Function at 0x1400028d0
Capabilities:
Create thread
Get common file path
Set current directory

Disassembly:
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0xaa0
cmp edx, 0x16
mov r12, rcx
je case.0x140003113.3304
jbe 0x140002930
cmp edx, 0x138
je 0x140003138
cmp edx, 0x312
jne 0x1400030e8
cmp r8w, 0x3e9
je 0x1400031f0
cmp r8w, 0x3ea
jne case.0x140003113.3304
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
add rsp, 0xaa0
pop rbx
pop rdi
pop r12
pop r13
pop r14
ret
cmp edx, 2
je 0x140003168
cmp edx, 0x10
je 0x140003168
cmp edx, 1
jne 0x140003118
lea r13, [0x14000f560]
mov ecx, 0x104
lea r14, str.static
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [0x14000f680]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r13, [rsp + 0x70]
mov rcx, r12
call dbg.SetupTrayIcon(HWND__*)
mov rbx, qword [sym.imp.USER32.dll_RegisterHotKey]
mov r9d, 0x53
mov rcx, r12
mov r8d, 0xb
mov edx, 0x3e9
call rbx
mov r9d, 0x48
mov edx, 0x3ea
mov rcx, r12
mov r8d, 0xb
call rbx
mov r8d, pe_nt_image_headers64
mov edx, 0xffffffec
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowLongA]
xor ecx, ecx
mov r9d, 0x50400000
mov rdx, r14
mov rbx, qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x14000c05f]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0xa
call rbx
mov r9d, 0x50400000
xor ecx, ecx
mov rdx, r14
lea r8, [0x14000c05f]
mov qword [0x14000f520], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0xaa
call rbx
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x201
mov qword [0x14000f518], rax
mov qword [rsp + 0x70], 0
call sym.memset
mov edx, 1
mov rcx, r13
call dbg.GetMythwarePathFromRegedit(char*, int)
mov qword [rsp + 0x50], r12
mov r9d, 0x50400000
cmp eax, 1
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0x3c
mov dword [rsp + 0x30], 0x136
mov dword [rsp + 0x28], 0xfa
mov dword [rsp + 0x20], 0xa
je 0x1400031d8
lea r8, [0x14000c0b9]
mov rdx, r14
xor ecx, ecx
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r14
mov qword [rsp + 0x50], r12
lea r13, str.button
mov qword [0x14000f510], rax
lea r8, str.from_liu_zhou
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], 0x136
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c0d8]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0xce5
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0xaa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c0e8]
mov qword [0x14000f508], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xce7
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, str.taskill
mov qword [0x14000f4f0], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xcf1
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 0xaa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c011]
mov qword [0x14000f4e8], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xce9
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x5a
mov dword [rsp + 0x20], 0xaa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c101]
mov qword [0x14000f4e0], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xcf0
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0xaa
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c114]
mov qword [0x14000f4b8], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xcea
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0xaa
mov dword [rsp + 0x20], 0xaa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c121]
mov qword [0x14000f4d8], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xcef
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x5a
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c12a]
mov qword [0x14000f500], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xce6
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r13
lea r8, [0x14000c133]
mov qword [0x14000f4f8], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xcf2
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0xd2
mov dword [rsp + 0x20], 0xa
call rbx
xor ecx, ecx
mov r9d, 0x50000003
mov rdx, r13
lea r8, [0x14000c05f]
mov qword [0x14000f4b0], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0xceb
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0xf
mov dword [rsp + 0x30], 0xf
mov dword [rsp + 0x28], 0xd2
mov dword [rsp + 0x20], 0xaa
call rbx
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r14
lea r8, [0x14000c146]
mov qword [0x14000f4d0], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], 0xd2
mov dword [rsp + 0x20], 0xbe
call rbx
xor ecx, ecx
mov r9d, 0x50000003
mov rdx, r13
lea r8, [0x14000c05f]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0xcec
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0xf
mov dword [rsp + 0x30], 0xf
mov dword [rsp + 0x28], 0xe6
mov dword [rsp + 0x20], 0xaa
call rbx
xor r9d, r9d
mov r8d, 1
mov edx, 0xf1
mov rcx, rax
mov qword [0x14000f4c8], rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, r14
lea r8, [0x14000c151]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], 0xe6
mov dword [rsp + 0x20], 0xbe
call rbx
mov r9d, 0x1f0003
mov r8d, 1
xor ecx, ecx
lea rdx, str.IsSetKeyboardHook
call qword [sym.imp.KERNEL32.dll_CreateEventExA]
mov rcx, rax
mov qword [0x14000f528], rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xfffffff9
lea rax, [0x14000c16c]
mov ecx, 0xfffffff1
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x190
call qword [sym.imp.GDI32.dll_CreateFontA]
xor r8d, r8d
mov rcx, r12
lea rdx, [dbg.SetWindowFont(HWND__*, long long)]
mov qword [0x14000f498], rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rbx, qword [sym.imp.msvcrt.dll__beginthreadex]
xor edx, edx
xor ecx, ecx
mov r9, r12
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea r8, [dbg.IsStart(void*)]
call rbx
mov dword [rsp + 0x20], 0
mov r9, r12
xor edx, edx
mov qword [0x14000f540], rax
lea r8, [dbg.KeyboardHook(void*)]
xor ecx, ecx
mov qword [rsp + 0x28], 0
call rbx
mov qword [0x14000f538], rax
jmp case.0x140003113.3304
cmp edx, 0x111
jne 0x140003118
sub r8w, 0xce5
cmp r8w, 0xd
ja case.0x140003113.3304
lea rdx, [0x14000c1dc]
movzx r8d, r8w
movsxd rax, dword [rdx + r8*4]
add rax, rdx
jmp rax
mov rcx, r12
add rsp, 0xaa0
pop rbx
pop rdi
pop r12
pop r13
pop r14
jmp qword [sym.imp.USER32.dll_DefWindowProcA]
mov rcx, r8
mov edx, 1
call qword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, 5
add rsp, 0xaa0
pop rbx
pop rdi
pop r12
pop r13
pop r14
jmp qword [sym.imp.GDI32.dll_GetStockObject]
lea rdx, [0x14000f280]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14000f540]
call rbx
mov rcx, qword [0x14000f538]
call rbx
lea rcx, [0x14000f680]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rbx, qword [sym.imp.USER32.dll_UnregisterHotKey]
mov rcx, r12
mov edx, 0x3e9
call rbx
mov edx, 0x3ea
mov rcx, r12
call rbx
mov rcx, qword [0x14000f498]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x140003113.3304
mov r8, r13
mov rdx, r14
xor ecx, ecx
call rbx
jmp 0x140002b07
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x140003113.3304
lea rcx, str.taskkill__f__im_studentmain.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
ja case.0x140003113.3304
movabs rax, 0xd66c6c696b736174
mov dword [0x14000f280], 0x210
mov qword [0x14000f330], rax
movabs rax, 0x21dcb0a7cad0d0b4
mov dword [0x14000f294], 0x10
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f338], rax
mov byte [0x14000f340], 0
nop dword [rax]
lea rdx, [0x14000f280]
mov ecx, 1
mov dword [0x14000f434], 0xbecae1cc
mov byte [0x14000f438], 0
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
jmp case.0x140003113.3304
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0xa20
mov qword [rsp + 0x70], 0
call sym.memset
lea r12, [rsp + 0x70]
mov rcx, r12
call dbg.GetMythwarePasswordFromRegedit(char*)
mov dword [0x14000f280], 0x210
mov dword [0x14000f294], 0x10
test eax, eax
movabs rax, 0xebc2dcc3c6d6b4b8
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f330], rax
je 0x140003695
lea rdx, [0x14000f280]
mov ecx, 1
mov dword [0x14000f338], 0xa6b9c9b3
mov byte [0x14000f33c], 0
mov dword [0x14000f434], 0xbecae1cc
mov byte [0x14000f438], 0
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov rcx, r12
call dbg.SetClipboard(char const*)
jmp case.0x140003113.3304
xor eax, eax
mov ecx, 0x1f
xor edx, edx
mov qword [rsp + 0x70], 0
lea rdi, [rsp + 0x78]
rep stosq qword [rdi], rax
lea r12, [rsp + 0x70]
mov rcx, r12
mov dword [rdi], 0
mov byte [rdi + 4], 0
movabs rdi, 0x6e776f6474756853
call dbg.GetMythwarePathFromRegedit(char*, int)
mov rcx, r12
call sym.strlen
lea rcx, str.sdpath____s
mov rdx, r12
add rax, r12
mov qword [rax], rdi
mov dword [rax + 8], 0x6578652e
mov byte [rax + 0xc], 0
call dbg.printf(char const*, ::)
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x14000f280], 0x210
mov dword [0x14000f294], 0x10
test eax, eax
movabs rax, 0x74756853fdb3bec9
mov qword [0x14000f330], rax
movabs rax, 0x6578652e6e776f64
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f338], rax
je 0x1400036ab
movabs rax, 0xa6b9c9b3febcc4ce
mov byte [0x14000f348], 0
mov qword [0x14000f340], rax
jmp 0x140003270
lea r12, [0x14000f680]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x14000f160]
xor edx, edx
call dbg.SuspendProcess(unsigned long, int)
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140003113.3304
call dbg.UseNtsd()
lea rcx, str.ntsd__c_q__pn_studentmain.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
ja case.0x140003113.3304
movabs rax, 0xd0d0b4d66473746e
mov r8d, 0x21
mov dword [0x14000f280], 0x210
mov dword [0x14000f294], 0x10
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f330], rax
mov dword [0x14000f338], 0xdcb0a7ca
mov word [0x14000f33c], r8w
jmp 0x140003270
lea r12, [rsp + 0x70]
mov r8d, 0x208
mov rcx, qword [0x14000f510]
movabs rdi, 0x4d746e6564757453
mov rdx, r12
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, r12
call sym.strlen
xor edx, edx
mov rcx, r12
add rax, r12
mov qword [rax], rdi
movabs rdi, 0x6578652e6e6961
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
ja case.0x140003113.3304
movabs rax, 0xf2d3abbcf4c6d8d6
mov edx, 0x21
mov dword [0x14000f280], 0x210
mov dword [0x14000f294], 0x10
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f330], rax
mov dword [0x14000f338], 0xdcb0a7ca
mov word [0x14000f33c], dx
jmp 0x140003270
lea r12, [0x14000f680]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x14000f160]
mov edx, 1
call dbg.SuspendProcess(unsigned long, int)
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140003113.3304
lea rcx, str.mythware_super_password
call dbg.SetClipboard(char const*)
mov ecx, 0xffffebc2
movabs rax, 0xf2cdc6d6b4b8d1d2
mov dword [0x14000f280], 0x210
mov dword [0x14000f294], 0x10
mov dword [0x14000f430], 0
mov dword [0x14000f474], 1
mov qword [0x14000f330], rax
mov dword [0x14000f338], 0xdcc3dcc4
mov word [0x14000f33c], cx
mov byte [0x14000f33e], 0
jmp 0x140003270
mov rcx, qword [0x14000f4a8]
xor r8d, r8d
lea rdx, [dbg.EnumChildWindowsProc(HWND__*, long long)]
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp case.0x140003113.3304
lea rcx, [0x14000c1ab]
mov edx, 0x111
call dbg.printf(char const*, ::)
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf2
mov rcx, qword [0x14000f4d0]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14000f528]
cmp rax, 1
je 0x140003733
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp case.0x140003113.3304
mov dword [0x14000f338], 0xdcb0a7ca
mov byte [0x14000f33c], 0
jmp 0x140003270
movabs rax, 0xdcb0a7cafebcc4ce
mov byte [0x14000f376], 0
mov qword [0x14000f340], rax
movabs rax, 0xf2bbfebcc4ceaca3
mov qword [0x14000f348], rax
movabs rax, 0xbec9bbb1d1d2edd0
mov qword [0x14000f350], rax
movabs rax, 0xa2b3f2bbaca3fdb3
mov qword [0x14000f358], rax
movabs rax, 0xaacebbbbd0c7d4ca
mov qword [0x14000f360], rax
movabs rax, 0xa8c8b1d4edc0dcb9
mov qword [0x14000f368], rax
mov eax, 0xffffd4ca
mov dword [0x14000f370], 0xd8d6decf
mov word [0x14000f374], ax
jmp 0x140003270
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x140003113.3304
imul r13d, dword [rsi + 0x64], 0x646e6957
outsd dx, dword [rsi]
ja 0x140022f66
add byte [rdx], dl
bndmov bnd1, xmmword [rbp + 0x11]
add byte [rax], al
invalid
invalid
je case.0x1400023d1.2
jne 0x14002379b
je 0x1400237a3
outsd dx, dword [rsi]
outsb dx, byte [rsi]
pop rdi
xor byte [rax], al
add dword [rdi + 0x37], ebp
add byte [rax], al
and dword [rdi + 0x5f], ebx
pop rdi
pop rdi
imul ebp, dword [rsi + 0x69], 0x6c616974
imul edi, dword [rdx + 0x65], 0xa00705f
add eax, dword [rcx]
jl 0x14002375a
add byte [rax], al
and dword [rdi + 0x5f], ebx
add byte [rcx], ah
pop rdi
pop rdi
jo 0x1400237d2
imul ebp, dword [rdi + 0x72], 0x797469
or al, byte [rbx]
add dword [rcx + rax], edi
add byte [rax], al
invalid
add byte [rax], al
add byte [rdi], bl
add byte gs:[rcx], al
int 2
add eax, dword fs:[rax]
add byte [rsi - 0x46000000], bh
add byte [rax], al
add byte [rcx], bl
outsb dx, byte [rsi]
push rbx
push 0x6d43776f
add byte fs:[rcx], al
int 2
push rdi
jl 0x1400237f5
add byte [rax], al
fiadd dword [rax]
add byte [rax], al
add dl, bl
add byte [rax], al
add dh, dl
add byte [rax], al
add byte [rdx], bl
ja 0x140023864
add byte [rcx], al
fld dword [rdx]
or eax, 0x15a0
add edx, dword [rcx + 0x68167ef0]
ja 0x140023880
add byte fs:[rcx], al
fiadd dword [rdx]
invalid
add byte [rax], al
add byte [rax + 0x29], ah
add byte [rax], al
add esi, dword [rdx + 0x37]
add byte [rax + 1], al
add byte [rax], al
add bh, dh
invalid
jge 0x140023882
add dword [rcx], eax
push rcx
add bh, byte [rsi]
add byte [rbx], al
cwde
invalid