Function at 0x1401acc00
Capabilities:
Check if file exists
Create process on windows
Manipulate boot configuration
Read .ini file
Shutdown system

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x66dc0
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0x66978], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x66db8], rax
mov dword [rsp + 0x66974], 0
mov rax, qword [rsp + 0x66dd8]
mov qword [rsp + 0x66980], rax
cmp qword [rsp + 0x66980], 0x808b
ja 0x1401accd5
cmp qword [rsp + 0x66980], 0x808b
je 0x1401acee3
cmp qword [rsp + 0x66980], 0x4cb
je 0x1401ace43
cmp qword [rsp + 0x66980], 0x8004
je 0x1401acd34
cmp qword [rsp + 0x66980], 0x8064
je 0x1401acf15
cmp qword [rsp + 0x66980], 0x8069
je 0x1401ae9d9
cmp qword [rsp + 0x66980], 0x806f
je 0x1401aea0b
jmp 0x1401af5ef
cmp qword [rsp + 0x66980], 0x80a0
je 0x1401ace4a
cmp qword [rsp + 0x66980], 0x80b7
je 0x1401aea3d
cmp qword [rsp + 0x66980], 0x814e
je 0x1401aeb1d
cmp qword [rsp + 0x66980], 0x814f
je 0x1401aef7b
cmp qword [rsp + 0x66980], 0x815a
je 0x1401af201
jmp 0x1401af5ef
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7a
lea rcx, [rsp + 0x50]
call fcn.1401483e0
nop
lea rcx, [rsp + 0x50]
call fcn.140089e64
cmp rax, 1
jne 0x1401ace32
lea rdx, [0x140245a78]
lea rcx, [rsp + 0x666f0]
call fcn.1400eeb20
mov qword [rsp + 0x66988], rax
mov rax, qword [rsp + 0x66988]
mov qword [rsp + 0x66990], rax
lea rdx, [0x140245a68]
mov rcx, qword [rsp + 0x66990]
call fcn.140006d30
movzx eax, al
test eax, eax
je 0x1401acdb2
mov dword [rsp + 0x66998], 0x9b
jmp 0x1401acdbd
mov dword [rsp + 0x66998], 0x66
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0x220
mov edx, dword [rsp + 0x66998]
call fcn.1400efd90
nop
lea rcx, [rsp + 0x666f0]
call fcn.140001470
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
mov edx, 0x6a
call fcn.1400efb20
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xe70
mov edx, 0xd1
call fcn.1400efb20
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xf18
mov edx, 0xd0
call fcn.1400efb20
nop
lea rcx, [rsp + 0x50]
call fcn.140147330
xor eax, eax
jmp 0x1401af5f4
xor eax, eax
jmp 0x1401af5f4
lea rcx, [rsp + 0x666f8]
call fcn.140001000
mov qword [rsp + 0x669a0], rax
mov rax, qword [rsp + 0x669a0]
mov qword [rsp + 0x669a8], rax
lea r8, [0x140245a88]
mov rdx, qword [rsp + 0x669a8]
lea rcx, [rsp + 0x66700]
call fcn.1400010b0
mov qword [rsp + 0x669b0], rax
mov rcx, qword [rsp + 0x669b0]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x66700]
call fcn.140001470
nop
lea rcx, [rsp + 0x666f8]
call fcn.140001470
xor eax, eax
jmp 0x1401af5f4
xor edx, edx
lea rcx, [rsp + 0x910]
call fcn.14016bc00
nop
lea rcx, [rsp + 0x910]
call fcn.1400819f8
nop
lea rcx, [rsp + 0x910]
call fcn.14016b780
xor eax, eax
jmp 0x1401af5f4
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Account_Files__AccInfo.ini_wks.ini_.csv_nxd.ini_accinfo.ini_wks.ini_.csv_nxd.ini
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0xb50]
call fcn.14008b628
nop
lea rcx, [rsp + 0xb50]
call fcn.14008c4e8
cmp rax, 1
je 0x1401acf92
mov dword [rsp + 0x66708], 0
lea rcx, [rsp + 0xb50]
call fcn.14008b530
mov eax, dword [rsp + 0x66708]
jmp 0x1401af5f4
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0xb50]
call fcn.14008c6a0
nop
lea rdx, [rsp + 0x66710]
lea rcx, [rsp + 0xb50]
call fcn.14008ca5c
mov qword [rsp + 0x669b8], rax
lea rdx, str.wks.ini
mov rcx, qword [rsp + 0x669b8]
call fcn.140006050
test eax, eax
jne 0x1401acfea
mov dword [rsp + 0x669c0], 1
jmp 0x1401acff5
mov dword [rsp + 0x669c0], 0
movzx eax, byte [rsp + 0x669c0]
mov byte [rsp + 0x6670c], al
lea rcx, [rsp + 0x66710]
call fcn.140001470
movzx edx, byte [rsp + 0x6670c]
test edx, edx
je 0x1401ad7a6
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0xf10]
mov qword [rsp + 0x20f10], rdx
mov rax, qword [rsp + 0x20f10]
movzx eax, word [rax]
test eax, eax
je 0x1401ad783
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x20f20]
lea r8, [0x140244064]
lea rdx, str.WksName
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x21a60]
lea r8, [0x14024408c]
lea rdx, str.IpAddr
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x21720]
call fcn.1401cd320
nop
mov dword [rsp + 0x218b8], 0
lea rcx, [rsp + 0x21720]
call fcn.1401d1f50
lea rcx, [rsp + 0x218c0]
lea rdx, [rsp + 0x20f20]
call fcn.140002060
lea rcx, [rsp + 0x218d8]
lea rdx, [rsp + 0x21a60]
call fcn.140002060
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66718]
call fcn.140002090
mov qword [rsp + 0x669c8], rax
mov rax, qword [rsp + 0x669c8]
mov qword [rsp + 0x669d0], rax
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66720]
mov rcx, qword [rsp + 0x669d0]
call fcn.140002230
mov qword [rsp + 0x669d8], rax
mov rax, qword [rsp + 0x669d8]
mov qword [rsp + 0x669e0], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66728]
call fcn.140002090
mov qword [rsp + 0x669e8], rax
mov rax, qword [rsp + 0x669e8]
mov qword [rsp + 0x669f0], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66730]
mov rcx, qword [rsp + 0x669f0]
call fcn.140002230
mov qword [rsp + 0x669f8], rax
mov rax, qword [rsp + 0x669f8]
mov qword [rsp + 0x66a00], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66738]
call fcn.140002090
mov qword [rsp + 0x66a08], rax
mov rax, qword [rsp + 0x66a08]
mov qword [rsp + 0x66a10], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66740]
mov rcx, qword [rsp + 0x66a10]
call fcn.140002230
mov qword [rsp + 0x66a18], rax
mov rax, qword [rsp + 0x66a18]
mov qword [rsp + 0x66a20], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66748]
call fcn.140002090
mov qword [rsp + 0x66a28], rax
mov rax, qword [rsp + 0x66a28]
mov qword [rsp + 0x66a30], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66750]
mov rcx, qword [rsp + 0x66a30]
call fcn.140002230
mov qword [rsp + 0x66a38], rax
mov rax, qword [rsp + 0x66a38]
mov qword [rsp + 0x66a40], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66758]
call fcn.140002090
mov qword [rsp + 0x66a48], rax
mov rax, qword [rsp + 0x66a48]
mov qword [rsp + 0x66a50], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66760]
mov rcx, qword [rsp + 0x66a50]
call fcn.140002230
mov qword [rsp + 0x66a58], rax
mov rax, qword [rsp + 0x66a58]
mov qword [rsp + 0x66a60], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66768]
call fcn.140002090
mov qword [rsp + 0x66a68], rax
mov rax, qword [rsp + 0x66a68]
mov qword [rsp + 0x66a70], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x66770]
mov rcx, qword [rsp + 0x66a70]
call fcn.140002230
mov qword [rsp + 0x66a78], rax
mov rax, qword [rsp + 0x66a78]
mov qword [rsp + 0x66a80], rax
lea r8, [0x14024437c]
mov rdx, qword [rsp + 0x66a80]
lea rcx, [rsp + 0x66778]
call fcn.1400010b0
mov qword [rsp + 0x66a88], rax
mov rax, qword [rsp + 0x66a88]
mov qword [rsp + 0x66a90], rax
mov r8, qword [rsp + 0x66a60]
mov rdx, qword [rsp + 0x66a90]
lea rcx, [rsp + 0x66780]
call fcn.140006b70
mov qword [rsp + 0x66a98], rax
mov rax, qword [rsp + 0x66a98]
mov qword [rsp + 0x66aa0], rax
lea r8, [0x140244354]
mov rdx, qword [rsp + 0x66aa0]
lea rcx, [rsp + 0x66788]
call fcn.1400010b0
mov qword [rsp + 0x66aa8], rax
mov rax, qword [rsp + 0x66aa8]
mov qword [rsp + 0x66ab0], rax
mov r8, qword [rsp + 0x66a40]
mov rdx, qword [rsp + 0x66ab0]
lea rcx, [rsp + 0x66790]
call fcn.140006b70
mov qword [rsp + 0x66ab8], rax
mov rax, qword [rsp + 0x66ab8]
mov qword [rsp + 0x66ac0], rax
lea r8, [0x140244324]
mov rdx, qword [rsp + 0x66ac0]
lea rcx, [rsp + 0x66798]
call fcn.1400010b0
mov qword [rsp + 0x66ac8], rax
mov rax, qword [rsp + 0x66ac8]
mov qword [rsp + 0x66ad0], rax
mov r8, qword [rsp + 0x66a20]
mov rdx, qword [rsp + 0x66ad0]
lea rcx, [rsp + 0x667a0]
call fcn.140006b70
mov qword [rsp + 0x66ad8], rax
mov rax, qword [rsp + 0x66ad8]
mov qword [rsp + 0x66ae0], rax
lea r8, [0x1402442fc]
mov rdx, qword [rsp + 0x66ae0]
lea rcx, [rsp + 0x667a8]
call fcn.1400010b0
mov qword [rsp + 0x66ae8], rax
mov rax, qword [rsp + 0x66ae8]
mov qword [rsp + 0x66af0], rax
mov r8, qword [rsp + 0x66a00]
mov rdx, qword [rsp + 0x66af0]
lea rcx, [rsp + 0x667b0]
call fcn.140006b70
mov qword [rsp + 0x66af8], rax
mov rax, qword [rsp + 0x66af8]
mov qword [rsp + 0x66b00], rax
lea r8, [0x1402441fc]
mov rdx, qword [rsp + 0x66b00]
lea rcx, [rsp + 0x667b8]
call fcn.1400010b0
mov qword [rsp + 0x66b08], rax
mov rax, qword [rsp + 0x66b08]
mov qword [rsp + 0x66b10], rax
mov r8, qword [rsp + 0x669e0]
mov rdx, qword [rsp + 0x66b10]
lea rcx, [rsp + 0x667c0]
call fcn.140006b70
mov qword [rsp + 0x66b18], rax
mov rax, qword [rsp + 0x66b18]
mov qword [rsp + 0x66b20], rax
lea rcx, [rsp + 0x218e8]
mov rdx, qword [rsp + 0x66b20]
call fcn.140002d20
nop
lea rcx, [rsp + 0x667c0]
call fcn.140001470
nop
lea rcx, [rsp + 0x667b8]
call fcn.140001470
nop
lea rcx, [rsp + 0x667b0]
call fcn.140001470
nop
lea rcx, [rsp + 0x667a8]
call fcn.140001470
nop
lea rcx, [rsp + 0x667a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x66798]
call fcn.140001470
nop
lea rcx, [rsp + 0x66790]
call fcn.140001470
nop
lea rcx, [rsp + 0x66788]
call fcn.140001470
nop
lea rcx, [rsp + 0x66780]
call fcn.140001470
nop
lea rcx, [rsp + 0x66778]
call fcn.140001470
nop
lea rcx, [rsp + 0x66770]
call fcn.140001470
nop
lea rcx, [rsp + 0x66768]
call fcn.140001470
nop
lea rcx, [rsp + 0x66760]
call fcn.140001470
nop
lea rcx, [rsp + 0x66758]
call fcn.140001470
nop
lea rcx, [rsp + 0x66750]
call fcn.140001470
nop
lea rcx, [rsp + 0x66748]
call fcn.140001470
nop
lea rcx, [rsp + 0x66740]
call fcn.140001470
nop
lea rcx, [rsp + 0x66738]
call fcn.140001470
nop
lea rcx, [rsp + 0x66730]
call fcn.140001470
nop
lea rcx, [rsp + 0x66728]
call fcn.140001470
nop
lea rcx, [rsp + 0x66720]
call fcn.140001470
nop
lea rcx, [rsp + 0x66718]
call fcn.140001470
lea rcx, [rsp + 0x218e8]
call fcn.1400068b0
lea rcx, [rsp + 0x21720]
call fcn.1401b8b50
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000f500
mov dword [rsp + 0x20f18], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x218b8]
mov r8d, dword [rsp + 0x20f18]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a6370
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x20f10]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x20f10], rax
lea rcx, [rsp + 0x21720]
call fcn.140005d50
jmp 0x1401ad054
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245ac8]
call fcn.1400ef150
lea rdx, [rsp + 0x667d0]
lea rcx, [rsp + 0xb50]
call fcn.14008ca5c
mov qword [rsp + 0x66b28], rax
lea rdx, str.accinfo.ini
mov rcx, qword [rsp + 0x66b28]
call fcn.140006050
test eax, eax
jne 0x1401ad7e8
mov dword [rsp + 0x66b30], 1
jmp 0x1401ad7f3
mov dword [rsp + 0x66b30], 0
movzx eax, byte [rsp + 0x66b30]
mov byte [rsp + 0x667c8], al
lea rcx, [rsp + 0x667d0]
call fcn.140001470
movzx edx, byte [rsp + 0x667c8]
test edx, edx
je 0x1401ada43
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x22260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x22260]
mov qword [rsp + 0x42260], rdx
mov rax, qword [rsp + 0x42260]
movzx eax, word [rax]
test eax, eax
je 0x1401ada20
lea rdx, [0x1402443d4]
mov rcx, qword [rsp + 0x42260]
call fcn.140010b10
test rax, rax
jne 0x1401ad8a6
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
jmp 0x1401ad852
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42270]
lea r8, [0x1402444cc]
lea rdx, str.ComputerName
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42db0]
lea r8, [0x14024465c]
lea rdx, str.IPAddress
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x42a70]
call fcn.1401cd320
nop
mov dword [rsp + 0x42c08], 0
lea rcx, [rsp + 0x42a70]
call fcn.1401d1f50
lea rcx, [rsp + 0x42c10]
lea rdx, [rsp + 0x42270]
call fcn.140002060
lea rcx, [rsp + 0x42c28]
lea rdx, [rsp + 0x42db0]
call fcn.140002060
lea rcx, [rsp + 0x42c38]
mov rdx, qword [rsp + 0x42260]
call fcn.140002060
lea rcx, [rsp + 0x42c38]
call fcn.1400068b0
lea rcx, [rsp + 0x42a70]
call fcn.1401b8b50
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000f500
mov dword [rsp + 0x42268], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x42c08]
mov r8d, dword [rsp + 0x42268]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a6370
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
lea rcx, [rsp + 0x42a70]
call fcn.140005d50
jmp 0x1401ad852
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245b20]
call fcn.1400ef150
lea rdx, [rsp + 0x667e0]
lea rcx, [rsp + 0xb50]
call fcn.14008ccb0
mov qword [rsp + 0x66b38], rax
lea rdx, [0x140245b28]
mov rcx, qword [rsp + 0x66b38]
call fcn.140006050
test eax, eax
jne 0x1401ada85
mov dword [rsp + 0x66b40], 1
jmp 0x1401ada90
mov dword [rsp + 0x66b40], 0
movzx eax, byte [rsp + 0x66b40]
mov byte [rsp + 0x667d8], al
lea rcx, [rsp + 0x667e0]
call fcn.140001470
movzx edx, byte [rsp + 0x667d8]
test edx, edx
je 0x1401ae75a
lea rdx, [rsp + 0x667e8]
lea rcx, [rsp + 0xb50]
call fcn.14008c6a0
mov qword [rsp + 0x66b48], rax
mov rcx, qword [rsp + 0x66b48]
call fcn.1400012c0
lea rdx, [0x140244864]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x435b0], rax
lea rcx, [rsp + 0x667e8]
call fcn.140001470
cmp qword [rsp + 0x435b0], 0
jne 0x1401adb47
mov dword [rsp + 0x667f0], 0
lea rcx, [rsp + 0xb40]
call fcn.140001470
nop
lea rcx, [rsp + 0xb50]
call fcn.14008b530
mov eax, dword [rsp + 0x667f0]
jmp 0x1401af5f4
mov rcx, qword [rsp + 0x435b0]
call fcn.1400a9dc0
test eax, eax
jne 0x1401ae72a
mov byte [rsp + 0x43950], 0
lea rdi, [rsp + 0x43951]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x435b0]
mov edx, 0x400
lea rcx, [rsp + 0x43950]
call fcn.1400aa4c8
test rax, rax
jne 0x1401adb99
jmp 0x1401ae72a
lea rcx, [rsp + 0x43950]
call fcn.1400a9170
test rax, rax
jne 0x1401adbb0
jmp 0x1401ae72a
lea rdx, [rsp + 0x43950]
lea rcx, [rsp + 0x435c0]
call fcn.14000f2f0
nop
lea rdx, [0x140244984]
lea rcx, [rsp + 0x435c0]
call fcn.140006970
lea rdx, [0x140244b8c]
lea rcx, [rsp + 0x435c0]
call fcn.140006970
lea rdx, [0x140244b9c]
lea rcx, [rsp + 0x435c0]
call fcn.140006970
lea rcx, [rsp + 0x435c0]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1401adc2e
lea rcx, [rsp + 0x435c0]
call fcn.140001470
jmp 0x1401ae72a
mov dword [rsp + 0x43940], 0
lea rcx, [rsp + 0x43948]
call fcn.140002d50
nop
lea rcx, [rsp + 0x435d0]
call fcn.140002d50
nop
lea rcx, [rsp + 0x435b8]
call fcn.140002d50
nop
lea rcx, [rsp + 0x435d8]
call fcn.1400774a0
nop
cmp dword [rsp + 0x43940], 0
jl 0x1401ae48b
mov r8d, dword [rsp + 0x43940]
lea rdx, [0x140244bb4]
lea rcx, [rsp + 0x435c0]
call fcn.140006720
mov dword [rsp + 0x43d58], eax
lea rcx, [rsp + 0x43d50]
call fcn.140002d50
nop
cmp dword [rsp + 0x43d58], 0
jl 0x1401add5c
mov eax, dword [rsp + 0x43940]
mov r9d, dword [rsp + 0x43d58]
sub r9d, eax
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x667f8]
lea rcx, [rsp + 0x435c0]
call fcn.140002230
mov qword [rsp + 0x66b50], rax
mov rax, qword [rsp + 0x66b50]
mov qword [rsp + 0x66b58], rax
mov rdx, qword [rsp + 0x66b58]
lea rcx, [rsp + 0x43d50]
call fcn.140002d20
nop
lea rcx, [rsp + 0x667f8]
call fcn.140001470
mov eax, dword [rsp + 0x43d58]
add eax, 1
mov dword [rsp + 0x43940], eax
lea rcx, [rsp + 0x435c0]
call fcn.1400019f0
cmp dword [rsp + 0x43940], eax
jl 0x1401add5a
mov dword [rsp + 0x43940], 0xffffffff
jmp 0x1401addbf
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x66800]
lea rcx, [rsp + 0x435c0]
call fcn.1400069a0
mov qword [rsp + 0x66b60], rax
mov rax, qword [rsp + 0x66b60]
mov qword [rsp + 0x66b68], rax
mov rdx, qword [rsp + 0x66b68]
lea rcx, [rsp + 0x43d50]
call fcn.140002d20
nop
lea rcx, [rsp + 0x66800]
call fcn.140001470
mov dword [rsp + 0x43940], 0xffffffff
lea rdx, [0x140244bc4]
lea rcx, [rsp + 0x43d50]
call fcn.140006970
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d8]
call fcn.14000f190
lea rcx, [rsp + 0x43d50]
call fcn.1400012c0
mov rdx, rax
lea rcx, [rsp + 0x66810]
call fcn.140002d80
mov qword [rsp + 0x66b70], rax
mov rax, qword [rsp + 0x66b70]
mov qword [rsp + 0x66b78], rax
mov eax, dword [rsp + 0x66974]
or eax, 1
mov dword [rsp + 0x66974], eax
mov rcx, qword [rsp + 0x66b78]
call fcn.140002e30
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x1401ade6a
lea rcx, [rsp + 0x435d0]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ade6a
mov dword [rsp + 0x66b80], 1
jmp 0x1401ade75
mov dword [rsp + 0x66b80], 0
movzx eax, byte [rsp + 0x66b80]
mov byte [rsp + 0x66808], al
mov eax, dword [rsp + 0x66974]
and eax, 1
test eax, eax
je 0x1401adea7
and dword [rsp + 0x66974], 0xfffffffe
lea rcx, [rsp + 0x66810]
call fcn.140002e10
movzx eax, byte [rsp + 0x66808]
test eax, eax
je 0x1401adec8
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d0]
call fcn.140002d20
lea rcx, [rsp + 0x43d50]
call fcn.1400019f0
cmp eax, 0xc
jne 0x1401ae479
lea rcx, [rsp + 0x435b8]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae479
lea rcx, [rsp + 0x43d50]
call fcn.1400068b0
mov dword [rsp + 0x43d5c], 0
mov dword [rsp + 0x43d60], 0
jmp 0x1401adf2c
mov eax, dword [rsp + 0x43d60]
add eax, 1
mov dword [rsp + 0x43d60], eax
cmp dword [rsp + 0x43d60], 0xc
jge 0x1401adfcf
mov r9d, 1
mov r8d, dword [rsp + 0x43d60]
lea rdx, [rsp + 0x66820]
lea rcx, [rsp + 0x43d50]
call fcn.140002230
mov qword [rsp + 0x66b88], rax
lea rdx, [0x140245b30]
mov rcx, qword [rsp + 0x66b88]
call fcn.1400067d0
test eax, eax
jge 0x1401adf8a
mov dword [rsp + 0x66b90], 1
jmp 0x1401adf95
mov dword [rsp + 0x66b90], 0
movzx eax, byte [rsp + 0x66b90]
mov byte [rsp + 0x66818], al
lea rcx, [rsp + 0x66820]
call fcn.140001470
movzx edx, byte [rsp + 0x66818]
test edx, edx
je 0x1401adfca
mov dword [rsp + 0x43d5c], 1
jmp 0x1401adfcf
jmp 0x1401adf1b
cmp dword [rsp + 0x43d5c], 0
jne 0x1401ae479
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435b8]
call fcn.140002d20
lea rcx, [rsp + 0x43d68]
call fcn.140002d50
nop
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66828]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66b98], rax
mov rax, qword [rsp + 0x66b98]
mov qword [rsp + 0x66ba0], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66830]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66ba8], rax
mov rax, qword [rsp + 0x66ba8]
mov qword [rsp + 0x66bb0], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66838]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66bb8], rax
mov rax, qword [rsp + 0x66bb8]
mov qword [rsp + 0x66bc0], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66840]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66bc8], rax
mov rax, qword [rsp + 0x66bc8]
mov qword [rsp + 0x66bd0], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66848]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66bd8], rax
mov rax, qword [rsp + 0x66bd8]
mov qword [rsp + 0x66be0], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x66850]
lea rcx, [rsp + 0x435b8]
call fcn.140002230
mov qword [rsp + 0x66be8], rax
mov rax, qword [rsp + 0x66be8]
mov qword [rsp + 0x66bf0], rax
lea r8, [0x140244db4]
mov rdx, qword [rsp + 0x66bf0]
lea rcx, [rsp + 0x66858]
call fcn.1400010b0
mov qword [rsp + 0x66bf8], rax
mov rax, qword [rsp + 0x66bf8]
mov qword [rsp + 0x66c00], rax
mov r8, qword [rsp + 0x66be0]
mov rdx, qword [rsp + 0x66c00]
lea rcx, [rsp + 0x66860]
call fcn.140006b70
mov qword [rsp + 0x66c08], rax
mov rax, qword [rsp + 0x66c08]
mov qword [rsp + 0x66c10], rax
lea r8, [0x140244d4c]
mov rdx, qword [rsp + 0x66c10]
lea rcx, [rsp + 0x66868]
call fcn.1400010b0
mov qword [rsp + 0x66c18], rax
mov rax, qword [rsp + 0x66c18]
mov qword [rsp + 0x66c20], rax
mov r8, qword [rsp + 0x66bd0]
mov rdx, qword [rsp + 0x66c20]
lea rcx, [rsp + 0x66870]
call fcn.140006b70
mov qword [rsp + 0x66c28], rax
mov rax, qword [rsp + 0x66c28]
mov qword [rsp + 0x66c30], rax
lea r8, [0x140244cfc]
mov rdx, qword [rsp + 0x66c30]
lea rcx, [rsp + 0x66878]
call fcn.1400010b0
mov qword [rsp + 0x66c38], rax
mov rax, qword [rsp + 0x66c38]
mov qword [rsp + 0x66c40], rax
mov r8, qword [rsp + 0x66bc0]
mov rdx, qword [rsp + 0x66c40]
lea rcx, [rsp + 0x66880]
call fcn.140006b70
mov qword [rsp + 0x66c48], rax
mov rax, qword [rsp + 0x66c48]
mov qword [rsp + 0x66c50], rax
lea r8, [0x140244c5c]
mov rdx, qword [rsp + 0x66c50]
lea rcx, [rsp + 0x66888]
call fcn.1400010b0
mov qword [rsp + 0x66c58], rax
mov rax, qword [rsp + 0x66c58]
mov qword [rsp + 0x66c60], rax
mov r8, qword [rsp + 0x66bb0]
mov rdx, qword [rsp + 0x66c60]
lea rcx, [rsp + 0x66890]
call fcn.140006b70
mov qword [rsp + 0x66c68], rax
mov rax, qword [rsp + 0x66c68]
mov qword [rsp + 0x66c70], rax
lea r8, [0x140244be4]
mov rdx, qword [rsp + 0x66c70]
lea rcx, [rsp + 0x66898]
call fcn.1400010b0
mov qword [rsp + 0x66c78], rax
mov rax, qword [rsp + 0x66c78]
mov qword [rsp + 0x66c80], rax
mov r8, qword [rsp + 0x66ba0]
mov rdx, qword [rsp + 0x66c80]
lea rcx, [rsp + 0x668a0]
call fcn.140006b70
mov qword [rsp + 0x66c88], rax
mov rax, qword [rsp + 0x66c88]
mov qword [rsp + 0x66c90], rax
mov rdx, qword [rsp + 0x66c90]
lea rcx, [rsp + 0x43d68]
call fcn.140002d20
nop
lea rcx, [rsp + 0x668a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x66898]
call fcn.140001470
nop
lea rcx, [rsp + 0x66890]
call fcn.140001470
nop
lea rcx, [rsp + 0x66888]
call fcn.140001470
nop
lea rcx, [rsp + 0x66880]
call fcn.140001470
nop
lea rcx, [rsp + 0x66878]
call fcn.140001470
nop
lea rcx, [rsp + 0x66870]
call fcn.140001470
nop
lea rcx, [rsp + 0x66868]
call fcn.140001470
nop
lea rcx, [rsp + 0x66860]
call fcn.140001470
nop
lea rcx, [rsp + 0x66858]
call fcn.140001470
nop
lea rcx, [rsp + 0x66850]
call fcn.140001470
nop
lea rcx, [rsp + 0x66848]
call fcn.140001470
nop
lea rcx, [rsp + 0x66840]
call fcn.140001470
nop
lea rcx, [rsp + 0x66838]
call fcn.140001470
nop
lea rcx, [rsp + 0x66830]
call fcn.140001470
nop
lea rcx, [rsp + 0x66828]
call fcn.140001470
lea rdx, [rsp + 0x43d68]
lea rcx, [rsp + 0x435b8]
call fcn.140002d20
nop
lea rcx, [rsp + 0x43d68]
call fcn.140001470
nop
lea rcx, [rsp + 0x43d50]
call fcn.140001470
jmp 0x1401adc71
lea rcx, [rsp + 0x435d0]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae4e9
lea rcx, [rsp + 0x435d8]
call fcn.140077764
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001470
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001470
nop
lea rcx, [rsp + 0x43948]
call fcn.140001470
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001470
jmp 0x1401adb47
lea rcx, [rsp + 0x435d8]
call fcn.14000f920
cmp rax, 3
jl 0x1401ae59f
lea rcx, [rsp + 0x43948]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae533
xor edx, edx
lea rcx, [rsp + 0x435d8]
call fcn.140021970
mov rdx, rax
lea rcx, [rsp + 0x43948]
call fcn.140002d20
lea rcx, [rsp + 0x435d0]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae569
mov edx, 1
lea rcx, [rsp + 0x435d8]
call fcn.140021970
mov rdx, rax
lea rcx, [rsp + 0x435d0]
call fcn.140002d20
lea rcx, [rsp + 0x435b8]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae59f
mov edx, 2
lea rcx, [rsp + 0x435d8]
call fcn.140021970
mov rdx, rax
lea rcx, [rsp + 0x435b8]
call fcn.140002d20
lea rcx, [rsp + 0x43600]
call fcn.1401cd320
nop
mov dword [rsp + 0x43798], 0
lea rcx, [rsp + 0x43600]
call fcn.1401d1f50
lea rcx, [rsp + 0x43948]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ae631
lea rcx, [rsp + 0x43600]
call fcn.140005d50
nop
lea rcx, [rsp + 0x435d8]
call fcn.140077764
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001470
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001470
nop
lea rcx, [rsp + 0x43948]
call fcn.140001470
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001470
jmp 0x1401adb47
lea rcx, [rsp + 0x437a0]
lea rdx, [rsp + 0x43948]
call fcn.140002d20
lea rcx, [rsp + 0x437b8]
lea rdx, [rsp + 0x435d0]
call fcn.140002d20
lea rcx, [rsp + 0x437c8]
lea rdx, [rsp + 0x435b8]
call fcn.140002d20
lea rcx, [rsp + 0x437c8]
call fcn.1400068b0
lea rcx, [rsp + 0x43600]
call fcn.1401b8b50
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000f500
mov dword [rsp + 0x435c8], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x43798]
mov r8d, dword [rsp + 0x435c8]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a6370
nop
lea rcx, [rsp + 0x43600]
call fcn.140005d50
nop
lea rcx, [rsp + 0x435d8]
call fcn.140077764
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001470
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001470
nop
lea rcx, [rsp + 0x43948]
call fcn.140001470
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001470
jmp 0x1401adb47
mov rcx, qword [rsp + 0x435b0]
call fcn.1400a9ff0
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245b58]
call fcn.1400ef150
lea rdx, [rsp + 0x668b0]
lea rcx, [rsp + 0xb50]
call fcn.14008ca5c
mov qword [rsp + 0x66c98], rax
lea rdx, str.nxd.ini
mov rcx, qword [rsp + 0x66c98]
call fcn.140006050
test eax, eax
jne 0x1401ae79c
mov dword [rsp + 0x66ca0], 1
jmp 0x1401ae7a7
mov dword [rsp + 0x66ca0], 0
movzx eax, byte [rsp + 0x66ca0]
mov byte [rsp + 0x668a8], al
lea rcx, [rsp + 0x668b0]
call fcn.140001470
movzx edx, byte [rsp + 0x668a8]
test edx, edx
je 0x1401ae9b7
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x43d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x43d70]
mov qword [rsp + 0x63d70], rdx
mov rax, qword [rsp + 0x63d70]
movzx eax, word [rax]
test eax, eax
je 0x1401ae993
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x640c0]
lea r8, [0x140244dcc]
lea rdx, [0x140245b70]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.1400012c0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x648c0]
lea r8, [0x140244ee4]
lea rdx, [0x140245b78]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x63d80]
call fcn.1401cd320
nop
mov dword [rsp + 0x63f18], 0
lea rcx, [rsp + 0x63d80]
call fcn.1401d1f50
lea rcx, [rsp + 0x63f20]
mov rdx, qword [rsp + 0x63d70]
call fcn.140002060
lea rcx, [rsp + 0x63f38]
lea rdx, [rsp + 0x648c0]
call fcn.140002060
lea rcx, [rsp + 0x63f48]
lea rdx, [rsp + 0x640c0]
call fcn.140002060
lea rcx, [rsp + 0x63f48]
call fcn.1400068b0
lea rcx, [rsp + 0x63d80]
call fcn.1401b8b50
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000f500
mov dword [rsp + 0x63d78], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x63f18]
mov r8d, dword [rsp + 0x63d78]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a6370
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x63d70]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x63d70], rax
lea rcx, [rsp + 0x63d80]
call fcn.140005d50
jmp 0x1401ae806
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245b80]
call fcn.1400ef150
nop
lea rcx, [rsp + 0xb40]
call fcn.140001470
nop
lea rcx, [rsp + 0xb50]
call fcn.14008b530
xor eax, eax
jmp 0x1401af5f4
xor edx, edx
lea rcx, [rsp + 0x650c0]
call fcn.140143140
nop
lea rcx, [rsp + 0x650c0]
call fcn.1400819f8
nop
lea rcx, [rsp + 0x650c0]
call fcn.140142f90
xor eax, eax
jmp 0x1401af5f4
xor edx, edx
lea rcx, [rsp + 0x65390]
call fcn.140141d50
nop
lea rcx, [rsp + 0x65390]
call fcn.1400819f8
nop
lea rcx, [rsp + 0x65390]
call fcn.140141d00
xor eax, eax
jmp 0x1401af5f4
lea rcx, [rsp + 0x668b8]
call fcn.140001000
mov qword [rsp + 0x66ca8], rax
mov rax, qword [rsp + 0x66ca8]
mov qword [rsp + 0x66cb0], rax
lea rcx, [rsp + 0x668c0]
call fcn.140001000
mov qword [rsp + 0x66cb8], rax
mov rax, qword [rsp + 0x66cb8]
mov qword [rsp + 0x66cc0], rax
lea r8, str.CCVHDUsb.exe__www.ccboot.com
mov rdx, qword [rsp + 0x66cc0]
lea rcx, [rsp + 0x668c8]
call fcn.1400010b0
mov qword [rsp + 0x66cc8], rax
mov rax, qword [rsp + 0x66cc8]
mov qword [rsp + 0x66cd0], rax
mov rcx, qword [rsp + 0x66cb0]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0x66cd0]
call fcn.1400012c0
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1400048c0
nop
lea rcx, [rsp + 0x668c8]
call fcn.140001470
nop
lea rcx, [rsp + 0x668c0]
call fcn.140001470
nop
lea rcx, [rsp + 0x668b8]
call fcn.140001470
xor eax, eax
jmp 0x1401af5f4
lea rcx, [rsp + 0x668d0]
call fcn.140001000
mov qword [rsp + 0x66cd8], rax
mov rax, qword [rsp + 0x66cd8]
mov qword [rsp + 0x66ce0], rax
lea r8, [0x140245bc8]
mov rdx, qword [rsp + 0x66ce0]
lea rcx, [rsp + 0x65698]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x668d0]
call fcn.140001470
lea rcx, [rsp + 0x65698]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401aeb9b
lea rcx, [rsp + 0x65698]
call fcn.1400012c0
mov rcx, rax
call fcn.140004b80
lea rcx, [rsp + 0x656a0]
call fcn.140002d50
nop
lea rcx, [rsp + 0x668d8]
call fcn.14000f6f0
lea r8, str._Y_m_d_H_M_S
lea rdx, [rsp + 0x668e0]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0x66ce8], rax
mov rax, qword [rsp + 0x66ce8]
mov qword [rsp + 0x66cf0], rax
mov r9, qword [rsp + 0x66cf0]
mov r9, qword [r9]
mov r8, qword [rsp + 0x65698]
lea rdx, str._sccboot_config__s.zip
lea rcx, [rsp + 0x656a0]
call fcn.140002be0
nop
lea rcx, [rsp + 0x668e0]
call fcn.140001470
lea rcx, [rsp + 0x656a0]
call fcn.1400012c0
mov r9, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Settings_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
lea r8, [0x140245c28]
xor edx, edx
lea rcx, [rsp + 0x656b0]
call fcn.14008b628
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008c4e8
cmp rax, 1
je 0x1401aecc1
mov dword [rsp + 0x668e8], 0
lea rcx, [rsp + 0x656b0]
call fcn.14008b530
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x65698]
call fcn.140001470
mov eax, dword [rsp + 0x668e8]
jmp 0x1401af5f4
mov dword [rsp + 0x65690], 0
mov edx, 0xa
lea rcx, [rsp + 0x65650]
call fcn.14008d720
nop
lea rcx, [rsp + 0x668f0]
call fcn.140001000
mov qword [rsp + 0x66cf8], rax
mov rax, qword [rsp + 0x66cf8]
mov qword [rsp + 0x66d00], rax
lea r8, [0x140245c30]
mov rdx, qword [rsp + 0x66d00]
lea rcx, [rsp + 0x668f8]
call fcn.1400010b0
mov qword [rsp + 0x66d08], rax
mov rax, qword [rsp + 0x66d08]
mov qword [rsp + 0x66d10], rax
mov rdx, qword [rsp + 0x66d10]
lea rcx, [rsp + 0x65650]
call fcn.14008d90c
nop
lea rcx, [rsp + 0x668f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x668f0]
call fcn.140001470
lea rcx, [rsp + 0x66900]
call fcn.140001000
mov qword [rsp + 0x66d18], rax
mov rax, qword [rsp + 0x66d18]
mov qword [rsp + 0x66d20], rax
lea r8, str.db.xml
mov rdx, qword [rsp + 0x66d20]
lea rcx, [rsp + 0x66908]
call fcn.1400010b0
mov qword [rsp + 0x66d28], rax
mov rax, qword [rsp + 0x66d28]
mov qword [rsp + 0x66d30], rax
mov rdx, qword [rsp + 0x66d30]
lea rcx, [rsp + 0x65650]
call fcn.14008d90c
nop
lea rcx, [rsp + 0x66908]
call fcn.140001470
nop
lea rcx, [rsp + 0x66900]
call fcn.140001470
lea rdx, [rsp + 0x65688]
lea rcx, [rsp + 0x656b0]
call fcn.14008c6a0
nop
lea rcx, [rsp + 0x66918]
call fcn.140001000
mov qword [rsp + 0x66d38], rax
mov rax, qword [rsp + 0x66d38]
mov qword [rsp + 0x66d40], rax
lea rcx, [rsp + 0x65688]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0x66d40]
call fcn.1400012c0
lea r9, [rsp + 0x65690]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x65650]
call fcn.1401847c0
test eax, eax
jne 0x1401aee77
mov dword [rsp + 0x66d48], 1
jmp 0x1401aee82
mov dword [rsp + 0x66d48], 0
movzx eax, byte [rsp + 0x66d48]
mov byte [rsp + 0x66910], al
lea rcx, [rsp + 0x66918]
call fcn.140001470
movzx edx, byte [rsp + 0x66910]
test edx, edx
je 0x1401aef1a
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Backup_of_settings_has_failed_
call fcn.1400ef150
mov dword [rsp + 0x66920], 0
lea rcx, [rsp + 0x65688]
call fcn.140001470
nop
lea rcx, [rsp + 0x65650]
call fcn.14008d8c0
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008b530
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x65698]
call fcn.140001470
mov eax, dword [rsp + 0x66920]
jmp 0x1401af5f4
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Backup_of_settings_was_successful_
call fcn.1400ef150
nop
lea rcx, [rsp + 0x65688]
call fcn.140001470
nop
lea rcx, [rsp + 0x65650]
call fcn.14008d8c0
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008b530
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x65698]
call fcn.140001470
xor eax, eax
jmp 0x1401af5f4
lea rcx, [rsp + 0x66928]
call fcn.140001000
mov qword [rsp + 0x66d50], rax
mov rax, qword [rsp + 0x66d50]
mov qword [rsp + 0x66d58], rax
lea r8, [0x140245ce8]
mov rdx, qword [rsp + 0x66d58]
lea rcx, [rsp + 0x65a70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x66928]
call fcn.140001470
lea rcx, [rsp + 0x65a70]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401af02c
lea rcx, [rsp + 0x66930]
call fcn.140001000
mov qword [rsp + 0x66d60], rax
mov rax, qword [rsp + 0x66d60]
mov qword [rsp + 0x66d68], rax
mov rdx, qword [rsp + 0x66d68]
lea rcx, [rsp + 0x65a70]
call fcn.140002d20
nop
lea rcx, [rsp + 0x66930]
call fcn.140001470
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Restore_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140245cf8]
mov edx, 1
lea rcx, [rsp + 0x65a80]
call fcn.14008b628
nop
lea rcx, [rsp + 0x65a70]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0x65a80]
call fcn.140088d30
mov qword [rax + 0x50], rdi
lea rcx, [rsp + 0x65a80]
call fcn.14008c4e8
cmp rax, 1
je 0x1401af0dc
mov dword [rsp + 0x66938], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008b530
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001470
mov eax, dword [rsp + 0x66938]
jmp 0x1401af5f4
lea rdx, [rsp + 0x66940]
lea rcx, [rsp + 0x65a80]
call fcn.14008c6a0
mov qword [rsp + 0x66d70], rax
mov rax, qword [rsp + 0x66d70]
mov qword [rsp + 0x66d78], rax
mov rcx, qword [rsp + 0x66d78]
call fcn.1400012c0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8053
mov edx, 0xffffffff
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
test rax, rax
jne 0x1401af147
mov dword [rsp + 0x66d80], 1
jmp 0x1401af152
mov dword [rsp + 0x66d80], 0
movzx eax, byte [rsp + 0x66d80]
mov byte [rsp + 0x6693c], al
lea rcx, [rsp + 0x66940]
call fcn.140001470
movzx edx, byte [rsp + 0x6693c]
test edx, edx
je 0x1401af1c5
call fcn.1401b7fe0
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Restoring_settings_has_failed_
call fcn.1400ef150
mov dword [rsp + 0x66948], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008b530
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001470
mov eax, dword [rsp + 0x66948]
jmp 0x1401af5f4
call fcn.1401b7fe0
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Restoring_settings_was_successful_
call fcn.1400ef150
nop
lea rcx, [rsp + 0x65a80]
call fcn.14008b530
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001470
xor eax, eax
jmp 0x1401af5f4
lea rcx, [rsp + 0x65e70]
call fcn.1400053a0
nop
lea rcx, [rsp + 0x65e40]
call fcn.14001e700
nop
lea rcx, [rsp + 0x65e80]
call fcn.14001e700
nop
lea rdx, [rsp + 0x65e80]
lea rcx, [rsp + 0x65e40]
call fcn.140117ba0
mov dword [rsp + 0x65eb0], 0
mov dword [rsp + 0x65eb4], 0
jmp 0x1401af269
mov eax, dword [rsp + 0x65eb4]
add eax, 1
mov dword [rsp + 0x65eb4], eax
movsxd rdi, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.140007db0
cmp rdi, rax
jae 0x1401af4b6
movsxd rdx, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.14001e980
mov r8, rax
lea rdx, str.SYSTEMCurrentControlSetEnum_
lea rcx, [rsp + 0x66950]
call fcn.140006c30
mov qword [rsp + 0x66d88], rax
mov rcx, qword [rsp + 0x66d88]
call fcn.1400012c0
mov r9d, 0x20019
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.140005560
test eax, eax
je 0x1401af2f6
mov dword [rsp + 0x66d90], 1
jmp 0x1401af301
mov dword [rsp + 0x66d90], 0
movzx eax, byte [rsp + 0x66d90]
mov byte [rsp + 0x6694c], al
lea rcx, [rsp + 0x66950]
call fcn.140001470
movzx edx, byte [rsp + 0x6694c]
test edx, edx
je 0x1401af32e
jmp 0x1401af258
xor eax, eax
mov word [rsp + 0x65ec0], ax
lea rdi, [rsp + 0x65ec2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x666c0], 0x400
lea r9, [rsp + 0x666c0]
lea r8, [rsp + 0x65ec0]
lea rdx, [0x140245dc8]
lea rcx, [rsp + 0x65e70]
call fcn.140005670
lea rcx, [rsp + 0x65e70]
call fcn.140005430
lea rdx, [rsp + 0x65ec0]
lea rcx, [rsp + 0x66960]
call fcn.140002090
mov qword [rsp + 0x66d98], rax
mov rax, qword [rsp + 0x66d98]
mov qword [rsp + 0x66da0], rax
mov r8, qword [rsp + 0x66da0]
lea rdx, str.SYSTEMCurrentControlSetControlClass_
lea rcx, [rsp + 0x66968]
call fcn.140006c30
mov qword [rsp + 0x66da8], rax
mov rcx, qword [rsp + 0x66da8]
call fcn.1400012c0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.140005560
test eax, eax
je 0x1401af411
mov dword [rsp + 0x66db0], 1
jmp 0x1401af41c
mov dword [rsp + 0x66db0], 0
movzx eax, byte [rsp + 0x66db0]
mov byte [rsp + 0x66958], al
lea rcx, [rsp + 0x66968]
call fcn.140001470
nop
lea rcx, [rsp + 0x66960]
call fcn.140001470
movzx edx, byte [rsp + 0x66958]
test edx, edx
je 0x1401af457
jmp 0x1401af258
mov r9d, 1
lea r8, [0x140244f0c]
lea rdx, [0x140245e30]
lea rcx, [rsp + 0x65e70]
call fcn.140005940
mov r9d, 1
lea r8, [0x140244f34]
lea rdx, str.FlowControl
lea rcx, [rsp + 0x65e70]
call fcn.140005940
lea rcx, [rsp + 0x65e70]
call fcn.140005430
mov dword [rsp + 0x65eb0], 1
jmp 0x1401af258
cmp dword [rsp + 0x65eb0], 0
je 0x1401af5c2
mov r8d, 0xffffffff
mov edx, 0x44
mov ecx, 0x83
call fcn.1400f0ec0
cmp eax, 6
jne 0x1401af5c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x666c8], rax
lea r8, [rsp + 0x666d0]
mov edx, 0x20
mov rcx, qword [rsp + 0x666c8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x666e0], 1
lea r8, [rsp + 0x666d8]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rdx, qword [rsp + 0x666d8]
mov qword [rsp + 0x666e4], rdx
mov dword [rsp + 0x666ec], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x666e0]
xor edx, edx
mov rcx, qword [rsp + 0x666d0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x80020003
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [rsp + 0x66970], 0
lea rcx, [rsp + 0x65e80]
call fcn.140007d80
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007d80
nop
lea rcx, [rsp + 0x65e70]
call fcn.1400053d0
mov eax, dword [rsp + 0x66970]
jmp 0x1401af5f4
lea rcx, [rsp + 0x65e80]
call fcn.140007d80
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007d80
nop
lea rcx, [rsp + 0x65e70]
call fcn.1400053d0
xor eax, eax
jmp 0x1401af5f4
mov eax, 1
mov rcx, qword [rsp + 0x66db8]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x66dc0
pop rdi
ret