx, 0x53f
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ebb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.1400881c4
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1328
mov dword [rsp + 0x20], 1
mov r9, qword [rsp + 0x3210]
lea r8, [rsp + 0x50]
mov edx, 0x50000b44
call fcn.140083a20
mov edx, 0x53f
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
test rax, rax
je 0x1401aab81
mov edx, 0x53f
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ebb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.1400881c4
mov eax, dword [rsp + 0x54]
sub eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x13d0
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax + 0x13d0]
mov dword [rsp + 0x20], 0xe804
mov r9d, 0x56000700
mov r8d, 0x400
mov rdx, qword [rsp + 0x3210]
call qword [rax + 0x300]
mov rdx, qword [rsp + 0x3210]
add rdx, 0x1328
mov rcx, qword [rsp + 0x3210]
add rcx, 0x13d0
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
call fcn.140085068
mov rcx, qword [rsp + 0x3210]
add rcx, 0x13d0
mov edx, 1
call fcn.140079c60
lea rcx, [rsp + 0x50]
call fcn.140020b60
mov rcx, qword [rsp + 0x3210]
add rcx, 0x13d0
mov r8d, 1
mov rdx, rax
call fcn.14000eb40
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, 7
mov rdx, qword [rsp + 0x3210]
mov rdx, qword [rdx + 0x1410]
call fcn.14000ea40
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14e0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
mov r9d, 0x21
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400848bc
lea rdx, str.Edit_DiskAdd_ImageEdit_ImageDelete_ImageAdd_GroupDelete_GroupAdd_ClientAdd_ClientsAuto_ScanEdit_ClientDelete_ClientEnable_Super_ClientDisable_Super_ClientKeySearch
lea rcx, [rsp + 0x1450]
call fcn.1400f05c0
nop
xor eax, eax
mov word [rsp + 0x410], ax
lea rdi, [rsp + 0x412]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1450]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x410]
call fcn.1400aac40
mov dword [rsp + 0x181c], 0
jmp 0x1401aac21
mov eax, dword [rsp + 0x181c]
add eax, 1
mov dword [rsp + 0x181c], eax
lea rcx, [rsp + 0x1450]
call fcn.1400019a0
cmp dword [rsp + 0x181c], eax
jge 0x1401aac60
movsxd rax, dword [rsp + 0x181c]
movzx eax, word [rsp + rax*2 + 0x410]
cmp eax, 0x7c
jne 0x1401aac5e
movsxd rcx, dword [rsp + 0x181c]
xor eax, eax
mov word [rsp + rcx*2 + 0x410], ax
jmp 0x1401aac10
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1328
lea rdx, [rsp + 0x410]
call fcn.14000e9a0
mov dword [rsp + 0x17a8], 0x804c
mov dword [rsp + 0x17ac], 0x80bf
mov dword [rsp + 0x17b0], 0x80c0
mov dword [rsp + 0x17b4], 0x80c1
mov dword [rsp + 0x17b8], 0x8054
mov dword [rsp + 0x17bc], 0x8056
mov dword [rsp + 0x17c0], 0x800e
mov dword [rsp + 0x17c4], 0x80d4
mov dword [rsp + 0x17c8], 0x8014
mov dword [rsp + 0x17cc], 0x800f
mov dword [rsp + 0x17d0], 0x8010
mov dword [rsp + 0x17d4], 0x80d6
mov dword [rsp + 0x17d8], 0x80d9
mov dword [rsp + 0x17dc], 0x8166
mov dword [rsp + 0x17e0], 0x8166
mov dword [rsp + 0x4c], reloc.OLEAUT32.dll_SafeArrayDestroy
mov dword [rsp + 0x1820], 0
jmp 0x1401aad47
mov eax, dword [rsp + 0x1820]
add eax, 1
mov dword [rsp + 0x1820], eax
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x1820], eax
jge 0x1401aad89
movsxd rdi, dword [rsp + 0x1820]
call fcn.14000f460
mov edx, dword [rsp + rdi*4 + 0x17a8]
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14e0
mov rdx, rax
call fcn.14000e970
jmp 0x1401aad36
mov eax, dword [0x1404d1010]
and eax, 1
test eax, eax
jne 0x1401aadbe
mov eax, dword [0x1404d1010]
or eax, 1
mov dword [0x1404d1010], eax
lea rcx, [0x1404d1000]
call fcn.140084308
lea rcx, [0x140213040]
call fcn.1400aa47c
nop
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
mov r9d, 0x21
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rcx, [0x1404d1000]
call fcn.1400848bc
call fcn.14000f460
mov edx, 0xea
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xec
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xed
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xee
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xef
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf0
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf1
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0x80d4
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf2
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf3
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf4
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf5
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xf6
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d1000]
call fcn.14000e970
mov rdx, qword [rsp + 0x3210]
add rdx, 0x14e0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1328
call fcn.14000e620
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1328
lea rdx, [0x1404d1000]
call fcn.14000e5e0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov edx, gethostbyname
lea rcx, [rsp + 0x2cf0]
call fcn.14001b210
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1328
mov rdx, qword [rax]
call fcn.14000e590
lea rdx, [0x14025abd8]
lea rcx, [rsp + 0x2d00]
call fcn.1400f05c0
mov qword [rsp + 0x2fa8], rax
lea rdx, [0x14025abc8]
mov rcx, qword [rsp + 0x2fa8]
call fcn.140006e10
mov byte [rsp + 0x2cf8], al
lea rcx, [rsp + 0x2d00]
call fcn.140007060
movzx edx, byte [rsp + 0x2cf8]
test edx, edx
je 0x1401ab2f3
lea rdx, [0x14025ac00]
lea rcx, [rsp + 0x2d10]
call fcn.1400f05c0
mov qword [rsp + 0x2fb0], rax
lea rdx, [0x14025abe8]
mov rcx, qword [rsp + 0x2fb0]
call fcn.140006dd0
mov byte [rsp + 0x2d08], al
lea rcx, [rsp + 0x2d10]
call fcn.140007060
movzx edx, byte [rsp + 0x2d08]
test edx, edx
je 0x1401ab0df
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x8011
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x8089
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x8087
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x50b
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x8071
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x809c
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 2
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x80a0
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x8160
mov rcx, rax
call fcn.14000e560
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0xd8]
mov edx, 6
mov rcx, rax
call fcn.14000e530
xor r8d, r8d
mov edx, 0x815d
mov rcx, rax
call fcn.14000e560
mov rcx, qword [rsp + 0x3210]
add rcx, 0x220
mov edx, 9
call fcn.14000e500
mov rcx, qword [rsp + 0x3210]
add rcx, 0x220
mov edx, 8
call fcn.14000e500
mov rcx, qword [rsp + 0x3210]
add rcx, 0x220
mov edx, 7
call fcn.14000e500
mov rcx, qword [rsp + 0x3210]
add rcx, 0x220
mov edx, 6
call fcn.14000e500
mov rcx, qword [rsp + 0x3210]
add rcx, 0xdc8
mov r9d, 0x430
xor r8d, r8d
mov edx, 0x1036
call fcn.14000e4c0
mov rcx, qword [rsp + 0x3210]
add rcx, 0xe70
mov r9d, 0x430
xor r8d, r8d
mov edx, 0x1036
call fcn.14000e4c0
mov rcx, qword [rsp + 0x3210]
add rcx, 0xf18
mov r9d, 0x430
xor r8d, r8d
mov edx, 0x1036
call fcn.14000e4c0
mov edx, 0x3f8
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ebb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.1400881c4
mov rcx, qword [rsp + 0x3210]
add rcx, 0xdc8
mov r8d, 1
lea rdx, [rsp + 0x50]
call fcn.14000eb40
mov rcx, qword [rsp + 0x3210]
add rcx, 0xe70
mov r8d, 1
lea rdx, [rsp + 0x50]
call fcn.14000eb40
mov rcx, qword [rsp + 0x3210]
add rcx, 0xf18
mov r8d, 1
lea rdx, [rsp + 0x50]
call fcn.14000eb40
mov edx, 0x540
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ebb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.1400881c4
mov rcx, qword [rsp + 0x3210]
add rcx, 0x980
mov r8d, 1
lea rdx, [rsp + 0x50]
call fcn.14000eb40
lea rcx, [rsp + 0x2d18]
call fcn.140001000
mov qword [rsp + 0x2fb8], rax
mov rax, qword [rsp + 0x2fb8]
mov qword [rsp + 0x2fc0], rax
lea r8, [0x14025ac18]
mov rdx, qword [rsp + 0x2fc0]
lea rcx, [rsp + 0x2d20]
call fcn.1400010b0
mov qword [rsp + 0x2fc8], rax
mov rcx, qword [rsp + 0x2fc8]
call fcn.140050200
mov r9, rax
mov r8d, 0x20
lea rdx, [0x14025ac30]
lea rcx, [0x14025ac50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x1430], eax
lea rcx, [rsp + 0x2d20]
call fcn.140007060
nop
lea rcx, [rsp + 0x2d18]
call fcn.140007060
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
mov r9d, 0x21
mov r8d, dword [rsp + 0x1430]
mov edx, dword [rsp + 0x1430]
call fcn.1400848bc
call fcn.14000f460
mov edx, 0xdb
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov rdx, rax
call fcn.14000e970
call fcn.14000f460
mov edx, 0x496
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov rdx, rax
call fcn.14000e970
call fcn.14000f460
mov edx, 0xdc
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov rdx, rax
call fcn.14000e970
call fcn.14000f460
mov edx, 0x80d2
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov rdx, rax
call fcn.14000e970
call fcn.14000f460
mov edx, 0xda
mov rcx, rax
call fcn.14000e660
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1610
mov rdx, rax
call fcn.14000e970
mov rdx, qword [rsp + 0x3210]
add rdx, 0x1610
mov rcx, qword [rsp + 0x3210]
add rcx, 0xdc8
mov r8d, 1
call fcn.14000e470
mov edx, 0x6a
lea rcx, [rsp + 0x1420]
call fcn.1400f1540
nop
mov dword [rsp + 0x17a0], 0
mov dword [rsp + 0x70], 0
cmp dword [rsp + 0x17a0], 0xffffffff
je 0x1401ab6dd
lea r9, [rsp + 0x17a0]
lea r8, [0x14025a834]
lea rdx, [rsp + 0x1828]
lea rcx, [rsp + 0x1420]
call fcn.140006620
nop
lea rcx, [rsp + 0x1828]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ab677
lea rcx, [rsp + 0x1828]
call fcn.140007060
jmp 0x1401ab6dd
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x2fd0], eax
lea rcx, [rsp + 0x1828]
call fcn.140050200
mov rcx, qword [rsp + 0x3210]
add rcx, 0xdc8
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x50
xor r9d, r9d
mov r8, rax
mov edx, dword [rsp + 0x2fd0]
call fcn.1400841e4
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x1828]
call fcn.140007060
jmp 0x1401ab621
mov eax, dword [0x1404d1010]
and eax, 2
test eax, eax
jne 0x1401ab712
mov eax, dword [0x1404d1010]
or eax, 2
mov dword [0x1404d1010], eax
lea rcx, [0x1404d0ff0]
call fcn.140084308
lea rcx, [0x140213020]
call fcn.1400aa47c
nop
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
mov r9d, 0x21
mov r8d, 0x20
mov edx, 0x20
lea rcx, [0x1404d0ff0]
call fcn.1400848bc
call fcn.14000f460
mov edx, 0x8f
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xfd
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xc6
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xfb
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xc7
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xc8
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xfc
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0x8c
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0xa8
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0ff0]
call fcn.14000e970
mov rcx, qword [rsp + 0x3210]
add rcx, 0xe70
mov r8d, 1
lea rdx, [0x1404d0ff0]
call fcn.14000e470
mov edx, 0xd1
lea rcx, [rsp + 0x2d28]
call fcn.1400f1540
mov qword [rsp + 0x2fd8], rax
mov rax, qword [rsp + 0x2fd8]
mov qword [rsp + 0x2fe0], rax
mov rdx, qword [rsp + 0x2fe0]
lea rcx, [rsp + 0x1420]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2d28]
call fcn.140007060
mov dword [rsp + 0x17a0], 0
mov dword [rsp + 0x70], 0
cmp dword [rsp + 0x17a0], 0xffffffff
je 0x1401ab9a5
lea r9, [rsp + 0x17a0]
lea r8, [0x14025abc4]
lea rdx, [rsp + 0x1830]
lea rcx, [rsp + 0x1420]
call fcn.140006620
nop
lea rcx, [rsp + 0x1830]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ab93f
lea rcx, [rsp + 0x1830]
call fcn.140007060
jmp 0x1401ab9a5
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x2fe8], eax
lea rcx, [rsp + 0x1830]
call fcn.140050200
mov rcx, qword [rsp + 0x3210]
add rcx, 0xe70
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x78
xor r9d, r9d
mov r8, rax
mov edx, dword [rsp + 0x2fe8]
call fcn.1400841e4
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x1830]
call fcn.140007060
jmp 0x1401ab8e9
mov eax, dword [0x1404d1010]
and eax, 4
test eax, eax
jne 0x1401ab9da
mov eax, dword [0x1404d1010]
or eax, 4
mov dword [0x1404d1010], eax
lea rcx, [0x1404d0fe0]
call fcn.140084308
lea rcx, [0x140213000]
call fcn.1400aa47c
nop
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
mov r9d, 0x21
mov r8d, 0x20
mov edx, 0x20
lea rcx, [0x1404d0fe0]
call fcn.1400848bc
call fcn.14000f460
mov edx, 0x3fc
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0fe0]
call fcn.14000e970
call fcn.14000f460
mov edx, 0x80e6
mov rcx, rax
call fcn.14000e660
mov rdx, rax
lea rcx, [0x1404d0fe0]
call fcn.14000e970
mov rcx, qword [rsp + 0x3210]
add rcx, 0xf18
mov r8d, 1
lea rdx, [0x1404d0fe0]
call fcn.14000e470
mov edx, 0xd0
lea rcx, [rsp + 0x2d30]
call fcn.1400f1540
mov qword [rsp + 0x2ff0], rax
mov rax, qword [rsp + 0x2ff0]
mov qword [rsp + 0x2ff8], rax
mov rdx, qword [rsp + 0x2ff8]
lea rcx, [rsp + 0x1420]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2d30]
call fcn.140007060
mov dword [rsp + 0x17a0], 0
mov dword [rsp + 0x70], 0
cmp dword [rsp + 0x17a0], 0xffffffff
je 0x1401abb86
lea r9, [rsp + 0x17a0]
lea r8, [0x14025ac60]
lea rdx, [rsp + 0x1838]
lea rcx, [rsp + 0x1420]
call fcn.140006620
nop
lea rcx, [rsp + 0x1838]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401abb20
lea rcx, [rsp + 0x1838]
call fcn.140007060
jmp 0x1401abb86
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x3000], eax
lea rcx, [rsp + 0x1838]
call fcn.140050200
mov rcx, qword [rsp + 0x3210]
add rcx, 0xf18
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x78
xor r9d, r9d
mov r8, rax
mov edx, dword [rsp + 0x3000]
call fcn.1400841e4
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x1838]
call fcn.140007060
jmp 0x1401abaca
mov edx, 0x4ec
mov rcx, qword [rsp + 0x3210]
call fcn.1400799cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ebb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.1400881c4
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14f8
mov dword [rsp + 0x20], 0x4ec
mov r9, qword [rsp + 0x3210]
lea r8, [rsp + 0x50]
mov edx, 0x50000000
call fcn.1400d6fc0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x3210]
call fcn.14000e440
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14f8
call fcn.14001b240
test rax, rax
je 0x1401abc94
lea rcx, [rsp + 0x1840]
call fcn.140020b60
lea rdx, [rsp + 0x1840]
mov rcx, qword [rsp + 0x3210]
call fcn.14000e440
mov eax, dword [rsp + 0x1840]
add eax, 0x64
mov dword [rsp + 0x1854], eax
mov eax, dword [rsp + 0x1848]
sub eax, 0x64
mov dword [rsp + 0x1850], eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14f8
mov r8d, dword [rsp + 0x1850]
mov edx, dword [rsp + 0x1854]
call fcn.1400d6630
mov rcx, qword [rsp + 0x3210]
add rcx, 0x14f8
mov edx, 1
call fcn.14000e410
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov edx, 0x4eb
call fcn.14000e3d0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov edx, 0x4ab
call fcn.14000e3d0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov edx, 0x4ac
call fcn.14000e3d0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov edx, 0x9f
call fcn.14000e3d0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov rdx, qword [rsp + 0x3210]
mov rdx, qword [rdx + 0x9c0]
call fcn.14000ea40
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.WS2_32.dll_inet_addr
mov edx, 0x4f6
call fcn.14000e3d0
mov rcx, qword [rsp + 0x3210]
add rcx, 0x1d0
mov r8d, reloc.WS2_32.dll_inet_addr
mov rdx, qword [rsp + 0x3210]
mov rdx, qword [rdx + 0x1538]
call fcn.14000ea40
xor edx, edx
mov rcx, qword [rsp + 0x3210]
call fcn.140199e80
mov rcx, qword [rsp + 0x3210]
call fcn.1401a1780
mov rax, qword [rsp + 0x3210]
mov rax, qword [rax]
lea rdx, str.866_518
mov rcx, qword [rsp + 0x3210]
call qword [rax + 0x2d8]
lea rax, [rsp + 0x2d38]
mov qword [rsp + 0x2d40], rax
lea rcx, [rsp + 0x2d48]
call fcn.140001000
mov qword [rsp + 0x3008], rax
mov rax, qword [rsp + 0x3008]
mov qword [rsp + 0x3010], rax
lea r8, [0x14025ac78]
mov rdx, qword [rsp + 0x3010]
mov rcx, qword [rsp + 0x2d40]
call fcn.1400010b0
mov qword [rsp + 0x3018], rax
mov rcx, qword [rsp + 0x3018]
call fcn.1401cb5a0
nop
lea rcx, [rsp + 0x2d48]
call fcn.140007060
lea rcx, [rsp + 0x1460]
call fcn.14000e170
nop
mov dword [rsp + 0x15f8], 1
lea rcx, [rsp + 0x1460]
call fcn.1401e4480
lea rcx, [rsp + 0x1628]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401acade
lea rcx, [rsp + 0x1858]
call fcn.1400dd7e0
nop
lea rcx, [rsp + 0x1858]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x2d50]
call fcn.140002d40
mov qword [rsp + 0x3020], rax
mov rax, qword [rsp + 0x3020]
mov qword [rsp + 0x3028], rax
mov rcx, qword [rsp + 0x3028]
call fcn.140002df0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x23c0], eax
lea rcx, [rsp + 0x2d50]
call fcn.140002dd0
xor eax, eax
mov word [rsp + 0x1870], ax
lea rdi, [rsp + 0x1872]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x23c2]
movzx r9d, byte [rsp + 0x23c1]
movzx r8d, byte [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
lea rdx, str._d._d._d.101
lea rcx, [rsp + 0x1870]
call fcn.1400aa834
lea rcx, [rsp + 0x1630]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401abf52
lea rcx, [rsp + 0x1630]
lea rdx, [rsp + 0x1870]
call fcn.140002020
movzx eax, byte [rsp + 0x23c2]
movzx r9d, byte [rsp + 0x23c1]
movzx r8d, byte [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
lea rdx, str._d._d._d.254
lea rcx, [rsp + 0x1870]
call fcn.1400aa834
lea rcx, [rsp + 0x1638]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401abfad
lea rcx, [rsp + 0x1638]
lea rdx, [rsp + 0x1870]
call fcn.140002020
lea rcx, [rsp + 0x1628]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401abfd6
lea rcx, [rsp + 0x1628]
lea rdx, [rsp + 0x1858]
call fcn.140002ce0
lea rdx, str.255.255.255.0
lea rcx, [rsp + 0x1860]
call fcn.140002050
nop
lea rcx, [rsp + 0x1868]
call fcn.140002d10
nop
movzx eax, byte [rsp + 0x23c2]
movzx r9d, byte [rsp + 0x23c1]
movzx r8d, byte [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
lea rdx, [0x14025ace8]
lea rcx, [rsp + 0x1868]
call fcn.140002ba0
lea rcx, [rsp + 0x2070]
call fcn.140002d10
nop
movzx eax, byte [rsp + 0x23c2]
movzx r9d, byte [rsp + 0x23c1]
movzx r8d, byte [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
lea rdx, str._d._d._d.1
lea rcx, [rsp + 0x2070]
call fcn.140002ba0
lea rcx, [rsp + 0x23f0]
call fcn.140002d10
nop
mov qword [rsp + 0x2410], 0
mov ecx, 0x2c0
call fcn.1400aba8c
mov qword [rsp + 0x23f8], rax
cmp qword [rsp + 0x23f8], 0
jne 0x1401ac0b5
lea rdx, [0x14025ad20]
xor ecx, ecx
call fcn.1400de020
jmp 0x1401ac598
mov dword [rsp + 0x2408], 0x2c0
lea rdx, [rsp + 0x2408]
mov rcx, qword [rsp + 0x23f8]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1401ac119
mov rcx, qword [rsp + 0x23f8]
call fcn.1400a9ef0
mov ecx, dword [rsp + 0x2408]
call fcn.1400aba8c
mov qword [rsp + 0x23f8], rax
cmp qword [rsp + 0x23f8], 0
jne 0x1401ac119
lea rdx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo
xor ecx, ecx
call fcn.1400de020
jmp 0x1401ac598
lea rdx, [rsp + 0x2408]
mov rcx, qword [rsp + 0x23f8]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1401ac368
mov rax, qword [rsp + 0x23f8]
mov qword [rsp + 0x2410], rax
cmp qword [rsp + 0x2410], 0
je 0x1401ac368
mov rdx, qword [rsp + 0x2410]
add rdx, 0x1c0
lea rcx, [rsp + 0x2418]
call fcn.1400ddd50
nop
lea rcx, [rsp + 0x1628]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x2418]
call fcn.140006130
test eax, eax
je 0x1401ac1b5
mov rax, qword [rsp + 0x2410]
mov rax, qword [rax]
mov qword [rsp + 0x2410], rax
lea rcx, [rsp + 0x2418]
call fcn.140007060
jmp 0x1401ac146
mov rdx, qword [rsp + 0x2410]
add rdx, 0x1d0
lea rcx, [rsp + 0x2d60]
call fcn.140007000
mov qword [rsp + 0x3030], rax
mov rcx, qword [rsp + 0x3030]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401ac1fa
mov dword [rsp + 0x3038], 1
jmp 0x1401ac205
mov dword [rsp + 0x3038], 0
movzx eax, byte [rsp + 0x3038]
mov byte [rsp + 0x2d58], al
lea rcx, [rsp + 0x2d60]
call fcn.140007060
movzx edx, byte [rsp + 0x2d58]
test edx, edx
je 0x1401ac284
mov rdx, qword [rsp + 0x2410]
add rdx, 0x1d0
lea rcx, [rsp + 0x2d68]
call fcn.1400ddd50
mov qword [rsp + 0x3040], rax
mov rax, qword [rsp + 0x3040]
mov qword [rsp + 0x3048], rax
mov rdx, qword [rsp + 0x3048]
lea rcx, [rsp + 0x1860]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2d68]
call fcn.140007060
mov rdx, qword [rsp + 0x2410]
add rdx, 0x1f0
lea rcx, [rsp + 0x2d78]
call fcn.140007000
mov qword [rsp + 0x3050], rax
mov rcx, qword [rsp + 0x3050]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401ac2c9
mov dword [rsp + 0x3058], 1
jmp 0x1401ac2d4
mov dword [rsp + 0x3058], 0
movzx eax, byte [rsp + 0x3058]
mov byte [rsp + 0x2d70], al
lea rcx, [rsp + 0x2d78]
call fcn.140007060
movzx edx, byte [rsp + 0x2d70]
test edx, edx
je 0x1401ac354
mov rdx, qword [rsp + 0x2410]
add rdx, 0x1f0
lea rcx, [rsp + 0x2d80]
call fcn.1400ddd50
mov qword [rsp + 0x3060], rax
mov rax, qword [rsp + 0x3060]
mov qword [rsp + 0x3068], rax
mov rdx, qword [rsp + 0x3068]
lea rcx, [rsp + 0x1868]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2d80]
call fcn.140007060
nop
lea rcx, [rsp + 0x2418]
call fcn.140007060
jmp 0x1401ac368
cmp qword [rsp + 0x23f8], 0
je 0x1401ac380
mov rcx, qword [rsp + 0x23f8]
call fcn.1400a9ef0
mov ecx, 0x258
call fcn.1400aba8c
mov qword [rsp + 0x2400], rax
cmp qword [rsp + 0x2400], 0
jne 0x1401ac3b0
lea rdx, [0x14025ae00]
xor ecx, ecx
call fcn.1400de020
jmp 0x1401ac598
mov dword [rsp + 0x2408], 0x258
lea rdx, [rsp + 0x2408]
mov rcx, qword [rsp + 0x2400]
call sub.IPHLPAPI.DLL_GetNetworkParams
cmp eax, 0x6f
jne 0x1401ac414
mov rcx, qword [rsp + 0x2400]
call fcn.1400a9ef0
mov ecx, dword [rsp + 0x2408]
call fcn.1400aba8c
mov qword [rsp + 0x2400], rax
cmp qword [rsp + 0x2400], 0
jne 0x1401ac414
lea rdx, str.Error_allocating_memory_needed_to_call_GetNetworkParams
xor ecx, ecx
call fcn.1400de020
jmp 0x1401ac598
lea rdx, [rsp + 0x2408]
mov rcx, qword [rsp + 0x2400]
call sub.IPHLPAPI.DLL_GetNetworkParams
test eax, eax
jne 0x1401ac576
mov rdx, qword [rsp + 0x2400]
add rdx, 0x118
lea rcx, [rsp + 0x2d90]
call fcn.140007000
mov qword [rsp + 0x3070], rax
mov rcx, qword [rsp + 0x3070]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401ac476
mov dword [rsp + 0x3078], 1
jmp 0x1401ac481
mov dword [rsp + 0x3078], 0
movzx eax, byte [rsp + 0x3078]
mov byte [rsp + 0x2d88], al
lea rcx, [rsp + 0x2d90]
call fcn.140007060
movzx edx, byte [rsp + 0x2d88]
test edx, edx
je 0x1401ac500
mov rdx, qword [rsp + 0x2400]
add rdx, 0x118
lea rcx, [rsp + 0x2d98]
call fcn.1400ddd50
mov qword [rsp + 0x3080], rax
mov rax, qword [rsp + 0x3080]
mov qword [rsp + 0x3088], rax
mov rdx, qword [rsp + 0x3088]
lea rcx, [rsp + 0x2070]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2d98]
call fcn.140007060
mov rax, qword [rsp + 0x2400]
mov rax, qword [rax + 0x110]
mov qword [rsp + 0x2420], rax
cmp qword [rsp + 0x2420], 0
je 0x1401ac576
mov rdx, qword [rsp + 0x2420]
add rdx, 8
lea rcx, [rsp + 0x2da0]
call fcn.1400ddd50
mov qword [rsp + 0x3090], rax
mov rax, qword [rsp + 0x3090]
mov qword [rsp + 0x3098], rax
mov rdx, qword [rsp + 0x3098]
lea rcx, [rsp + 0x23f0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x2da0]
call fcn.140007060
cmp qword [rsp + 0x2400], 0
je 0x1401ac58e
mov rcx, qword [rsp + 0x2400]
call fcn.1400a9ef0
xor eax, eax
test eax, eax
jne 0x1401ac079
lea rcx, [rsp + 0x1640]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac5c1
lea rcx, [rsp + 0x1640]
lea rdx, [rsp + 0x1860]
call fcn.140002ce0
lea rcx, [rsp + 0x1620]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac5ea
lea rcx, [rsp + 0x1620]
lea rdx, [rsp + 0x1868]
call fcn.140002ce0
lea rcx, [rsp + 0x1648]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac613
lea rcx, [rsp + 0x1648]
lea rdx, [rsp + 0x2070]
call fcn.140002ce0
lea rcx, [rsp + 0x1650]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac63c
lea rcx, [rsp + 0x1650]
lea rdx, [rsp + 0x23f0]
call fcn.140002ce0
lea rcx, [rsp + 0x2080]
call fcn.14000dfa0
nop
lea rcx, [rsp + 0x23c8]
call fcn.1400834ec
nop
lea rax, [rsp + 0x2da8]
mov qword [rsp + 0x2db0], rax
lea rdx, [0x14025aee0]
mov rcx, qword [rsp + 0x2db0]
call fcn.140002050
mov qword [rsp + 0x30a0], rax
mov r9d, 0xfffffffe
lea r8, [rsp + 0x23c8]
mov rdx, qword [rsp + 0x30a0]
lea rcx, [rsp + 0x2080]
call fcn.1401e3fe0
lea rdx, [0x14025ac64]
lea rcx, [rsp + 0x2078]
call fcn.140002050
nop
mov dword [rsp + 0x2428], 0
jmp 0x1401ac6da
mov eax, dword [rsp + 0x2428]
add eax, 1
mov dword [rsp + 0x2428], eax
movsxd rdi, dword [rsp + 0x2428]
lea rcx, [rsp + 0x23c8]
call fcn.1400202c0
cmp rdi, rax
jge 0x1401ac722
movsxd rdx, dword [rsp + 0x2428]
lea rcx, [rsp + 0x23c8]
call fcn.14000de90
mov r8d, dword [rax]
lea rdx, [0x14025aef0]
lea rcx, [rsp + 0x2078]
call fcn.14000df50
jmp 0x1401ac6c9
lea rcx, [rsp + 0x2078]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac747
lea rax, [0x14025af00]
mov qword [rsp + 0x30a8], rax
jmp 0x1401ac75c
lea rcx, [rsp + 0x2078]
call fcn.140050200
mov qword [rsp + 0x30a8], rax
lea rcx, [rsp + 0x1608]
mov rdx, qword [rsp + 0x30a8]
call fcn.140002020
lea rax, [rsp + 0x2db8]
mov qword [rsp + 0x2dc0], rax
lea rdx, [0x14025af08]
mov rcx, qword [rsp + 0x2dc0]
call fcn.140002050
mov qword [rsp + 0x30b0], rax
mov r9d, 0xfffffffe
lea r8, [rsp + 0x23c8]
mov rdx, qword [rsp + 0x30b0]
lea rcx, [rsp + 0x2080]
call fcn.1401e3fe0
lea rcx, [rsp + 0x2078]
call fcn.140001910
mov dword [rsp + 0x242c], 0
jmp 0x1401ac7eb
mov eax, dword [rsp + 0x242c]
add eax, 1
mov dword [rsp + 0x242c], eax
movsxd rdi, dword [rsp + 0x242c]
lea rcx, [rsp + 0x23c8]
call fcn.1400202c0
cmp rdi, rax
jge 0x1401ac833
movsxd rdx, dword [rsp + 0x242c]
lea rcx, [rsp + 0x23c8]
call fcn.14000de90
mov r8d, dword [rax]
lea rdx, [0x14025af18]
lea rcx, [rsp + 0x2078]
call fcn.14000df50
jmp 0x1401ac7da
lea rcx, [rsp + 0x2078]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ac858
lea rax, [0x14025af28]
mov qword [rsp + 0x30b8], rax
jmp 0x1401ac86d
lea rcx, [rsp + 0x2078]
call fcn.140050200
mov qword [rsp + 0x30b8], rax
lea rcx, [rsp + 0x1610]
mov rdx, qword [rsp + 0x30b8]
call fcn.140002020
lea rax, [rsp + 0x2dc8]
mov qword [rsp + 0x2dd0], rax
lea rdx, [0x14025af30]
mov rcx, qword [rsp + 0x2dd0]
call fcn.140002050
mov qword [rsp + 0x30c0], rax
mov r9d, 0xfffffffe
lea r8, [rsp + 0x23c8]
mov rdx, qword [rsp + 0x30c0]
lea rcx, [rsp + 0x2080]
call fcn.1401e3fe0
lea rcx, [rsp + 0x2078]
call fcn.140001910
mov dword [rsp + 0x2430], 0
jmp 0x1401ac8fc
mov eax, dword [rsp + 0x2430]
add eax, 1
mov dword [rsp + 0x2430], eax
movsxd rdi, dword [rsp + 0x2430]
lea rcx, [rsp + 0x23c8]
call fcn.1400202c0
cmp rdi, rax
jge 0x1401ac944
movsxd rdx, dword [rsp + 0x2430]
lea rcx, [rsp + 0x23c8]
call fcn.14000de90
mov r8d, dword [rax]
lea rdx, [0x14025af38]
lea rcx, [rsp + 0x2078]
call fcn.14000df50
jmp 0x1401ac8eb
lea rcx, [rsp + 0x1688]
lea rdx, [rsp + 0x2078]
call fcn.140002ce0
lea rcx, [rsp + 0x1460]
call fcn.1401cbc50
test eax, eax
jne 0x1401ac977
lea rcx, [rsp + 0x1460]
call fcn.1401cc080
mov edx, 1
mov ecx, 1
call fcn.1401cc440
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8004
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
lea rcx, [rsp + 0x2dd8]
call fcn.1400f0640
mov qword [rsp + 0x30c8], rax
mov rax, qword [rsp + 0x30c8]
mov qword [rsp + 0x30d0], rax
mov rcx, qword [rsp + 0x30d0]
call fcn.140050200
mov rdi, rax
call fcn.14000f060
mov rdx, rdi
mov rcx, rax
call fcn.1400f2a30
nop
lea rcx, [rsp + 0x2dd8]
call fcn.140007060
lea rdx, [0x14025af58]
lea rcx, [rsp + 0x2de8]
call fcn.1400f05c0
mov qword [rsp + 0x30d8], rax
lea rdx, [0x14025af48]
mov rcx, qword [rsp + 0x30d8]
call fcn.140006dd0
mov byte [rsp + 0x2de0], al
lea rcx, [rsp + 0x2de8]
call fcn.140007060
movzx edx, byte [rsp + 0x2de0]
test edx, edx
je 0x1401aca6f
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__www.ccboot.com_specs.htm
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x2078]
call fcn.140007060
nop
lea rcx, [rsp + 0x23c8]
call fcn.14008350c
nop
lea rcx, [rsp + 0x2080]
call fcn.140005e30
nop
lea rcx, [rsp + 0x23f0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2070]
call fcn.140007060
nop
lea rcx, [rsp + 0x1868]
call fcn.140007060
nop
lea rcx, [rsp + 0x1860]
call fcn.140007060
nop
lea rcx, [rsp + 0x1858]
call fcn.140007060
call fcn.14000f460
lea rdx, str._mini
mov rcx, qword [rax + 0x90]
call fcn.1400ab9f8
test eax, eax
je 0x1401acb3c
mov rcx, qword [rsp + 0x3210]
call fcn.14000de20
mov rcx, qword [rsp + 0x3210]
call fcn.14000de00
test eax, eax
je 0x1401acb2a
mov edx, 9
mov rcx, qword [rsp + 0x3210]
call fcn.140079c60
mov edx, 5
mov rcx, qword [rsp + 0x3210]
call fcn.140079c60
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x17a0], 0
xor eax, eax
mov word [rsp + 0xc20], ax
lea rdi, [rsp + 0xc22]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x2df0]
call fcn.140001000
mov qword [rsp + 0x30e0], rax
mov rax, qword [rsp + 0x30e0]
mov qword [rsp + 0x30e8], rax
lea r8, [0x14025afc0]
mov rdx, qword [rsp + 0x30e8]
lea rcx, [rsp + 0x2df8]
call fcn.1400010b0
mov qword [rsp + 0x30f0], rax
mov rcx, qword [rsp + 0x30f0]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xc20]
lea r8, [0x14025afd8]
lea rdx, [0x14025afe8]
lea rcx, [0x14025b000]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x2df8]
call fcn.140007060
nop
lea rcx, [rsp + 0x2df0]
call fcn.140007060
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x68]
call fcn.140002050
nop
lea r9, [rsp + 0x17a0]
lea r8, [0x14025ace4]
lea rdx, [rsp + 0x2e00]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x30f8], rax
mov rcx, qword [rsp + 0x30f8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x2e00]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025aeec]
lea rdx, [rsp + 0x2e08]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3100], rax
mov rcx, qword [rsp + 0x3100]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x2e08]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025aefc]
lea rdx, [rsp + 0x2e10]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3108], rax
mov rcx, qword [rsp + 0x3108]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x2e10]
call fcn.140007060
movzx r8d, byte [rsp + 0xb8]
movzx eax, byte [rsp + 0xa8]
shl eax, 8
or r8d, eax
movzx eax, byte [rsp + 0x48]
shl eax, 0x10
or r8d, eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x980
mov dword [rsp + 0x20], 0
mov r9d, 0x64
xor edx, edx
call fcn.140121590
mov dword [rsp + 0x17a0], 0
lea rcx, [rsp + 0x2e18]
call fcn.140001000
mov qword [rsp + 0x3110], rax
mov rax, qword [rsp + 0x3110]
mov qword [rsp + 0x3118], rax
lea r8, [0x14025b020]
mov rdx, qword [rsp + 0x3118]
lea rcx, [rsp + 0x2e20]
call fcn.1400010b0
mov qword [rsp + 0x3120], rax
mov rcx, qword [rsp + 0x3120]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xc20]
lea r8, [0x14025b038]
lea rdx, [0x14025b048]
lea rcx, [0x14025b060]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x2e20]
call fcn.140007060
nop
lea rcx, [rsp + 0x2e18]
call fcn.140007060
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x68]
call fcn.140002020
lea r9, [rsp + 0x17a0]
lea r8, [0x14025af14]
lea rdx, [rsp + 0x2e28]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3128], rax
mov rcx, qword [rsp + 0x3128]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x2e28]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025af24]
lea rdx, [rsp + 0x2e30]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3130], rax
mov rcx, qword [rsp + 0x3130]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x2e30]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025af44]
lea rdx, [rsp + 0x2e38]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3138], rax
mov rcx, qword [rsp + 0x3138]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x2e38]
call fcn.140007060
movzx r8d, byte [rsp + 0xb8]
movzx eax, byte [rsp + 0xa8]
shl eax, 8
or r8d, eax
movzx eax, byte [rsp + 0x48]
shl eax, 0x10
or r8d, eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x980
mov dword [rsp + 0x20], 0
mov r9d, 0x64
mov edx, 1
call fcn.140121590
mov dword [rsp + 0x17a0], 0
lea rcx, [rsp + 0x2e40]
call fcn.140001000
mov qword [rsp + 0x3140], rax
mov rax, qword [rsp + 0x3140]
mov qword [rsp + 0x3148], rax
lea r8, [0x14025b080]
mov rdx, qword [rsp + 0x3148]
lea rcx, [rsp + 0x2e48]
call fcn.1400010b0
mov qword [rsp + 0x3150], rax
mov rcx, qword [rsp + 0x3150]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xc20]
lea r8, [0x14025b098]
lea rdx, [0x14025b0b0]
lea rcx, [0x14025b0c8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x2e48]
call fcn.140007060
nop
lea rcx, [rsp + 0x2e40]
call fcn.140007060
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x68]
call fcn.140002020
lea r9, [rsp + 0x17a0]
lea r8, [0x14025afbc]
lea rdx, [rsp + 0x2e50]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3158], rax
mov rcx, qword [rsp + 0x3158]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x2e50]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025b05c]
lea rdx, [rsp + 0x2e58]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3160], rax
mov rcx, qword [rsp + 0x3160]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x2e58]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025b0ac]
lea rdx, [rsp + 0x2e60]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3168], rax
mov rcx, qword [rsp + 0x3168]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x2e60]
call fcn.140007060
movzx r8d, byte [rsp + 0xb8]
movzx eax, byte [rsp + 0xa8]
shl eax, 8
or r8d, eax
movzx eax, byte [rsp + 0x48]
shl eax, 0x10
or r8d, eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x980
mov dword [rsp + 0x20], 0
mov r9d, 0x64
mov edx, 2
call fcn.140121590
mov dword [rsp + 0x17a0], 0
lea rcx, [rsp + 0x2e68]
call fcn.140001000
mov qword [rsp + 0x3170], rax
mov rax, qword [rsp + 0x3170]
mov qword [rsp + 0x3178], rax
lea r8, [0x14025b0e8]
mov rdx, qword [rsp + 0x3178]
lea rcx, [rsp + 0x2e70]
call fcn.1400010b0
mov qword [rsp + 0x3180], rax
mov rcx, qword [rsp + 0x3180]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xc20]
lea r8, [0x14025b100]
lea rdx, [0x14025b118]
lea rcx, [0x14025b130]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x2e70]
call fcn.140007060
nop
lea rcx, [rsp + 0x2e68]
call fcn.140007060
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x68]
call fcn.140002020
lea r9, [rsp + 0x17a0]
lea r8, [0x14025b114]
lea rdx, [rsp + 0x2e78]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3188], rax
mov rcx, qword [rsp + 0x3188]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x2e78]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025b12c]
lea rdx, [rsp + 0x2e80]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3190], rax
mov rcx, qword [rsp + 0x3190]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x2e80]
call fcn.140007060
lea r9, [rsp + 0x17a0]
lea r8, [0x14025b14c]
lea rdx, [rsp + 0x2e88]
lea rcx, [rsp + 0x68]
call fcn.140006620
mov qword [rsp + 0x3198], rax
mov rcx, qword [rsp + 0x3198]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x2e88]
call fcn.140007060
movzx r8d, byte [rsp + 0xb8]
movzx eax, byte [rsp + 0xa8]
shl eax, 8
or r8d, eax
movzx eax, byte [rsp + 0x48]
shl eax, 0x10
or r8d, eax
mov rcx, qword [rsp + 0x3210]
add rcx, 0x980
mov dword [rsp + 0x20], 0
mov r9d, 0x64
mov edx, 3
call fcn.140121590
mov r8, qword [rsp + 0x3210]
add r8, 0x15e4
mov rdx, qword [rsp + 0x3210]
add rdx, 0x15dc
mov rcx, qword [rsp + 0x3210]
add rcx, 0x15d4
call sub.KERNEL32.dll_GetSystemTimes
mov r8, qword [rsp + 0x3210]
add r8, 0x15f8
xor edx, edx
xor ecx, ecx
call sub.pdh.dll_PdhOpenQueryW
mov dword [rsp + 0xc10], eax
cmp dword [rsp + 0xc10], 0
jne 0x1401ad406
mov r9, qword [rsp + 0x3210]
add r9, 0x1600
xor r8d, r8d
lea rdx, [0x14025b150]
mov rcx, qword [rsp + 0x3210]
mov rcx, qword [rcx + 0x15f8]
call sub.pdh.dll_PdhAddCounterW
mov dword [rsp + 0xc10], eax
cmp dword [rsp + 0xc10], 0
jne 0x1401ad406
mov rax, qword [rsp + 0x3210]
mov dword [rax + 0x1608], 1
xor r9d, r9d
mov r8d, 0x3e8
mov edx, 1
mov rcx, qword [rsp + 0x3210]
call fcn.14000ddc0
xor r9d, r9d
mov r8d, 0x36ee80
mov edx, 2
mov rcx, qword [rsp + 0x3210]
call fcn.14000ddc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x3210]
lea r8, [0x14019fab0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rax, qword [rsp + 0x3210]
mov qword [rax + 0x950], rdx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x3210]
lea r8, [0x1401aa190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rax, qword [rsp + 0x3210]
mov qword [rax + 0x958], rdx
mov dword [rsp + 0x1440], 0x9a
mov dword [rsp + 0x1444], 0x9c
mov dword [rsp + 0x1448], 0x9d
mov dword [rsp + 0x144c], 0xd3
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov r8d, 4
lea rdx, [rsp + 0x1440]
call fcn.140089984
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov dword [rsp + 0x20], 0x258
mov r9d, 0x8000000
mov r8d, ILFree
xor edx, edx
call fcn.140089824
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov dword [rsp + 0x20], 0
mov r9d, 0x8000000
mov r8d, 0x9c
mov edx, 1
call fcn.140089824
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov dword [rsp + 0x20], 0xfa
xor r9d, r9d
mov r8d, 0x9d
mov edx, 2
call fcn.140089824
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_DllRegisterServer
xor r9d, r9d
mov r8d, 0xd3
mov edx, 3
call fcn.140089824
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov r9d, 1
lea r8, [0x14025b1b0]
xor edx, edx
call fcn.140089428
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov r9d, 1
lea r8, [0x14025b1b4]
mov edx, 1
call fcn.140089428
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov r9d, 1
lea r8, [0x14025b1b8]
mov edx, 2
call fcn.140089428
mov rcx, qword [rsp + 0x3210]
add rcx, 0x3d8
mov r9d, 1
lea r8, [0x14025b1bc]
mov edx, 3
call fcn.140089428
call fcn.14019bf20
test eax, eax
jne 0x1401ad65c
xor r8d, r8d
xor edx, edx
lea rcx, str.This_server_blocked_ccboot.com_site_and_cannot_work_normal.
call fcn.1400f0bf0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0xc18], 0
mov qword [rsp + 0x1428], 0
mov edx, 0x400
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1401ada1b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov dword [rax], 0x80c008c8
mov rax, qword [rsp + 0x60]
mov dword [rax + 4], 8
mov ecx, 1
mov rax, qword [rsp + 0x60]
mov word [rax + 8], cx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax + 0xa], cx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax + 0xc], cx
mov ecx, 0xf0
mov rax, qword [rsp + 0x60]
mov word [rax + 0xe], cx
mov ecx, 0x2e
mov rax, qword [rsp + 0x60]
mov word [rax + 0x10], cx
mov rax, qword [rsp + 0x60]
add rax, 0x12
mov qword [rsp + 0x1428], rax
xor ecx, ecx
mov rax, qword [rsp + 0x1428]
mov word [rax], cx
mov rax, qword [rsp + 0x1428]
add rax, 2
mov qword [rsp + 0x1428], rax
xor ecx, ecx
mov rax, qword [rsp + 0x1428]
mov word [rax], cx
mov rax, qword [rsp + 0x1428]
add rax, 2
mov qword [rsp + 0x1428], rax
call fcn.14000f0b0
mov rdx, rax
lea rcx, [rsp + 0x2e90]
call fcn.1400f05c0
mov qword [rsp + 0x31a0], rax
mov rax, qword [rsp + 0x31a0]
mov qword [rsp + 0x31a8], rax
mov rcx, qword [rsp + 0x31a8]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x2e98]
call fcn.1400dddd0
mov qword [rsp + 0x31b0], rax
mov rcx, qword [rsp + 0x31b0]
call fcn.140050200
mov rdx, rax
mov rcx, qword [rsp + 0x1428]
call fcn.1400aac40
lea rcx, [rsp + 0x2e98]
call fcn.140007060
nop
lea rcx, [rsp + 0x2e90]
call fcn.140007060
mov rcx, qword [rsp + 0x1428]
call fcn.1400a99d4
mov rdx, rax
mov rax, qword [rsp + 0x1428]
lea rax, [rax + rdx*2 + 2]
mov qword [rsp + 0x1428], rax
mov ecx, 8
mov rax, qword [rsp + 0x1428]
mov word [rax], cx
mov rax, qword [rsp + 0x1428]
add rax, 2
mov qword [rsp + 0x1428], rax
lea rdx, [0x14025b238]
mov rcx, qword [rsp + 0x1428]
call fcn.1400aac40
mov rcx, qword [rsp + 0x1428]
call fcn.1400a99d4
mov rdx, rax
mov rax, qword [rsp + 0x1428]
lea rax, [rax + rdx*2 + 2]
mov qword [rsp + 0x1428], rax
mov rax, qword [rsp + 0x1428]
add rax, 3
xor edx, edx
mov ecx, 4
div rcx
shl rax, 2
mov qword [rsp + 0x1428], rax
mov rax, qword [rsp + 0x1428]
mov qword [rsp + 0xc18], rax
mov ecx, 0x1d
mov rax, qword [rsp + 0xc18]
mov word [rax + 8], cx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rax, qword [rsp + 0xc18]
mov word [rax + 0xa], cx
mov ecx, UnRegisterTypeLib
mov rax, qword [rsp + 0xc18]
mov word [rax + 0xc], cx
mov ecx, reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0xc18]
mov word [rax + 0xe], cx
mov ecx, 0x64
mov rax, qword [rsp + 0xc18]
mov word [rax + 0x10], cx
mov rax, qword [rsp + 0xc18]
mov dword [rax], 0x50800000
mov rax, qword [rsp + 0xc18]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0xc18]
add rax, 0x12
mov qword [rsp + 0x1428], rax
lea rdx, [0x14025b258]
mov rcx, qword [rsp + 0x1428]
call fcn.1400aac40
lea rcx, [0x14025b280]
call fcn.1400a99d4
mov rdx, rax
mov rax, qword [rsp + 0x1428]
lea rax, [rax + rdx*2 + 2]
mov qword [rsp + 0x1428], rax
xor ecx, ecx
mov rax, qword [rsp + 0x1428]
mov word [rax], cx
mov rax, qword [rsp + 0x1428]
add rax, 2
mov qword [rsp + 0x1428], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call fcn.14000dda0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdx, rax
mov rax, qword [rsp + 0x3210]
mov qword [rax + 0x970], rdx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x3210]
cmp qword [rax + 0x970], 0
je 0x1401ada1b
mov rcx, qword [rsp + 0x3210]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 0x64
mov rcx, qword [rsp + 0x3210]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rax, qword [rsp + 0x3210]
mov qword [rax + 0x968], rdx
lea rcx, [rsp + 0x78]
call fcn.140007080
nop
lea rcx, [rsp + 0xc0]
call fcn.14000dfa0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xc0]
call fcn.1401cb640
mov dword [rsp + 0x2434], 0
jmp 0x1401ada64
mov eax, dword [rsp + 0x2434]
add eax, 1
mov dword [rsp + 0x2434], eax
movsxd rdi, dword [rsp + 0x2434]
lea rcx, [rsp + 0x78]
call fcn.140007100
cmp rdi, rax
jae 0x1401adefa
movsxd rdx, dword [rsp + 0x2434]
lea rcx, [rsp + 0x78]
call fcn.140007130
mov rcx, rax
add rcx, 0x1a8
lea rdx, [0x14025b2a8]
call fcn.140006130
test eax, eax
je 0x1401adaad
jmp 0x1401ada53
lea rdx, [0x14025b254]
lea rcx, [rsp + 0x2438]
call fcn.140002050
nop
lea rdx, [0x14025b27c]
lea rcx, [rsp + 0x2448]
call fcn.140002050
nop
xor eax, eax
mov word [rsp + 0x2460], ax
lea rdi, [rsp + 0x2462]
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
movsxd rdx, dword [rsp + 0x2434]
lea rcx, [rsp + 0x78]
call fcn.140007130
mov rcx, rax
add rcx, 0x1a0
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x2ea8]
call fcn.1400021f0
mov qword [rsp + 0x31b8], rax
mov rax, qword [rsp + 0x31b8]
mov qword [rsp + 0x31c0], rax
lea r8, [0x14025b2a4]
mov rdx, qword [rsp + 0x31c0]
lea rcx, [rsp + 0x2eb0]
call fcn.1400010b0
mov qword [rsp + 0x31c8], rax
mov rcx, qword [rsp + 0x31c8]
call fcn.140050200
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x2460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1401adbbb
mov dword [rsp + 0x31d0], 1
jmp 0x1401adbc6
mov dword [rsp + 0x31d0], 0
movzx eax, byte [rsp + 0x31d0]
mov byte [rsp + 0x2ea0], al
lea rcx, [rsp + 0x2eb0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2ea8]
call fcn.140007060
movzx edx, byte [rsp + 0x2ea0]
test edx, edx
je 0x1401add4f
movsxd rdx, dword [rsp + 0x2434]
lea rcx, [rsp + 0x78]
call fcn.140007130
mov rcx, rax
add rcx, 0x1a0
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x2eb8]
call fcn.1400021f0
mov qword [rsp + 0x31d8], rax
mov rax, qword [rsp + 0x31d8]
mov qword [rsp + 0x31e0], rax
lea r8, [0x14025b2b4]
mov rdx, qword [rsp + 0x31e0]
lea rcx, [rsp + 0x2ec0]
call fcn.1400010b0
mov qword [rsp + 0x31e8], rax
mov rcx, qword [rsp + 0x31e8]
call fcn.140050200
lea r9, [rsp + 0x2c78]
lea r8, [rsp + 0x2c70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2ec0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2eb8]
call fcn.140007060
mov rax, qword [rsp + 0x2c70]
pxor xmm2, xmm2
cvtsi2sd xmm2, rax
test rax, rax
jge 0x1401adccf
addsd xmm2, qword [0x140272fc0]
divsd xmm2, qword [0x140275288]
divsd xmm2, qword [0x140275288]
divsd xmm2, qword [0x140275288]
movq r8, xmm2
lea rdx, [0x14025b2b8]
lea rcx, [rsp + 0x2438]
call fcn.140002ba0
mov rdx, qword [rsp + 0x2c78]
pxor xmm2, xmm2
cvtsi2sd xmm2, rdx
test rdx, rdx
jge 0x1401add1e
addsd xmm2, qword [0x140272fc0]
divsd xmm2, qword [0x140275288]
divsd xmm2, qword [0x140275288]
divsd xmm2, qword [0x140275288]
movq r8, xmm2
lea rdx, [0x14025b2c8]
lea rcx, [rsp + 0x2448]
call fcn.140002ba0
lea rcx, [rsp + 0x2448]
call fcn.140050200
mov rcx, rax
call fcn.1400abbf8
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x2450], xmm0
lea rcx, [rsp + 0x2438]
call fcn.140050200
mov rcx, rax
call fcn.1400abbf8
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x2440], xmm0
movss xmm0, dword [rsp + 0x2450]
comiss xmm0, dword [0x1402221ac]
jbe 0x1401adeda
movss xmm0, dword [rsp + 0x2440]
comiss xmm0, dword [0x1402221ac]
jbe 0x1401adeda
movd xmm1, dword [rsp + 0x2450]
cvtps2pd xmm1, xmm1
movd xmm0, dword [rsp + 0x2440]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x140275048]
subsd xmm1, xmm0
xorpd xmm0, xmm0
comisd xmm0, xmm1
jbe 0x1401adeda
lea rdx, [0x14025b2e8]
lea rcx, [rsp + 0x2ed0]
call fcn.1400f05c0
mov qword [rsp + 0x31f0], rax
lea rdx, [0x14025b2d8]
mov rcx, qword [rsp + 0x31f0]
call fcn.140006e10
mov byte [rsp + 0x2ec8], al
lea rcx, [rsp + 0x2ed0]
call fcn.140007060
movzx edx, byte [rsp + 0x2ec8]
test edx, edx
je 0x1401ade61
lea rcx, [rsp + 0x2448]
call fcn.140007060
nop
lea rcx, [rsp + 0x2438]
call fcn.140007060
jmp 0x1401adefa
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Your_image_disk_is_almost_full._Please_merge_your_images_to_free_disk_space._Do_you_want_to_see_how_to_merge_images_
call fcn.1400f0bf0
cmp eax, 6
jne 0x1401adebd
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__www.ccboot.com_wiki_merge_image.htm
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x2448]
call fcn.140007060
nop
lea rcx, [rsp + 0x2438]
call fcn.140007060
jmp 0x1401adefa
lea rcx, [rsp + 0x2448]
call fcn.140007060
nop
lea rcx, [rsp + 0x2438]
call fcn.140007060
jmp 0x1401adefa
lea rcx, [rsp + 0x2448]
call fcn.140007060
nop
lea rcx, [rsp + 0x2438]
call fcn.140007060
jmp 0x1401ada53
mov rcx, qword [rsp + 0x3210]
call fcn.1401a4e50
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x3210]
lea r8, [0x1401a2790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2ed8], 1
lea rcx, [rsp + 0xc0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x78]
call fcn.1400070d0
nop
lea rcx, [rsp + 0x68]
call fcn.140007060
nop
lea rcx, [rsp + 0x1460]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1420]
call fcn.140007060
nop
lea rcx, [rsp + 0x1450]
call fcn.140007060
nop
lea rcx, [rsp + 0x1438]
call fcn.140007060
nop
lea rcx, [rsp + 0xb0]
call fcn.140007060
mov eax, dword [rsp + 0x2ed8]
mov rcx, qword [rsp + 0x31f8]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0x3200
pop rdi
ret