Function at 0x1401d7dd0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Get disk size
Get local ipv4 addresses
Get socket information
Manipulate boot configuration
Read .ini file
Read file on windows
Read pipe
Set registry value
Set socket configuration
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x165b8
call fcn.1401e9500
sub rsp, rax
mov qword [rsp + 0x15d18], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0x165a0], rax
mov dword [rsp + 0x15d10], 0
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x65
jne 0x1401d7e37
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d61e0
mov eax, 1
jmp 0x1401e04eb
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x66
jne 0x1401d7e5c
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d56c0
mov eax, 1
jmp 0x1401e04eb
lea rcx, [rsp + 0x7b0]
call fcn.14000e170
nop
mov dword [rsp + 0x948], 1
lea rcx, [rsp + 0x7b0]
call fcn.1401e4480
mov dword [rsp + 0xaf0], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xaf0]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], 0x4010
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rdx, qword [rsp + 0x165d8]
mov eax, dword [rdx + 0x14]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x470]
call fcn.1401e0790
nop
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401e6670
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401e0460
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401e0460
mov byte [rsp + 0xb00], 0
lea rdi, [rsp + 0xb01]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
test eax, eax
jne 0x1401d7f8d
jmp 0x1401e0460
lea rcx, [0x140234b18]
call fcn.1400aa950
mov r8, rax
lea rdx, str.getservercmd
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401d97db
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.14000f140
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15518], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15530]
call fcn.1400227d0
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x15518]
lea rdx, [rsp + 0x15520]
call fcn.140022800
mov rdx, rdi
mov rcx, rax
call fcn.1400208a0
movzx eax, al
test eax, eax
je 0x1401d8061
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15540], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15540]
call fcn.140022610
mov rcx, rax
call fcn.1400206d0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
lea rdx, [0x140234b38]
lea rcx, [rsp + 0x15548]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15544], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15544]
call fcn.140022610
lea rdx, [rsp + 0x15548]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x15548]
call fcn.140007060
lea rdx, [0x140234b58]
lea rcx, [rsp + 0x15558]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15550], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15550]
call fcn.140022610
lea rdx, [rsp + 0x15558]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x15558]
call fcn.140007060
lea rcx, [rsp + 0x15568]
call fcn.140001000
mov qword [rsp + 0x15d20], rax
mov rax, qword [rsp + 0x15d20]
mov qword [rsp + 0x15d28], rax
lea r8, [0x140232dcc]
mov rdx, qword [rsp + 0x15d28]
lea rcx, [rsp + 0x15570]
call fcn.1400010b0
mov qword [rsp + 0x15d30], rax
mov rax, qword [rsp + 0x15d30]
mov qword [rsp + 0x15d38], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x15d38]
lea rcx, [rsp + 0x15578]
call fcn.1400010b0
mov qword [rsp + 0x15d40], rax
mov rax, qword [rsp + 0x15d40]
mov qword [rsp + 0x15d48], rax
lea r8, [0x140234b90]
mov rdx, qword [rsp + 0x15d48]
lea rcx, [rsp + 0x15580]
call fcn.1400010b0
mov qword [rsp + 0x15d50], rax
mov rcx, qword [rsp + 0x15d50]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, [0x140234ba0]
lea rcx, [0x140234bc0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x15560], eax
lea rcx, [rsp + 0x15580]
call fcn.140007060
nop
lea rcx, [rsp + 0x15578]
call fcn.140007060
nop
lea rcx, [rsp + 0x15570]
call fcn.140007060
nop
lea rcx, [rsp + 0x15568]
call fcn.140007060
cmp dword [rsp + 0x15560], 0
je 0x1401d82af
lea rdx, [0x140234bd0]
lea rcx, [rsp + 0x15590]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15588], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15588]
call fcn.140022610
lea rdx, [rsp + 0x15590]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x15590]
call fcn.140007060
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
lea rcx, [rsp + 0x155a0]
call fcn.140001000
mov qword [rsp + 0x15d58], rax
mov rax, qword [rsp + 0x15d58]
mov qword [rsp + 0x15d60], rax
mov eax, dword [rsp + 0x15d10]
or eax, 1
mov dword [rsp + 0x15d10], eax
lea r8, [0x140232e24]
mov rdx, qword [rsp + 0x15d60]
lea rcx, [rsp + 0x155a8]
call fcn.1400010b0
mov qword [rsp + 0x15d68], rax
mov rax, qword [rsp + 0x15d68]
mov qword [rsp + 0x15d70], rax
mov eax, dword [rsp + 0x15d10]
or eax, 2
mov dword [rsp + 0x15d10], eax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x15d70]
lea rcx, [rsp + 0x155b0]
call fcn.1400010b0
mov qword [rsp + 0x15d78], rax
mov rax, qword [rsp + 0x15d78]
mov qword [rsp + 0x15d80], rax
mov eax, dword [rsp + 0x15d10]
or eax, 4
mov dword [rsp + 0x15d10], eax
lea r8, [0x140234bf0]
mov rdx, qword [rsp + 0x15d80]
lea rcx, [rsp + 0x155b8]
call fcn.1400010b0
mov qword [rsp + 0x15d88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 8
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15d88]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, [0x140234c00]
lea rcx, [0x140234c20]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401d840c
lea rcx, [rsp + 0x6d0]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d840c
mov dword [rsp + 0x15d90], 1
jmp 0x1401d8417
mov dword [rsp + 0x15d90], 0
movzx eax, byte [rsp + 0x15d90]
mov byte [rsp + 0x15598], al
mov eax, dword [rsp + 0x15d10]
and eax, 8
test eax, eax
je 0x1401d844a
and dword [rsp + 0x15d10], 0xfffffff7
lea rcx, [rsp + 0x155b8]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 4
test eax, eax
je 0x1401d846e
and dword [rsp + 0x15d10], 0xfffffffb
lea rcx, [rsp + 0x155b0]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 2
test eax, eax
je 0x1401d8492
and dword [rsp + 0x15d10], 0xfffffffd
lea rcx, [rsp + 0x155a8]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 1
test eax, eax
je 0x1401d84b5
and dword [rsp + 0x15d10], 0xfffffffe
lea rcx, [rsp + 0x155a0]
call fcn.140007060
movzx eax, byte [rsp + 0x15598]
test eax, eax
je 0x1401d851e
lea rdx, [0x140234c30]
lea rcx, [rsp + 0x155c8]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155c0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155c0]
call fcn.140022610
lea rdx, [rsp + 0x155c8]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x155c8]
call fcn.140007060
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401d97d6
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401d97d6
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.14000f140
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155d0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155e8]
call fcn.1400227d0
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x155d0]
lea rdx, [rsp + 0x155d8]
call fcn.140022800
mov rdx, rdi
mov rcx, rax
call fcn.1400208e0
movzx eax, al
test eax, eax
je 0x1401d860d
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401d853f
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155f8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155f8]
call fcn.140022610
mov rdx, rax
lea rcx, [rsp + 0x1b10]
call fcn.1400228f0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155fc], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155fc]
call fcn.140022610
mov rcx, rax
call fcn.1400206d0
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov dword [rsp + 0x1b08], 0
mov dword [rsp + 0x1b40], 0
jmp 0x1401d86c4
mov eax, dword [rsp + 0x1b40]
add eax, 1
mov dword [rsp + 0x1b40], eax
movsxd rdi, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001d480
cmp rdi, rax
jae 0x1401d9209
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
mov r8, rax
lea rdx, str.servercmd
lea rcx, [rsp + 0x15600]
call fcn.140006d10
mov qword [rsp + 0x15d98], rax
mov rax, qword [rsp + 0x15d98]
mov qword [rsp + 0x15da0], rax
lea r8, [0x140234c4c]
mov rdx, qword [rsp + 0x15da0]
lea rcx, [rsp + 0x15608]
call fcn.1400010b0
mov qword [rsp + 0x15da8], rax
mov rax, qword [rsp + 0x15da8]
mov qword [rsp + 0x15db0], rax
mov rcx, qword [rsp + 0x15db0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15610]
call fcn.1400dad50
mov qword [rsp + 0x15db8], rax
mov rax, qword [rsp + 0x15db8]
mov qword [rsp + 0x15dc0], rax
mov rcx, qword [rsp + 0x15dc0]
call fcn.140050200
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15610]
call fcn.140007060
nop
lea rcx, [rsp + 0x15608]
call fcn.140007060
nop
lea rcx, [rsp + 0x15600]
call fcn.140007060
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
test eax, eax
jne 0x1401d881d
mov dword [rsp + 0x1b08], 1
jmp 0x1401d9209
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, str.vnc_start
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8890
lea rcx, [0x140234c88]
call fcn.1400aa950
lea rcx, [rsp + rax + 0xb00]
call fcn.1400af2e0
mov dword [rsp + 0x1b44], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b44]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, str.vnc_monitor
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8903
lea rcx, str.vnc_ready
call fcn.1400aa950
lea rcx, [rsp + rax + 0xb00]
call fcn.1400af2e0
mov dword [rsp + 0x1b48], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b48]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, [0x140234cc0]
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d89ca
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d89ca
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15618]
call fcn.1400dea70
mov qword [rsp + 0x15dc8], rax
mov rax, qword [rsp + 0x15dc8]
mov qword [rsp + 0x15dd0], rax
mov rcx, qword [rsp + 0x15dd0]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15618]
call fcn.140007060
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, [0x140234ce0]
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8a91
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d8a91
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15620]
call fcn.1400dea70
mov qword [rsp + 0x15dd8], rax
mov rax, qword [rsp + 0x15dd8]
mov qword [rsp + 0x15de0], rax
mov rcx, qword [rsp + 0x15de0]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8058
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15620]
call fcn.140007060
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, str.getdiagnose_GetProcessInfo
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8b58
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d8b58
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15628]
call fcn.1400dea70
mov qword [rsp + 0x15de8], rax
mov rax, qword [rsp + 0x15de8]
mov qword [rsp + 0x15df0], rax
mov rcx, qword [rsp + 0x15df0]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15628]
call fcn.140007060
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, str.processinfo
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8c1f
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d8c1f
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15630]
call fcn.1400dea70
mov qword [rsp + 0x15df8], rax
mov rax, qword [rsp + 0x15df8]
mov qword [rsp + 0x15e00], rax
mov rcx, qword [rsp + 0x15e00]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15630]
call fcn.140007060
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, [0x140234d68]
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d8e67
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d8e67
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rcx, [0x140234d88]
call fcn.1400aa950
lea rcx, [rsp + rax + 0xb00]
call fcn.1400af2e0
mov dword [rsp + 0x1b60], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15638]
call fcn.140055990
lea rdi, [rsp + 0x15cf0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15648]
call fcn.14001d8a0
lea rdi, [rsp + 0x15ce0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x608]
lea r8, [rsp + 0x15cf0]
lea rdx, [rsp + 0x15ce0]
lea rcx, [rsp + 0x1b50]
call fcn.140025460
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.14000f140
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15658]
call fcn.140055990
mov rdx, rax
lea rcx, [rsp + 0x1b50]
call fcn.1400208a0
movzx eax, al
test eax, eax
je 0x1401d8db4
lea rdi, [rsp + 0x15668]
lea rsi, [rsp + 0x1b50]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x15d00]
lea rsi, [rsp + 0x15668]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea r8, [rsp + 0x15d00]
lea rdx, [rsp + 0x15678]
call fcn.140020fb0
cmp dword [rsp + 0x1b60], 0
jne 0x1401d8dda
lea rdx, [rsp + 0x608]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
call fcn.1400072d0
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15688]
call fcn.1400dea70
mov qword [rsp + 0x15e08], rax
mov rax, qword [rsp + 0x15e08]
mov qword [rsp + 0x15e10], rax
mov rcx, qword [rsp + 0x15e10]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15688]
call fcn.140007060
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007280
lea rdx, [0x140234d98]
mov rcx, rax
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401d9204
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
cmp rax, 2
jbe 0x1401d8f2e
lea rcx, [rsp + 0xb00]
call fcn.1400aa950
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15690]
call fcn.1400dea70
mov qword [rsp + 0x15e18], rax
mov rax, qword [rsp + 0x15e18]
mov qword [rsp + 0x15e20], rax
mov rcx, qword [rsp + 0x15e20]
call fcn.140050200
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403c8910]
call fcn.1401cef40
nop
lea rcx, [rsp + 0x15690]
call fcn.140007060
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401e6670
lea rcx, [rsp + 0x7b0]
call fcn.1401e4480
lea rcx, [rsp + 0x670]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d9204
lea rcx, [rsp + 0x9f0]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
cmp eax, 1
jne 0x1401d9204
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403c66e0]
call fcn.14013c160
mov qword [rsp + 0x1b70], rax
mov qword [rsp + 0x1b88], 0
mov qword [rsp + 0x1b78], 0
mov qword [rsp + 0x1b68], 0
lea rcx, [rsp + 0x1b90]
call fcn.140002d10
nop
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403c66e0]
call fcn.14013fb00
mov dword [rsp + 0x1b80], eax
cmp dword [rsp + 0x1b80], 0
jne 0x1401d900a
lea rcx, [rsp + 0x1b90]
call fcn.140007060
jmp 0x1401d86b3
mov r8d, dword [rsp + 0x1b80]
lea rdx, [0x140234db8]
lea rcx, [rsp + 0x1b90]
call fcn.140002ba0
lea rcx, [rsp + 0x1b90]
call fcn.140050200
lea r9, [rsp + 0x1b68]
lea r8, [rsp + 0x1b78]
lea rdx, [rsp + 0x1b88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1401d906a
lea rcx, [rsp + 0x1b90]
call fcn.140007060
jmp 0x1401d86b3
mov rax, qword [rsp + 0x1b68]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jge 0x1401d9088
addsd xmm0, qword [0x140272fc0]
mulsd xmm0, qword [0x140272fd0]
mov rax, qword [rsp + 0x1b78]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jge 0x1401d90ae
addsd xmm1, qword [0x140272fc0]
divsd xmm0, xmm1
comisd xmm0, xmmword [0x140275048]
jbe 0x1401d90ce
lea rcx, [rsp + 0x1b90]
call fcn.140007060
jmp 0x1401d86b3
xor edx, edx
lea rcx, [rsp + 0x1b90]
call fcn.140006e50
movzx edx, ax
lea rcx, [0x1403c66e0]
call fcn.14013f960
cmp dword [rsp + 0x608], eax
jne 0x1401d91f7
mov rax, qword [rsp + 0x1b68]
imul rax, rax, 0x64
xor edx, edx
div qword [rsp + 0x1b78]
mov rdi, rax
xor edx, edx
mov rax, qword [rsp + 0x1b70]
mov ecx, 0x400
div rcx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov eax, dword [rsp + 0x1b80]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x610]
lea rdx, str.Reboot__s___d_M__avoid_write_back_disk___c:__full__free__d___
xor ecx, ecx
call fcn.1400de020
lea rdx, [0x140234e50]
lea rcx, [rsp + 0x15698]
call fcn.1400dad50
mov qword [rsp + 0x15e28], rax
mov rax, qword [rsp + 0x15e28]
mov qword [rsp + 0x15e30], rax
mov rcx, qword [rsp + 0x15e30]
call fcn.140050200
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15698]
call fcn.140007060
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
test eax, eax
jne 0x1401d91f7
mov dword [rsp + 0x1b08], 1
lea rcx, [rsp + 0x1b90]
call fcn.140007060
jmp 0x1401d9209
lea rcx, [rsp + 0x1b90]
call fcn.140007060
jmp 0x1401d86b3
lea rcx, [rsp + 0x1b10]
call fcn.1400206d0
cmp dword [rsp + 0x1b08], 0
je 0x1401d9232
lea rcx, [rsp + 0x1b10]
call fcn.140007250
jmp 0x1401d97d6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b04]
cmp eax, 0x1e
jbe 0x1401d9521
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.14000f140
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a0]
call fcn.140022610
mov rcx, rax
call fcn.14001d480
cmp rax, 0xa
jae 0x1401d94d9
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x156a8]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a4], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a4]
call fcn.140022610
lea rdx, [rsp + 0x156a8]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x156a8]
call fcn.140007060
lea rdx, str.getdiagnose_GetHardwareInfo
lea rcx, [rsp + 0x156b8]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156b0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156b0]
call fcn.140022610
lea rdx, [rsp + 0x156b8]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x156b8]
call fcn.140007060
lea rcx, [rsp + 0x156c8]
call fcn.140001000
mov qword [rsp + 0x15e38], rax
mov rax, qword [rsp + 0x15e38]
mov qword [rsp + 0x15e40], rax
lea r8, [0x140232e34]
mov rdx, qword [rsp + 0x15e40]
lea rcx, [rsp + 0x156d0]
call fcn.1400010b0
mov qword [rsp + 0x15e48], rax
mov rax, qword [rsp + 0x15e48]
mov qword [rsp + 0x15e50], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x15e50]
lea rcx, [rsp + 0x156d8]
call fcn.1400010b0
mov qword [rsp + 0x15e58], rax
mov rax, qword [rsp + 0x15e58]
mov qword [rsp + 0x15e60], rax
lea r8, [0x140234ee0]
mov rdx, qword [rsp + 0x15e60]
lea rcx, [rsp + 0x156e0]
call fcn.1400010b0
mov qword [rsp + 0x15e68], rax
mov rcx, qword [rsp + 0x15e68]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, [0x140234ef0]
lea rcx, [0x140234f10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x156c0], eax
lea rcx, [rsp + 0x156e0]
call fcn.140007060
nop
lea rcx, [rsp + 0x156d8]
call fcn.140007060
nop
lea rcx, [rsp + 0x156d0]
call fcn.140007060
nop
lea rcx, [rsp + 0x156c8]
call fcn.140007060
cmp dword [rsp + 0x156c0], 0
je 0x1401d94d9
lea rdx, str.gettemperature
lea rcx, [rsp + 0x156f0]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156e8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156e8]
call fcn.140022610
lea rdx, [rsp + 0x156f0]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x156f0]
call fcn.140007060
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401e6670
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b00]
cmp eax, 0xe10
jbe 0x1401d97b8
lea rcx, [rsp + 0x15700]
call fcn.140001000
mov qword [rsp + 0x15e70], rax
mov rax, qword [rsp + 0x15e70]
mov qword [rsp + 0x15e78], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x10
mov dword [rsp + 0x15d10], eax
lea r8, [0x140232e5c]
mov rdx, qword [rsp + 0x15e78]
lea rcx, [rsp + 0x15708]
call fcn.1400010b0
mov qword [rsp + 0x15e80], rax
mov rax, qword [rsp + 0x15e80]
mov qword [rsp + 0x15e88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x20
mov dword [rsp + 0x15d10], eax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x15e88]
lea rcx, [rsp + 0x15710]
call fcn.1400010b0
mov qword [rsp + 0x15e90], rax
mov rax, qword [rsp + 0x15e90]
mov qword [rsp + 0x15e98], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x40
mov dword [rsp + 0x15d10], eax
lea r8, [0x140234f40]
mov rdx, qword [rsp + 0x15e98]
lea rcx, [rsp + 0x15718]
call fcn.1400010b0
mov qword [rsp + 0x15ea0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x80
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15ea0]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, str.CheckClientHDD
lea rcx, [0x140234f70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401d968b
lea rcx, [rsp + 0x6d0]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d968b
mov dword [rsp + 0x15ea8], 1
jmp 0x1401d9696
mov dword [rsp + 0x15ea8], 0
movzx eax, byte [rsp + 0x15ea8]
mov byte [rsp + 0x156f8], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x80
test eax, eax
je 0x1401d96ce
and dword [rsp + 0x15d10], 0xffffff7f
lea rcx, [rsp + 0x15718]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x40
test eax, eax
je 0x1401d96f2
and dword [rsp + 0x15d10], 0xffffffbf
lea rcx, [rsp + 0x15710]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x20
test eax, eax
je 0x1401d9716
and dword [rsp + 0x15d10], 0xffffffdf
lea rcx, [rsp + 0x15708]
call fcn.140007060
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x10
test eax, eax
je 0x1401d9739
and dword [rsp + 0x15d10], 0xffffffef
lea rcx, [rsp + 0x15700]
call fcn.140007060
movzx eax, byte [rsp + 0x156f8]
test eax, eax
je 0x1401d97a2
lea rdx, [0x140234f80]
lea rcx, [rsp + 0x15728]
call fcn.140002050
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15720], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15720]
call fcn.140022610
lea rdx, [rsp + 0x15728]
mov rcx, rax
call fcn.140011a30
nop
lea rcx, [rsp + 0x15728]
call fcn.140007060
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x1b10]
call fcn.140007250
jmp 0x1401d853f
jmp 0x1401e0460
mov r8d, 4
lea rdx, str.Sync
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401d981b
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d7200
jmp 0x1401e0460
lea rcx, [0x140234fa8]
call fcn.1400aa950
mov r8, rax
lea rdx, str.setpnpid
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401d9c5d
lea rcx, [rsp + 0x6c8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d98c6
lea rcx, [rsp + 0x670]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d98c6
lea rdx, [rsp + 0x15738]
lea rcx, [rsp + 0x470]
call fcn.1401e2b10
mov qword [rsp + 0x15eb0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x100
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15eb0]
call fcn.1400019a0
test eax, eax
jne 0x1401d98c6
mov dword [rsp + 0x15eb8], 1
jmp 0x1401d98d1
mov dword [rsp + 0x15eb8], 0
movzx eax, byte [rsp + 0x15eb8]
mov byte [rsp + 0x15730], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x100
test eax, eax
je 0x1401d9908
and dword [rsp + 0x15d10], 0xfffffeff
lea rcx, [rsp + 0x15738]
call fcn.140007060
movzx eax, byte [rsp + 0x15730]
test eax, eax
je 0x1401d9939
lea r8, [0x140234fc8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401e0460
lea r8, [0x140234fe0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
mov byte [rsp + 0x1fd0], 0
lea rdi, [rsp + 0x1fd1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
test eax, eax
jne 0x1401d99a2
jmp 0x1401e0460
mov byte [rsp + 0x1bb0], 0
lea rdi, [rsp + 0x1bb1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1bb0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
test eax, eax
jne 0x1401d99eb
jmp 0x1401e0460
lea rdx, [rsp + 0x1fd0]
lea rcx, [rsp + 0x15740]
call fcn.14000f540
mov qword [rsp + 0x15ec0], rax
mov rax, qword [rsp + 0x15ec0]
mov qword [rsp + 0x15ec8], rax
mov rcx, qword [rsp + 0x15ec8]
call fcn.14000f5d0
mov rdx, rax
lea rcx, [rsp + 0x1b98]
call fcn.140002050
nop
lea rcx, [rsp + 0x15740]
call fcn.140002dd0
lea rdx, [rsp + 0x1bb0]
lea rcx, [rsp + 0x15748]
call fcn.14000f540
mov qword [rsp + 0x15ed0], rax
mov rax, qword [rsp + 0x15ed0]
mov qword [rsp + 0x15ed8], rax
mov rcx, qword [rsp + 0x15ed8]
call fcn.14000f5d0
mov rdx, rax
lea rcx, [rsp + 0x1fb0]
call fcn.140002050
nop
lea rcx, [rsp + 0x15748]
call fcn.140002dd0
lea r8, [0x1402340cc]
lea rdx, [0x140234fe8]
lea rcx, [rsp + 0x1b98]
call fcn.140006380
lea r8, [0x1402341dc]
lea rdx, [0x140234ff0]
lea rcx, [rsp + 0x1fb0]
call fcn.140006380
lea r8, [0x140234ff8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da6e0
mov dword [rsp + 0x1fc0], 0
lea rdx, [rsp + 0x15750]
lea rcx, [rsp + 0x470]
call fcn.1401e5200
mov qword [rsp + 0x15ee0], rax
mov rax, qword [rsp + 0x15ee0]
mov qword [rsp + 0x15ee8], rax
lea r9, [rsp + 0x1fc0]
lea r8, [0x14023421c]
lea rdx, [rsp + 0x1fb8]
mov rcx, qword [rsp + 0x15ee8]
call fcn.140006620
nop
lea rcx, [rsp + 0x15750]
call fcn.140007060
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x1fb8]
call fcn.140006920
mov dword [rsp + 0x1ba0], eax
cmp dword [rsp + 0x1ba0], 0
jge 0x1401d9bd2
lea rcx, [rsp + 0x1fb8]
call fcn.140007060
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140007060
nop
lea rcx, [rsp + 0x1b98]
call fcn.140007060
jmp 0x1401e0460
mov r8d, dword [rsp + 0x1ba0]
add r8d, 1
lea rdx, [rsp + 0x15758]
lea rcx, [rsp + 0x1fb8]
call fcn.140006a80
mov qword [rsp + 0x15ef0], rax
mov rax, qword [rsp + 0x15ef0]
mov qword [rsp + 0x15ef8], rax
mov rdx, qword [rsp + 0x15ef8]
lea rcx, [rsp + 0x1fb8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15758]
call fcn.140007060
nop
lea rcx, [rsp + 0x1fb8]
call fcn.140007060
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140007060
nop
lea rcx, [rsp + 0x1b98]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x140235000]
call fcn.1400aa950
mov r8, rax
lea rdx, str.getcmd
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401db63b
mov r8d, 0x800
lea rdx, [rsp + 0x3790]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x3790]
call fcn.14000b150
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea rdx, [rsp + 0x3790]
lea rcx, [rsp + 0x3788]
call fcn.140002050
nop
lea rdx, [0x140235010]
lea rcx, [rsp + 0x3788]
call fcn.140006080
lea rcx, [rsp + 0x2f40]
call fcn.140002d10
nop
mov dword [rsp + 0x3780], 0
mov dword [rsp + 0x2f30], 0
lea rcx, [rsp + 0x6f8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d9d69
lea rcx, [rsp + 0x670]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d9d69
lea rcx, [rsp + 0x6c8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
jne 0x1401d9d69
lea rcx, [rsp + 0x6d8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d9d8b
lea r8, str.setupdate_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401d9dab
lea r8, str.setupdate_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
lea rcx, [rsp + 0x6f8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d9de6
lea r8, str.setsuper_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401d9e06
lea r8, str.setsuper_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
lea rcx, [rsp + 0x6a8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d9eab
lea rcx, [rsp + 0x6b0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15760]
call fcn.140002d40
mov qword [rsp + 0x15f00], rax
mov rax, qword [rsp + 0x15f00]
mov qword [rsp + 0x15f08], rax
mov rcx, qword [rsp + 0x15f08]
call fcn.140002df0
mov r8, rax
lea rdx, str.setdisplay__s_r_n
lea rcx, [rsp + 0x3fa0]
call fcn.1400ae644
nop
lea rcx, [rsp + 0x15760]
call fcn.140002dd0
lea r8, [rsp + 0x3fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
lea rcx, [rsp + 0x2f38]
call fcn.140002d10
nop
lea rcx, [rsp + 0x720]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401d9ee6
lea rdx, str.77.88.8.3_77.88.8.7_
lea rcx, [rsp + 0x2f38]
call fcn.140002020
lea rdx, [rsp + 0x998]
lea rcx, [rsp + 0x2bd8]
call fcn.140001430
nop
lea rcx, [rsp + 0x688]
call fcn.1400019a0
test eax, eax
je 0x1401d9f22
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x2bd8]
call fcn.140002ce0
lea rdx, [rsp + 0x9a0]
lea rcx, [rsp + 0x3f98]
call fcn.140001430
nop
lea rcx, [rsp + 0x690]
call fcn.1400019a0
test eax, eax
je 0x1401d9f5e
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x3f98]
call fcn.140002ce0
lea rcx, [rsp + 0x2bd8]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401d9f8e
mov r8, qword [rsp + 0x2bd8]
lea rdx, [0x1402350a8]
lea rcx, [rsp + 0x2f38]
call fcn.14000df50
lea rcx, [rsp + 0x3f98]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401d9fbe
mov r8, qword [rsp + 0x3f98]
lea rdx, [0x1402350b0]
lea rcx, [rsp + 0x2f38]
call fcn.14000df50
lea rcx, [rsp + 0x2f38]
call fcn.1400019a0
test eax, eax
je 0x1401da05e
lea rcx, [rsp + 0x2f38]
call fcn.1400019a0
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x2f38]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x2c
jne 0x1401da05e
lea rcx, [rsp + 0x2f38]
call fcn.1400019a0
mov r8d, eax
sub r8d, 1
lea rdx, [rsp + 0x15768]
lea rcx, [rsp + 0x2f38]
call fcn.140006ba0
mov qword [rsp + 0x15f10], rax
mov rax, qword [rsp + 0x15f10]
mov qword [rsp + 0x15f18], rax
mov rdx, qword [rsp + 0x15f18]
lea rcx, [rsp + 0x2f38]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15768]
call fcn.140007060
mov r8, qword [rsp + 0x2f38]
lea rdx, str.setdns__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15770]
call fcn.140002d40
mov qword [rsp + 0x15f20], rax
mov rax, qword [rsp + 0x15f20]
mov qword [rsp + 0x15f28], rax
mov rcx, qword [rsp + 0x15f28]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15770]
call fcn.140002dd0
lea rcx, [rsp + 0x3788]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x2f80]
lea r8, [0x140234244]
lea rdx, [0x1402350d0]
lea rcx, [0x1402350e0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x2f80]
cmp eax, 0x47
jne 0x1401da146
lea rdx, str.setgmenu_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
jmp 0x1401da15a
lea rdx, str.setgmenu_0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15778]
call fcn.140002d40
mov qword [rsp + 0x15f30], rax
mov rax, qword [rsp + 0x15f30]
mov qword [rsp + 0x15f38], rax
mov rcx, qword [rsp + 0x15f38]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15778]
call fcn.140002dd0
lea rcx, [rsp + 0x970]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call fcn.1400aac40
lea rcx, [rsp + 0x680]
call fcn.1400019a0
test eax, eax
je 0x1401da212
lea rcx, [rsp + 0x680]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x23d0]
lea rdx, str.route_delete_0.0.0.0_r_nroute_add_0.0.0.0_mask_0.0.0.0__s_metric_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15780]
call fcn.140002d40
mov qword [rsp + 0x15f40], rax
mov rax, qword [rsp + 0x15f40]
mov qword [rsp + 0x15f48], rax
mov rcx, qword [rsp + 0x15f48]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15780]
call fcn.140002dd0
lea rcx, [rsp + 0x700]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
test eax, eax
je 0x1401da535
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x43a0]
call fcn.140001430
nop
mov dword [rsp + 0x43a8], 0
cmp dword [rsp + 0x43a8], 0xffffffff
je 0x1401da528
lea r9, [rsp + 0x43a8]
lea r8, [0x140234854]
lea rdx, [rsp + 0x43b8]
lea rcx, [rsp + 0x43a0]
call fcn.140006620
nop
lea rcx, [rsp + 0x43b8]
call fcn.1400019a0
test eax, eax
jne 0x1401da32e
lea rcx, [rsp + 0x43b8]
call fcn.140007060
jmp 0x1401da528
mov dword [rsp + 0x43ac], 0x10
lea r8, [rsp + 0x43ac]
lea rdx, [rsp + 0x43c0]
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [rsp + 0x43c4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15788]
call fcn.14000f540
mov qword [rsp + 0x15f50], rax
mov rax, qword [rsp + 0x15f50]
mov qword [rsp + 0x15f58], rax
mov rcx, qword [rsp + 0x15f58]
call fcn.14000f5d0
mov rdx, rax
lea rcx, [rsp + 0x43b0]
call fcn.140002050
nop
lea rcx, [rsp + 0x15788]
call fcn.140002dd0
lea rdx, [rsp + 0x43b0]
lea rcx, [rsp + 0x43b8]
call fcn.14001d080
movzx eax, al
test eax, eax
je 0x1401da508
lea rdx, str.net_start_MSiSCSI_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15790]
call fcn.140002d40
mov qword [rsp + 0x15f60], rax
mov rax, qword [rsp + 0x15f60]
mov qword [rsp + 0x15f68], rax
mov rcx, qword [rsp + 0x15f68]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15790]
call fcn.140002dd0
lea r9, [0x1402351e0]
mov r8, qword [rsp + 0x43b8]
lea rdx, str.iscsicli_AddTargetPortal__s_3260_r_niscsicli_LoginTarget__s:00_T______0x00000002__________0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15798]
call fcn.140002d40
mov qword [rsp + 0x15f70], rax
mov rax, qword [rsp + 0x15f70]
mov qword [rsp + 0x15f78], rax
mov rcx, qword [rsp + 0x15f78]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15798]
call fcn.140002dd0
nop
lea rcx, [rsp + 0x43b0]
call fcn.140007060
nop
lea rcx, [rsp + 0x43b8]
call fcn.140007060
jmp 0x1401da528
lea rcx, [rsp + 0x43b0]
call fcn.140007060
nop
lea rcx, [rsp + 0x43b8]
call fcn.140007060
jmp 0x1401da2d8
lea rcx, [rsp + 0x43a0]
call fcn.140007060
lea rcx, [rsp + 0x9b8]
lea rdx, [0x14023491c]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401dac68
lea r8, [rsp + 0x3790]
lea rdx, str._sCmdpublic.txt
lea rcx, [rsp + 0x3788]
call fcn.140002ba0
lea rcx, [rsp + 0x3788]
call fcn.140050200
lea rdx, [0x14023492c]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401da6ef
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab63c
test eax, eax
jne 0x1401da6c2
mov byte [rsp + 0x4730], 0
lea rdi, [rsp + 0x4731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x4730]
call fcn.1400abd44
lea rcx, [rsp + 0x4730]
call fcn.1400aa950
test rax, rax
jne 0x1401da5ff
jmp 0x1401da5a3
mov r8d, 5
lea rdx, [0x14023532c]
lea rcx, [rsp + 0x4730]
call fcn.1400ce558
test eax, eax
jne 0x1401da670
lea rax, [rsp + 0x157a0]
mov qword [rsp + 0x157a8], rax
lea rdx, [rsp + 0x4735]
mov rcx, qword [rsp + 0x157a8]
call fcn.1400ddd50
mov qword [rsp + 0x15f80], rax
mov r8, qword [rsp + 0x15f80]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d5290
jmp 0x1401da5a3
lea rcx, [0x140235338]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x140235348]
lea rcx, [rsp + 0x4730]
call fcn.1400ce558
test eax, eax
jne 0x1401da69c
jmp 0x1401da5a3
lea r8, [rsp + 0x4730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401da5a3
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab86c
lea r8, [0x140234a2c]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
lea rcx, [rsp + 0x658]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x43d0], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401e0720
nop
mov eax, dword [rsp + 0x43d0]
mov dword [rsp + 0x4588], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401cb860
lea rdx, [rsp + 0x4590]
lea rcx, [rsp + 0x43d8]
call fcn.140001430
nop
cmp dword [rsp + 0x43d0], 0
jne 0x1401da768
lea rdx, [0x140235358]
lea rcx, [rsp + 0x43d8]
call fcn.140002020
cmp dword [rsp + 0x43d0], 0xffffffff
jne 0x1401da786
lea rdx, str.Non_PXE
lea rcx, [rsp + 0x43d8]
call fcn.140002020
mov r9, qword [rsp + 0x43d8]
lea r8, [rsp + 0x3790]
lea rdx, [0x140235378]
lea rcx, [rsp + 0x3788]
call fcn.140002ba0
lea rcx, [rsp + 0x3788]
call fcn.140050200
lea rdx, [0x140234a74]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401da903
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab63c
test eax, eax
jne 0x1401da8d6
movzx eax, byte [0x14022824f]
mov byte [rsp + 0x5730], al
lea rdi, [rsp + 0x5731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x5730]
call fcn.1400abd44
lea rcx, [rsp + 0x5730]
call fcn.1400aa950
test rax, rax
jne 0x1401da83f
jmp 0x1401da7dd
mov r8d, 5
lea rdx, [0x140235394]
lea rcx, [rsp + 0x5730]
call fcn.1400ce558
test eax, eax
jne 0x1401da8b0
lea rax, [rsp + 0x157b0]
mov qword [rsp + 0x157b8], rax
lea rdx, [rsp + 0x5735]
mov rcx, qword [rsp + 0x157b8]
call fcn.1400ddd50
mov qword [rsp + 0x15f88], rax
mov r8, qword [rsp + 0x15f88]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d5290
jmp 0x1401da7dd
lea r8, [rsp + 0x5730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401da7dd
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab86c
lea r8, [0x140234a8c]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x157c0]
call fcn.14000f540
mov qword [rsp + 0x15f90], rax
mov rax, qword [rsp + 0x15f90]
mov qword [rsp + 0x15f98], rax
mov rcx, qword [rsp + 0x15f98]
call fcn.14000f5d0
mov r9, rax
lea r8, [rsp + 0x3790]
lea rdx, [0x1402353a0]
lea rcx, [rsp + 0x3788]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x157c0]
call fcn.140002dd0
lea rcx, [rsp + 0x3788]
call fcn.140050200
lea rdx, [0x140234c84]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401daacf
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab63c
test eax, eax
jne 0x1401daaa2
movzx eax, byte [0x140228253]
mov byte [rsp + 0x6730], al
lea rdi, [rsp + 0x6731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x6730]
call fcn.1400abd44
lea rcx, [rsp + 0x6730]
call fcn.1400aa950
test rax, rax
jne 0x1401daa0b
jmp 0x1401da9a9
mov r8d, 5
lea rdx, [0x1402353bc]
lea rcx, [rsp + 0x6730]
call fcn.1400ce558
test eax, eax
jne 0x1401daa7c
lea rax, [rsp + 0x157c8]
mov qword [rsp + 0x157d0], rax
lea rdx, [rsp + 0x6735]
mov rcx, qword [rsp + 0x157d0]
call fcn.1400ddd50
mov qword [rsp + 0x15fa0], rax
mov r8, qword [rsp + 0x15fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d5290
jmp 0x1401da9a9
lea r8, [rsp + 0x6730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401da9a9
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab86c
lea r8, [0x140234d84]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
mov r9, qword [rsp + 0x610]
lea r8, [rsp + 0x3790]
lea rdx, str._sCmd_s.txt
lea rcx, [rsp + 0x3788]
call fcn.140002ba0
lea rcx, [rsp + 0x3788]
call fcn.140050200
lea rdx, [0x140234e4c]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401dac4d
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab63c
test eax, eax
jne 0x1401dac1f
movzx eax, byte [0x140228257]
mov byte [rsp + 0x7730], al
lea rdi, [rsp + 0x7731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x7730]
call fcn.1400abd44
lea rcx, [rsp + 0x7730]
call fcn.1400aa950
test rax, rax
jne 0x1401dab88
jmp 0x1401dab26
mov r8d, 5
lea rdx, [0x1402353e4]
lea rcx, [rsp + 0x7730]
call fcn.1400ce558
test eax, eax
jne 0x1401dabf9
lea rax, [rsp + 0x157d8]
mov qword [rsp + 0x157e0], rax
lea rdx, [rsp + 0x7735]
mov rcx, qword [rsp + 0x157e0]
call fcn.1400ddd50
mov qword [rsp + 0x15fa8], rax
mov r8, qword [rsp + 0x15fa8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401d5290
jmp 0x1401dab26
lea r8, [rsp + 0x7730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dab26
mov rcx, qword [rsp + 0x43e0]
call fcn.1400ab86c
lea r8, [0x140235304]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x43d8]
call fcn.140007060
nop
lea rcx, [rsp + 0x43f0]
call fcn.140005e30
lea rcx, [rsp + 0x9f8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0x3f90], eax
lea rdx, [rsp + 0xa00]
lea rcx, [rsp + 0x2f28]
call fcn.140001430
nop
lea rcx, [rsp + 0x9f8]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401dae84
lea rcx, [rsp + 0x9b8]
lea rdx, [0x140235344]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401dae84
lea rcx, [rsp + 0x157e8]
call fcn.140001000
mov qword [rsp + 0x15fb0], rax
mov rax, qword [rsp + 0x15fb0]
mov qword [rsp + 0x15fb8], rax
lea r8, [0x1402353f0]
mov rdx, qword [rsp + 0x15fb8]
lea rcx, [rsp + 0x8738]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157e8]
call fcn.140007060
lea rcx, [rsp + 0x8738]
call fcn.140050200
lea rdx, [0x140235354]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x8730], rax
cmp qword [rsp + 0x8730], 0
je 0x1401dae2c
mov rcx, qword [rsp + 0x8730]
call fcn.1400ab63c
test eax, eax
jne 0x1401dae1f
xor eax, eax
mov word [rsp + 0x8740], ax
lea rdi, [rsp + 0x8742]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x8730]
mov edx, 0x2000
lea rcx, [rsp + 0x8740]
call fcn.1400ab6ac
lea rcx, [rsp + 0x8740]
call fcn.1400a99d4
test rax, rax
jne 0x1401dadb1
jmp 0x1401dad53
lea rcx, [0x140235410]
call fcn.1400a99d4
mov r8, rax
lea rdx, [0x140235428]
lea rcx, [rsp + 0x8740]
call fcn.1400aab6c
test eax, eax
jne 0x1401dae1a
mov dword [rsp + 0x3f90], 1
lea rcx, [0x140235440]
call fcn.1400a99d4
lea rdx, [rsp + rax*2 + 0x8740]
lea rcx, [rsp + 0x2f28]
call fcn.140002020
lea rdx, [0x140235458]
lea rcx, [rsp + 0x2f28]
call fcn.140006a50
jmp 0x1401dae1f
jmp 0x1401dad53
mov rcx, qword [rsp + 0x8730]
call fcn.1400ab86c
lea rcx, [rsp + 0x9f8]
mov r8d, dword [rsp + 0x3f90]
lea rdx, [0x140235460]
call fcn.140002ba0
lea rcx, [rsp + 0xa00]
lea rdx, [rsp + 0x2f28]
call fcn.140002ce0
lea rcx, [rsp + 0x7b0]
call fcn.1401cbc50
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
nop
lea rcx, [rsp + 0x8738]
call fcn.140007060
cmp dword [rsp + 0x3f90], 0
je 0x1401daf6a
lea r8, [rsp + 0x2f28]
lea rdx, [0x140235470]
lea rcx, [rsp + 0x157f0]
call fcn.140006d10
mov qword [rsp + 0x15fc0], rax
mov rax, qword [rsp + 0x15fc0]
mov qword [rsp + 0x15fc8], rax
lea r8, [0x140235468]
mov rdx, qword [rsp + 0x15fc8]
lea rcx, [rsp + 0xa740]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157f0]
call fcn.140007060
lea rcx, [rsp + 0xa740]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x157f8]
call fcn.1400dad10
mov qword [rsp + 0x15fd0], rax
mov rax, qword [rsp + 0x15fd0]
mov qword [rsp + 0x15fd8], rax
mov rcx, qword [rsp + 0x15fd8]
call fcn.140050200
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x157f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xa740]
call fcn.140007060
lea r8, [rsp + 0x3790]
lea rdx, str._sCCBoot.ini
lea rcx, [rsp + 0x3788]
call fcn.140002ba0
lea rcx, [rsp + 0x2bd0]
call fcn.140002d10
nop
lea rcx, [rsp + 0x2be0]
call fcn.14000dfa0
nop
lea rcx, [rsp + 0x2f48]
call fcn.140007080
nop
lea rdx, [rsp + 0x2f48]
lea rcx, [rsp + 0x2be0]
call fcn.1401cb640
lea rdx, [0x1402354a4]
lea rcx, [rsp + 0x2bd0]
call fcn.140002020
mov dword [rsp + 0xa748], 0
jmp 0x1401daff7
mov eax, dword [rsp + 0xa748]
add eax, 1
mov dword [rsp + 0xa748], eax
movsxd rdi, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007100
cmp rdi, rax
jae 0x1401db220
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007130
mov rcx, rax
add rcx, 0x1a8
lea rdx, [0x1402354a8]
call fcn.140006130
test eax, eax
je 0x1401db046
jmp 0x1401dafe6
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007130
mov rcx, rax
add rcx, 0x1c0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15800]
call fcn.1400021f0
mov qword [rsp + 0x15fe0], rax
mov rax, qword [rsp + 0x15fe0]
mov qword [rsp + 0x15fe8], rax
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007130
mov rcx, rax
add rcx, 0x1a0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15808]
call fcn.1400021f0
mov qword [rsp + 0x15ff0], rax
mov rax, qword [rsp + 0x15ff0]
mov qword [rsp + 0x15ff8], rax
mov r8, qword [rsp + 0x15ff8]
lea rdx, [rsp + 0x2bd0]
lea rcx, [rsp + 0x15810]
call fcn.140006c50
mov qword [rsp + 0x16000], rax
mov rax, qword [rsp + 0x16000]
mov qword [rsp + 0x16008], rax
lea r8, [0x1402354b8]
mov rdx, qword [rsp + 0x16008]
lea rcx, [rsp + 0x15818]
call fcn.1400010b0
mov qword [rsp + 0x16010], rax
mov rax, qword [rsp + 0x16010]
mov qword [rsp + 0x16018], rax
mov r8, qword [rsp + 0x15fe8]
mov rdx, qword [rsp + 0x16018]
lea rcx, [rsp + 0x15820]
call fcn.140006c50
mov qword [rsp + 0x16020], rax
mov rax, qword [rsp + 0x16020]
mov qword [rsp + 0x16028], rax
lea r8, [0x1402354b4]
mov rdx, qword [rsp + 0x16028]
lea rcx, [rsp + 0x15828]
call fcn.1400010b0
mov qword [rsp + 0x16030], rax
mov rax, qword [rsp + 0x16030]
mov qword [rsp + 0x16038], rax
mov rdx, qword [rsp + 0x16038]
lea rcx, [rsp + 0x2bd0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15828]
call fcn.140007060
nop
lea rcx, [rsp + 0x15820]
call fcn.140007060
nop
lea rcx, [rsp + 0x15818]
call fcn.140007060
nop
lea rcx, [rsp + 0x15810]
call fcn.140007060
nop
lea rcx, [rsp + 0x15808]
call fcn.140007060
nop
lea rcx, [rsp + 0x15800]
call fcn.140007060
jmp 0x1401dafe6
lea rcx, [rsp + 0x2f20]
call fcn.140002d10
nop
mov dword [rsp + 0x3780], 0
cmp dword [rsp + 0x3780], 0xffffffff
je 0x1401db3cc
lea r9, [rsp + 0x3780]
lea r8, [0x1402354bc]
lea rdx, [rsp + 0xaf60]
lea rcx, [rsp + 0x2bd0]
call fcn.140006620
nop
lea rcx, [rsp + 0xaf60]
call fcn.1400019a0
test eax, eax
jne 0x1401db28f
lea rcx, [rsp + 0xaf60]
call fcn.140007060
jmp 0x1401db3cc
mov r8d, 1
lea rdx, [rsp + 0x15830]
lea rcx, [rsp + 0xaf60]
call fcn.140006ba0
mov qword [rsp + 0x16040], rax
lea rcx, [rsp + 0x3788]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0x16040]
call fcn.140050200
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xa750]
lea r8, [0x1402354c0]
mov rdx, rax
lea rcx, [0x1402354c8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15830]
call fcn.140007060
movzx eax, word [rsp + 0xa750]
test eax, eax
jne 0x1401db326
lea rcx, [rsp + 0xaf60]
call fcn.140007060
jmp 0x1401db239
lea rdx, [rsp + 0xa750]
lea rcx, [rsp + 0x2f20]
call fcn.140006080
lea rdx, [0x1402354ec]
lea rcx, [rsp + 0x2f20]
call fcn.140006080
mov r8d, 1
lea rdx, [rsp + 0x15838]
lea rcx, [rsp + 0xaf60]
call fcn.140006ae0
mov qword [rsp + 0x16048], rax
mov rax, qword [rsp + 0x16048]
mov qword [rsp + 0x16050], rax
mov rdx, qword [rsp + 0x16050]
lea rcx, [rsp + 0x2f20]
call fcn.140006050
nop
lea rcx, [rsp + 0x15838]
call fcn.140007060
lea rdx, [0x1402354f0]
lea rcx, [rsp + 0x2f20]
call fcn.140006080
nop
lea rcx, [rsp + 0xaf60]
call fcn.140007060
jmp 0x1401db239
lea rcx, [rsp + 0x2f20]
call fcn.1400019a0
test eax, eax
je 0x1401db469
mov r8, qword [rsp + 0x2f20]
lea rdx, [0x1402354f8]
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15840]
call fcn.140002d40
mov qword [rsp + 0x16058], rax
mov rax, qword [rsp + 0x16058]
mov qword [rsp + 0x16060], rax
mov rcx, qword [rsp + 0x16060]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15840]
call fcn.140002dd0
lea rcx, [rsp + 0x3788]
call fcn.140050200
mov r9, rax
mov r8d, 1
lea rdx, str.SetMkLink
lea rcx, [0x140235538]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401db4b7
lea r8, str.setmklink__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
lea rcx, [rsp + 0x3788]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, str.USBWriteProtect
lea rcx, [0x140235578]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401db4f3
lea rax, [0x1402354f4]
mov qword [rsp + 0x16068], rax
jmp 0x1401db502
lea rax, [0x140235534]
mov qword [rsp + 0x16068], rax
mov r8, qword [rsp + 0x16068]
lea rdx, str.setusbwriteprotect__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002ba0
lea rcx, [rsp + 0x2f40]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15848]
call fcn.140002d40
mov qword [rsp + 0x16070], rax
mov rax, qword [rsp + 0x16070]
mov qword [rsp + 0x16078], rax
mov rcx, qword [rsp + 0x16078]
call fcn.140002df0
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x15848]
call fcn.140002dd0
lea r8, str._r_n:end_r_n_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x2f20]
call fcn.140007060
nop
lea rcx, [rsp + 0x2f48]
call fcn.1400070d0
nop
lea rcx, [rsp + 0x2be0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x2bd0]
call fcn.140007060
nop
lea rcx, [rsp + 0x2f28]
call fcn.140007060
nop
lea rcx, [rsp + 0x3f98]
call fcn.140007060
nop
lea rcx, [rsp + 0x2bd8]
call fcn.140007060
nop
lea rcx, [rsp + 0x2f38]
call fcn.140007060
nop
lea rcx, [rsp + 0x2f40]
call fcn.140007060
nop
lea rcx, [rsp + 0x3788]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x1402355c8]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x1402355d8]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401dbd69
lea rcx, str.superenable
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xb788]
call fcn.1400dea70
nop
lea rdx, [0x1402355f8]
lea rcx, [rsp + 0xb788]
call fcn.140006a50
mov dword [rsp + 0xaf68], 0
lea rcx, [rsp + 0xb788]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15850]
call fcn.1400dddd0
mov qword [rsp + 0x16080], rax
mov rcx, qword [rsp + 0x16080]
call fcn.140050200
lea rdx, [rsp + 0xaf68]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xaf70], rax
lea rcx, [rsp + 0x15850]
call fcn.140007060
cmp dword [rsp + 0xaf68], 1
jge 0x1401db74a
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [0x140235600]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xb788]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [0x140235618]
lea rcx, [rsp + 0xb780]
call fcn.140002050
nop
mov dword [rsp + 0xaf6c], 0
mov dword [rsp + 0xb790], 0
jmp 0x1401db788
mov eax, dword [rsp + 0xb790]
add eax, 1
mov dword [rsp + 0xb790], eax
mov eax, dword [rsp + 0xaf68]
cmp dword [rsp + 0xb790], eax
jge 0x1401db93f
lea rcx, [0x140235638]
call fcn.1400a99d4
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._Pwd
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400aab6c
test eax, eax
jne 0x1401db870
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15858]
call fcn.1400ddd90
mov qword [rsp + 0x16088], rax
mov rax, qword [rsp + 0x16088]
mov qword [rsp + 0x16090], rax
mov r8d, 5
lea rdx, [rsp + 0x15860]
mov rcx, qword [rsp + 0x16090]
call fcn.140006a80
mov qword [rsp + 0x16098], rax
mov rax, qword [rsp + 0x16098]
mov qword [rsp + 0x160a0], rax
mov rdx, qword [rsp + 0x160a0]
lea rcx, [rsp + 0xb780]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15860]
call fcn.140007060
nop
lea rcx, [rsp + 0x15858]
call fcn.140007060
lea rcx, [0x140235658]
call fcn.1400a99d4
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._SuperType
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400aab6c
test eax, eax
jne 0x1401db93a
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15868]
call fcn.1400ddd90
mov qword [rsp + 0x160a8], rax
mov rax, qword [rsp + 0x160a8]
mov qword [rsp + 0x160b0], rax
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [rsp + 0x15870]
mov rcx, qword [rsp + 0x160b0]
call fcn.140006a80
mov qword [rsp + 0x160b8], rax
mov rcx, qword [rsp + 0x160b8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xaf6c], eax
lea rcx, [rsp + 0x15870]
call fcn.140007060
nop
lea rcx, [rsp + 0x15868]
call fcn.140007060
jmp 0x1401db777
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x140235688]
lea rcx, [rsp + 0xb780]
call fcn.1400060b0
test eax, eax
jne 0x1401db9a6
lea r8, [0x1402356a8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xb780]
call fcn.140007060
nop
lea rcx, [rsp + 0xb788]
call fcn.140007060
jmp 0x1401e0460
xor eax, eax
mov word [rsp + 0xaf80], ax
lea rdi, [rsp + 0xaf82]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15878]
call fcn.140001000
mov qword [rsp + 0x160c0], rax
mov rax, qword [rsp + 0x160c0]
mov qword [rsp + 0x160c8], rax
lea r8, [0x1402355d4]
mov rdx, qword [rsp + 0x160c8]
lea rcx, [rsp + 0x15880]
call fcn.1400010b0
mov qword [rsp + 0x160d0], rax
mov rax, qword [rsp + 0x160d0]
mov qword [rsp + 0x160d8], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x160d8]
lea rcx, [rsp + 0x15888]
call fcn.1400010b0
mov qword [rsp + 0x160e0], rax
mov rax, qword [rsp + 0x160e0]
mov qword [rsp + 0x160e8], rax
lea r8, [0x1402356c0]
mov rdx, qword [rsp + 0x160e8]
lea rcx, [rsp + 0x15890]
call fcn.1400010b0
mov qword [rsp + 0x160f0], rax
mov rcx, qword [rsp + 0x160f0]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xaf80]
lea r8, [0x1402355e4]
lea rdx, [0x1402356d0]
lea rcx, [0x1402356e8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15890]
call fcn.140007060
nop
lea rcx, [rsp + 0x15888]
call fcn.140007060
nop
lea rcx, [rsp + 0x15880]
call fcn.140007060
nop
lea rcx, [rsp + 0x15878]
call fcn.140007060
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158a0]
call fcn.140004d80
mov qword [rsp + 0x160f8], rax
mov rcx, qword [rsp + 0x160f8]
call fcn.140006ea0
mov byte [rsp + 0x15898], al
lea rcx, [rsp + 0x158a0]
call fcn.140007060
movzx edx, byte [rsp + 0x15898]
test edx, edx
je 0x1401dbb72
lea r8, [0x1402356f8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xb780]
call fcn.140007060
nop
lea rcx, [rsp + 0xb788]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158b0]
call fcn.140004d80
mov qword [rsp + 0x16100], rax
mov rax, qword [rsp + 0x16100]
mov qword [rsp + 0x16108], rax
mov rcx, qword [rsp + 0x16108]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0xb780]
call fcn.1400060b0
mov dword [rsp + 0x158a8], eax
lea rcx, [rsp + 0x158b0]
call fcn.140007060
cmp dword [rsp + 0x158a8], 0
je 0x1401dbc1b
lea r8, [0x140235718]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xb780]
call fcn.140007060
nop
lea rcx, [rsp + 0xb788]
call fcn.140007060
jmp 0x1401e0460
mov r8d, dword [rsp + 0xaf6c]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403c66e0]
call fcn.140142640
mov dword [rsp + 0x16110], eax
cmp dword [rsp + 0x16110], 0xfffffffd
je 0x1401dbc78
cmp dword [rsp + 0x16110], 0xfffffffe
je 0x1401dbc9d
cmp dword [rsp + 0x16110], 0xffffffff
je 0x1401dbcc2
cmp dword [rsp + 0x16110], 0
je 0x1401dbce4
cmp dword [rsp + 0x16110], 1
je 0x1401dbd06
jmp 0x1401dbd28
lea r8, str._ERR_DEVICEID_NOT_MATCH_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dbd49
lea r8, str._ERR_ALREADY_SUPER_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dbd49
lea r8, [0x140235768]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dbd49
lea r8, [0x140235788]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dbd49
lea r8, [0x1402357a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dbd49
lea r8, [0x1402357a8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xb780]
call fcn.140007060
nop
lea rcx, [rsp + 0xb788]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x1402357c8]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x1402357d8]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401dc499
lea rcx, str.superdisable
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xbfc0]
call fcn.1400dea70
nop
lea rdx, [0x1402357f8]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a50
mov dword [rsp + 0xb794], 0
lea rcx, [rsp + 0xbfc0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x158b8]
call fcn.1400dddd0
mov qword [rsp + 0x16118], rax
mov rcx, qword [rsp + 0x16118]
call fcn.140050200
lea rdx, [rsp + 0xb794]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xb7a0], rax
lea rcx, [rsp + 0x158b8]
call fcn.140007060
cmp dword [rsp + 0xb794], 3
jge 0x1401dbe78
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, str._ERR_INVALID_CMD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [0x140235818]
lea rcx, [rsp + 0xbfb0]
call fcn.140002050
nop
mov dword [rsp + 0xbfb8], 0
mov dword [rsp + 0xb798], 0
mov dword [rsp + 0xbfc8], 0
jmp 0x1401dbec1
mov eax, dword [rsp + 0xbfc8]
add eax, 1
mov dword [rsp + 0xbfc8], eax
mov eax, dword [rsp + 0xb794]
cmp dword [rsp + 0xbfc8], eax
jge 0x1401dc0cc
movsxd rax, dword [rsp + 0xbfc8]
mov rdx, qword [rsp + 0xb7a0]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x158c0]
call fcn.1400ddd90
mov qword [rsp + 0x16120], rax
mov rax, qword [rsp + 0x16120]
mov qword [rsp + 0x16128], rax
mov rdx, qword [rsp + 0x16128]
lea rcx, [rsp + 0xbfc0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x158c0]
call fcn.140007060
lea rcx, [0x140235838]
call fcn.1400a99d4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x140235848]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400aab6c
test eax, eax
jne 0x1401dbfbf
mov r8d, 5
lea rdx, [rsp + 0x158c8]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a80
mov qword [rsp + 0x16130], rax
mov rax, qword [rsp + 0x16130]
mov qword [rsp + 0x16138], rax
mov rdx, qword [rsp + 0x16138]
lea rcx, [rsp + 0xbfb0]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x158c8]
call fcn.140007060
jmp 0x1401dbeb0
lea rcx, [0x140235858]
call fcn.1400a99d4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x140235870]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400aab6c
test eax, eax
jne 0x1401dc043
mov r8d, 8
lea rdx, [rsp + 0x158d0]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a80
mov qword [rsp + 0x16140], rax
mov rcx, qword [rsp + 0x16140]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xbfb8], eax
lea rcx, [rsp + 0x158d0]
call fcn.140007060
jmp 0x1401dbeb0
lea rcx, [0x140235888]
call fcn.1400a99d4
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x1402358a0]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400aab6c
test eax, eax
jne 0x1401dc0c7
mov r8d, 0xa
lea rdx, [rsp + 0x158d8]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a80
mov qword [rsp + 0x16148], rax
mov rcx, qword [rsp + 0x16148]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xb798], eax
lea rcx, [rsp + 0x158d8]
call fcn.140007060
jmp 0x1401dbeb0
jmp 0x1401dbeb0
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.VERSION_ERROR
lea rcx, [rsp + 0xbfb0]
call fcn.1400060b0
test eax, eax
jne 0x1401dc133
lea r8, [0x1402358d8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140007060
jmp 0x1401e0460
xor eax, eax
mov word [rsp + 0xb7b0], ax
lea rdi, [rsp + 0xb7b2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x158e0]
call fcn.140001000
mov qword [rsp + 0x16150], rax
mov rax, qword [rsp + 0x16150]
mov qword [rsp + 0x16158], rax
lea r8, [0x140235634]
mov rdx, qword [rsp + 0x16158]
lea rcx, [rsp + 0x158e8]
call fcn.1400010b0
mov qword [rsp + 0x16160], rax
mov rax, qword [rsp + 0x16160]
mov qword [rsp + 0x16168], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x16168]
lea rcx, [rsp + 0x158f0]
call fcn.1400010b0
mov qword [rsp + 0x16170], rax
mov rax, qword [rsp + 0x16170]
mov qword [rsp + 0x16178], rax
lea r8, [0x1402358f0]
mov rdx, qword [rsp + 0x16178]
lea rcx, [rsp + 0x158f8]
call fcn.1400010b0
mov qword [rsp + 0x16180], rax
mov rcx, qword [rsp + 0x16180]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb7b0]
lea r8, [0x140235644]
lea rdx, [0x140235900]
lea rcx, [0x140235918]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x158f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x158f0]
call fcn.140007060
nop
lea rcx, [rsp + 0x158e8]
call fcn.140007060
nop
lea rcx, [rsp + 0x158e0]
call fcn.140007060
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15908]
call fcn.140004d80
mov qword [rsp + 0x16188], rax
mov rcx, qword [rsp + 0x16188]
call fcn.140006ea0
mov byte [rsp + 0x15900], al
lea rcx, [rsp + 0x15908]
call fcn.140007060
movzx edx, byte [rsp + 0x15900]
test edx, edx
je 0x1401dc2ff
lea r8, [0x140235928]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15918]
call fcn.140004d80
mov qword [rsp + 0x16190], rax
mov rax, qword [rsp + 0x16190]
mov qword [rsp + 0x16198], rax
mov rcx, qword [rsp + 0x16198]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0xbfb0]
call fcn.1400060b0
mov dword [rsp + 0x15910], eax
lea rcx, [rsp + 0x15918]
call fcn.140007060
cmp dword [rsp + 0x15910], 0
je 0x1401dc3a8
lea r8, [0x140235948]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140007060
jmp 0x1401e0460
mov r9d, dword [rsp + 0xb798]
mov r8d, dword [rsp + 0xbfb8]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403c66e0]
call fcn.14013b7a0
mov dword [rsp + 0x161a0], eax
cmp dword [rsp + 0x161a0], 0xffffffff
je 0x1401dc3f2
cmp dword [rsp + 0x161a0], 0
je 0x1401dc414
cmp dword [rsp + 0x161a0], 1
je 0x1401dc436
jmp 0x1401dc458
lea r8, str._ERR_GET_DEVICEID_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dc479
lea r8, str._ERR_INVALID_CLIENTID_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dc479
lea r8, str.OK_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dc479
lea r8, str._ERR_OPERATION_FAILURE_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x1402359c0]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x1402359c8]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401dd1b6
lea rcx, str.upload
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xc800]
call fcn.1400dea70
nop
lea rdx, [0x1402359d8]
lea rcx, [rsp + 0xc800]
call fcn.140006a50
mov dword [rsp + 0xc814], 0
lea r9, [rsp + 0xc814]
lea r8, [0x140235654]
lea rdx, [rsp + 0x15920]
lea rcx, [rsp + 0xc800]
call fcn.140006620
mov qword [rsp + 0x161a8], rax
mov rcx, qword [rsp + 0x161a8]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xc810], eax
lea rcx, [rsp + 0x15920]
call fcn.140007060
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401dc576
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea r9, [rsp + 0xc814]
lea r8, [0x1402356a4]
lea rdx, [rsp + 0x15928]
lea rcx, [rsp + 0xc800]
call fcn.140006620
mov qword [rsp + 0x161b0], rax
mov rcx, qword [rsp + 0x161b0]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xc7f8], eax
lea rcx, [rsp + 0x15928]
call fcn.140007060
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401dc5e7
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xc808]
call fcn.140002d10
nop
mov edx, dword [rsp + 0xc814]
lea rcx, [rsp + 0xc800]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x22
jne 0x1401dc683
mov eax, dword [rsp + 0xc814]
add eax, 1
mov dword [rsp + 0xc814], eax
lea r9, [rsp + 0xc814]
lea r8, [0x140235834]
lea rdx, [rsp + 0x15930]
lea rcx, [rsp + 0xc800]
call fcn.140006620
mov qword [rsp + 0x161b8], rax
mov rax, qword [rsp + 0x161b8]
mov qword [rsp + 0x161c0], rax
mov rdx, qword [rsp + 0x161c0]
lea rcx, [rsp + 0xc808]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15930]
call fcn.140007060
jmp 0x1401dc6e2
lea r9, [rsp + 0xc814]
lea r8, [0x140235844]
lea rdx, [rsp + 0x15938]
lea rcx, [rsp + 0xc800]
call fcn.140006620
mov qword [rsp + 0x161c8], rax
mov rax, qword [rsp + 0x161c8]
mov qword [rsp + 0x161d0], rax
mov rdx, qword [rsp + 0x161d0]
lea rcx, [rsp + 0xc808]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15938]
call fcn.140007060
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401dc6fd
lea rax, [0x140235854]
mov qword [rsp + 0x161d8], rax
jmp 0x1401dc761
lea r9, [rsp + 0xc814]
lea r8, [0x1402358d4]
lea rdx, [rsp + 0x15940]
lea rcx, [rsp + 0xc800]
call fcn.140006620
mov qword [rsp + 0x161e0], rax
mov rax, qword [rsp + 0x161e0]
mov qword [rsp + 0x161e8], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x200
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x161e8]
call fcn.140050200
mov qword [rsp + 0x161d8], rax
mov rdx, qword [rsp + 0x161d8]
lea rcx, [rsp + 0xc7f0]
call fcn.140002050
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x200
test eax, eax
je 0x1401dc79f
and dword [rsp + 0x15d10], 0xfffffdff
lea rcx, [rsp + 0x15940]
call fcn.140007060
xor eax, eax
mov word [rsp + 0xbfe0], ax
lea rdi, [rsp + 0xbfe2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15948]
call fcn.140001000
mov qword [rsp + 0x161f0], rax
mov rax, qword [rsp + 0x161f0]
mov qword [rsp + 0x161f8], rax
lea r8, [0x1402359ec]
mov rdx, qword [rsp + 0x161f8]
lea rcx, [rsp + 0x15950]
call fcn.1400010b0
mov qword [rsp + 0x16200], rax
mov rax, qword [rsp + 0x16200]
mov qword [rsp + 0x16208], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x16208]
lea rcx, [rsp + 0x15958]
call fcn.1400010b0
mov qword [rsp + 0x16210], rax
mov rax, qword [rsp + 0x16210]
mov qword [rsp + 0x16218], rax
lea r8, [0x1402359e0]
mov rdx, qword [rsp + 0x16218]
lea rcx, [rsp + 0x15960]
call fcn.1400010b0
mov qword [rsp + 0x16220], rax
mov rcx, qword [rsp + 0x16220]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xbfe0]
lea r8, [0x1402359f0]
lea rdx, [0x1402359f8]
lea rcx, [0x140235a10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15960]
call fcn.140007060
nop
lea rcx, [rsp + 0x15958]
call fcn.140007060
nop
lea rcx, [rsp + 0x15950]
call fcn.140007060
nop
lea rcx, [rsp + 0x15948]
call fcn.140007060
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15970]
call fcn.140004d80
mov qword [rsp + 0x16228], rax
mov rcx, qword [rsp + 0x16228]
call fcn.140006ea0
mov byte [rsp + 0x15968], al
lea rcx, [rsp + 0x15970]
call fcn.140007060
movzx edx, byte [rsp + 0x15968]
test edx, edx
je 0x1401dc979
lea r8, [0x140235a20]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140007060
nop
lea rcx, [rsp + 0xc808]
call fcn.140007060
nop
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15980]
call fcn.140004d80
mov qword [rsp + 0x16230], rax
mov rax, qword [rsp + 0x16230]
mov qword [rsp + 0x16238], rax
mov rcx, qword [rsp + 0x16238]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0xc7f0]
call fcn.1400060b0
mov dword [rsp + 0x15978], eax
lea rcx, [rsp + 0x15980]
call fcn.140007060
cmp dword [rsp + 0x15978], 0
je 0x1401dca30
lea r8, [0x140235a40]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140007060
nop
lea rcx, [rsp + 0xc808]
call fcn.140007060
nop
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xc7e8]
call fcn.1400021f0
nop
mov r8d, 1
lea rdx, [rsp + 0x15990]
lea rcx, [rsp + 0xc7e8]
call fcn.140006ae0
mov qword [rsp + 0x16240], rax
lea rdx, [0x140235a58]
mov rcx, qword [rsp + 0x16240]
call fcn.140006e10
mov byte [rsp + 0x15988], al
lea rcx, [rsp + 0x15990]
call fcn.140007060
movzx edx, byte [rsp + 0x15988]
test edx, edx
je 0x1401dcaba
lea rdx, [0x140235a5c]
lea rcx, [rsp + 0xc7e8]
call fcn.140006080
lea rcx, [rsp + 0xc808]
call fcn.140050200
lea rdx, [0x140235a60]
mov rcx, rax
call fcn.1400ab38c
test rax, rax
jne 0x1401dcb35
lea r8, [rsp + 0xc808]
lea rdx, [rsp + 0xc7e8]
lea rcx, [rsp + 0x15998]
call fcn.140006c50
mov qword [rsp + 0x16248], rax
mov rax, qword [rsp + 0x16248]
mov qword [rsp + 0x16250], rax
mov rdx, qword [rsp + 0x16250]
lea rcx, [rsp + 0xc7e8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15998]
call fcn.140007060
jmp 0x1401dcb4a
lea rdx, [rsp + 0xc808]
lea rcx, [rsp + 0xc7e8]
call fcn.140002ce0
lea rcx, [rsp + 0xc7e8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dcbda
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x140235a80]
mov ecx, 1
call fcn.1400de020
lea r8, [0x140235a68]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140007060
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140007060
nop
lea rcx, [rsp + 0xc808]
call fcn.140007060
nop
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x140235ae0]
xor ecx, ecx
call fcn.1400de020
lea rcx, [rsp + 0xc7e8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movsxd rdi, dword [rsp + 0xc7f8]
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
lea rcx, [rsp + 0xc7e8]
call fcn.140050200
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1401040e0
mov dword [rsp + 0xc7e0], eax
cmp dword [rsp + 0xc7e0], 0
jne 0x1401dccdf
lea rcx, [rsp + 0xc7e8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rsp + 0xc7e8]
lea rdx, str._ERROR__Ceate_image__s_error
mov ecx, 1
call fcn.1400de020
lea r8, str._ERR_CREATE_VMDK_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140007060
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140007060
nop
lea rcx, [rsp + 0xc808]
call fcn.140007060
nop
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xc820]
call fcn.14000d650
nop
lea rax, [rsp + 0x159a0]
mov qword [rsp + 0x159a8], rax
lea rdx, [rsp + 0xc7e8]
mov rcx, qword [rsp + 0x159a8]
call fcn.140001430
mov qword [rsp + 0x16258], rax
mov rdx, qword [rsp + 0x16258]
lea rcx, [rsp + 0xc820]
call fcn.1401e3e80
test eax, eax
jne 0x1401dcda4
lea rdx, [0x140235b08]
lea rcx, [rsp + 0x159b0]
call fcn.1400f05c0
mov qword [rsp + 0x16260], rax
mov rax, qword [rsp + 0x16260]
mov qword [rsp + 0x16268], rax
lea rcx, [rsp + 0xc9c0]
mov rdx, qword [rsp + 0x16268]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x159b0]
call fcn.140007060
lea rcx, [rsp + 0xc9c8]
lea rdx, [rsp + 0xc7e8]
call fcn.140002ce0
lea rcx, [rsp + 0xc820]
call fcn.1401e3690
lea rcx, [rsp + 0xbfd8]
call fcn.140002d10
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140002d10
nop
lea rax, [rsp + 0x159b8]
mov qword [rsp + 0x159c0], rax
lea rdx, [0x140235a64]
mov rcx, qword [rsp + 0x159c0]
call fcn.140002050
mov qword [rsp + 0x16270], rax
mov rax, qword [rsp + 0x16270]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xbfd0]
lea rdx, [rsp + 0xbfd8]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140015310
lea rcx, [rsp + 0xbfd0]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401dce47
lea rdx, [0x140235b88]
lea rcx, [rsp + 0xbfd0]
call fcn.140002020
lea rcx, [rsp + 0xbfd8]
call fcn.140006990
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401e6670
test eax, eax
jne 0x1401dd021
lea rax, [rsp + 0x159c8]
mov qword [rsp + 0x159d0], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159d0]
call fcn.140001430
mov qword [rsp + 0x16278], rax
mov rdx, qword [rsp + 0x16278]
lea rcx, [rsp + 0x470]
call fcn.1401e6500
test eax, eax
jne 0x1401dcf99
lea rax, [rsp + 0x159d8]
mov qword [rsp + 0x159e0], rax
lea rax, [rsp + 0x159e8]
mov qword [rsp + 0x159f0], rax
lea rdx, [rsp + 0xbfd0]
mov rcx, qword [rsp + 0x159e0]
call fcn.140001430
mov qword [rsp + 0x16280], rax
mov rax, qword [rsp + 0x16280]
mov qword [rsp + 0x16288], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159f0]
call fcn.140001430
mov qword [rsp + 0x16290], rax
mov rax, qword [rsp + 0x16288]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x16290]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401e67d0
lea rcx, [rsp + 0x658]
lea rdx, [0x140235b98]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401dcf87
lea rcx, [rsp + 0x658]
lea rdx, [0x140235ba0]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
jmp 0x1401dd01f
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000d900
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002ce0
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140235ba4]
call fcn.140002020
lea rcx, [rsp + 0x658]
lea rdx, [0x140235ba8]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401dd012
lea rcx, [rsp + 0x658]
lea rdx, [0x140235bb0]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
jmp 0x1401dd09b
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xbfd8]
call fcn.140002ce0
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002ce0
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140235bb4]
call fcn.140002020
lea rcx, [rsp + 0x658]
lea rdx, [0x140235bb8]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401dd08e
lea rcx, [rsp + 0x658]
lea rdx, [0x140235bc0]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
lea rcx, [rsp + 0x6f8]
lea rdx, [0x140235bc4]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
lea rcx, [0x1403c66e0]
call fcn.140020b40
mov r8d, eax
lea rdx, str.OK__d_r_n
lea rcx, [rsp + 0xb00]
call fcn.1400ae644
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140007060
nop
lea rcx, [rsp + 0xbfd8]
call fcn.140007060
nop
lea rcx, [rsp + 0xc820]
call fcn.140005e30
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140007060
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140007060
nop
lea rcx, [rsp + 0xc808]
call fcn.140007060
nop
lea rcx, [rsp + 0xc800]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x140235bd8]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x140235be8]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401de32f
lea rcx, str.disk2vhd
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xd5f0]
call fcn.1400dea70
nop
lea rdx, [0x140235c04]
lea rcx, [rsp + 0xd5f0]
call fcn.140006a50
mov dword [rsp + 0xd604], 0
lea r9, [rsp + 0xd604]
lea r8, [0x140235c0c]
lea rdx, [rsp + 0x159f8]
lea rcx, [rsp + 0xd5f0]
call fcn.140006620
mov qword [rsp + 0x16298], rax
mov rcx, qword [rsp + 0x16298]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xd600], eax
lea rcx, [rsp + 0x159f8]
call fcn.140007060
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401dd2b4
lea r8, [0x140235c10]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xd5f8]
call fcn.140002d10
nop
mov edx, dword [rsp + 0xd604]
lea rcx, [rsp + 0xd5f0]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x22
jne 0x1401dd350
mov eax, dword [rsp + 0xd604]
add eax, 1
mov dword [rsp + 0xd604], eax
lea r9, [rsp + 0xd604]
lea r8, [0x140235c24]
lea rdx, [rsp + 0x15a00]
lea rcx, [rsp + 0xd5f0]
call fcn.140006620
mov qword [rsp + 0x162a0], rax
mov rax, qword [rsp + 0x162a0]
mov qword [rsp + 0x162a8], rax
mov rdx, qword [rsp + 0x162a8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15a00]
call fcn.140007060
jmp 0x1401dd3af
lea r9, [rsp + 0xd604]
lea r8, [0x140235c28]
lea rdx, [rsp + 0x15a08]
lea rcx, [rsp + 0xd5f0]
call fcn.140006620
mov qword [rsp + 0x162b0], rax
mov rax, qword [rsp + 0x162b0]
mov qword [rsp + 0x162b8], rax
mov rdx, qword [rsp + 0x162b8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15a08]
call fcn.140007060
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401dd3ca
lea rax, [0x140235c2c]
mov qword [rsp + 0x162c0], rax
jmp 0x1401dd42e
lea r9, [rsp + 0xd604]
lea r8, [0x140235c30]
lea rdx, [rsp + 0x15a10]
lea rcx, [rsp + 0xd5f0]
call fcn.140006620
mov qword [rsp + 0x162c8], rax
mov rax, qword [rsp + 0x162c8]
mov qword [rsp + 0x162d0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x400
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x162d0]
call fcn.140050200
mov qword [rsp + 0x162c0], rax
mov rdx, qword [rsp + 0x162c0]
lea rcx, [rsp + 0xd5c0]
call fcn.140002050
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x400
test eax, eax
je 0x1401dd46c
and dword [rsp + 0x15d10], 0xfffffbff
lea rcx, [rsp + 0x15a10]
call fcn.140007060
xor eax, eax
mov word [rsp + 0xcdb0], ax
lea rdi, [rsp + 0xcdb2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15a18]
call fcn.140001000
mov qword [rsp + 0x162d8], rax
mov rax, qword [rsp + 0x162d8]
mov qword [rsp + 0x162e0], rax
lea r8, [0x140235c34]
mov rdx, qword [rsp + 0x162e0]
lea rcx, [rsp + 0x15a20]
call fcn.1400010b0
mov qword [rsp + 0x162e8], rax
mov rax, qword [rsp + 0x162e8]
mov qword [rsp + 0x162f0], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x162f0]
lea rcx, [rsp + 0x15a28]
call fcn.1400010b0
mov qword [rsp + 0x162f8], rax
mov rax, qword [rsp + 0x162f8]
mov qword [rsp + 0x16300], rax
lea r8, [0x140235c38]
mov rdx, qword [rsp + 0x16300]
lea rcx, [rsp + 0x15a30]
call fcn.1400010b0
mov qword [rsp + 0x16308], rax
mov rcx, qword [rsp + 0x16308]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xcdb0]
lea r8, [0x140235c44]
lea rdx, [0x140235c48]
lea rcx, [0x140235c60]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15a30]
call fcn.140007060
nop
lea rcx, [rsp + 0x15a28]
call fcn.140007060
nop
lea rcx, [rsp + 0x15a20]
call fcn.140007060
nop
lea rcx, [rsp + 0x15a18]
call fcn.140007060
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a40]
call fcn.140004d80
mov qword [rsp + 0x16310], rax
mov rcx, qword [rsp + 0x16310]
call fcn.140006ea0
mov byte [rsp + 0x15a38], al
lea rcx, [rsp + 0x15a40]
call fcn.140007060
movzx edx, byte [rsp + 0x15a38]
test edx, edx
je 0x1401dd646
lea r8, [0x140235c70]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a50]
call fcn.140004d80
mov qword [rsp + 0x16318], rax
mov rax, qword [rsp + 0x16318]
mov qword [rsp + 0x16320], rax
mov rcx, qword [rsp + 0x16320]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0xd5c0]
call fcn.1400060b0
mov dword [rsp + 0x15a48], eax
lea rcx, [rsp + 0x15a50]
call fcn.140007060
cmp dword [rsp + 0x15a48], 0
je 0x1401dd6fd
lea r8, [0x140235c90]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xd5b8]
call fcn.1400021f0
nop
mov r8d, 1
lea rdx, [rsp + 0x15a60]
lea rcx, [rsp + 0xd5b8]
call fcn.140006ae0
mov qword [rsp + 0x16328], rax
lea rdx, [0x140235ca8]
mov rcx, qword [rsp + 0x16328]
call fcn.140006e10
mov byte [rsp + 0x15a58], al
lea rcx, [rsp + 0x15a60]
call fcn.140007060
movzx edx, byte [rsp + 0x15a58]
test edx, edx
je 0x1401dd787
lea rdx, [0x140235cac]
lea rcx, [rsp + 0xd5b8]
call fcn.140006080
lea rcx, [rsp + 0xd5f8]
call fcn.140050200
lea rdx, [0x140235cb0]
mov rcx, rax
call fcn.1400ab38c
test rax, rax
jne 0x1401dd802
lea r8, [rsp + 0xd5f8]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0x15a68]
call fcn.140006c50
mov qword [rsp + 0x16330], rax
mov rax, qword [rsp + 0x16330]
mov qword [rsp + 0x16338], rax
mov rdx, qword [rsp + 0x16338]
lea rcx, [rsp + 0xd5b8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15a68]
call fcn.140007060
jmp 0x1401dd817
lea rdx, [rsp + 0xd5f8]
lea rcx, [rsp + 0xd5b8]
call fcn.140002ce0
lea rcx, [rsp + 0xd5b8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dd8a7
mov r8, qword [rsp + 0xd5b8]
lea rdx, str._ERROR__Cannot_create_image___s_exists
mov ecx, 1
call fcn.1400de020
lea r8, str._ERR_FILE_EXISTS_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
mov r8, qword [rsp + 0xd5b8]
lea rdx, str.Create_new_image__s
xor ecx, ecx
call fcn.1400de020
lea rcx, [rsp + 0xd5b8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140235cb4]
lea rcx, [rsp + 0xcda0]
call fcn.140002050
nop
lea rdx, str._echo_off_r_n_t_t_t_t_t_t_t___REM_CCBootShare_Required_Services_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:rpc_endpoint_mapper_r_n_t_t_t_t_t_t_t___REM_RPC_Endpoint_Mapper_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_mapper_service_r_n_t_t_t_t_t_t_t___sc_config_nsi_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_nsi_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:dcom_server_process_launcher_r_n_t_t_t_t_t_t_t___REM_DCOM_Server_Process_Launcher_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_dcom_service_r_n_t_t_t_t_t_t_t___sc_config_DcomLaunch_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_DcomLaunch_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:remote_procedure_call_r_n_t_t_t_t_t_t_t___REM_Remote_Procedure_Call__RPC__r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_service_r_n_t_t_t_t_t_t_t___sc_config_RpcSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_RpcSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:security_accounts_manager_r_n_t_t_t_t_t_t_t___REM_Security_Accounts_Manager_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_security_service_r_n_t_t_t_t_t_t_t___sc_config_SamSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_SamSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:server_service_r_n_t_t_t_t_t_t_t___REM_Server_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_server_service_r_n_t_t_t_t_t_t_t___sc_config_LanmanServer_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_LanmanServer_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:bat_exit_r_n_t_t_t_t_t_t_t___echo_12__get_sid_gust_variable_r_n_t_t_t_t_t_t_t___for__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_t_t_t_t_t_t_t___if_not____a__SID____r_n_t_t_t_t_t_t_t___set_sid_guest__a_r_n_t_t_t_t_t_t_t___goto_loop_end_r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:loop_end_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_13__create_script_for_regini_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_14__add_permission_for_machine_security_r_n_t_t_t_t_t_t_t___net_user_guest__active:yes_r_n_t_t_t_t_t_t_t___regini_x_r_n_t_t_t_t_t_t_t___del_x_r_n_t_t_t_t_t_t_t____echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_t_t_t_t_t_t_t____echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_t_t_t_t_t_t_t____echo__hex_0_:42_00_00_00____y.reg_r_n_t_t_t_t_t_t_t___reg_import_y.reg_r_n_t_t_t_t_t_t_t___del_y.reg_r_n_t_t_t_t_t_t_t____echo_on_r_n
lea rcx, [rsp + 0xcda0]
call fcn.140002020
mov rdx, qword [rsp + 0x165d0]
add rdx, 0x228
lea r8, [0x140237508]
lea rcx, [rsp + 0xd5c8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0xd5d0]
call fcn.140093cf4
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140050200
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.14009447c
test eax, eax
je 0x1401dda8a
lea rcx, [rsp + 0xd5d0]
call fcn.140025730
lea rcx, [rsp + 0xcda0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15a70]
call fcn.1400dad10
mov qword [rsp + 0x16340], rax
mov rax, qword [rsp + 0x16340]
mov qword [rsp + 0x16348], rax
lea rcx, [rsp + 0xcda0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15a78]
call fcn.1400dad10
mov qword [rsp + 0x16350], rax
mov rax, qword [rsp + 0x16350]
mov qword [rsp + 0x16358], rax
mov rcx, qword [rsp + 0x16348]
call fcn.1400019a0
mov edi, eax
mov rcx, qword [rsp + 0x16358]
call fcn.140050200
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.140093974
nop
lea rcx, [rsp + 0x15a78]
call fcn.140007060
nop
lea rcx, [rsp + 0x15a70]
call fcn.140007060
lea rcx, [rsp + 0xd5d0]
call fcn.140093c6c
lea rcx, [rsp + 0xd5c8]
call fcn.140050200
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004880
lea rcx, [rsp + 0xd5c8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0xcb98]
call fcn.140001430
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0xcb98]
call fcn.140006280
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xcb98]
call fcn.140006920
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x15a80]
lea rcx, [rsp + 0xcb98]
call fcn.1400021f0
mov qword [rsp + 0x16360], rax
mov rax, qword [rsp + 0x16360]
mov qword [rsp + 0x16368], rax
mov rdx, qword [rsp + 0x16368]
lea rcx, [rsp + 0xcb98]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15a80]
call fcn.140007060
lea rcx, [rsp + 0xcb98]
call fcn.1400019a0
cmp eax, 2
jne 0x1401ddba0
mov edx, 1
lea rcx, [rsp + 0xcb98]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x3a
jne 0x1401ddba0
lea r8, [0x140237504]
lea rdx, [rsp + 0xcb98]
lea rcx, [rsp + 0x15a88]
call fcn.1400010b0
mov qword [rsp + 0x16370], rax
mov rax, qword [rsp + 0x16370]
mov qword [rsp + 0x16378], rax
mov rdx, qword [rsp + 0x16378]
lea rcx, [rsp + 0xcb98]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15a88]
call fcn.140007060
mov r8, qword [rsp + 0xcb98]
lea rdx, str.SetAcl___s__start
xor ecx, ecx
call fcn.1400de020
xor edx, edx
lea rcx, [rsp + 0xcbc0]
call fcn.140181160
nop
lea rax, [rsp + 0x15a90]
mov qword [rsp + 0x15a98], rax
lea rax, [rsp + 0x15aa0]
mov qword [rsp + 0x15aa8], rax
lea rax, [rsp + 0x15ab0]
mov qword [rsp + 0x15ab8], rax
lea rdx, [0x140237558]
mov rcx, qword [rsp + 0x15a98]
call fcn.140002050
mov qword [rsp + 0x16380], rax
mov rax, qword [rsp + 0x16380]
mov qword [rsp + 0x16388], rax
lea rdx, [0x140237568]
mov rcx, qword [rsp + 0x15aa8]
call fcn.140002050
mov qword [rsp + 0x16390], rax
mov rax, qword [rsp + 0x16390]
mov qword [rsp + 0x16398], rax
lea rdx, [rsp + 0xcb98]
mov rcx, qword [rsp + 0x15ab8]
call fcn.140001430
mov qword [rsp + 0x163a0], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x16388]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x16398]
mov r8d, 1
mov rdx, qword [rsp + 0x163a0]
lea rcx, [rsp + 0xcbc0]
call fcn.14018c5b0
mov dword [rsp + 0xd5b0], eax
mov r9, qword [rsp + 0xcb98]
mov r8d, dword [rsp + 0xd5b0]
lea rdx, str.SetAcl___d____s_
xor ecx, ecx
call fcn.1400de020
xor r8d, r8d
lea rdx, [0x1402375a8]
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea rcx, [0x1402375c0]
call fcn.140020b60
mov qword [rsp + 0xcb60], rax
mov dword [rsp + 0xcb68], 0
mov qword [rsp + 0xcb70], 0
mov dword [rsp + 0xcb78], 0x7f
mov dword [rsp + 0xcb7c], 0xffffffff
mov dword [rsp + 0xcb80], 0
lea rcx, [rsp + 0xcb98]
call fcn.140022590
mov rcx, rax
call fcn.140020b60
mov qword [rsp + 0xcb88], rax
lea rcx, [0x1402375d8]
call fcn.140020b60
mov qword [rsp + 0xcb90], rax
xor r9d, r9d
lea r8, [rsp + 0xcb60]
mov edx, 2
xor ecx, ecx
call sub.NETAPI32.dll_NetShareAdd
mov dword [rsp + 0xcba8], eax
cmp dword [rsp + 0xcba8], 0
je 0x1401dde36
lea rdx, str._ERROR__Sharing_of_image_file_failed.
mov ecx, 1
call fcn.1400de020
lea r8, str._ERR_SHARE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140181070
nop
lea rcx, [rsp + 0xcb98]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5d0]
call fcn.140093f40
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140007060
nop
lea rcx, [rsp + 0xcda0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xd610]
call fcn.14000d650
nop
lea rax, [rsp + 0x15ac0]
mov qword [rsp + 0x15ac8], rax
lea rdx, [rsp + 0xd5b8]
mov rcx, qword [rsp + 0x15ac8]
call fcn.140001430
mov qword [rsp + 0x163a8], rax
mov rdx, qword [rsp + 0x163a8]
lea rcx, [rsp + 0xd610]
call fcn.1401e3e80
test eax, eax
jne 0x1401ddefb
lea rdx, [0x140237660]
lea rcx, [rsp + 0x15ad0]
call fcn.1400f05c0
mov qword [rsp + 0x163b0], rax
mov rax, qword [rsp + 0x163b0]
mov qword [rsp + 0x163b8], rax
lea rcx, [rsp + 0xd7b0]
mov rdx, qword [rsp + 0x163b8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15ad0]
call fcn.140007060
lea rcx, [rsp + 0xd7b8]
lea rdx, [rsp + 0xd5b8]
call fcn.140002ce0
lea rcx, [rsp + 0xd610]
call fcn.1401e3690
lea rcx, [rsp + 0xcbb0]
call fcn.140002d10
nop
lea rcx, [rsp + 0xcba0]
call fcn.140002d10
nop
lea rax, [rsp + 0x15ad8]
mov qword [rsp + 0x15ae0], rax
lea rdx, [0x140237554]
mov rcx, qword [rsp + 0x15ae0]
call fcn.140002050
mov qword [rsp + 0x163c0], rax
mov rax, qword [rsp + 0x163c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xcba0]
lea rdx, [rsp + 0xcbb0]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140015310
lea rcx, [rsp + 0xcba0]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401ddf9e
lea rdx, str.Master
lea rcx, [rsp + 0xcba0]
call fcn.140002020
lea rcx, [rsp + 0xcbb0]
call fcn.140006990
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401e6670
test eax, eax
jne 0x1401de178
lea rax, [rsp + 0x15ae8]
mov qword [rsp + 0x15af0], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15af0]
call fcn.140001430
mov qword [rsp + 0x163c8], rax
mov rdx, qword [rsp + 0x163c8]
lea rcx, [rsp + 0x470]
call fcn.1401e6500
test eax, eax
jne 0x1401de0f0
lea rax, [rsp + 0x15af8]
mov qword [rsp + 0x15b00], rax
lea rax, [rsp + 0x15b08]
mov qword [rsp + 0x15b10], rax
lea rdx, [rsp + 0xcba0]
mov rcx, qword [rsp + 0x15b00]
call fcn.140001430
mov qword [rsp + 0x163d0], rax
mov rax, qword [rsp + 0x163d0]
mov qword [rsp + 0x163d8], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15b10]
call fcn.140001430
mov qword [rsp + 0x163e0], rax
mov rax, qword [rsp + 0x163d8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x163e0]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401e67d0
lea rcx, [rsp + 0x658]
lea rdx, [0x140237688]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401de0de
lea rcx, [rsp + 0x658]
lea rdx, [0x14023765c]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
jmp 0x1401de176
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000d900
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002ce0
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140237690]
call fcn.140002020
lea rcx, [rsp + 0x658]
lea rdx, [0x140237694]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401de169
lea rcx, [rsp + 0x658]
lea rdx, [0x14023769c]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
jmp 0x1401de1f2
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xcbb0]
call fcn.140002ce0
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002ce0
lea rcx, [rsp + 0x6f0]
lea rdx, [0x1402376a0]
call fcn.140002020
lea rcx, [rsp + 0x658]
lea rdx, [0x1402376a4]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401de1e5
lea rcx, [rsp + 0x658]
lea rdx, [0x1402376ac]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
lea rcx, [rsp + 0x6f8]
lea rdx, [0x1402376b0]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
lea r8, [0x1402376b4]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xcba0]
call fcn.140007060
nop
lea rcx, [rsp + 0xcbb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd610]
call fcn.140005e30
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140181070
nop
lea rcx, [rsp + 0xcb98]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5d0]
call fcn.140093f40
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140007060
nop
lea rcx, [rsp + 0xcda0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x1402376c0]
call fcn.1400aa950
mov r8, rax
lea rdx, str.endupload
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401de5d1
cmp dword [rsp + 0x608], 0
jbe 0x1401de59b
lea rcx, [rsp + 0x6f8]
lea rdx, [0x1402376dc]
call fcn.140006dd0
movzx eax, al
test eax, eax
je 0x1401de59b
lea rcx, [rsp + 0x6f8]
lea rdx, [0x1402376e0]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
lea rcx, [0x1402376e8]
call fcn.1400aa950
mov r8, rax
lea rdx, str.endupload_ok
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401de54c
lea rcx, [rsp + 0xd950]
call fcn.14000d650
nop
lea rax, [rsp + 0x15b18]
mov qword [rsp + 0x15b20], rax
lea rdx, [0x140237708]
mov rcx, qword [rsp + 0x15b20]
call fcn.1400f05c0
mov qword [rsp + 0x163e8], rax
mov rdx, qword [rsp + 0x163e8]
lea rcx, [rsp + 0xd950]
call fcn.1401e3d20
test eax, eax
je 0x1401de53f
lea rcx, [rsp + 0x15b28]
call fcn.14000dd70
lea r8, str._m_d_H_M
lea rdx, [rsp + 0x15b30]
mov rcx, rax
call fcn.14000d730
mov qword [rsp + 0x163f0], rax
mov rax, qword [rsp + 0x163f0]
mov qword [rsp + 0x163f8], rax
mov r8, qword [rsp + 0x163f8]
lea rdx, [0x140237738]
lea rcx, [rsp + 0x15b38]
call fcn.140006d10
mov qword [rsp + 0x16400], rax
mov rax, qword [rsp + 0x16400]
mov qword [rsp + 0x16408], rax
lea rcx, [rsp + 0xdaf0]
mov rdx, qword [rsp + 0x16408]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15b38]
call fcn.140007060
nop
lea rcx, [rsp + 0x15b30]
call fcn.140007060
lea rcx, [rsp + 0xd950]
call fcn.1401cbc50
lea rcx, [rsp + 0x660]
mov r8d, dword [rsp + 0xdae8]
lea rdx, [0x140237740]
call fcn.140002ba0
lea rcx, [rsp + 0x668]
lea rdx, [0x1402376e4]
call fcn.140002020
lea rcx, [rsp + 0x470]
call fcn.1401e31e0
lea rcx, [rsp + 0x950]
mov r8d, dword [rsp + 0x608]
lea rdx, [0x140237748]
call fcn.140002ba0
lea rcx, [rsp + 0x7b0]
call fcn.1401cbc50
nop
lea rcx, [rsp + 0xd950]
call fcn.140005e30
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
xor r8d, r8d
lea rdx, str.Disk2VHD
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea r8, [0x140237764]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401e0460
lea rcx, [0x140237770]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x140237780]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401ded04
lea rcx, str.multisyncto
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xe4a8]
call fcn.1400dea70
nop
lea rdx, [0x1402377a0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006a50
mov dword [rsp + 0xe4b0], 0
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402377a8]
lea rdx, [rsp + 0x15b40]
lea rcx, [rsp + 0xe4a8]
call fcn.140006620
mov qword [rsp + 0x16410], rax
mov rcx, qword [rsp + 0x16410]
call fcn.140050200
mov rcx, rax
call fcn.1400aac5c
mov dword [rsp + 0xdc98], eax
lea rcx, [rsp + 0x15b40]
call fcn.140007060
cmp dword [rsp + 0xe4b0], 0xffffffff
jne 0x1401de6cf
lea r8, [0x1402377b0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402377ac]
lea rdx, [rsp + 0xe4a0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006620
nop
xor eax, eax
mov word [rsp + 0xdca0], ax
lea rdi, [rsp + 0xdca2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15b48]
call fcn.140001000
mov qword [rsp + 0x16418], rax
mov rax, qword [rsp + 0x16418]
mov qword [rsp + 0x16420], rax
lea r8, [0x1402377d4]
mov rdx, qword [rsp + 0x16420]
lea rcx, [rsp + 0x15b50]
call fcn.1400010b0
mov qword [rsp + 0x16428], rax
mov rax, qword [rsp + 0x16428]
mov qword [rsp + 0x16430], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x16430]
lea rcx, [rsp + 0x15b58]
call fcn.1400010b0
mov qword [rsp + 0x16438], rax
mov rax, qword [rsp + 0x16438]
mov qword [rsp + 0x16440], rax
lea r8, [0x1402377c8]
mov rdx, qword [rsp + 0x16440]
lea rcx, [rsp + 0x15b60]
call fcn.1400010b0
mov qword [rsp + 0x16448], rax
mov rcx, qword [rsp + 0x16448]
call fcn.140050200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xdca0]
lea r8, [0x1402377d8]
lea rdx, [0x1402377e0]
lea rcx, [0x1402377f8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15b60]
call fcn.140007060
nop
lea rcx, [rsp + 0x15b58]
call fcn.140007060
nop
lea rcx, [rsp + 0x15b50]
call fcn.140007060
nop
lea rcx, [rsp + 0x15b48]
call fcn.140007060
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b70]
call fcn.140004d80
mov qword [rsp + 0x16450], rax
mov rcx, qword [rsp + 0x16450]
call fcn.140006ea0
mov byte [rsp + 0x15b68], al
lea rcx, [rsp + 0x15b70]
call fcn.140007060
movzx edx, byte [rsp + 0x15b68]
test edx, edx
je 0x1401de8c0
lea r8, str._ERR_NEED_SET_ADMIN_PASSWORD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b80]
call fcn.140004d80
mov qword [rsp + 0x16458], rax
mov rax, qword [rsp + 0x16458]
mov qword [rsp + 0x16460], rax
mov rcx, qword [rsp + 0x16460]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0xe4a0]
call fcn.1400060b0
mov dword [rsp + 0x15b78], eax
lea rcx, [rsp + 0x15b80]
call fcn.140007060
cmp dword [rsp + 0x15b78], 0
je 0x1401de969
lea r8, str._ERR_NO_PERMISSION_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xdc90]
call fcn.140002d10
nop
cmp dword [rsp + 0xdc98], 0
jne 0x1401decb5
mov edx, dword [rsp + 0xe4b0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x22
jne 0x1401dea13
mov eax, dword [rsp + 0xe4b0]
add eax, 1
mov dword [rsp + 0xe4b0], eax
lea r9, [rsp + 0xe4b0]
lea r8, [0x140237840]
lea rdx, [rsp + 0x15b88]
lea rcx, [rsp + 0xe4a8]
call fcn.140006620
mov qword [rsp + 0x16468], rax
mov rax, qword [rsp + 0x16468]
mov qword [rsp + 0x16470], rax
mov rdx, qword [rsp + 0x16470]
lea rcx, [rsp + 0xdc90]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15b88]
call fcn.140007060
jmp 0x1401dea72
lea r9, [rsp + 0xe4b0]
lea r8, [0x140237844]
lea rdx, [rsp + 0x15b90]
lea rcx, [rsp + 0xe4a8]
call fcn.140006620
mov qword [rsp + 0x16478], rax
mov rax, qword [rsp + 0x16478]
mov qword [rsp + 0x16480], rax
mov rdx, qword [rsp + 0x16480]
lea rcx, [rsp + 0xdc90]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15b90]
call fcn.140007060
lea rcx, [rsp + 0xe4c0]
call fcn.14000d650
nop
lea rax, [rsp + 0x15b98]
mov qword [rsp + 0x15ba0], rax
lea rdx, [rsp + 0xdc90]
mov rcx, qword [rsp + 0x15ba0]
call fcn.140001430
mov qword [rsp + 0x16488], rax
mov rdx, qword [rsp + 0x16488]
lea rcx, [rsp + 0xe4c0]
call fcn.1401e3d20
test eax, eax
je 0x1401deca8
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xeb40]
call fcn.14000d590
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007080
nop
lea rdx, [rsp + 0xeeb0]
lea rcx, [rsp + 0xeb40]
call fcn.1401cb640
lea rcx, [rsp + 0xeeb0]
call fcn.140007100
test rax, rax
jbe 0x1401deb8d
lea r8, str._ERR_CHILD_IMAGE_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xeeb0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005e30
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xdc90]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xe800]
call fcn.1401e0680
nop
lea rcx, [rsp + 0xee80]
call fcn.140007080
nop
lea rdx, [rsp + 0xee80]
lea rcx, [rsp + 0xe800]
call fcn.1401cb640
lea rcx, [rsp + 0xee80]
call fcn.140007100
test rax, rax
jbe 0x1401dec70
lea r8, str._ERR_RECOVERY_POINT_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xee80]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xe800]
call fcn.140005e30
nop
lea rcx, [rsp + 0xeeb0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005e30
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xdc90]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xee80]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xe800]
call fcn.140005e30
nop
lea rcx, [rsp + 0xeeb0]
call fcn.1400070d0
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005e30
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005e30
lea r8, [0x140237888]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xdc90]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140007060
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x140237890]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x1402378a0]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401dfb08
lea rcx, str.robocopyready
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xf288]
call fcn.1400dea70
nop
lea rdx, [0x1402378c0]
lea rcx, [rsp + 0xf288]
call fcn.140006a50
mov dword [rsp + 0xf2a0], 0
lea rcx, [rsp + 0xf298]
call fcn.140002d10
nop
lea rcx, [rsp + 0xf258]
call fcn.140002d10
nop
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x22
jne 0x1401dee1a
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x1402378c8]
lea rdx, [rsp + 0x15ba8]
lea rcx, [rsp + 0xf288]
call fcn.140006620
mov qword [rsp + 0x16490], rax
mov rax, qword [rsp + 0x16490]
mov qword [rsp + 0x16498], rax
mov rdx, qword [rsp + 0x16498]
lea rcx, [rsp + 0xf298]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15ba8]
call fcn.140007060
jmp 0x1401dee79
lea r9, [rsp + 0xf2a0]
lea r8, [0x1402378cc]
lea rdx, [rsp + 0x15bb0]
lea rcx, [rsp + 0xf288]
call fcn.140006620
mov qword [rsp + 0x164a0], rax
mov rax, qword [rsp + 0x164a0]
mov qword [rsp + 0x164a8], rax
mov rdx, qword [rsp + 0x164a8]
lea rcx, [rsp + 0xf298]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15bb0]
call fcn.140007060
cmp dword [rsp + 0xf2a0], 0xffffffff
jne 0x1401deed2
lea r8, [0x1402378d0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xf258]
call fcn.140007060
nop
lea rcx, [rsp + 0xf298]
call fcn.140007060
nop
lea rcx, [rsp + 0xf288]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0xf298]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401def35
lea r8, [0x1402378e8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0xf258]
call fcn.140007060
nop
lea rcx, [rsp + 0xf298]
call fcn.140007060
nop
lea rcx, [rsp + 0xf288]
call fcn.140007060
jmp 0x1401e0460
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x22
jne 0x1401defc3
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x1402378fc]
lea rdx, [rsp + 0x15bb8]
lea rcx, [rsp + 0xf288]
call fcn.140006620
mov qword [rsp + 0x164b0], rax
mov rax, qword [rsp + 0x164b0]
mov qword [rsp + 0x164b8], rax
mov rdx, qword [rsp + 0x164b8]
lea rcx, [rsp + 0xf258]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15bb8]
call fcn.140007060
jmp 0x1401df022
lea r9, [rsp + 0xf2a0]
lea r8, [0x140237900]
lea rdx, [rsp + 0x15bc0]
lea rcx, [rsp + 0xf288]
call fcn.140006620
mov qword [rsp + 0x164c0], rax
mov rax, qword [rsp + 0x164c0]
mov qword [rsp + 0x164c8], rax
mov rdx, qword [rsp + 0x164c8]
lea rcx, [rsp + 0xf258]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15bc0]
call fcn.140007060
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15bc8]
call fcn.14000f540
mov qword [rsp + 0x164d0], rax
mov rax, qword [rsp + 0x164d0]
mov qword [rsp + 0x164d8], rax
mov rcx, qword [rsp + 0x164d8]
call fcn.14000f5d0
mov rdx, rax
lea rcx, [rsp + 0xef00]
call fcn.140002050
nop
lea rcx, [rsp + 0x15bc8]
call fcn.140002dd0
lea r8, [rsp + 0xef00]
lea rdx, [0x140237924]
lea rcx, [rsp + 0x15bd0]
call fcn.140006d10
mov qword [rsp + 0x164e0], rax
mov rax, qword [rsp + 0x164e0]
mov qword [rsp + 0x164e8], rax
lea r8, [0x140237908]
mov rdx, qword [rsp + 0x164e8]
lea rcx, [rsp + 0xeef8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15bd0]
call fcn.140007060
lea r8, [rsp + 0xf298]
lea rdx, [0x140237930]
lea rcx, [rsp + 0xf278]
call fcn.140006d10
nop
lea rcx, [rsp + 0xef10]
call fcn.14000dfa0
nop
lea rax, [rsp + 0x15bd8]
mov qword [rsp + 0x15be0], rax
lea rdx, [0x140237938]
mov rcx, qword [rsp + 0x15be0]
call fcn.140002050
mov qword [rsp + 0x164f0], rax
mov rdx, qword [rsp + 0x164f0]
lea rcx, [rsp + 0xef10]
call fcn.1401e5bd0
test eax, eax
je 0x1401df1f2
lea rdx, [rsp + 0xf0b0]
lea r8, [0x140237904]
lea rcx, [rsp + 0x15be8]
call fcn.1400010b0
mov qword [rsp + 0x164f8], rax
mov rax, qword [rsp + 0x164f8]
mov qword [rsp + 0x16500], rax
lea r8, [rsp + 0xf298]
mov rdx, qword [rsp + 0x16500]
lea rcx, [rsp + 0x15bf0]
call fcn.140006c50
mov qword [rsp + 0x16508], rax
mov rax, qword [rsp + 0x16508]
mov qword [rsp + 0x16510], rax
mov rdx, qword [rsp + 0x16510]
lea rcx, [rsp + 0xf278]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15bf0]
call fcn.140007060
nop
lea rcx, [rsp + 0x15be8]
call fcn.140007060
mov dword [rsp + 0xeee8], 1
lea rcx, [rsp + 0xf2b0]
call fcn.14000d650
nop
lea rax, [rsp + 0x15bf8]
mov qword [rsp + 0x15c00], rax
lea rdx, [rsp + 0xf258]
mov rcx, qword [rsp + 0x15c00]
call fcn.140001430
mov qword [rsp + 0x16518], rax
mov rdx, qword [rsp + 0x16518]
lea rcx, [rsp + 0xf2b0]
call fcn.1401e3d20
test eax, eax
je 0x1401df271
lea rdx, [rsp + 0xf458]
lea rcx, [rsp + 0xf278]
call fcn.140002ce0
mov dword [rsp + 0xeee8], 0
call fcn.14018fd90
lea rdx, [0x140237948]
mov qword [rsp + 0x20], rdx
lea r9, [0x140237968]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x140237988]
lea rcx, [rsp + 0xf288]
call fcn.140002ba0
lea rcx, [rsp + 0xf288]
call fcn.140050200
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004880
xor r8d, r8d
lea rdx, [0x140237944]
lea rcx, [rsp + 0xeef8]
call fcn.140006800
cmp eax, 0xffffffff
je 0x1401df37e
lea r8, [rsp + 0xeef8]
lea rdx, [0x1402379c4]
lea rcx, [rsp + 0x15c08]
call fcn.140006d10
mov qword [rsp + 0x16520], rax
mov rax, qword [rsp + 0x16520]
mov qword [rsp + 0x16528], rax
lea r8, [0x1402379c0]
mov rdx, qword [rsp + 0x16528]
lea rcx, [rsp + 0x15c10]
call fcn.1400010b0
mov qword [rsp + 0x16530], rax
mov rax, qword [rsp + 0x16530]
mov qword [rsp + 0x16538], rax
mov rdx, qword [rsp + 0x16538]
lea rcx, [rsp + 0xeef8]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15c10]
call fcn.140007060
nop
lea rcx, [rsp + 0x15c08]
call fcn.140007060
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xf278]
call fcn.140006920
mov r9d, eax
add r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xf280]
lea rcx, [rsp + 0xf278]
call fcn.1400021f0
nop
xor r8d, r8d
lea rdx, [0x1402379c8]
lea rcx, [rsp + 0xf280]
call fcn.140006800
cmp eax, 0xffffffff
je 0x1401df468
lea r8, [rsp + 0xf280]
lea rdx, [0x1402379d0]
lea rcx, [rsp + 0x15c18]
call fcn.140006d10
mov qword [rsp + 0x16540], rax
mov rax, qword [rsp + 0x16540]
mov qword [rsp + 0x16548], rax
lea r8, [0x1402379cc]
mov rdx, qword [rsp + 0x16548]
lea rcx, [rsp + 0x15c20]
call fcn.1400010b0
mov qword [rsp + 0x16550], rax
mov rax, qword [rsp + 0x16550]
mov qword [rsp + 0x16558], rax
mov rdx, qword [rsp + 0x16558]
lea rcx, [rsp + 0xf280]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x15c20]
call fcn.140007060
nop
lea rcx, [rsp + 0x15c18]
call fcn.140007060
mov rax, qword [rsp + 0xf298]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf280]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x1402379d8]
lea rcx, [rsp + 0xf288]
call fcn.140002ba0
lea rcx, [rsp + 0xf288]
call fcn.140050200
mov rdx, rax
xor ecx, ecx
call fcn.1400de020
mov qword [rsp + 0xeef0], 0
mov qword [rsp + 0xeee0], 0
mov dword [rsp + 0xf260], 0x18
mov qword [rsp + 0xf268], 0
mov dword [rsp + 0xf270], 1
xor r9d, r9d
lea r8, [rsp + 0xf260]
lea rdx, [rsp + 0xeee0]
lea rcx, [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1401df520
lea rdx, str.Failed_to_create_pipe_
mov ecx, 1
call fcn.1400de020
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0xf290], 0
mov dword [rsp + 0xf250], 0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x11610]
call fcn.1400a9850
mov dword [rsp + 0x11610], 0x68
lea rcx, [rsp + 0x11610]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdx, qword [rsp + 0xeee0]
mov qword [rsp + 0x11670], rdx
mov rax, qword [rsp + 0xeee0]
mov qword [rsp + 0x11668], rax
xor eax, eax
mov word [rsp + 0x11650], ax
lea rax, str.winsta0default
mov qword [rsp + 0x11620], rax
mov dword [rsp + 0x1164c], 0x101
xor eax, eax
mov word [rsp + 0xf5f0], ax
lea rdi, [rsp + 0xf5f2]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
lea rcx, [rsp + 0xf288]
call fcn.140050200
mov r8d, 0x1000
mov rdx, rax
lea rcx, [rsp + 0xf5f0]
call fcn.1400aa9f8
lea rdx, [rsp + 0x115f0]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x11610]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xf5f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0xf290], eax
cmp dword [rsp + 0xf290], 0
jne 0x1401df701
lea rdx, str.Failed_to_CreateProcessAsUser_
mov ecx, 1
call fcn.1400de020
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0xf280]
call fcn.140007060
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xef10]
call fcn.140005e30
nop
lea rcx, [rsp + 0xf278]
call fcn.140007060
nop
lea rcx, [rsp + 0xeef8]
call fcn.140007060
nop
lea rcx, [rsp + 0xef00]
call fcn.140007060
nop
lea rcx, [rsp + 0xf258]
call fcn.140007060
nop
lea rcx, [rsp + 0xf298]
call fcn.140007060
nop
lea rcx, [rsp + 0xf288]
call fcn.140007060
jmp 0x1401e0460
xor eax, eax
cmp eax, 1
je 0x1401df972
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x11680], eax
cmp dword [rsp + 0x11680], 0
jne 0x1401df732
jmp 0x1401df972
mov byte [rsp + 0x116a0], 0
lea rdi, [rsp + 0x116a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x11694], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, 0xfff
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x11694], 1
jae 0x1401df7a6
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401df701
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, dword [rsp + 0x11694]
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x11690], eax
cmp dword [rsp + 0x11690], 0
je 0x1401df7f0
cmp dword [rsp + 0x11694], 0
jne 0x1401df811
lea rdx, str.Failed_to_ReadFile_in_piple_
mov ecx, 1
call fcn.1400de020
mov dword [rsp + 0xf250], 1
jmp 0x1401df972
lea rdx, [rsp + 0x116a0]
lea rcx, [rsp + 0x11688]
call fcn.1400ecc70
nop
lea rcx, [rsp + 0x11688]
call fcn.140011a10
lea rcx, [rsp + 0x11688]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401df954
lea rcx, [rsp + 0x11688]
call fcn.1400019a0
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x11688]
call fcn.140006e50
movzx eax, ax
cmp eax, 0x25
jne 0x1401df954
mov dx, 0x25
lea rcx, [rsp + 0x11688]
call fcn.140022420
mov byte [rsp + 0x126a0], 0
lea rdi, [rsp + 0x126a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11688]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x15c28]
call fcn.1400ecbf0
mov qword [rsp + 0x16560], rax
mov r9, qword [rsp + 0x16560]
mov r9, qword [r9]
lea r8, str.__s_r_n
mov edx, 0x1000
lea rcx, [rsp + 0x126a0]
call fcn.1400ae6e0
lea rcx, [rsp + 0x15c28]
call fcn.140007060
lea r8, [rsp + 0x126a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
test eax, eax
jne 0x1401df954
lea rdx, str.terminate_robocopy_because_another_server_exit_sync
xor ecx, ecx
call fcn.1400de020
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0x11688]
call fcn.140007060
jmp 0x1401df972
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x11688]
call fcn.140007060
jmp 0x1401df701
mov rcx, qword [rsp + 0xeee0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.CCBootSyncTo
lea rdx, str.NET_SHARE__s__DELETE
lea rcx, [rsp + 0xf288]
call fcn.140002ba0
lea rcx, [rsp + 0xf288]
call fcn.140050200
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004880
cmp dword [rsp + 0xf250], 0
je 0x1401df9f8
lea r8, [0x140237b98]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401dfa86
cmp dword [rsp + 0xeee8], 0
je 0x1401dfa45
lea rcx, [rsp + 0xf450]
lea rdx, [rsp + 0xf258]
call fcn.140002ce0
lea rcx, [rsp + 0xf458]
lea rdx, [rsp + 0xf278]
call fcn.140002ce0
lea rcx, [rsp + 0xf2b0]
call fcn.1401e3690
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
lea r8, [0x140237bb0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
nop
lea rcx, [rsp + 0xf280]
call fcn.140007060
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005e30
nop
lea rcx, [rsp + 0xef10]
call fcn.140005e30
nop
lea rcx, [rsp + 0xf278]
call fcn.140007060
nop
lea rcx, [rsp + 0xeef8]
call fcn.140007060
nop
lea rcx, [rsp + 0xef00]
call fcn.140007060
nop
lea rcx, [rsp + 0xf258]
call fcn.140007060
nop
lea rcx, [rsp + 0xf298]
call fcn.140007060
nop
lea rcx, [rsp + 0xf288]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [0x140237bb8]
call fcn.1400aa950
mov r8, rax
lea rdx, [0x140237bd0]
lea rcx, [rsp + 0xb00]
call fcn.1400ce558
test eax, eax
jne 0x1401e0439
lea rcx, str.multisynctofile
call fcn.1400aa950
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0x14e50]
call fcn.1400ddd50
nop
lea rdx, [0x140237bfc]
lea rcx, [rsp + 0x14e50]
call fcn.140006a50
mov dword [rsp + 0x14e60], 0
lea r9, [rsp + 0x14e60]
lea r8, [0x1402379d4]
lea rdx, [rsp + 0x15c30]
lea rcx, [rsp + 0x14e50]
call fcn.140006620
mov qword [rsp + 0x16568], rax
mov rcx, qword [rsp + 0x16568]
call fcn.140050200
mov rcx, rax
call fcn.1400aac68
mov qword [rsp + 0x13a00], rax
lea rcx, [rsp + 0x15c30]
call fcn.140007060
cmp dword [rsp + 0x14e60], 0xffffffff
jne 0x1401dfc07
lea r8, str._ERR_PARAM_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x14e50]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0x15c38]
call fcn.140001000
mov qword [rsp + 0x16570], rax
mov rax, qword [rsp + 0x16570]
mov qword [rsp + 0x16578], rax
lea r8, str._syncdb.xml
mov rdx, qword [rsp + 0x16578]
lea rcx, [rsp + 0x139f8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15c38]
call fcn.140007060
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x139f8]
call fcn.140006920
mov dword [rsp + 0x139f0], eax
cmp dword [rsp + 0x139f0], 0xffffffff
je 0x1401dfcd0
mov r8d, dword [rsp + 0x139f0]
lea rdx, [rsp + 0x15c40]
lea rcx, [rsp + 0x139f8]
call fcn.140006ba0
mov qword [rsp + 0x16580], rax
mov rax, qword [rsp + 0x16580]
mov qword [rsp + 0x16588], rax
mov rcx, qword [rsp + 0x16588]
call fcn.140050200
mov rcx, rax
call fcn.140004b40
nop
lea rcx, [rsp + 0x15c40]
call fcn.140007060
lea rcx, [rsp + 0x139f8]
call fcn.140050200
lea rdx, [0x140237c38]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x14e58], rax
cmp qword [rsp + 0x14e58], 0
jne 0x1401dfd40
lea r8, [0x140237c40]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x139f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x14e50]
call fcn.140007060
jmp 0x1401e0460
mov byte [rsp + 0x13d50], 0
lea rdi, [rsp + 0x13d51]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x14e64], 0
jmp 0x1401dfd77
mov eax, dword [rsp + 0x14e64]
add eax, 1
mov dword [rsp + 0x14e64], eax
mov edi, dword [rsp + 0x14e64]
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
cmp rdi, rax
jae 0x1401dfe00
mov qword [rsp + 0x14e68], 0x1000
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x14e68]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da4b0
test eax, eax
jne 0x1401dfdd8
jmp 0x1401dfe00
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x14e68]
lea rcx, [rsp + 0x13d50]
call fcn.1400ade24
jmp 0x1401dfd66
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
mov qword [rsp + 0x136a0], rdx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x136a0]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da4b0
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x136a0]
lea rcx, [rsp + 0x13d50]
call fcn.1400ade24
mov rcx, qword [rsp + 0x14e58]
call fcn.1400ab86c
lea rcx, [rsp + 0x14d80]
call fcn.1400e82c0
nop
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov dword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rax
lea rdx, [rsp + 0x15c48]
lea rcx, [rsp + 0x14d80]
call fcn.1400eb690
mov rcx, rax
call fcn.1400e53c0
movzx eax, al
test eax, eax
jne 0x1401dff4a
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dfefb
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [0x140237c58]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6b90
nop
lea rcx, [rsp + 0x139f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x14e50]
call fcn.140007060
jmp 0x1401e0460
xor r9d, r9d
lea r8, [0x140237c70]
lea rdx, [rsp + 0x14d50]
lea rcx, [rsp + 0x14d80]
call fcn.1400ebff0
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4720
test rax, rax
jne 0x1401e000d
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401dffb0
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._ERR_COPY_FILE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4770
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6b90
nop
lea rcx, [rsp + 0x139f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x14e50]
call fcn.140007060
jmp 0x1401e0460
lea rcx, [rsp + 0x13a10]
call fcn.1401e0790
nop
lea rcx, [rsp + 0x13a10]
call fcn.1401cba60
mov dword [rsp + 0x14e70], 0
jmp 0x1401e0046
mov eax, dword [rsp + 0x14e70]
add eax, 1
mov dword [rsp + 0x14e70], eax
mov edi, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4720
cmp rdi, rax
jae 0x1401e0164
lea rcx, [rsp + 0x14e80]
call fcn.1401e0790
nop
mov dword [rsp + 0x15018], 0
lea rcx, [rsp + 0x14e80]
call fcn.1401e5810
mov dword [rsp + 0x151c0], 0
jmp 0x1401e00a7
mov eax, dword [rsp + 0x151c0]
add eax, 1
mov dword [rsp + 0x151c0], eax
mov eax, dword [rsp + 0x151b0]
cmp dword [rsp + 0x151c0], eax
jae 0x1401e0144
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x14e88]
call fcn.140050200
mov rdi, rax
mov edx, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e46f0
lea rdx, [rsp + 0x15c60]
mov rcx, rax
call fcn.1400e7990
mov r8, rdi
lea rdx, [rsp + 0x15c68]
mov rcx, rax
call fcn.1400e6ea0
lea r8, [0x140237cc8]
lea rdx, [rsp + 0x15c70]
mov rcx, rax
call fcn.1400e6df0
mov rcx, rax
call fcn.1400e5720
mov rdx, rax
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x15020]
call fcn.140002020
jmp 0x1401e0096
lea rcx, [rsp + 0x14e80]
call fcn.1401cc080
nop
lea rcx, [rsp + 0x14e80]
call fcn.140005e30
jmp 0x1401e0035
lea rcx, [rsp + 0x136b0]
call fcn.1401e0720
nop
lea rcx, [rsp + 0x136b0]
call fcn.1401cba60
xor r9d, r9d
lea r8, [0x140237cd8]
lea rdx, [rsp + 0x15c78]
lea rcx, [rsp + 0x14d80]
call fcn.1400ebff0
mov qword [rsp + 0x16590], rax
mov rax, qword [rsp + 0x16590]
mov qword [rsp + 0x16598], rax
mov rdx, qword [rsp + 0x16598]
lea rcx, [rsp + 0x14d50]
call fcn.1400e6340
nop
lea rcx, [rsp + 0x15c78]
call fcn.1400e4770
mov dword [rsp + 0x151c4], 0
jmp 0x1401e01f7
mov eax, dword [rsp + 0x151c4]
add eax, 1
mov dword [rsp + 0x151c4], eax
mov edi, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4720
cmp rdi, rax
jae 0x1401e0367
lea rcx, [rsp + 0x151d0]
call fcn.1401e0720
nop
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e46f0
lea rdx, [rsp + 0x15ca0]
mov rcx, rax
call fcn.1400e7990
lea r8, [0x140237d04]
lea rdx, [rsp + 0x15ca8]
mov rcx, rax
call fcn.1400e6ea0
lea r8, [0x140237d10]
lea rdx, [rsp + 0x15cb0]
mov rcx, rax
call fcn.1400e6df0
xor edx, edx
mov rcx, rax
call fcn.1400e8300
mov dword [rsp + 0x15510], eax
mov dword [rsp + 0x15514], 0
jmp 0x1401e02a3
mov eax, dword [rsp + 0x15514]
add eax, 1
mov dword [rsp + 0x15514], eax
mov eax, dword [rsp + 0x15500]
cmp dword [rsp + 0x15514], eax
jae 0x1401e0340
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x151d8]
call fcn.140050200
mov rdi, rax
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e46f0
lea rdx, [rsp + 0x15cb8]
mov rcx, rax
call fcn.1400e7990
mov r8, rdi
lea rdx, [rsp + 0x15cc0]
mov rcx, rax
call fcn.1400e6ea0
lea r8, [0x140237d20]
lea rdx, [rsp + 0x15cc8]
mov rcx, rax
call fcn.1400e6df0
mov rcx, rax
call fcn.1400e5720
mov rdx, rax
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x15370]
call fcn.140002020
jmp 0x1401e0292
mov edx, dword [rsp + 0x15510]
lea rcx, [rsp + 0x151d0]
call fcn.1401e2730
nop
lea rcx, [rsp + 0x151d0]
call fcn.140005e30
jmp 0x1401e01e6
mov edx, 1
xor ecx, ecx
call fcn.1401cc440
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8056
xor edx, edx
lea rcx, [0x1403c8910]
call fcn.1401cf1e0
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401e03c3
lea rcx, [rsp + 0x139f8]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str.OK__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
nop
lea rcx, [rsp + 0x136b0]
call fcn.140005e30
nop
lea rcx, [rsp + 0x13a10]
call fcn.140005e30
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4770
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e6b90
nop
lea rcx, [rsp + 0x139f8]
call fcn.140007060
nop
lea rcx, [rsp + 0x14e50]
call fcn.140007060
jmp 0x1401e0460
lea r8, str._ERR_VERSION_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400db000
jmp 0x1401e0460
mov edx, 1
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_shutdown]
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x60], 0x400
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400da4b0
mov dword [rsp + 0x15cd0], 0
lea rcx, [rsp + 0x470]
call fcn.140005e30
nop
lea rcx, [rsp + 0x7b0]
call fcn.140005e30
mov eax, dword [rsp + 0x15cd0]
mov rcx, qword [rsp + 0x165a0]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0x165b8
pop rdi
pop rsi
ret