Function at 0x1401c7740
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get disk information
Link many functions at runtime
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0xd9f0
call fcn.1401e9500
sub rsp, rax
mov qword [rsp + 0xd840], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0xd9e8], rax
mov rax, qword [rsp + 0xda08]
mov qword [rsp + 0xd848], rax
cmp qword [rsp + 0xd848], 0x8156
ja 0x1401c77f6
cmp qword [rsp + 0xd848], 0x8156
je 0x1401cae89
mov rax, qword [rsp + 0xd848]
sub rax, 0x804f
mov qword [rsp + 0xd848], rax
cmp qword [rsp + 0xd848], 0xa6
ja case.0x1401c77f4.32848
lea rcx, [0x140000000]
mov rax, qword [rsp + 0xd848]
movzx eax, byte [rcx + rax + 0x1caf7c]
mov eax, dword [rcx + rax*4 + 0x1caf50]
add rax, rcx
jmp rax
cmp qword [rsp + 0xd848], 0x816e
je 0x1401c7da0
jmp case.0x1401c77f4.32848
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140163a00
nop
lea rcx, [rsp + 0x40]
call fcn.1400830e4
cmp rax, 1
je 0x1401c784b
mov dword [rsp + 0xd650], 0
lea rcx, [rsp + 0x40]
call fcn.1401637c0
mov eax, dword [rsp + 0xd650]
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
call fcn.14000dba0
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0x250]
mov r8d, eax
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
nop
lea rcx, [rsp + 0x40]
call fcn.1401637c0
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
jge 0x1401c78cf
xor eax, eax
jmp 0x1401caf36
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.140163a00
nop
mov dword [rsp + 0x494], 1
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x270]
call fcn.140083bd4
mov dword [rsp + 0x490], eax
lea rcx, [rsp + 0x280]
call fcn.1400830e4
cmp rax, 1
je 0x1401c7943
mov dword [rsp + 0xd654], 0
lea rcx, [rsp + 0x280]
call fcn.1401637c0
mov eax, dword [rsp + 0xd654]
jmp 0x1401caf36
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0x490]
mov r8d, dword [rsp + 0x270]
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
nop
lea rcx, [rsp + 0x280]
call fcn.1401637c0
xor eax, eax
jmp 0x1401caf36
xor r8d, r8d
lea rdx, [rsp + 0xd660]
mov rcx, qword [rsp + 0xda00]
call fcn.140199b60
mov qword [rsp + 0xd850], rax
lea rdx, [0x14025c380]
mov rcx, qword [rsp + 0xd850]
call fcn.140006e10
mov byte [rsp + 0xd658], al
lea rcx, [rsp + 0xd660]
call fcn.140007060
movzx edx, byte [rsp + 0xd658]
test edx, edx
je 0x1401c79df
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 0
jge 0x1401c7a16
xor eax, eax
jmp 0x1401caf36
cmp dword [rsp + 0x4b0], 0
jl 0x1401c7ad4
lea rcx, [rsp + 0x4c0]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.140083bd4
mov dword [rsp + 0x658], eax
lea rcx, [rsp + 0x4c0]
call fcn.1401e3c50
test eax, eax
je 0x1401c7a9a
xor r8d, r8d
xor edx, edx
lea rcx, [0x14025c3a0]
call fcn.1400f0bf0
mov dword [rsp + 0xd668], 1
lea rcx, [rsp + 0x4c0]
call fcn.140005e30
mov eax, dword [rsp + 0xd668]
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, dword [rsp + 0x4b0]
call fcn.14000d6f0
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x4c0]
call fcn.140005e30
jmp 0x1401c7a16
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x4b0], eax
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_delete_the_image_
call fcn.1400f0bf0
cmp eax, 7
jne 0x1401c7b1a
xor eax, eax
jmp 0x1401caf36
cmp dword [rsp + 0x4b0], 0
jl 0x1401c7d8a
lea rcx, [rsp + 0xb70]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.140083bd4
mov dword [rsp + 0xd08], eax
lea rcx, [rsp + 0xb70]
call fcn.1401cb860
lea rcx, [rsp + 0x800]
call fcn.1401e0790
nop
lea rcx, [rsp + 0xb40]
call fcn.140007080
nop
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x800]
call fcn.1401e3450
mov dword [rsp + 0xeb0], 0
jmp 0x1401c7bb4
mov eax, dword [rsp + 0xeb0]
add eax, 1
mov dword [rsp + 0xeb0], eax
mov edi, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007100
cmp rdi, rax
jae 0x1401c7d0e
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007130
mov rcx, rax
add rcx, 0x1f0
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
cmp eax, dword [rsp + 0xd08]
je 0x1401c7c3e
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007130
mov rcx, rax
add rcx, 0x1f8
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
cmp eax, dword [rsp + 0xd08]
je 0x1401c7c3e
jmp 0x1401c7ba3
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007130
mov eax, dword [rax + 0x198]
mov dword [rsp + 0x998], eax
lea rcx, [rsp + 0x800]
call fcn.1401e5810
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007130
mov rcx, rax
add rcx, 0x1f0
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
cmp eax, dword [rsp + 0xd08]
jne 0x1401c7cb4
lea rcx, [rsp + 0x9f0]
lea rdx, [0x14025c37c]
call fcn.140002020
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007130
mov rcx, rax
add rcx, 0x1f8
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
cmp eax, dword [rsp + 0xd08]
jne 0x1401c7cfc
lea rcx, [rsp + 0x9f8]
lea rdx, [0x14025c39c]
call fcn.140002020
lea rcx, [rsp + 0x800]
call fcn.1401e31e0
jmp 0x1401c7ba3
lea rcx, [rsp + 0xb70]
call fcn.1401cbb70
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.14000d620
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0xb40]
call fcn.1400070d0
nop
lea rcx, [rsp + 0x800]
call fcn.140005e30
nop
lea rcx, [rsp + 0xb70]
call fcn.140005e30
jmp 0x1401c7b1a
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x1220], eax
cmp dword [rsp + 0x1220], 0
jge 0x1401c7dd7
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0x1250]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x1220]
call fcn.140083bd4
mov dword [rsp + 0x13e8], eax
lea rcx, [rsp + 0x1250]
call fcn.1401cb860
test eax, eax
jne 0x1401c7e3c
mov dword [rsp + 0xd66c], 0
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd66c]
jmp 0x1401caf36
lea rcx, [rsp + 0x13f8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0xeb4], eax
cmp dword [rsp + 0xeb4], 2
je 0x1401c7e86
mov dword [rsp + 0xd670], 0
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd670]
jmp 0x1401caf36
lea rcx, [rsp + 0x1250]
call fcn.1401e3c50
test eax, eax
je 0x1401c7ecc
xor r8d, r8d
xor edx, edx
lea rcx, str.You_cant_compact_an_image_that_is_used_in_super_client
call fcn.1400f0bf0
mov dword [rsp + 0xd674], 0
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd674]
jmp 0x1401caf36
lea rdx, [rsp + 0x13f8]
lea rcx, [rsp + 0x1240]
call fcn.140001430
nop
mov dx, 0x2e
lea rcx, [rsp + 0x1240]
call fcn.140006920
mov dword [rsp + 0x1598], eax
cmp dword [rsp + 0x1598], 0xffffffff
je 0x1401c7f22
mov edx, dword [rsp + 0x1598]
add edx, 1
lea r8, str.001.
lea rcx, [rsp + 0x1240]
call fcn.140006160
lea rcx, [rsp + 0x1240]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c7f82
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_need_to_merge_the_image_before_compacting_it
call fcn.1400f0bf0
mov dword [rsp + 0xd678], 0
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd678]
jmp 0x1401caf36
mov edx, dword [rsp + 0x13e8]
lea rcx, [rsp + 0xee0]
call fcn.14000d590
nop
lea rcx, [rsp + 0x15a0]
call fcn.140007080
nop
lea rdx, [rsp + 0x15a0]
lea rcx, [rsp + 0xee0]
call fcn.1401cb640
lea rcx, [rsp + 0x15a0]
call fcn.140007100
test rax, rax
jbe 0x1401c802e
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_cant_compact_an_image_that_has_child_disks
call fcn.1400f0bf0
mov dword [rsp + 0xd67c], 0
lea rcx, [rsp + 0x15a0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xee0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd67c]
jmp 0x1401caf36
lea rcx, [0x14025c5c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x1230], rax
cmp qword [rsp + 0x1230], 0
jne 0x1401c80b0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025c5e0]
call fcn.1400f0bf0
mov dword [rsp + 0xd680], 0
lea rcx, [rsp + 0x15a0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xee0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd680]
jmp 0x1401caf36
lea rdx, str.CompactVirtualDisk
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1228], rax
lea rdx, [0x14025c638]
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1590], rax
mov qword [rsp + 0xed8], 0xffffffffffffffff
mov dword [rsp + 0xec0], 2
mov dword [rsp + 0xec4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0xec8], ax
mov eax, 0x47e9
mov word [rsp + 0xeca], ax
mov byte [rsp + 0xecc], 0x90
mov byte [rsp + 0xecd], 0x1f
mov byte [rsp + 0xece], 0x71
mov byte [rsp + 0xecf], 0x41
mov byte [rsp + 0xed0], 0x5a
mov byte [rsp + 0xed1], 0x66
mov byte [rsp + 0xed2], 0x34
mov byte [rsp + 0xed3], 0x5b
mov dword [rsp + 0x1238], 1
lea rdi, [rsp + 0x123c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x123c], 1
lea rcx, [rsp + 0x13f8]
call fcn.140050200
mov rdx, rax
lea rax, [rsp + 0xed8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0xec0]
call qword [rsp + 0x1590]
test eax, eax
je 0x1401c8235
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c648]
call fcn.1400f0bf0
mov dword [rsp + 0xd684], 0
lea rcx, [rsp + 0x15a0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xee0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd684]
jmp 0x1401caf36
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x1248]
call fcn.1400a9850
mov dword [rsp + 0x1248], 1
xor r9d, r9d
lea r8, [rsp + 0x1248]
xor edx, edx
mov rcx, qword [rsp + 0xed8]
call qword [rsp + 0x1228]
test eax, eax
je 0x1401c82e5
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c670]
call fcn.1400f0bf0
mov dword [rsp + 0xd688], 0
lea rcx, [rsp + 0x15a0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xee0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
mov eax, dword [rsp + 0xd688]
jmp 0x1401caf36
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Compact_image_successfully
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0x15a0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xee0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x1240]
call fcn.140007060
nop
lea rcx, [rsp + 0x1250]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x15d0], eax
cmp dword [rsp + 0x15d0], 0
jge 0x1401c837d
xor eax, eax
jmp 0x1401caf36
xor r8d, r8d
lea rdx, [rsp + 0xd690]
mov rcx, qword [rsp + 0xda00]
call fcn.140199b60
mov qword [rsp + 0xd858], rax
lea rdx, [0x14025c6d8]
mov rcx, qword [rsp + 0xd858]
call fcn.140006dd0
mov byte [rsp + 0xd68c], al
lea rcx, [rsp + 0xd690]
call fcn.140007060
movzx edx, byte [rsp + 0xd68c]
test edx, edx
je 0x1401c85c5
lea rcx, [rsp + 0x15e0]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x15d0]
call fcn.140083bd4
mov dword [rsp + 0x1778], eax
lea rcx, [rsp + 0x15e0]
call fcn.1401cb860
test eax, eax
jne 0x1401c843a
mov dword [rsp + 0xd698], 0
lea rcx, [rsp + 0x15e0]
call fcn.140005e30
mov eax, dword [rsp + 0xd698]
jmp 0x1401caf36
lea rdx, [rsp + 0x1788]
lea rcx, [rsp + 0x15d8]
call fcn.140001430
nop
lea rcx, [rsp + 0x15d8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0x15d4], eax
cmp dword [rsp + 0x15d4], 5
jne 0x1401c84dd
lea rcx, [0x14025c6f8]
call fcn.1400a99d4
mov r8d, eax
lea rdx, [rsp + 0xd6a0]
lea rcx, [rsp + 0x15d8]
call fcn.140006a80
mov qword [rsp + 0xd860], rax
mov rcx, qword [rsp + 0xd860]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd6a0]
call fcn.140007060
cmp dword [rsp + 0x15d4], 1
je 0x1401c84ff
cmp dword [rsp + 0x15d4], 2
je 0x1401c84ff
cmp dword [rsp + 0x15d4], 8
jne 0x1401c85aa
lea r8, [rsp + 0x15d8]
lea rdx, str._n__select__
lea rcx, [rsp + 0xd6a8]
call fcn.140006d10
mov qword [rsp + 0xd868], rax
mov rax, qword [rsp + 0xd868]
mov qword [rsp + 0xd870], rax
lea r8, [0x14025c404]
mov rdx, qword [rsp + 0xd870]
lea rcx, [rsp + 0xd6b0]
call fcn.1400010b0
mov qword [rsp + 0xd878], rax
mov rcx, qword [rsp + 0xd878]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14025c728]
lea rdx, [0x14025c748]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd6b0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd6a8]
call fcn.140007060
nop
lea rcx, [rsp + 0x15d8]
call fcn.140007060
nop
lea rcx, [rsp + 0x15e0]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
xor r8d, r8d
lea rdx, [rsp + 0xd6c0]
mov rcx, qword [rsp + 0xda00]
call fcn.140199b60
mov qword [rsp + 0xd880], rax
lea rdx, [0x14025c758]
mov rcx, qword [rsp + 0xd880]
call fcn.140006dd0
mov byte [rsp + 0xd6b8], al
lea rcx, [rsp + 0xd6c0]
call fcn.140007060
movzx edx, byte [rsp + 0xd6b8]
test edx, edx
je 0x1401c8769
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x1c70], eax
cmp dword [rsp + 0x1c70], 0
jge 0x1401c865b
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0x1930]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x1c70]
call fcn.140083bd4
mov dword [rsp + 0x1ac8], eax
lea rcx, [rsp + 0x1930]
call fcn.1401cb860
lea rcx, [rsp + 0x1ad8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0x1920], eax
cmp dword [rsp + 0x1920], 3
je 0x1401c86d2
cmp dword [rsp + 0x1920], 4
je 0x1401c86d2
cmp dword [rsp + 0x1920], 5
jne 0x1401c86f6
mov dword [rsp + 0xd6c8], 0
lea rcx, [rsp + 0x1930]
call fcn.140005e30
mov eax, dword [rsp + 0xd6c8]
jmp 0x1401caf36
xor edx, edx
lea rcx, [rsp + 0x1c80]
call fcn.140165b40
nop
mov eax, dword [rsp + 0x1ac8]
mov dword [rsp + 0x1f58], eax
lea rcx, [rsp + 0x1c80]
call fcn.1400830e4
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0x1ac8]
mov r8d, dword [rsp + 0x1c70]
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
nop
lea rcx, [rsp + 0x1c80]
call fcn.140165a90
nop
lea rcx, [rsp + 0x1930]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xda00]
lea r8, [0x1401c5fb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1401caf36
mov rax, qword [rsp + 0xda00]
cmp dword [rax + 0x978], 0
je 0x1401c87c2
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x2b54], eax
cmp dword [rsp + 0x2b54], 0
jge 0x1401c87f9
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0x2810]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x2b54]
call fcn.140083bd4
mov dword [rsp + 0x29a8], eax
lea rcx, [rsp + 0x2810]
call fcn.1401cb860
test eax, eax
jne 0x1401c885e
mov dword [rsp + 0xd6cc], 0
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6cc]
jmp 0x1401caf36
lea rcx, [rsp + 0x29b8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0x2024], eax
cmp dword [rsp + 0x2024], 2
je 0x1401c88a8
mov dword [rsp + 0xd6d0], 0
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6d0]
jmp 0x1401caf36
mov rax, qword [rsp + 0xda00]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_add_nic_driver_to_the_image_
call fcn.1400f0bf0
cmp eax, 7
jne 0x1401c8909
mov rax, qword [rsp + 0xda00]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd6d4], 0
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6d4]
jmp 0x1401caf36
lea rdx, [rsp + 0x29b8]
lea r8, [0x14025c7d8]
lea rcx, [rsp + 0x3370]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rdi, rax
lea rcx, [rsp + 0x29b8]
call fcn.140050200
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140108cb0
lea rcx, [0x14025c7f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x2b58], rax
cmp qword [rsp + 0x2b58], 0
jne 0x1401c89df
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025c810]
call fcn.1400f0bf0
mov dword [rsp + 0xd6d8], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6d8]
jmp 0x1401caf36
lea rdx, [0x14025c868]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3378], rax
lea rdx, [0x14025c880]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3380], rax
lea rdx, [0x14025c890]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2800], rax
lea rdx, [0x14025c8a8]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3388], rax
mov qword [rsp + 0x27f8], 0xffffffffffffffff
mov dword [rsp + 0x27e0], 2
mov dword [rsp + 0x27e4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x27e8], ax
mov eax, 0x47e9
mov word [rsp + 0x27ea], ax
mov byte [rsp + 0x27ec], 0x90
mov byte [rsp + 0x27ed], 0x1f
mov byte [rsp + 0x27ee], 0x71
mov byte [rsp + 0x27ef], 0x41
mov byte [rsp + 0x27f0], 0x5a
mov byte [rsp + 0x27f1], 0x66
mov byte [rsp + 0x27f2], 0x34
mov byte [rsp + 0x27f3], 0x5b
mov dword [rsp + 0x2b60], 1
lea rdi, [rsp + 0x2b64]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x2b64], 1
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rdx, rax
lea rax, [rsp + 0x27f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x27e0]
call qword [rsp + 0x3380]
test eax, eax
je 0x1401c8baa
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c8c8]
call fcn.1400f0bf0
mov dword [rsp + 0xd6dc], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6dc]
jmp 0x1401caf36
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x2800]
test eax, eax
je 0x1401c8c53
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c8f0]
call fcn.1400f0bf0
mov dword [rsp + 0xd6e0], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6e0]
jmp 0x1401caf36
xor eax, eax
mov word [rsp + 0x2b70], ax
lea rdi, [rsp + 0x2b72]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x27d8], 0x800
lea r8, [rsp + 0x2b70]
lea rdx, [rsp + 0x27d8]
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3388]
lea rcx, [0x14025c918]
call fcn.1400a99d4
lea rcx, [rsp + rax*2 + 0x2b70]
call fcn.1400aac5c
mov dword [rsp + 0x2020], eax
mov eax, 0x43
mov word [rsp + 0x2b50], ax
mov dword [rsp + 0x3390], 0
jmp 0x1401c8ce3
mov eax, dword [rsp + 0x3390]
add eax, 1
mov dword [rsp + 0x3390], eax
cmp dword [rsp + 0x3390], 0x14
jge 0x1401c8faa
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401c8faa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x3394], eax
mov byte [rsp + 0x3398], 0x43
jmp 0x1401c8d35
movzx eax, byte [rsp + 0x3398]
add al, 1
mov byte [rsp + 0x3398], al
movsx eax, byte [rsp + 0x3398]
cmp eax, 0x5a
jg 0x1401c8fa5
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401c8fa5
movsx ecx, byte [rsp + 0x3398]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x3394]
and eax, ecx
test eax, eax
jne 0x1401c8d7a
jmp 0x1401c8d24
lea rcx, [rsp + 0x73b8]
call fcn.140002d10
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x14025c940]
lea rcx, [rsp + 0x73b8]
call fcn.140002ba0
lea rcx, [rsp + 0x73b8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401c8dd2
lea rcx, [rsp + 0x73b8]
call fcn.140007060
jmp 0x1401c8d24
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x14025c948]
lea rcx, [rsp + 0x73b8]
call fcn.140002ba0
lea rcx, [rsp + 0x73b8]
call fcn.140050200
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x33a0], rax
cmp qword [rsp + 0x33a0], 0xffffffffffffffff
jne 0x1401c8e51
lea rcx, [rsp + 0x73b8]
call fcn.140007060
jmp 0x1401c8d24
mov dword [rsp + 0x73b0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x73b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x33b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401c8f84
mov dword [rsp + 0x73c0], 0
mov dword [rsp + 0x73c0], 0
jmp 0x1401c8ed1
mov eax, dword [rsp + 0x73c0]
add eax, 1
mov dword [rsp + 0x73c0], eax
mov eax, dword [rsp + 0x33b0]
cmp dword [rsp + 0x73c0], eax
jge 0x1401c8f84
cmp dword [rsp + 0x2020], 0xffffffff
je 0x1401c8f0d
movsxd rax, dword [rsp + 0x73c0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x33b8]
cmp dword [rsp + 0x2020], eax
je 0x1401c8f0d
jmp 0x1401c8ec0
lea rcx, [rsp + 0x73c8]
call fcn.140002d10
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x14025c958]
lea rcx, [rsp + 0x73c8]
call fcn.140002ba0
lea rcx, [rsp + 0x73c8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c8f72
movsx ax, byte [rsp + 0x3398]
mov word [rsp + 0x2b50], ax
lea rcx, [rsp + 0x73c8]
call fcn.140007060
jmp 0x1401c8f84
lea rcx, [rsp + 0x73c8]
call fcn.140007060
jmp 0x1401c8ec0
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x73b8]
call fcn.140007060
jmp 0x1401c8d24
jmp 0x1401c8cd2
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401c9062
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401c8ff4
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c970]
call fcn.1400f0bf0
mov dword [rsp + 0xd6e4], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6e4]
jmp 0x1401caf36
call fcn.1400d8f80
test eax, eax
jne 0x1401c9116
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401c90a8
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025c998]
call fcn.1400f0bf0
mov dword [rsp + 0xd6e8], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd6e8]
jmp 0x1401caf36
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd6f0]
call fcn.140005e70
mov qword [rsp + 0xd888], rax
mov rax, qword [rsp + 0xd888]
mov qword [rsp + 0xd890], rax
lea r8, [0x14025c9d0]
mov rdx, qword [rsp + 0xd890]
lea rcx, [rsp + 0xd6f8]
call fcn.1400010b0
mov qword [rsp + 0xd898], rax
mov rcx, qword [rsp + 0xd898]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd6f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd6f0]
call fcn.140007060
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd700]
call fcn.140005e70
mov qword [rsp + 0xd8a0], rax
mov rax, qword [rsp + 0xd8a0]
mov qword [rsp + 0xd8a8], rax
lea r8, [0x14025c9e0]
mov rdx, qword [rsp + 0xd8a8]
lea rcx, [rsp + 0xd708]
call fcn.1400010b0
mov qword [rsp + 0xd8b0], rax
mov rcx, qword [rsp + 0xd8b0]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd708]
call fcn.140007060
nop
lea rcx, [rsp + 0xd700]
call fcn.140007060
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd718]
call fcn.140005e70
mov qword [rsp + 0xd8b8], rax
mov rax, qword [rsp + 0xd8b8]
mov qword [rsp + 0xd8c0], rax
lea r8, [0x14025ca00]
mov rdx, qword [rsp + 0xd8c0]
lea rcx, [rsp + 0xd720]
call fcn.1400010b0
mov qword [rsp + 0xd8c8], rax
mov rax, qword [rsp + 0xd8c8]
mov qword [rsp + 0xd8d0], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd728]
call fcn.140005e70
mov qword [rsp + 0xd8d8], rax
mov rax, qword [rsp + 0xd8d8]
mov qword [rsp + 0xd8e0], rax
lea r8, [0x14025ca48]
mov rdx, qword [rsp + 0xd8e0]
lea rcx, [rsp + 0xd730]
call fcn.1400010b0
mov qword [rsp + 0xd8e8], rax
mov rcx, qword [rsp + 0xd8d0]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0xd8e8]
call fcn.140050200
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd710], eax
lea rcx, [rsp + 0xd730]
call fcn.140007060
nop
lea rcx, [rsp + 0xd728]
call fcn.140007060
nop
lea rcx, [rsp + 0xd720]
call fcn.140007060
nop
lea rcx, [rsp + 0xd718]
call fcn.140007060
cmp dword [rsp + 0xd710], 0
je 0x1401c9415
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401c93a7
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025ca58]
call fcn.1400f0bf0
mov dword [rsp + 0xd738], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd738]
jmp 0x1401caf36
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd740]
call fcn.140005e70
mov qword [rsp + 0xd8f0], rax
mov rax, qword [rsp + 0xd8f0]
mov qword [rsp + 0xd8f8], rax
lea r8, [0x14025ca90]
mov rdx, qword [rsp + 0xd8f8]
lea rcx, [rsp + 0xd748]
call fcn.1400010b0
mov qword [rsp + 0xd900], rax
mov rax, qword [rsp + 0xd900]
mov qword [rsp + 0xd908], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd750]
call fcn.140005e70
mov qword [rsp + 0xd910], rax
mov rax, qword [rsp + 0xd910]
mov qword [rsp + 0xd918], rax
lea r8, [0x14025cad8]
mov rdx, qword [rsp + 0xd918]
lea rcx, [rsp + 0xd758]
call fcn.1400010b0
mov qword [rsp + 0xd920], rax
mov rcx, qword [rsp + 0xd908]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0xd920]
call fcn.140050200
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd73c], eax
lea rcx, [rsp + 0xd758]
call fcn.140007060
nop
lea rcx, [rsp + 0xd750]
call fcn.140007060
nop
lea rcx, [rsp + 0xd748]
call fcn.140007060
nop
lea rcx, [rsp + 0xd740]
call fcn.140007060
cmp dword [rsp + 0xd73c], 0
je 0x1401c9685
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd760]
call fcn.140005e70
mov qword [rsp + 0xd928], rax
mov rax, qword [rsp + 0xd928]
mov qword [rsp + 0xd930], rax
lea r8, [0x14025caf0]
mov rdx, qword [rsp + 0xd930]
lea rcx, [rsp + 0xd768]
call fcn.1400010b0
mov qword [rsp + 0xd938], rax
mov rcx, qword [rsp + 0xd938]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd768]
call fcn.140007060
nop
lea rcx, [rsp + 0xd760]
call fcn.140007060
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401c9617
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025cb00]
call fcn.1400f0bf0
mov dword [rsp + 0xd770], 0
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd770]
jmp 0x1401caf36
xor edx, edx
lea rcx, [rsp + 0x2030]
call fcn.140154e80
nop
movzx eax, word [rsp + 0x2b50]
mov word [rsp + 0x22f4], ax
lea rcx, [rsp + 0x2030]
call fcn.1400830e4
mov qword [rsp + 0x27d0], rax
cmp qword [rsp + 0x27d0], 1
je 0x1401c96d3
cmp dword [rsp + 0x27c0], 0
je 0x1401c9b12
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd778]
call fcn.140005e70
mov qword [rsp + 0xd940], rax
mov rax, qword [rsp + 0xd940]
mov qword [rsp + 0xd948], rax
lea r8, [0x14025cb38]
mov rdx, qword [rsp + 0xd948]
lea rcx, [rsp + 0xd780]
call fcn.1400010b0
mov qword [rsp + 0xd950], rax
mov rcx, qword [rsp + 0xd950]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd780]
call fcn.140007060
nop
lea rcx, [rsp + 0xd778]
call fcn.140007060
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd788]
call fcn.140005e70
mov qword [rsp + 0xd958], rax
mov rax, qword [rsp + 0xd958]
mov qword [rsp + 0xd960], rax
lea r8, [0x14025cb48]
mov rdx, qword [rsp + 0xd960]
lea rcx, [rsp + 0xd790]
call fcn.1400010b0
mov qword [rsp + 0xd968], rax
mov rcx, qword [rsp + 0xd968]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd790]
call fcn.140007060
nop
lea rcx, [rsp + 0xd788]
call fcn.140007060
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x24
lea rcx, [0x14025cb60]
call fcn.1400f0bf0
cmp eax, 6
jne 0x1401c9a7e
mov edx, dword [rsp + 0x29a8]
lea rcx, [rsp + 0x73d0]
call fcn.1401e0680
nop
lea rcx, [rsp + 0x29b8]
call fcn.140050200
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x7718]
call fcn.1400fc150
nop
mov dx, 0x2e
lea rcx, [rsp + 0x7718]
call fcn.140006920
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd798]
lea rcx, [rsp + 0x7718]
call fcn.140006a80
mov qword [rsp + 0xd970], rax
mov rcx, qword [rsp + 0xd970]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x7710], eax
lea rcx, [rsp + 0xd798]
call fcn.140007060
lea rcx, [rsp + 0x7570]
mov r8d, dword [rsp + 0x7710]
lea rdx, [0x14025c774]
call fcn.140002ba0
lea rcx, [rsp + 0x7578]
lea rdx, [0x14025cba8]
call fcn.140002020
lea rcx, [rsp + 0xd7a0]
call fcn.14000dd70
lea r8, [0x14025cbd8]
lea rdx, [rsp + 0xd7a8]
mov rcx, rax
call fcn.14000d730
mov qword [rsp + 0xd978], rax
mov rax, qword [rsp + 0xd978]
mov qword [rsp + 0xd980], rax
lea rcx, [rsp + 0x7580]
mov rdx, qword [rsp + 0xd980]
call fcn.140002ce0
nop
lea rcx, [rsp + 0xd7a8]
call fcn.140007060
lea rcx, [rsp + 0x73d0]
call fcn.1401cc080
mov edx, 1
mov ecx, 1
call fcn.1401cc440
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x968], 0
je 0x1401c99a4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x970], 0
je 0x1401c99ee
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call fcn.14007e140
xor edx, edx
mov rcx, rax
call fcn.14007d820
mov edx, 5
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x7718]
call fcn.140050200
mov rdi, rax
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov r8, qword [rsp + 0xda00]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140108390
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x970], 0
je 0x1401c9a4e
xor edx, edx
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025cc00]
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0x7718]
call fcn.140007060
nop
lea rcx, [rsp + 0x73d0]
call fcn.140005e30
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0x29a8]
mov r8d, dword [rsp + 0x2b54]
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
mov dword [rsp + 0xd7b0], 0
lea rcx, [rsp + 0x2030]
call fcn.140154e00
nop
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
mov eax, dword [rsp + 0xd7b0]
jmp 0x1401caf36
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7b8]
call fcn.140005e70
mov qword [rsp + 0xd988], rax
mov rax, qword [rsp + 0xd988]
mov qword [rsp + 0xd990], rax
lea r8, [0x14025cc40]
mov rdx, qword [rsp + 0xd990]
lea rcx, [rsp + 0xd7c0]
call fcn.1400010b0
mov qword [rsp + 0xd998], rax
mov rcx, qword [rsp + 0xd998]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd7b8]
call fcn.140007060
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7c8]
call fcn.140005e70
mov qword [rsp + 0xd9a0], rax
mov rax, qword [rsp + 0xd9a0]
mov qword [rsp + 0xd9a8], rax
lea r8, [0x14025cc50]
mov rdx, qword [rsp + 0xd9a8]
lea rcx, [rsp + 0xd7d0]
call fcn.1400010b0
mov qword [rsp + 0xd9b0], rax
mov rcx, qword [rsp + 0xd9b0]
call fcn.140050200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7d0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd7c8]
call fcn.140007060
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x2030]
call fcn.140154e00
nop
lea rcx, [rsp + 0x3370]
call fcn.140007060
nop
lea rcx, [rsp + 0x2810]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0x7754], eax
cmp dword [rsp + 0x7754], 0
jge 0x1401c9ced
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0x7f90]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0x7754]
call fcn.140083bd4
mov dword [rsp + 0x8128], eax
lea rcx, [rsp + 0x7f90]
call fcn.1401cb860
test eax, eax
jne 0x1401c9d52
mov dword [rsp + 0xd7d8], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7d8]
jmp 0x1401caf36
lea rcx, [rsp + 0x8138]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0x7724], eax
cmp dword [rsp + 0x7724], 2
je 0x1401c9db0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025cc70]
call fcn.1400f0bf0
mov dword [rsp + 0xd7dc], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7dc]
jmp 0x1401caf36
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_mount_this_image_
call fcn.1400f0bf0
cmp eax, 7
jne 0x1401c9ded
mov dword [rsp + 0xd7e0], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7e0]
jmp 0x1401caf36
lea rdx, [rsp + 0x8138]
lea r8, [0x14025cd48]
lea rcx, [rsp + 0x7f70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rdi, rax
lea rcx, [rsp + 0x8138]
call fcn.140050200
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140108cb0
lea rcx, [0x14025cd60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x7758], rax
cmp qword [rsp + 0x7758], 0
jne 0x1401c9eb1
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025cd80]
call fcn.1400f0bf0
mov dword [rsp + 0xd7e4], 0
lea rcx, [rsp + 0x7f70]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7e4]
jmp 0x1401caf36
lea rdx, [0x14025cdd8]
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f78], rax
lea rdx, [0x14025cdf0]
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f80], rax
lea rdx, [0x14025ce00]
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7748], rax
lea rdx, [0x14025ce18]
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f88], rax
mov rax, qword [rsp + 0xda00]
mov qword [rax + 0x1320], 0xffffffffffffffff
mov dword [rsp + 0x7730], 2
mov dword [rsp + 0x7734], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x7738], ax
mov eax, 0x47e9
mov word [rsp + 0x773a], ax
mov byte [rsp + 0x773c], 0x90
mov byte [rsp + 0x773d], 0x1f
mov byte [rsp + 0x773e], 0x71
mov byte [rsp + 0x773f], 0x41
mov byte [rsp + 0x7740], 0x5a
mov byte [rsp + 0x7741], 0x66
mov byte [rsp + 0x7742], 0x34
mov byte [rsp + 0x7743], 0x5b
mov dword [rsp + 0x7760], 1
lea rdi, [rsp + 0x7764]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x7764], 1
mov rdi, qword [rsp + 0xda00]
add rdi, 0x1320
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rdx, rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x7760]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x7730]
call qword [rsp + 0x7f80]
test eax, eax
je 0x1401ca086
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025ce38]
call fcn.1400f0bf0
mov dword [rsp + 0xd7e8], 0
lea rcx, [rsp + 0x7f70]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7e8]
jmp 0x1401caf36
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7748]
test eax, eax
je 0x1401ca150
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xda00]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025ce60]
call fcn.1400f0bf0
mov dword [rsp + 0xd7ec], 0
lea rcx, [rsp + 0x7f70]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7ec]
jmp 0x1401caf36
xor eax, eax
mov word [rsp + 0x7770], ax
lea rdi, [rsp + 0x7772]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x7728], 0x800
lea r8, [rsp + 0x7770]
lea rdx, [rsp + 0x7728]
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7f88]
lea rcx, [0x14025ce88]
call fcn.1400a99d4
lea rcx, [rsp + rax*2 + 0x7770]
call fcn.1400aac5c
mov dword [rsp + 0x7720], eax
mov eax, 0x43
mov word [rsp + 0x7750], ax
mov dword [rsp + 0x82d0], 0
jmp 0x1401ca1e7
mov eax, dword [rsp + 0x82d0]
add eax, 1
mov dword [rsp + 0x82d0], eax
cmp dword [rsp + 0x82d0], 0x14
jge 0x1401ca4ae
movzx eax, word [rsp + 0x7750]
cmp eax, 0x43
jne 0x1401ca4ae
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x82d4], eax
mov byte [rsp + 0x82d8], 0x43
jmp 0x1401ca239
movzx eax, byte [rsp + 0x82d8]
add al, 1
mov byte [rsp + 0x82d8], al
movsx eax, byte [rsp + 0x82d8]
cmp eax, 0x5a
jg 0x1401ca4a9
movzx eax, word [rsp + 0x7750]
cmp eax, 0x43
jne 0x1401ca4a9
movsx ecx, byte [rsp + 0x82d8]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x82d4]
and eax, ecx
test eax, eax
jne 0x1401ca27e
jmp 0x1401ca228
lea rcx, [rsp + 0xc2f8]
call fcn.140002d10
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x14025ceb0]
lea rcx, [rsp + 0xc2f8]
call fcn.140002ba0
lea rcx, [rsp + 0xc2f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401ca2d6
lea rcx, [rsp + 0xc2f8]
call fcn.140007060
jmp 0x1401ca228
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x14025ceb8]
lea rcx, [rsp + 0xc2f8]
call fcn.140002ba0
lea rcx, [rsp + 0xc2f8]
call fcn.140050200
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x82e0], rax
cmp qword [rsp + 0x82e0], 0xffffffffffffffff
jne 0x1401ca355
lea rcx, [rsp + 0xc2f8]
call fcn.140007060
jmp 0x1401ca228
mov dword [rsp + 0xc2f0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0xc2f0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x82f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401ca488
mov dword [rsp + 0xc300], 0
mov dword [rsp + 0xc300], 0
jmp 0x1401ca3d5
mov eax, dword [rsp + 0xc300]
add eax, 1
mov dword [rsp + 0xc300], eax
mov eax, dword [rsp + 0x82f0]
cmp dword [rsp + 0xc300], eax
jge 0x1401ca488
cmp dword [rsp + 0x7720], 0xffffffff
je 0x1401ca411
movsxd rax, dword [rsp + 0xc300]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x82f8]
cmp dword [rsp + 0x7720], eax
je 0x1401ca411
jmp 0x1401ca3c4
lea rcx, [rsp + 0xc308]
call fcn.140002d10
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x14025cec8]
lea rcx, [rsp + 0xc308]
call fcn.140002ba0
lea rcx, [rsp + 0xc308]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401ca476
movsx ax, byte [rsp + 0x82d8]
mov word [rsp + 0x7750], ax
lea rcx, [rsp + 0xc308]
call fcn.140007060
jmp 0x1401ca488
lea rcx, [rsp + 0xc308]
call fcn.140007060
jmp 0x1401ca3c4
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc2f8]
call fcn.140007060
jmp 0x1401ca228
jmp 0x1401ca1d6
movzx eax, word [rsp + 0x7750]
cmp eax, 0x43
jne 0x1401ca57e
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x1320], 0xffffffffffffffff
je 0x1401ca514
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0x7f78]
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xda00]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x14025ced8]
call fcn.1400f0bf0
mov dword [rsp + 0xd7f0], 0
lea rcx, [rsp + 0x7f70]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
mov eax, dword [rsp + 0xd7f0]
jmp 0x1401caf36
mov rcx, qword [rsp + 0x7758]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x8140]
lea rdx, [0x14025c66c]
call fcn.140002020
lea rcx, [rsp + 0x8148]
mov r8d, dword [rsp + 0x7720]
lea rdx, [0x14025c9f4]
call fcn.140002ba0
lea rcx, [rsp + 0x7f90]
call fcn.1401cbc50
mov edx, 1
mov ecx, 1
call fcn.1401cc440
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Image_mounting_successful.
call fcn.1400f0bf0
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0x8128]
mov r8d, dword [rsp + 0x7754]
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
mov r8d, 1
movzx edx, word [rsp + 0x7750]
lea rcx, [rsp + 0xd7f8]
call fcn.140005e70
mov qword [rsp + 0xd9b8], rax
mov rax, qword [rsp + 0xd9b8]
mov qword [rsp + 0xd9c0], rax
lea r8, [0x14025cc64]
mov rdx, qword [rsp + 0xd9c0]
lea rcx, [rsp + 0xd800]
call fcn.1400010b0
mov qword [rsp + 0xd9c8], rax
mov rcx, qword [rsp + 0xd9c8]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd800]
call fcn.140007060
nop
lea rcx, [rsp + 0xd7f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f70]
call fcn.140007060
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov rax, qword [rsp + 0xda00]
cmp dword [rax + 0x978], 0
je 0x1401ca6f3
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0xc314], eax
cmp dword [rsp + 0xc314], 0
jge 0x1401ca72a
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0xc330]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0xc314]
call fcn.140083bd4
mov dword [rsp + 0xc4c8], eax
lea rcx, [rsp + 0xc330]
call fcn.1401cb860
test eax, eax
jne 0x1401ca78f
mov dword [rsp + 0xd808], 0
lea rcx, [rsp + 0xc330]
call fcn.140005e30
mov eax, dword [rsp + 0xd808]
jmp 0x1401caf36
lea rcx, [rsp + 0xc4d8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0xc310], eax
cmp dword [rsp + 0xc310], 2
je 0x1401ca7ed
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025cf40]
call fcn.1400f0bf0
mov dword [rsp + 0xd80c], 0
lea rcx, [rsp + 0xc330]
call fcn.140005e30
mov eax, dword [rsp + 0xd80c]
jmp 0x1401caf36
mov rax, qword [rsp + 0xda00]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_unmount_this_image_
call fcn.1400f0bf0
cmp eax, 7
jne 0x1401ca84e
mov rax, qword [rsp + 0xda00]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd810], 0
lea rcx, [rsp + 0xc330]
call fcn.140005e30
mov eax, dword [rsp + 0xd810]
jmp 0x1401caf36
lea rdx, [rsp + 0xc4d8]
lea r8, [0x14025d018]
lea rcx, [rsp + 0xc320]
call fcn.1400010b0
nop
lea rcx, [0x14025d030]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xc318], rax
cmp qword [rsp + 0xc318], 0
jne 0x1401ca8e3
mov rax, qword [rsp + 0xda00]
mov dword [rax + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025d050]
call fcn.1400f0bf0
mov dword [rsp + 0xd814], 0
lea rcx, [rsp + 0xc320]
call fcn.140007060
nop
lea rcx, [rsp + 0xc330]
call fcn.140005e30
mov eax, dword [rsp + 0xd814]
jmp 0x1401caf36
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x1320], 0xffffffffffffffff
je 0x1401ca955
lea rdx, [0x14025d0a8]
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc670], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [rsp + 0xc670]
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xda00]
mov qword [rdx + 0x1320], 0xffffffffffffffff
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_save_the_changes_
call fcn.1400f0bf0
cmp eax, 6
jne 0x1401cabab
mov edx, dword [rsp + 0xc4c8]
lea rcx, [rsp + 0xc680]
call fcn.1401e0680
nop
lea rcx, [rsp + 0xc4d8]
call fcn.140050200
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc9c8]
call fcn.1400fc150
nop
mov dx, 0x2e
lea rcx, [rsp + 0xc9c8]
call fcn.140006920
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd818]
lea rcx, [rsp + 0xc9c8]
call fcn.140006a80
mov qword [rsp + 0xd9d0], rax
mov rcx, qword [rsp + 0xd9d0]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xc9c0], eax
lea rcx, [rsp + 0xd818]
call fcn.140007060
lea rcx, [rsp + 0xc820]
mov r8d, dword [rsp + 0xc9c0]
lea rdx, [0x14025d104]
call fcn.140002ba0
lea rcx, [rsp + 0xc828]
lea rdx, [0x14025d110]
call fcn.140002020
lea rcx, [rsp + 0xd820]
call fcn.14000dd70
lea r8, [0x14025d128]
lea rdx, [rsp + 0xd828]
mov rcx, rax
call fcn.14000d730
mov qword [rsp + 0xd9d8], rax
mov rax, qword [rsp + 0xd9d8]
mov qword [rsp + 0xd9e0], rax
lea rcx, [rsp + 0xc830]
mov rdx, qword [rsp + 0xd9e0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0xd828]
call fcn.140007060
lea rcx, [rsp + 0xc680]
call fcn.1401cc080
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x968], 0
je 0x1401caae5
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x970], 0
je 0x1401cab2f
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call fcn.14007e140
xor edx, edx
mov rcx, rax
call fcn.14007d820
mov edx, 5
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0xc9c8]
call fcn.140050200
mov rdi, rax
lea rcx, [rsp + 0xc320]
call fcn.140050200
mov r8, qword [rsp + 0xda00]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140108390
mov rax, qword [rsp + 0xda00]
cmp qword [rax + 0x970], 0
je 0x1401cab90
xor edx, edx
mov rcx, qword [rsp + 0xda00]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rsp + 0xc9c8]
call fcn.140007060
nop
lea rcx, [rsp + 0xc680]
call fcn.140005e30
lea rcx, [rsp + 0xc4e0]
lea rdx, [0x14025c6f4]
call fcn.140002020
lea rcx, [rsp + 0xc4e8]
call fcn.140001910
lea rcx, [rsp + 0xc330]
call fcn.1401cbc50
mov edx, 1
mov ecx, 1
call fcn.1401cc440
lea rcx, [rsp + 0xc320]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xda00]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x14025d150]
call fcn.1400f0bf0
mov rdx, qword [rsp + 0xda00]
add rdx, 0xf18
mov r9d, dword [rsp + 0xc4c8]
mov r8d, dword [rsp + 0xc314]
mov rcx, qword [rsp + 0xda00]
call fcn.1401b2f90
nop
lea rcx, [rsp + 0xc320]
call fcn.140007060
nop
lea rcx, [rsp + 0xc330]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0xcd20], eax
cmp dword [rsp + 0xcd20], 0
jge 0x1401cacaa
xor eax, eax
jmp 0x1401caf36
lea rcx, [rsp + 0xd030]
call fcn.14000d650
nop
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0xcd20]
call fcn.140083bd4
mov dword [rsp + 0xd1c8], eax
lea rcx, [rsp + 0xd030]
call fcn.1401cb860
test eax, eax
jne 0x1401cad0f
mov dword [rsp + 0xd830], 0
lea rcx, [rsp + 0xd030]
call fcn.140005e30
mov eax, dword [rsp + 0xd830]
jmp 0x1401caf36
lea rcx, [rsp + 0xd1d8]
call fcn.140050200
mov rcx, rax
call fcn.1400fabb0
mov dword [rsp + 0xc9d0], eax
cmp dword [rsp + 0xc9d0], 3
je 0x1401cad49
cmp dword [rsp + 0xc9d0], 4
je 0x1401cad49
cmp dword [rsp + 0xc9d0], 5
jne 0x1401cad81
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Child_disk_can_not_be_created_with_this_image_format._nPlease_select_.vhd_or_.vmdk_format.
call fcn.1400f0bf0
mov dword [rsp + 0xd834], 0
lea rcx, [rsp + 0xd030]
call fcn.140005e30
mov eax, dword [rsp + 0xd834]
jmp 0x1401caf36
mov edx, dword [rsp + 0xd1c8]
lea rcx, [rsp + 0xc9e0]
call fcn.1401e0680
nop
lea rcx, [rsp + 0xd000]
call fcn.140007080
nop
lea rdx, [rsp + 0xd000]
lea rcx, [rsp + 0xc9e0]
call fcn.1401cb640
lea rcx, [rsp + 0xd000]
call fcn.140007100
test rax, rax
jbe 0x1401cae1f
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Please_merge_all_your_recovery_first_
call fcn.1400f0bf0
mov dword [rsp + 0xd838], 0
lea rcx, [rsp + 0xd000]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xc9e0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xd030]
call fcn.140005e30
mov eax, dword [rsp + 0xd838]
jmp 0x1401caf36
xor edx, edx
lea rcx, [rsp + 0xcd30]
call fcn.140174f70
nop
mov eax, dword [rsp + 0xd1c8]
mov dword [rsp + 0xcf40], eax
lea rcx, [rsp + 0xcd30]
call fcn.1400830e4
nop
lea rcx, [rsp + 0xcd30]
call fcn.140174f10
nop
lea rcx, [rsp + 0xd000]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xc9e0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xd030]
call fcn.140005e30
xor eax, eax
jmp 0x1401caf36
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000d6f0
mov dword [rsp + 0xd370], eax
xor edx, edx
lea rcx, [rsp + 0xd380]
call fcn.14014d050
nop
mov dword [rsp + 0xd5a0], 0
mov rcx, qword [rsp + 0xda00]
add rcx, 0xf18
mov edx, dword [rsp + 0xd370]
call fcn.140083bd4
mov dword [rsp + 0xd5a4], eax
lea rcx, [rsp + 0xd380]
call fcn.1400830e4
cmp rax, 1
je 0x1401caf20
mov dword [rsp + 0xd83c], 0
lea rcx, [rsp + 0xd380]
call fcn.14014cfe0
mov eax, dword [rsp + 0xd83c]
jmp 0x1401caf36
lea rcx, [rsp + 0xd380]
call fcn.14014cfe0
xor eax, eax
jmp 0x1401caf36
mov eax, 1
mov rcx, qword [rsp + 0xd9e8]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0xd9f0
pop rdi
ret