Function at 0x1401abc60
Capabilities:
Check if file exists
Create process on windows
Manipulate boot configuration
Read .ini file
Shutdown system

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x66dc0
call fcn.1401d4c90
sub rsp, rax
mov qword [rsp + 0x66978], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0x66db8], rax
mov dword [rsp + 0x66974], 0
mov rax, qword [rsp + 0x66dd8]
mov qword [rsp + 0x66980], rax
cmp qword [rsp + 0x66980], 0x808b
ja 0x1401abd35
cmp qword [rsp + 0x66980], 0x808b
je 0x1401abf43
cmp qword [rsp + 0x66980], 0x4cb
je 0x1401abea3
cmp qword [rsp + 0x66980], 0x8004
je 0x1401abd94
cmp qword [rsp + 0x66980], 0x8064
je 0x1401abf75
cmp qword [rsp + 0x66980], 0x8069
je 0x1401ada39
cmp qword [rsp + 0x66980], 0x806f
je 0x1401ada6b
jmp 0x1401ae64f
cmp qword [rsp + 0x66980], 0x80a0
je 0x1401abeaa
cmp qword [rsp + 0x66980], 0x80b7
je 0x1401ada9d
cmp qword [rsp + 0x66980], 0x814e
je 0x1401adb7d
cmp qword [rsp + 0x66980], 0x814f
je 0x1401adfdb
cmp qword [rsp + 0x66980], 0x815a
je 0x1401ae261
jmp 0x1401ae64f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7a
lea rcx, [rsp + 0x50]
call fcn.1401484b0
nop
lea rcx, [rsp + 0x50]
call fcn.140089b1c
cmp rax, 1
jne 0x1401abe92
lea rdx, [0x140244cb8]
lea rcx, [rsp + 0x666f0]
call fcn.1400eeb90
mov qword [rsp + 0x66988], rax
mov rax, qword [rsp + 0x66988]
mov qword [rsp + 0x66990], rax
lea rdx, [0x140244ca8]
mov rcx, qword [rsp + 0x66990]
call fcn.140006d90
movzx eax, al
test eax, eax
je 0x1401abe12
mov dword [rsp + 0x66998], 0x9b
jmp 0x1401abe1d
mov dword [rsp + 0x66998], 0x66
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0x220
mov edx, dword [rsp + 0x66998]
call fcn.1400efe00
nop
lea rcx, [rsp + 0x666f0]
call fcn.140001490
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
mov edx, 0x6a
call fcn.1400efb90
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xe70
mov edx, 0xd1
call fcn.1400efb90
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xf18
mov edx, 0xd0
call fcn.1400efb90
nop
lea rcx, [rsp + 0x50]
call fcn.140147400
xor eax, eax
jmp 0x1401ae654
xor eax, eax
jmp 0x1401ae654
lea rcx, [rsp + 0x666f8]
call fcn.140001000
mov qword [rsp + 0x669a0], rax
mov rax, qword [rsp + 0x669a0]
mov qword [rsp + 0x669a8], rax
lea r8, [0x140244cc8]
mov rdx, qword [rsp + 0x669a8]
lea rcx, [rsp + 0x66700]
call fcn.1400010b0
mov qword [rsp + 0x669b0], rax
mov rcx, qword [rsp + 0x669b0]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x66700]
call fcn.140001490
nop
lea rcx, [rsp + 0x666f8]
call fcn.140001490
xor eax, eax
jmp 0x1401ae654
xor edx, edx
lea rcx, [rsp + 0x910]
call fcn.14016bcd0
nop
lea rcx, [rsp + 0x910]
call fcn.140081900
nop
lea rcx, [rsp + 0x910]
call fcn.14016b850
xor eax, eax
jmp 0x1401ae654
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Account_Files__AccInfo.ini_wks.ini_.csv_nxd.ini_accinfo.ini_wks.ini_.csv_nxd.ini
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0xb50]
call fcn.14008b2e0
nop
lea rcx, [rsp + 0xb50]
call fcn.14008c1a0
cmp rax, 1
je 0x1401abff2
mov dword [rsp + 0x66708], 0
lea rcx, [rsp + 0xb50]
call fcn.14008b1e8
mov eax, dword [rsp + 0x66708]
jmp 0x1401ae654
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0xb50]
call fcn.14008c358
nop
lea rdx, [rsp + 0x66710]
lea rcx, [rsp + 0xb50]
call fcn.14008c714
mov qword [rsp + 0x669b8], rax
lea rdx, str.wks.ini
mov rcx, qword [rsp + 0x669b8]
call fcn.1400060b0
test eax, eax
jne 0x1401ac04a
mov dword [rsp + 0x669c0], 1
jmp 0x1401ac055
mov dword [rsp + 0x669c0], 0
movzx eax, byte [rsp + 0x669c0]
mov byte [rsp + 0x6670c], al
lea rcx, [rsp + 0x66710]
call fcn.140001490
movzx edx, byte [rsp + 0x6670c]
test edx, edx
je 0x1401ac806
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0xf10]
mov qword [rsp + 0x20f10], rdx
mov rax, qword [rsp + 0x20f10]
movzx eax, word [rax]
test eax, eax
je 0x1401ac7e3
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x20f20]
lea r8, [0x140243064]
lea rdx, str.WksName
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x21a60]
lea r8, [0x14024308c]
lea rdx, str.IpAddr
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x21720]
call fcn.1401cc380
nop
mov dword [rsp + 0x218b8], 0
lea rcx, [rsp + 0x21720]
call fcn.1401d0fb0
lea rcx, [rsp + 0x218c0]
lea rdx, [rsp + 0x20f20]
call fcn.1400020a0
lea rcx, [rsp + 0x218d8]
lea rdx, [rsp + 0x21a60]
call fcn.1400020a0
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66718]
call fcn.1400020d0
mov qword [rsp + 0x669c8], rax
mov rax, qword [rsp + 0x669c8]
mov qword [rsp + 0x669d0], rax
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66720]
mov rcx, qword [rsp + 0x669d0]
call fcn.140002270
mov qword [rsp + 0x669d8], rax
mov rax, qword [rsp + 0x669d8]
mov qword [rsp + 0x669e0], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66728]
call fcn.1400020d0
mov qword [rsp + 0x669e8], rax
mov rax, qword [rsp + 0x669e8]
mov qword [rsp + 0x669f0], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66730]
mov rcx, qword [rsp + 0x669f0]
call fcn.140002270
mov qword [rsp + 0x669f8], rax
mov rax, qword [rsp + 0x669f8]
mov qword [rsp + 0x66a00], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66738]
call fcn.1400020d0
mov qword [rsp + 0x66a08], rax
mov rax, qword [rsp + 0x66a08]
mov qword [rsp + 0x66a10], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66740]
mov rcx, qword [rsp + 0x66a10]
call fcn.140002270
mov qword [rsp + 0x66a18], rax
mov rax, qword [rsp + 0x66a18]
mov qword [rsp + 0x66a20], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66748]
call fcn.1400020d0
mov qword [rsp + 0x66a28], rax
mov rax, qword [rsp + 0x66a28]
mov qword [rsp + 0x66a30], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66750]
mov rcx, qword [rsp + 0x66a30]
call fcn.140002270
mov qword [rsp + 0x66a38], rax
mov rax, qword [rsp + 0x66a38]
mov qword [rsp + 0x66a40], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66758]
call fcn.1400020d0
mov qword [rsp + 0x66a48], rax
mov rax, qword [rsp + 0x66a48]
mov qword [rsp + 0x66a50], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66760]
mov rcx, qword [rsp + 0x66a50]
call fcn.140002270
mov qword [rsp + 0x66a58], rax
mov rax, qword [rsp + 0x66a58]
mov qword [rsp + 0x66a60], rax
mov rdx, qword [rsp + 0x20f10]
lea rcx, [rsp + 0x66768]
call fcn.1400020d0
mov qword [rsp + 0x66a68], rax
mov rax, qword [rsp + 0x66a68]
mov qword [rsp + 0x66a70], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x66770]
mov rcx, qword [rsp + 0x66a70]
call fcn.140002270
mov qword [rsp + 0x66a78], rax
mov rax, qword [rsp + 0x66a78]
mov qword [rsp + 0x66a80], rax
lea r8, [0x14024337c]
mov rdx, qword [rsp + 0x66a80]
lea rcx, [rsp + 0x66778]
call fcn.1400010b0
mov qword [rsp + 0x66a88], rax
mov rax, qword [rsp + 0x66a88]
mov qword [rsp + 0x66a90], rax
mov r8, qword [rsp + 0x66a60]
mov rdx, qword [rsp + 0x66a90]
lea rcx, [rsp + 0x66780]
call fcn.140006bd0
mov qword [rsp + 0x66a98], rax
mov rax, qword [rsp + 0x66a98]
mov qword [rsp + 0x66aa0], rax
lea r8, [0x140243354]
mov rdx, qword [rsp + 0x66aa0]
lea rcx, [rsp + 0x66788]
call fcn.1400010b0
mov qword [rsp + 0x66aa8], rax
mov rax, qword [rsp + 0x66aa8]
mov qword [rsp + 0x66ab0], rax
mov r8, qword [rsp + 0x66a40]
mov rdx, qword [rsp + 0x66ab0]
lea rcx, [rsp + 0x66790]
call fcn.140006bd0
mov qword [rsp + 0x66ab8], rax
mov rax, qword [rsp + 0x66ab8]
mov qword [rsp + 0x66ac0], rax
lea r8, [0x140243324]
mov rdx, qword [rsp + 0x66ac0]
lea rcx, [rsp + 0x66798]
call fcn.1400010b0
mov qword [rsp + 0x66ac8], rax
mov rax, qword [rsp + 0x66ac8]
mov qword [rsp + 0x66ad0], rax
mov r8, qword [rsp + 0x66a20]
mov rdx, qword [rsp + 0x66ad0]
lea rcx, [rsp + 0x667a0]
call fcn.140006bd0
mov qword [rsp + 0x66ad8], rax
mov rax, qword [rsp + 0x66ad8]
mov qword [rsp + 0x66ae0], rax
lea r8, [0x1402432fc]
mov rdx, qword [rsp + 0x66ae0]
lea rcx, [rsp + 0x667a8]
call fcn.1400010b0
mov qword [rsp + 0x66ae8], rax
mov rax, qword [rsp + 0x66ae8]
mov qword [rsp + 0x66af0], rax
mov r8, qword [rsp + 0x66a00]
mov rdx, qword [rsp + 0x66af0]
lea rcx, [rsp + 0x667b0]
call fcn.140006bd0
mov qword [rsp + 0x66af8], rax
mov rax, qword [rsp + 0x66af8]
mov qword [rsp + 0x66b00], rax
lea r8, [0x1402431fc]
mov rdx, qword [rsp + 0x66b00]
lea rcx, [rsp + 0x667b8]
call fcn.1400010b0
mov qword [rsp + 0x66b08], rax
mov rax, qword [rsp + 0x66b08]
mov qword [rsp + 0x66b10], rax
mov r8, qword [rsp + 0x669e0]
mov rdx, qword [rsp + 0x66b10]
lea rcx, [rsp + 0x667c0]
call fcn.140006bd0
mov qword [rsp + 0x66b18], rax
mov rax, qword [rsp + 0x66b18]
mov qword [rsp + 0x66b20], rax
lea rcx, [rsp + 0x218e8]
mov rdx, qword [rsp + 0x66b20]
call fcn.140002d80
nop
lea rcx, [rsp + 0x667c0]
call fcn.140001490
nop
lea rcx, [rsp + 0x667b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x667b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x667a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x667a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x66798]
call fcn.140001490
nop
lea rcx, [rsp + 0x66790]
call fcn.140001490
nop
lea rcx, [rsp + 0x66788]
call fcn.140001490
nop
lea rcx, [rsp + 0x66780]
call fcn.140001490
nop
lea rcx, [rsp + 0x66778]
call fcn.140001490
nop
lea rcx, [rsp + 0x66770]
call fcn.140001490
nop
lea rcx, [rsp + 0x66768]
call fcn.140001490
nop
lea rcx, [rsp + 0x66760]
call fcn.140001490
nop
lea rcx, [rsp + 0x66758]
call fcn.140001490
nop
lea rcx, [rsp + 0x66750]
call fcn.140001490
nop
lea rcx, [rsp + 0x66748]
call fcn.140001490
nop
lea rcx, [rsp + 0x66740]
call fcn.140001490
nop
lea rcx, [rsp + 0x66738]
call fcn.140001490
nop
lea rcx, [rsp + 0x66730]
call fcn.140001490
nop
lea rcx, [rsp + 0x66728]
call fcn.140001490
nop
lea rcx, [rsp + 0x66720]
call fcn.140001490
nop
lea rcx, [rsp + 0x66718]
call fcn.140001490
lea rcx, [rsp + 0x218e8]
call fcn.140006910
lea rcx, [rsp + 0x21720]
call fcn.1401b7bb0
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000ebf0
mov dword [rsp + 0x20f18], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x218b8]
mov r8d, dword [rsp + 0x20f18]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a53d0
mov rcx, qword [rsp + 0x20f10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x20f10]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x20f10], rax
lea rcx, [rsp + 0x21720]
call fcn.140005db0
jmp 0x1401ac0b4
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140244d08]
call fcn.1400ef1c0
lea rdx, [rsp + 0x667d0]
lea rcx, [rsp + 0xb50]
call fcn.14008c714
mov qword [rsp + 0x66b28], rax
lea rdx, str.accinfo.ini
mov rcx, qword [rsp + 0x66b28]
call fcn.1400060b0
test eax, eax
jne 0x1401ac848
mov dword [rsp + 0x66b30], 1
jmp 0x1401ac853
mov dword [rsp + 0x66b30], 0
movzx eax, byte [rsp + 0x66b30]
mov byte [rsp + 0x667c8], al
lea rcx, [rsp + 0x667d0]
call fcn.140001490
movzx edx, byte [rsp + 0x667c8]
test edx, edx
je 0x1401acaa3
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x22260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x22260]
mov qword [rsp + 0x42260], rdx
mov rax, qword [rsp + 0x42260]
movzx eax, word [rax]
test eax, eax
je 0x1401aca80
lea rdx, [0x1402433d4]
mov rcx, qword [rsp + 0x42260]
call fcn.140010240
test rax, rax
jne 0x1401ac906
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
jmp 0x1401ac8b2
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42270]
lea r8, [0x14024389c]
lea rdx, str.ComputerName
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x42db0]
lea r8, [0x140243aa4]
lea rdx, str.IPAddress
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x42a70]
call fcn.1401cc380
nop
mov dword [rsp + 0x42c08], 0
lea rcx, [rsp + 0x42a70]
call fcn.1401d0fb0
lea rcx, [rsp + 0x42c10]
lea rdx, [rsp + 0x42270]
call fcn.1400020a0
lea rcx, [rsp + 0x42c28]
lea rdx, [rsp + 0x42db0]
call fcn.1400020a0
lea rcx, [rsp + 0x42c38]
mov rdx, qword [rsp + 0x42260]
call fcn.1400020a0
lea rcx, [rsp + 0x42c38]
call fcn.140006910
lea rcx, [rsp + 0x42a70]
call fcn.1401b7bb0
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000ebf0
mov dword [rsp + 0x42268], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x42c08]
mov r8d, dword [rsp + 0x42268]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a53d0
mov rcx, qword [rsp + 0x42260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x42260]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x42260], rax
lea rcx, [rsp + 0x42a70]
call fcn.140005db0
jmp 0x1401ac8b2
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140244d60]
call fcn.1400ef1c0
lea rdx, [rsp + 0x667e0]
lea rcx, [rsp + 0xb50]
call fcn.14008c968
mov qword [rsp + 0x66b38], rax
lea rdx, [0x140244d68]
mov rcx, qword [rsp + 0x66b38]
call fcn.1400060b0
test eax, eax
jne 0x1401acae5
mov dword [rsp + 0x66b40], 1
jmp 0x1401acaf0
mov dword [rsp + 0x66b40], 0
movzx eax, byte [rsp + 0x66b40]
mov byte [rsp + 0x667d8], al
lea rcx, [rsp + 0x667e0]
call fcn.140001490
movzx edx, byte [rsp + 0x667d8]
test edx, edx
je 0x1401ad7ba
lea rdx, [rsp + 0x667e8]
lea rcx, [rsp + 0xb50]
call fcn.14008c358
mov qword [rsp + 0x66b48], rax
mov rcx, qword [rsp + 0x66b48]
call fcn.140023510
lea rdx, [0x140243bc4]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x435b0], rax
lea rcx, [rsp + 0x667e8]
call fcn.140001490
cmp qword [rsp + 0x435b0], 0
jne 0x1401acba7
mov dword [rsp + 0x667f0], 0
lea rcx, [rsp + 0xb40]
call fcn.140001490
nop
lea rcx, [rsp + 0xb50]
call fcn.14008b1e8
mov eax, dword [rsp + 0x667f0]
jmp 0x1401ae654
mov rcx, qword [rsp + 0x435b0]
call fcn.1400a9dd0
test eax, eax
jne 0x1401ad78a
mov byte [rsp + 0x43950], 0
lea rdi, [rsp + 0x43951]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x435b0]
mov edx, 0x400
lea rcx, [rsp + 0x43950]
call fcn.1400aa4d8
test rax, rax
jne 0x1401acbf9
jmp 0x1401ad78a
lea rcx, [rsp + 0x43950]
call fcn.1400a9180
test rax, rax
jne 0x1401acc10
jmp 0x1401ad78a
lea rdx, [rsp + 0x43950]
lea rcx, [rsp + 0x435c0]
call fcn.14000e9e0
nop
lea rdx, [0x140243dcc]
lea rcx, [rsp + 0x435c0]
call fcn.1400069d0
lea rdx, [0x140243ddc]
lea rcx, [rsp + 0x435c0]
call fcn.1400069d0
lea rdx, [0x140243df4]
lea rcx, [rsp + 0x435c0]
call fcn.1400069d0
lea rcx, [rsp + 0x435c0]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1401acc8e
lea rcx, [rsp + 0x435c0]
call fcn.140001490
jmp 0x1401ad78a
mov dword [rsp + 0x43940], 0
lea rcx, [rsp + 0x43948]
call fcn.140002db0
nop
lea rcx, [rsp + 0x435d0]
call fcn.140002db0
nop
lea rcx, [rsp + 0x435b8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x435d8]
call fcn.140077478
nop
cmp dword [rsp + 0x43940], 0
jl 0x1401ad4eb
mov r8d, dword [rsp + 0x43940]
lea rdx, [0x140243e04]
lea rcx, [rsp + 0x435c0]
call fcn.140006780
mov dword [rsp + 0x43d58], eax
lea rcx, [rsp + 0x43d50]
call fcn.140002db0
nop
cmp dword [rsp + 0x43d58], 0
jl 0x1401acdbc
mov eax, dword [rsp + 0x43940]
mov r9d, dword [rsp + 0x43d58]
sub r9d, eax
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x667f8]
lea rcx, [rsp + 0x435c0]
call fcn.140002270
mov qword [rsp + 0x66b50], rax
mov rax, qword [rsp + 0x66b50]
mov qword [rsp + 0x66b58], rax
mov rdx, qword [rsp + 0x66b58]
lea rcx, [rsp + 0x43d50]
call fcn.140002d80
nop
lea rcx, [rsp + 0x667f8]
call fcn.140001490
mov eax, dword [rsp + 0x43d58]
add eax, 1
mov dword [rsp + 0x43940], eax
lea rcx, [rsp + 0x435c0]
call fcn.140001a40
cmp dword [rsp + 0x43940], eax
jl 0x1401acdba
mov dword [rsp + 0x43940], 0xffffffff
jmp 0x1401ace1f
mov r8d, dword [rsp + 0x43940]
lea rdx, [rsp + 0x66800]
lea rcx, [rsp + 0x435c0]
call fcn.140006a00
mov qword [rsp + 0x66b60], rax
mov rax, qword [rsp + 0x66b60]
mov qword [rsp + 0x66b68], rax
mov rdx, qword [rsp + 0x66b68]
lea rcx, [rsp + 0x43d50]
call fcn.140002d80
nop
lea rcx, [rsp + 0x66800]
call fcn.140001490
mov dword [rsp + 0x43940], 0xffffffff
lea rdx, [0x140243e24]
lea rcx, [rsp + 0x43d50]
call fcn.1400069d0
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d8]
call fcn.14000e880
lea rcx, [rsp + 0x43d50]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x66810]
call fcn.140002de0
mov qword [rsp + 0x66b70], rax
mov rax, qword [rsp + 0x66b70]
mov qword [rsp + 0x66b78], rax
mov eax, dword [rsp + 0x66974]
or eax, 1
mov dword [rsp + 0x66974], eax
mov rcx, qword [rsp + 0x66b78]
call fcn.140002e90
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x1401aceca
lea rcx, [rsp + 0x435d0]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401aceca
mov dword [rsp + 0x66b80], 1
jmp 0x1401aced5
mov dword [rsp + 0x66b80], 0
movzx eax, byte [rsp + 0x66b80]
mov byte [rsp + 0x66808], al
mov eax, dword [rsp + 0x66974]
and eax, 1
test eax, eax
je 0x1401acf07
and dword [rsp + 0x66974], 0xfffffffe
lea rcx, [rsp + 0x66810]
call fcn.140002e70
movzx eax, byte [rsp + 0x66808]
test eax, eax
je 0x1401acf28
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435d0]
call fcn.140002d80
lea rcx, [rsp + 0x43d50]
call fcn.140001a40
cmp eax, 0xc
jne 0x1401ad4d9
lea rcx, [rsp + 0x435b8]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad4d9
lea rcx, [rsp + 0x43d50]
call fcn.140006910
mov dword [rsp + 0x43d5c], 0
mov dword [rsp + 0x43d60], 0
jmp 0x1401acf8c
mov eax, dword [rsp + 0x43d60]
add eax, 1
mov dword [rsp + 0x43d60], eax
cmp dword [rsp + 0x43d60], 0xc
jge 0x1401ad02f
mov r9d, 1
mov r8d, dword [rsp + 0x43d60]
lea rdx, [rsp + 0x66820]
lea rcx, [rsp + 0x43d50]
call fcn.140002270
mov qword [rsp + 0x66b88], rax
lea rdx, [0x140244d70]
mov rcx, qword [rsp + 0x66b88]
call fcn.140006830
test eax, eax
jge 0x1401acfea
mov dword [rsp + 0x66b90], 1
jmp 0x1401acff5
mov dword [rsp + 0x66b90], 0
movzx eax, byte [rsp + 0x66b90]
mov byte [rsp + 0x66818], al
lea rcx, [rsp + 0x66820]
call fcn.140001490
movzx edx, byte [rsp + 0x66818]
test edx, edx
je 0x1401ad02a
mov dword [rsp + 0x43d5c], 1
jmp 0x1401ad02f
jmp 0x1401acf7b
cmp dword [rsp + 0x43d5c], 0
jne 0x1401ad4d9
lea rdx, [rsp + 0x43d50]
lea rcx, [rsp + 0x435b8]
call fcn.140002d80
lea rcx, [rsp + 0x43d68]
call fcn.140002db0
nop
mov r9d, 2
mov r8d, 0xa
lea rdx, [rsp + 0x66828]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66b98], rax
mov rax, qword [rsp + 0x66b98]
mov qword [rsp + 0x66ba0], rax
mov r9d, 2
mov r8d, 8
lea rdx, [rsp + 0x66830]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66ba8], rax
mov rax, qword [rsp + 0x66ba8]
mov qword [rsp + 0x66bb0], rax
mov r9d, 2
mov r8d, 6
lea rdx, [rsp + 0x66838]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66bb8], rax
mov rax, qword [rsp + 0x66bb8]
mov qword [rsp + 0x66bc0], rax
mov r9d, 2
mov r8d, 4
lea rdx, [rsp + 0x66840]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66bc8], rax
mov rax, qword [rsp + 0x66bc8]
mov qword [rsp + 0x66bd0], rax
mov r9d, 2
mov r8d, 2
lea rdx, [rsp + 0x66848]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66bd8], rax
mov rax, qword [rsp + 0x66bd8]
mov qword [rsp + 0x66be0], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x66850]
lea rcx, [rsp + 0x435b8]
call fcn.140002270
mov qword [rsp + 0x66be8], rax
mov rax, qword [rsp + 0x66be8]
mov qword [rsp + 0x66bf0], rax
lea r8, [0x14024400c]
mov rdx, qword [rsp + 0x66bf0]
lea rcx, [rsp + 0x66858]
call fcn.1400010b0
mov qword [rsp + 0x66bf8], rax
mov rax, qword [rsp + 0x66bf8]
mov qword [rsp + 0x66c00], rax
mov r8, qword [rsp + 0x66be0]
mov rdx, qword [rsp + 0x66c00]
lea rcx, [rsp + 0x66860]
call fcn.140006bd0
mov qword [rsp + 0x66c08], rax
mov rax, qword [rsp + 0x66c08]
mov qword [rsp + 0x66c10], rax
lea r8, [0x140243ff4]
mov rdx, qword [rsp + 0x66c10]
lea rcx, [rsp + 0x66868]
call fcn.1400010b0
mov qword [rsp + 0x66c18], rax
mov rax, qword [rsp + 0x66c18]
mov qword [rsp + 0x66c20], rax
mov r8, qword [rsp + 0x66bd0]
mov rdx, qword [rsp + 0x66c20]
lea rcx, [rsp + 0x66870]
call fcn.140006bd0
mov qword [rsp + 0x66c28], rax
mov rax, qword [rsp + 0x66c28]
mov qword [rsp + 0x66c30], rax
lea r8, [0x140243f8c]
mov rdx, qword [rsp + 0x66c30]
lea rcx, [rsp + 0x66878]
call fcn.1400010b0
mov qword [rsp + 0x66c38], rax
mov rax, qword [rsp + 0x66c38]
mov qword [rsp + 0x66c40], rax
mov r8, qword [rsp + 0x66bc0]
mov rdx, qword [rsp + 0x66c40]
lea rcx, [rsp + 0x66880]
call fcn.140006bd0
mov qword [rsp + 0x66c48], rax
mov rax, qword [rsp + 0x66c48]
mov qword [rsp + 0x66c50], rax
lea r8, [0x140243f3c]
mov rdx, qword [rsp + 0x66c50]
lea rcx, [rsp + 0x66888]
call fcn.1400010b0
mov qword [rsp + 0x66c58], rax
mov rax, qword [rsp + 0x66c58]
mov qword [rsp + 0x66c60], rax
mov r8, qword [rsp + 0x66bb0]
mov rdx, qword [rsp + 0x66c60]
lea rcx, [rsp + 0x66890]
call fcn.140006bd0
mov qword [rsp + 0x66c68], rax
mov rax, qword [rsp + 0x66c68]
mov qword [rsp + 0x66c70], rax
lea r8, [0x140243e9c]
mov rdx, qword [rsp + 0x66c70]
lea rcx, [rsp + 0x66898]
call fcn.1400010b0
mov qword [rsp + 0x66c78], rax
mov rax, qword [rsp + 0x66c78]
mov qword [rsp + 0x66c80], rax
mov r8, qword [rsp + 0x66ba0]
mov rdx, qword [rsp + 0x66c80]
lea rcx, [rsp + 0x668a0]
call fcn.140006bd0
mov qword [rsp + 0x66c88], rax
mov rax, qword [rsp + 0x66c88]
mov qword [rsp + 0x66c90], rax
mov rdx, qword [rsp + 0x66c90]
lea rcx, [rsp + 0x43d68]
call fcn.140002d80
nop
lea rcx, [rsp + 0x668a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x66898]
call fcn.140001490
nop
lea rcx, [rsp + 0x66890]
call fcn.140001490
nop
lea rcx, [rsp + 0x66888]
call fcn.140001490
nop
lea rcx, [rsp + 0x66880]
call fcn.140001490
nop
lea rcx, [rsp + 0x66878]
call fcn.140001490
nop
lea rcx, [rsp + 0x66870]
call fcn.140001490
nop
lea rcx, [rsp + 0x66868]
call fcn.140001490
nop
lea rcx, [rsp + 0x66860]
call fcn.140001490
nop
lea rcx, [rsp + 0x66858]
call fcn.140001490
nop
lea rcx, [rsp + 0x66850]
call fcn.140001490
nop
lea rcx, [rsp + 0x66848]
call fcn.140001490
nop
lea rcx, [rsp + 0x66840]
call fcn.140001490
nop
lea rcx, [rsp + 0x66838]
call fcn.140001490
nop
lea rcx, [rsp + 0x66830]
call fcn.140001490
nop
lea rcx, [rsp + 0x66828]
call fcn.140001490
lea rdx, [rsp + 0x43d68]
lea rcx, [rsp + 0x435b8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x43d68]
call fcn.140001490
nop
lea rcx, [rsp + 0x43d50]
call fcn.140001490
jmp 0x1401accd1
lea rcx, [rsp + 0x435d0]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad549
lea rcx, [rsp + 0x435d8]
call fcn.14007773c
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x43948]
call fcn.140001490
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001490
jmp 0x1401acba7
lea rcx, [rsp + 0x435d8]
call fcn.140014cc0
cmp rax, 3
jl 0x1401ad5ff
lea rcx, [rsp + 0x43948]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad593
xor edx, edx
lea rcx, [rsp + 0x435d8]
call fcn.14004ff30
mov rdx, rax
lea rcx, [rsp + 0x43948]
call fcn.140002d80
lea rcx, [rsp + 0x435d0]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad5c9
mov edx, 1
lea rcx, [rsp + 0x435d8]
call fcn.14004ff30
mov rdx, rax
lea rcx, [rsp + 0x435d0]
call fcn.140002d80
lea rcx, [rsp + 0x435b8]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad5ff
mov edx, 2
lea rcx, [rsp + 0x435d8]
call fcn.14004ff30
mov rdx, rax
lea rcx, [rsp + 0x435b8]
call fcn.140002d80
lea rcx, [rsp + 0x43600]
call fcn.1401cc380
nop
mov dword [rsp + 0x43798], 0
lea rcx, [rsp + 0x43600]
call fcn.1401d0fb0
lea rcx, [rsp + 0x43948]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401ad691
lea rcx, [rsp + 0x43600]
call fcn.140005db0
nop
lea rcx, [rsp + 0x435d8]
call fcn.14007773c
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x43948]
call fcn.140001490
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001490
jmp 0x1401acba7
lea rcx, [rsp + 0x437a0]
lea rdx, [rsp + 0x43948]
call fcn.140002d80
lea rcx, [rsp + 0x437b8]
lea rdx, [rsp + 0x435d0]
call fcn.140002d80
lea rcx, [rsp + 0x437c8]
lea rdx, [rsp + 0x435b8]
call fcn.140002d80
lea rcx, [rsp + 0x437c8]
call fcn.140006910
lea rcx, [rsp + 0x43600]
call fcn.1401b7bb0
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000ebf0
mov dword [rsp + 0x435c8], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x43798]
mov r8d, dword [rsp + 0x435c8]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a53d0
nop
lea rcx, [rsp + 0x43600]
call fcn.140005db0
nop
lea rcx, [rsp + 0x435d8]
call fcn.14007773c
nop
lea rcx, [rsp + 0x435b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x435d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x43948]
call fcn.140001490
nop
lea rcx, [rsp + 0x435c0]
call fcn.140001490
jmp 0x1401acba7
mov rcx, qword [rsp + 0x435b0]
call fcn.1400aa000
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140244d98]
call fcn.1400ef1c0
lea rdx, [rsp + 0x668b0]
lea rcx, [rsp + 0xb50]
call fcn.14008c714
mov qword [rsp + 0x66c98], rax
lea rdx, str.nxd.ini
mov rcx, qword [rsp + 0x66c98]
call fcn.1400060b0
test eax, eax
jne 0x1401ad7fc
mov dword [rsp + 0x66ca0], 1
jmp 0x1401ad807
mov dword [rsp + 0x66ca0], 0
movzx eax, byte [rsp + 0x66ca0]
mov byte [rsp + 0x668a8], al
lea rcx, [rsp + 0x668b0]
call fcn.140001490
movzx edx, byte [rsp + 0x668a8]
test edx, edx
je 0x1401ada17
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x43d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rdx, [rsp + 0x43d70]
mov qword [rsp + 0x63d70], rdx
mov rax, qword [rsp + 0x63d70]
movzx eax, word [rax]
test eax, eax
je 0x1401ad9f3
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x640c0]
lea r8, [0x140244124]
lea rdx, [0x140244db0]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb40]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x648c0]
lea r8, [0x14024414c]
lea rdx, [0x140244db8]
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x63d80]
call fcn.1401cc380
nop
mov dword [rsp + 0x63f18], 0
lea rcx, [rsp + 0x63d80]
call fcn.1401d0fb0
lea rcx, [rsp + 0x63f20]
mov rdx, qword [rsp + 0x63d70]
call fcn.1400020a0
lea rcx, [rsp + 0x63f38]
lea rdx, [rsp + 0x648c0]
call fcn.1400020a0
lea rcx, [rsp + 0x63f48]
lea rdx, [rsp + 0x640c0]
call fcn.1400020a0
lea rcx, [rsp + 0x63f48]
call fcn.140006910
lea rcx, [rsp + 0x63d80]
call fcn.1401b7bb0
mov rcx, qword [rsp + 0x66dd0]
add rcx, 0xdc8
call fcn.14000ebf0
mov dword [rsp + 0x63d78], eax
mov rdx, qword [rsp + 0x66dd0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x63f18]
mov r8d, dword [rsp + 0x63d78]
mov rcx, qword [rsp + 0x66dd0]
call fcn.1401a53d0
mov rcx, qword [rsp + 0x63d70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x63d70]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x63d70], rax
lea rcx, [rsp + 0x63d80]
call fcn.140005db0
jmp 0x1401ad866
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140244dc0]
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0xb40]
call fcn.140001490
nop
lea rcx, [rsp + 0xb50]
call fcn.14008b1e8
xor eax, eax
jmp 0x1401ae654
xor edx, edx
lea rcx, [rsp + 0x650c0]
call fcn.140143210
nop
lea rcx, [rsp + 0x650c0]
call fcn.140081900
nop
lea rcx, [rsp + 0x650c0]
call fcn.140143060
xor eax, eax
jmp 0x1401ae654
xor edx, edx
lea rcx, [rsp + 0x65390]
call fcn.140141e20
nop
lea rcx, [rsp + 0x65390]
call fcn.140081900
nop
lea rcx, [rsp + 0x65390]
call fcn.140141dd0
xor eax, eax
jmp 0x1401ae654
lea rcx, [rsp + 0x668b8]
call fcn.140001000
mov qword [rsp + 0x66ca8], rax
mov rax, qword [rsp + 0x66ca8]
mov qword [rsp + 0x66cb0], rax
lea rcx, [rsp + 0x668c0]
call fcn.140001000
mov qword [rsp + 0x66cb8], rax
mov rax, qword [rsp + 0x66cb8]
mov qword [rsp + 0x66cc0], rax
lea r8, str.CCVHDUsb.exe__www.ccboot.com
mov rdx, qword [rsp + 0x66cc0]
lea rcx, [rsp + 0x668c8]
call fcn.1400010b0
mov qword [rsp + 0x66cc8], rax
mov rax, qword [rsp + 0x66cc8]
mov qword [rsp + 0x66cd0], rax
mov rcx, qword [rsp + 0x66cb0]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0x66cd0]
call fcn.140023510
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004900
nop
lea rcx, [rsp + 0x668c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x668c0]
call fcn.140001490
nop
lea rcx, [rsp + 0x668b8]
call fcn.140001490
xor eax, eax
jmp 0x1401ae654
lea rcx, [rsp + 0x668d0]
call fcn.140001000
mov qword [rsp + 0x66cd8], rax
mov rax, qword [rsp + 0x66cd8]
mov qword [rsp + 0x66ce0], rax
lea r8, [0x140244e08]
mov rdx, qword [rsp + 0x66ce0]
lea rcx, [rsp + 0x65698]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x668d0]
call fcn.140001490
lea rcx, [rsp + 0x65698]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401adbfb
lea rcx, [rsp + 0x65698]
call fcn.140023510
mov rcx, rax
call fcn.140004bc0
lea rcx, [rsp + 0x656a0]
call fcn.140002db0
nop
lea rcx, [rsp + 0x668d8]
call fcn.14000edc0
lea r8, str._Y_m_d_H_M_S
lea rdx, [rsp + 0x668e0]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0x66ce8], rax
mov rax, qword [rsp + 0x66ce8]
mov qword [rsp + 0x66cf0], rax
mov r9, qword [rsp + 0x66cf0]
mov r9, qword [r9]
mov r8, qword [rsp + 0x65698]
lea rdx, str._sccboot_config__s.zip
lea rcx, [rsp + 0x656a0]
call fcn.140002c40
nop
lea rcx, [rsp + 0x668e0]
call fcn.140001490
lea rcx, [rsp + 0x656a0]
call fcn.140023510
mov r9, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Settings_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
lea r8, [0x140244e68]
xor edx, edx
lea rcx, [rsp + 0x656b0]
call fcn.14008b2e0
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008c1a0
cmp rax, 1
je 0x1401add21
mov dword [rsp + 0x668e8], 0
lea rcx, [rsp + 0x656b0]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x65698]
call fcn.140001490
mov eax, dword [rsp + 0x668e8]
jmp 0x1401ae654
mov dword [rsp + 0x65690], 0
mov edx, 0xa
lea rcx, [rsp + 0x65650]
call fcn.14008d3d8
nop
lea rcx, [rsp + 0x668f0]
call fcn.140001000
mov qword [rsp + 0x66cf8], rax
mov rax, qword [rsp + 0x66cf8]
mov qword [rsp + 0x66d00], rax
lea r8, [0x140244e70]
mov rdx, qword [rsp + 0x66d00]
lea rcx, [rsp + 0x668f8]
call fcn.1400010b0
mov qword [rsp + 0x66d08], rax
mov rax, qword [rsp + 0x66d08]
mov qword [rsp + 0x66d10], rax
mov rdx, qword [rsp + 0x66d10]
lea rcx, [rsp + 0x65650]
call fcn.14008d5c4
nop
lea rcx, [rsp + 0x668f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x668f0]
call fcn.140001490
lea rcx, [rsp + 0x66900]
call fcn.140001000
mov qword [rsp + 0x66d18], rax
mov rax, qword [rsp + 0x66d18]
mov qword [rsp + 0x66d20], rax
lea r8, str.db.xml
mov rdx, qword [rsp + 0x66d20]
lea rcx, [rsp + 0x66908]
call fcn.1400010b0
mov qword [rsp + 0x66d28], rax
mov rax, qword [rsp + 0x66d28]
mov qword [rsp + 0x66d30], rax
mov rdx, qword [rsp + 0x66d30]
lea rcx, [rsp + 0x65650]
call fcn.14008d5c4
nop
lea rcx, [rsp + 0x66908]
call fcn.140001490
nop
lea rcx, [rsp + 0x66900]
call fcn.140001490
lea rdx, [rsp + 0x65688]
lea rcx, [rsp + 0x656b0]
call fcn.14008c358
nop
lea rcx, [rsp + 0x66918]
call fcn.140001000
mov qword [rsp + 0x66d38], rax
mov rax, qword [rsp + 0x66d38]
mov qword [rsp + 0x66d40], rax
lea rcx, [rsp + 0x65688]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0x66d40]
call fcn.140023510
lea r9, [rsp + 0x65690]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x65650]
call fcn.140184890
test eax, eax
jne 0x1401aded7
mov dword [rsp + 0x66d48], 1
jmp 0x1401adee2
mov dword [rsp + 0x66d48], 0
movzx eax, byte [rsp + 0x66d48]
mov byte [rsp + 0x66910], al
lea rcx, [rsp + 0x66918]
call fcn.140001490
movzx edx, byte [rsp + 0x66910]
test edx, edx
je 0x1401adf7a
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Backup_of_settings_has_failed_
call fcn.1400ef1c0
mov dword [rsp + 0x66920], 0
lea rcx, [rsp + 0x65688]
call fcn.140001490
nop
lea rcx, [rsp + 0x65650]
call fcn.14008d578
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x65698]
call fcn.140001490
mov eax, dword [rsp + 0x66920]
jmp 0x1401ae654
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Backup_of_settings_was_successful_
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x65688]
call fcn.140001490
nop
lea rcx, [rsp + 0x65650]
call fcn.14008d578
nop
lea rcx, [rsp + 0x656b0]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x656a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x65698]
call fcn.140001490
xor eax, eax
jmp 0x1401ae654
lea rcx, [rsp + 0x66928]
call fcn.140001000
mov qword [rsp + 0x66d50], rax
mov rax, qword [rsp + 0x66d50]
mov qword [rsp + 0x66d58], rax
lea r8, [0x140244f28]
mov rdx, qword [rsp + 0x66d58]
lea rcx, [rsp + 0x65a70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x66928]
call fcn.140001490
lea rcx, [rsp + 0x65a70]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401ae08c
lea rcx, [rsp + 0x66930]
call fcn.140001000
mov qword [rsp + 0x66d60], rax
mov rax, qword [rsp + 0x66d60]
mov qword [rsp + 0x66d68], rax
mov rdx, qword [rsp + 0x66d68]
lea rcx, [rsp + 0x65a70]
call fcn.140002d80
nop
lea rcx, [rsp + 0x66930]
call fcn.140001490
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, str.Restore_Backup__.zip_.zip
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140244f38]
mov edx, 1
lea rcx, [rsp + 0x65a80]
call fcn.14008b2e0
nop
lea rcx, [rsp + 0x65a70]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0x65a80]
call fcn.140088920
mov qword [rax + 0x50], rdi
lea rcx, [rsp + 0x65a80]
call fcn.14008c1a0
cmp rax, 1
je 0x1401ae13c
mov dword [rsp + 0x66938], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001490
mov eax, dword [rsp + 0x66938]
jmp 0x1401ae654
lea rdx, [rsp + 0x66940]
lea rcx, [rsp + 0x65a80]
call fcn.14008c358
mov qword [rsp + 0x66d70], rax
mov rax, qword [rsp + 0x66d70]
mov qword [rsp + 0x66d78], rax
mov rcx, qword [rsp + 0x66d78]
call fcn.140023510
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8053
mov edx, 0xffffffff
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
test rax, rax
jne 0x1401ae1a7
mov dword [rsp + 0x66d80], 1
jmp 0x1401ae1b2
mov dword [rsp + 0x66d80], 0
movzx eax, byte [rsp + 0x66d80]
mov byte [rsp + 0x6693c], al
lea rcx, [rsp + 0x66940]
call fcn.140001490
movzx edx, byte [rsp + 0x6693c]
test edx, edx
je 0x1401ae225
call fcn.1401b7040
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Restoring_settings_has_failed_
call fcn.1400ef1c0
mov dword [rsp + 0x66948], 0
lea rcx, [rsp + 0x65a80]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001490
mov eax, dword [rsp + 0x66948]
jmp 0x1401ae654
call fcn.1401b7040
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Restoring_settings_was_successful_
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x65a80]
call fcn.14008b1e8
nop
lea rcx, [rsp + 0x65a70]
call fcn.140001490
xor eax, eax
jmp 0x1401ae654
lea rcx, [rsp + 0x65e70]
call fcn.1400053e0
nop
lea rcx, [rsp + 0x65e40]
call fcn.140021960
nop
lea rcx, [rsp + 0x65e80]
call fcn.140021960
nop
lea rdx, [rsp + 0x65e80]
lea rcx, [rsp + 0x65e40]
call fcn.140117c10
mov dword [rsp + 0x65eb0], 0
mov dword [rsp + 0x65eb4], 0
jmp 0x1401ae2c9
mov eax, dword [rsp + 0x65eb4]
add eax, 1
mov dword [rsp + 0x65eb4], eax
movsxd rdi, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.14001db40
cmp rdi, rax
jae 0x1401ae516
movsxd rdx, dword [rsp + 0x65eb4]
lea rcx, [rsp + 0x65e40]
call fcn.140007d10
mov r8, rax
lea rdx, str.SYSTEMCurrentControlSetEnum_
lea rcx, [rsp + 0x66950]
call fcn.140006c90
mov qword [rsp + 0x66d88], rax
mov rcx, qword [rsp + 0x66d88]
call fcn.140023510
mov r9d, 0x20019
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.1400055a0
test eax, eax
je 0x1401ae356
mov dword [rsp + 0x66d90], 1
jmp 0x1401ae361
mov dword [rsp + 0x66d90], 0
movzx eax, byte [rsp + 0x66d90]
mov byte [rsp + 0x6694c], al
lea rcx, [rsp + 0x66950]
call fcn.140001490
movzx edx, byte [rsp + 0x6694c]
test edx, edx
je 0x1401ae38e
jmp 0x1401ae2b8
xor eax, eax
mov word [rsp + 0x65ec0], ax
lea rdi, [rsp + 0x65ec2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x666c0], 0x400
lea r9, [rsp + 0x666c0]
lea r8, [rsp + 0x65ec0]
lea rdx, [0x140245008]
lea rcx, [rsp + 0x65e70]
call fcn.1400056b0
lea rcx, [rsp + 0x65e70]
call fcn.140005470
lea rdx, [rsp + 0x65ec0]
lea rcx, [rsp + 0x66960]
call fcn.1400020d0
mov qword [rsp + 0x66d98], rax
mov rax, qword [rsp + 0x66d98]
mov qword [rsp + 0x66da0], rax
mov r8, qword [rsp + 0x66da0]
lea rdx, str.SYSTEMCurrentControlSetControlClass_
lea rcx, [rsp + 0x66968]
call fcn.140006c90
mov qword [rsp + 0x66da8], rax
mov rcx, qword [rsp + 0x66da8]
call fcn.140023510
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x65e70]
call fcn.1400055a0
test eax, eax
je 0x1401ae471
mov dword [rsp + 0x66db0], 1
jmp 0x1401ae47c
mov dword [rsp + 0x66db0], 0
movzx eax, byte [rsp + 0x66db0]
mov byte [rsp + 0x66958], al
lea rcx, [rsp + 0x66968]
call fcn.140001490
nop
lea rcx, [rsp + 0x66960]
call fcn.140001490
movzx edx, byte [rsp + 0x66958]
test edx, edx
je 0x1401ae4b7
jmp 0x1401ae2b8
mov r9d, 1
lea r8, [0x140244174]
lea rdx, [0x140245070]
lea rcx, [rsp + 0x65e70]
call fcn.140005980
mov r9d, 1
lea r8, [0x140244184]
lea rdx, str.FlowControl
lea rcx, [rsp + 0x65e70]
call fcn.140005980
lea rcx, [rsp + 0x65e70]
call fcn.140005470
mov dword [rsp + 0x65eb0], 1
jmp 0x1401ae2b8
cmp dword [rsp + 0x65eb0], 0
je 0x1401ae622
mov r8d, 0xffffffff
mov edx, 0x44
mov ecx, 0x83
call fcn.1400f0f30
cmp eax, 6
jne 0x1401ae622
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x666c8], rax
lea r8, [rsp + 0x666d0]
mov edx, 0x20
mov rcx, qword [rsp + 0x666c8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x666e0], 1
lea r8, [rsp + 0x666d8]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rdx, qword [rsp + 0x666d8]
mov qword [rsp + 0x666e4], rdx
mov dword [rsp + 0x666ec], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x666e0]
xor edx, edx
mov rcx, qword [rsp + 0x666d0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x80020003
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [rsp + 0x66970], 0
lea rcx, [rsp + 0x65e80]
call fcn.140007c90
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007c90
nop
lea rcx, [rsp + 0x65e70]
call fcn.140005410
mov eax, dword [rsp + 0x66970]
jmp 0x1401ae654
lea rcx, [rsp + 0x65e80]
call fcn.140007c90
nop
lea rcx, [rsp + 0x65e40]
call fcn.140007c90
nop
lea rcx, [rsp + 0x65e70]
call fcn.140005410
xor eax, eax
jmp 0x1401ae654
mov eax, 1
mov rcx, qword [rsp + 0x66db8]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0x66dc0
pop rdi
ret