Function at 0x1401b3080
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get disk information
Link many functions at runtime
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0xdac8
call fcn.1401d4c90
sub rsp, rax
mov qword [rsp + 0xd900], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0xdab0], rax
mov rax, qword [rsp + 0xdae8]
mov qword [rsp + 0xd908], rax
cmp qword [rsp + 0xd908], 0x8156
ja 0x1401b3137
cmp qword [rsp + 0xd908], 0x8156
je 0x1401b69b9
mov rax, qword [rsp + 0xd908]
sub rax, 0x804f
mov qword [rsp + 0xd908], rax
cmp qword [rsp + 0xd908], 0xa6
ja case.0x1401b3135.32848
lea rcx, [0x140000000]
mov rax, qword [rsp + 0xd908]
movzx eax, byte [rcx + rax + 0x1b6aac]
mov eax, dword [rcx + rax*4 + 0x1b6a80]
add rax, rcx
jmp rax
cmp qword [rsp + 0xd908], 0x816e
je 0x1401b36f3
cmp qword [rsp + 0xd908], 0x8172
je 0x1401b5630
jmp case.0x1401b3135.32848
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140158980
nop
lea rcx, [rsp + 0x40]
call fcn.140081900
cmp rax, 1
je 0x1401b319e
mov dword [rsp + 0xd640], 0
lea rcx, [rsp + 0x40]
call fcn.140158740
mov eax, dword [rsp + 0xd640]
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
call fcn.14000ebf0
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x250]
mov r8d, eax
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
nop
lea rcx, [rsp + 0x40]
call fcn.140158740
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
jge 0x1401b3222
xor eax, eax
jmp 0x1401b6a66
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.140158980
nop
mov dword [rsp + 0x494], 1
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x270]
call fcn.1400823f0
mov dword [rsp + 0x490], eax
lea rcx, [rsp + 0x280]
call fcn.140081900
cmp rax, 1
je 0x1401b3296
mov dword [rsp + 0xd644], 0
lea rcx, [rsp + 0x280]
call fcn.140158740
mov eax, dword [rsp + 0xd644]
jmp 0x1401b6a66
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x490]
mov r8d, dword [rsp + 0x270]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
nop
lea rcx, [rsp + 0x280]
call fcn.140158740
xor eax, eax
jmp 0x1401b6a66
xor r8d, r8d
lea rdx, [rsp + 0xd650]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d770
mov qword [rsp + 0xd910], rax
lea rdx, [0x140245130]
mov rcx, qword [rsp + 0xd910]
call fcn.140006d90
mov byte [rsp + 0xd648], al
lea rcx, [rsp + 0xd650]
call fcn.140001490
movzx edx, byte [rsp + 0xd648]
test edx, edx
je 0x1401b3332
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 0
jge 0x1401b3369
xor eax, eax
jmp 0x1401b6a66
cmp dword [rsp + 0x4b0], 0
jl 0x1401b3427
lea rcx, [rsp + 0x4c0]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.1400823f0
mov dword [rsp + 0x658], eax
lea rcx, [rsp + 0x4c0]
call fcn.1401cf3f0
test eax, eax
je 0x1401b33ed
xor r8d, r8d
xor edx, edx
lea rcx, str.Error__The_image_is_being_used_by_a_super_client.
call fcn.1400ef1c0
mov dword [rsp + 0xd658], 1
lea rcx, [rsp + 0x4c0]
call fcn.140005db0
mov eax, dword [rsp + 0xd658]
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, dword [rsp + 0x4b0]
call fcn.14000e740
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x4c0]
call fcn.140005db0
jmp 0x1401b3369
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x4b0], eax
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_delete_the_image_
call fcn.1400ef1c0
cmp eax, 7
jne 0x1401b346d
xor eax, eax
jmp 0x1401b6a66
cmp dword [rsp + 0x4b0], 0
jl 0x1401b36dd
lea rcx, [rsp + 0xb70]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.1400823f0
mov dword [rsp + 0xd08], eax
lea rcx, [rsp + 0xb70]
call fcn.1401b7390
lea rcx, [rsp + 0x800]
call fcn.1401cc380
nop
lea rcx, [rsp + 0xb40]
call fcn.140007ac0
nop
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x800]
call fcn.1401ced10
mov dword [rsp + 0xeb0], 0
jmp 0x1401b3507
mov eax, dword [rsp + 0xeb0]
add eax, 1
mov dword [rsp + 0xeb0], eax
mov edi, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b40
cmp rdi, rax
jae 0x1401b3661
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1f0
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
cmp eax, dword [rsp + 0xd08]
je 0x1401b3591
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1f8
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
cmp eax, dword [rsp + 0xd08]
je 0x1401b3591
jmp 0x1401b34f6
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b70
mov eax, dword [rax + 0x198]
mov dword [rsp + 0x998], eax
lea rcx, [rsp + 0x800]
call fcn.1401d0fb0
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1f0
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
cmp eax, dword [rsp + 0xd08]
jne 0x1401b3607
lea rcx, [rsp + 0x9f0]
lea rdx, [0x1402441a4]
call fcn.1400020a0
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1f8
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
cmp eax, dword [rsp + 0xd08]
jne 0x1401b364f
lea rcx, [rsp + 0x9f8]
lea rdx, [0x14024433c]
call fcn.1400020a0
lea rcx, [rsp + 0x800]
call fcn.1401ceaa0
jmp 0x1401b34f6
lea rcx, [rsp + 0xb70]
call fcn.1401b76a0
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.14000e670
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0xb40]
call fcn.140007b10
nop
lea rcx, [rsp + 0x800]
call fcn.140005db0
nop
lea rcx, [rsp + 0xb70]
call fcn.140005db0
jmp 0x1401b346d
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x1220], eax
cmp dword [rsp + 0x1220], 0
jge 0x1401b372a
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0x1250]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x1220]
call fcn.1400823f0
mov dword [rsp + 0x13e8], eax
lea rcx, [rsp + 0x1250]
call fcn.1401b7390
test eax, eax
jne 0x1401b378f
mov dword [rsp + 0xd65c], 0
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd65c]
jmp 0x1401b6a66
lea rcx, [rsp + 0x13f8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0xeb4], eax
cmp dword [rsp + 0xeb4], 2
je 0x1401b37d9
mov dword [rsp + 0xd660], 0
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd660]
jmp 0x1401b6a66
lea rcx, [rsp + 0x1250]
call fcn.1401cf3f0
test eax, eax
je 0x1401b381f
xor r8d, r8d
xor edx, edx
lea rcx, str.You_cant_compact_an_image_that_is_used_in_super_client
call fcn.1400ef1c0
mov dword [rsp + 0xd664], 0
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd664]
jmp 0x1401b6a66
lea rdx, [rsp + 0x13f8]
lea rcx, [rsp + 0x1240]
call fcn.140001430
nop
mov dx, 0x2e
lea rcx, [rsp + 0x1240]
call fcn.1400068a0
mov dword [rsp + 0x1598], eax
cmp dword [rsp + 0x1598], 0xffffffff
je 0x1401b3875
mov edx, dword [rsp + 0x1598]
add edx, 1
lea r8, str.001.
lea rcx, [rsp + 0x1240]
call fcn.1400060e0
lea rcx, [rsp + 0x1240]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b38d5
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_need_to_merge_the_image_before_compacting_it
call fcn.1400ef1c0
mov dword [rsp + 0xd668], 0
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd668]
jmp 0x1401b6a66
lea rcx, [rsp + 0x13f8]
call fcn.14015a170
mov edx, dword [rsp + 0x13e8]
lea rcx, [rsp + 0xee0]
call fcn.14000e5e0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140007ac0
nop
lea rdx, [rsp + 0x15a0]
lea rcx, [rsp + 0xee0]
call fcn.1401b7170
lea rcx, [rsp + 0x15a0]
call fcn.140007b40
test rax, rax
jbe 0x1401b398e
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_cant_compact_an_image_that_has_child_disks
call fcn.1400ef1c0
mov dword [rsp + 0xd66c], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xee0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd66c]
jmp 0x1401b6a66
lea rcx, [0x140245360]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x1230], rax
cmp qword [rsp + 0x1230], 0
jne 0x1401b3a10
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245380]
call fcn.1400ef1c0
mov dword [rsp + 0xd670], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xee0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd670]
jmp 0x1401b6a66
lea rdx, str.CompactVirtualDisk
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1228], rax
lea rdx, [0x1402453f0]
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1590], rax
mov qword [rsp + 0xed8], 0xffffffffffffffff
mov dword [rsp + 0xec0], 2
mov dword [rsp + 0xec4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0xec8], ax
mov eax, 0x47e9
mov word [rsp + 0xeca], ax
mov byte [rsp + 0xecc], 0x90
mov byte [rsp + 0xecd], 0x1f
mov byte [rsp + 0xece], 0x71
mov byte [rsp + 0xecf], 0x41
mov byte [rsp + 0xed0], 0x5a
mov byte [rsp + 0xed1], 0x66
mov byte [rsp + 0xed2], 0x34
mov byte [rsp + 0xed3], 0x5b
mov dword [rsp + 0x1238], 1
lea rdi, [rsp + 0x123c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x123c], 1
lea rcx, [rsp + 0x13f8]
call fcn.140023510
mov rdx, rax
lea rax, [rsp + 0xed8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0xec0]
call qword [rsp + 0x1590]
test eax, eax
je 0x1401b3b95
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245400]
call fcn.1400ef1c0
mov dword [rsp + 0xd674], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xee0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd674]
jmp 0x1401b6a66
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x1248]
call fcn.1400a8080
mov dword [rsp + 0x1248], 1
xor r9d, r9d
lea r8, [rsp + 0x1248]
xor edx, edx
mov rcx, qword [rsp + 0xed8]
call qword [rsp + 0x1228]
test eax, eax
je 0x1401b3c45
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245428]
call fcn.1400ef1c0
mov dword [rsp + 0xd678], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xee0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
mov eax, dword [rsp + 0xd678]
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Compact_image_successfully
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xee0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x1240]
call fcn.140001490
nop
lea rcx, [rsp + 0x1250]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x15d0], eax
cmp dword [rsp + 0x15d0], 0
jge 0x1401b3cdd
xor eax, eax
jmp 0x1401b6a66
xor r8d, r8d
lea rdx, [rsp + 0xd680]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d770
mov qword [rsp + 0xd918], rax
lea rdx, [0x140245490]
mov rcx, qword [rsp + 0xd918]
call fcn.140006d50
mov byte [rsp + 0xd67c], al
lea rcx, [rsp + 0xd680]
call fcn.140001490
movzx edx, byte [rsp + 0xd67c]
test edx, edx
je 0x1401b3f25
lea rcx, [rsp + 0x15e0]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x15d0]
call fcn.1400823f0
mov dword [rsp + 0x1778], eax
lea rcx, [rsp + 0x15e0]
call fcn.1401b7390
test eax, eax
jne 0x1401b3d9a
mov dword [rsp + 0xd688], 0
lea rcx, [rsp + 0x15e0]
call fcn.140005db0
mov eax, dword [rsp + 0xd688]
jmp 0x1401b6a66
lea rdx, [rsp + 0x1788]
lea rcx, [rsp + 0x15d8]
call fcn.140001430
nop
lea rcx, [rsp + 0x15d8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0x15d4], eax
cmp dword [rsp + 0x15d4], 5
jne 0x1401b3e3d
lea rcx, [0x1402454b0]
call fcn.1400a8204
mov r8d, eax
lea rdx, [rsp + 0xd690]
lea rcx, [rsp + 0x15d8]
call fcn.140006a00
mov qword [rsp + 0xd920], rax
mov rcx, qword [rsp + 0xd920]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd690]
call fcn.140001490
cmp dword [rsp + 0x15d4], 1
je 0x1401b3e5f
cmp dword [rsp + 0x15d4], 2
je 0x1401b3e5f
cmp dword [rsp + 0x15d4], 8
jne 0x1401b3f0a
lea r8, [rsp + 0x15d8]
lea rdx, str._n__select__
lea rcx, [rsp + 0xd698]
call fcn.140006c90
mov qword [rsp + 0xd928], rax
mov rax, qword [rsp + 0xd928]
mov qword [rsp + 0xd930], rax
lea r8, [0x1402443d4]
mov rdx, qword [rsp + 0xd930]
lea rcx, [rsp + 0xd6a0]
call fcn.1400010b0
mov qword [rsp + 0xd938], rax
mov rcx, qword [rsp + 0xd938]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1402454e0]
lea rdx, [0x140245500]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd6a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd698]
call fcn.140001490
nop
lea rcx, [rsp + 0x15d8]
call fcn.140001490
nop
lea rcx, [rsp + 0x15e0]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
xor r8d, r8d
lea rdx, [rsp + 0xd6b0]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d770
mov qword [rsp + 0xd940], rax
lea rdx, [0x140245510]
mov rcx, qword [rsp + 0xd940]
call fcn.140006d50
mov byte [rsp + 0xd6a8], al
lea rcx, [rsp + 0xd6b0]
call fcn.140001490
movzx edx, byte [rsp + 0xd6a8]
test edx, edx
je 0x1401b40d6
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x1c70], eax
cmp dword [rsp + 0x1c70], 0
jge 0x1401b3fbb
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0x1930]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x1c70]
call fcn.1400823f0
mov dword [rsp + 0x1ac8], eax
lea rcx, [rsp + 0x1930]
call fcn.1401b7390
lea rcx, [rsp + 0x1ad8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0x1920], eax
cmp dword [rsp + 0x1920], 3
je 0x1401b4032
cmp dword [rsp + 0x1920], 4
je 0x1401b4032
cmp dword [rsp + 0x1920], 5
jne 0x1401b4056
mov dword [rsp + 0xd6b8], 0
lea rcx, [rsp + 0x1930]
call fcn.140005db0
mov eax, dword [rsp + 0xd6b8]
jmp 0x1401b6a66
lea rcx, [rsp + 0x1ad8]
call fcn.14015a170
xor edx, edx
lea rcx, [rsp + 0x1c80]
call fcn.14015aca0
nop
mov eax, dword [rsp + 0x1ac8]
mov dword [rsp + 0x1f58], eax
lea rcx, [rsp + 0x1c80]
call fcn.140081900
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x1ac8]
mov r8d, dword [rsp + 0x1c70]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
nop
lea rcx, [rsp + 0x1c80]
call fcn.14015abf0
nop
lea rcx, [rsp + 0x1930]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xdae0]
lea r8, [0x1401b18e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1401b6a66
mov rax, qword [rsp + 0xdae0]
cmp dword [rax + 0x978], 0
je 0x1401b412f
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x2b54], eax
cmp dword [rsp + 0x2b54], 0
jge 0x1401b4166
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0x2810]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x2b54]
call fcn.1400823f0
mov dword [rsp + 0x29a8], eax
lea rcx, [rsp + 0x2810]
call fcn.1401b7390
test eax, eax
jne 0x1401b41cb
mov dword [rsp + 0xd6bc], 0
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6bc]
jmp 0x1401b6a66
lea rcx, [rsp + 0x29b8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0x2024], eax
cmp dword [rsp + 0x2024], 2
je 0x1401b4215
mov dword [rsp + 0xd6c0], 0
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6c0]
jmp 0x1401b6a66
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, [0x140245530]
call fcn.1400ef1c0
cmp eax, 7
jne 0x1401b4276
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd6c4], 0
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6c4]
jmp 0x1401b6a66
lea rcx, [rsp + 0x29b8]
call fcn.14015a170
lea rdx, [rsp + 0x29b8]
lea r8, [0x140245588]
lea rcx, [rsp + 0x3370]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0x29b8]
call fcn.140023510
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140105400
lea rcx, [0x1402455a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x2b58], rax
cmp qword [rsp + 0x2b58], 0
jne 0x1401b4359
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x1402455c0]
call fcn.1400ef1c0
mov dword [rsp + 0xd6c8], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6c8]
jmp 0x1401b6a66
lea rdx, [0x140245618]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3378], rax
lea rdx, [0x140245630]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3380], rax
lea rdx, [0x140245640]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2800], rax
lea rdx, [0x140245658]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3388], rax
mov qword [rsp + 0x27f8], 0xffffffffffffffff
mov dword [rsp + 0x27e0], 2
mov dword [rsp + 0x27e4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x27e8], ax
mov eax, 0x47e9
mov word [rsp + 0x27ea], ax
mov byte [rsp + 0x27ec], 0x90
mov byte [rsp + 0x27ed], 0x1f
mov byte [rsp + 0x27ee], 0x71
mov byte [rsp + 0x27ef], 0x41
mov byte [rsp + 0x27f0], 0x5a
mov byte [rsp + 0x27f1], 0x66
mov byte [rsp + 0x27f2], 0x34
mov byte [rsp + 0x27f3], 0x5b
mov dword [rsp + 0x2b60], 1
lea rdi, [rsp + 0x2b64]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x2b64], 1
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rdx, rax
lea rax, [rsp + 0x27f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x27e0]
call qword [rsp + 0x3380]
test eax, eax
je 0x1401b4524
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245678]
call fcn.1400ef1c0
mov dword [rsp + 0xd6cc], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6cc]
jmp 0x1401b6a66
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x2800]
test eax, eax
je 0x1401b45cd
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402456a0]
call fcn.1400ef1c0
mov dword [rsp + 0xd6d0], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6d0]
jmp 0x1401b6a66
xor eax, eax
mov word [rsp + 0x2b70], ax
lea rdi, [rsp + 0x2b72]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x27d8], 0x800
lea r8, [rsp + 0x2b70]
lea rdx, [rsp + 0x27d8]
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3388]
lea rcx, [0x1402456c8]
call fcn.1400a8204
lea rcx, [rsp + rax*2 + 0x2b70]
call fcn.1400a948c
mov dword [rsp + 0x2020], eax
mov eax, 0x43
mov word [rsp + 0x2b50], ax
mov dword [rsp + 0x3390], 0
jmp 0x1401b465d
mov eax, dword [rsp + 0x3390]
add eax, 1
mov dword [rsp + 0x3390], eax
cmp dword [rsp + 0x3390], 0x14
jge 0x1401b4924
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b4924
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x3394], eax
mov byte [rsp + 0x3398], 0x43
jmp 0x1401b46af
movzx eax, byte [rsp + 0x3398]
add al, 1
mov byte [rsp + 0x3398], al
movsx eax, byte [rsp + 0x3398]
cmp eax, 0x5a
jg 0x1401b491f
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b491f
movsx ecx, byte [rsp + 0x3398]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x3394]
and eax, ecx
test eax, eax
jne 0x1401b46f4
jmp 0x1401b469e
lea rcx, [rsp + 0x73b8]
call fcn.140002db0
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x1402456f0]
lea rcx, [rsp + 0x73b8]
call fcn.140002c40
lea rcx, [rsp + 0x73b8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401b474c
lea rcx, [rsp + 0x73b8]
call fcn.140001490
jmp 0x1401b469e
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x1402456f8]
lea rcx, [rsp + 0x73b8]
call fcn.140002c40
lea rcx, [rsp + 0x73b8]
call fcn.140023510
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x33a0], rax
cmp qword [rsp + 0x33a0], 0xffffffffffffffff
jne 0x1401b47cb
lea rcx, [rsp + 0x73b8]
call fcn.140001490
jmp 0x1401b469e
mov dword [rsp + 0x73b0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x73b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x33b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401b48fe
mov dword [rsp + 0x73c0], 0
mov dword [rsp + 0x73c0], 0
jmp 0x1401b484b
mov eax, dword [rsp + 0x73c0]
add eax, 1
mov dword [rsp + 0x73c0], eax
mov eax, dword [rsp + 0x33b0]
cmp dword [rsp + 0x73c0], eax
jge 0x1401b48fe
cmp dword [rsp + 0x2020], 0xffffffff
je 0x1401b4887
movsxd rax, dword [rsp + 0x73c0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x33b8]
cmp dword [rsp + 0x2020], eax
je 0x1401b4887
jmp 0x1401b483a
lea rcx, [rsp + 0x73c8]
call fcn.140002db0
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x140245708]
lea rcx, [rsp + 0x73c8]
call fcn.140002c40
lea rcx, [rsp + 0x73c8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b48ec
movsx ax, byte [rsp + 0x3398]
mov word [rsp + 0x2b50], ax
lea rcx, [rsp + 0x73c8]
call fcn.140001490
jmp 0x1401b48fe
lea rcx, [rsp + 0x73c8]
call fcn.140001490
jmp 0x1401b483a
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x73b8]
call fcn.140001490
jmp 0x1401b469e
jmp 0x1401b464c
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b49dc
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b496e
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245720]
call fcn.1400ef1c0
mov dword [rsp + 0xd6d4], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6d4]
jmp 0x1401b6a66
call fcn.1400d6b90
test eax, eax
jne 0x1401b4a90
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b4a22
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245748]
call fcn.1400ef1c0
mov dword [rsp + 0xd6d8], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd6d8]
jmp 0x1401b6a66
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd6e0]
call fcn.140005df0
mov qword [rsp + 0xd948], rax
mov rax, qword [rsp + 0xd948]
mov qword [rsp + 0xd950], rax
lea r8, [0x140245780]
mov rdx, qword [rsp + 0xd950]
lea rcx, [rsp + 0xd6e8]
call fcn.1400010b0
mov qword [rsp + 0xd958], rax
mov rcx, qword [rsp + 0xd958]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd6e8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd6e0]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd6f0]
call fcn.140005df0
mov qword [rsp + 0xd960], rax
mov rax, qword [rsp + 0xd960]
mov qword [rsp + 0xd968], rax
lea r8, [0x140245790]
mov rdx, qword [rsp + 0xd968]
lea rcx, [rsp + 0xd6f8]
call fcn.1400010b0
mov qword [rsp + 0xd970], rax
mov rcx, qword [rsp + 0xd970]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd6f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd6f0]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd708]
call fcn.140005df0
mov qword [rsp + 0xd978], rax
mov rax, qword [rsp + 0xd978]
mov qword [rsp + 0xd980], rax
lea r8, [0x1402457b0]
mov rdx, qword [rsp + 0xd980]
lea rcx, [rsp + 0xd710]
call fcn.1400010b0
mov qword [rsp + 0xd988], rax
mov rax, qword [rsp + 0xd988]
mov qword [rsp + 0xd990], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd718]
call fcn.140005df0
mov qword [rsp + 0xd998], rax
mov rax, qword [rsp + 0xd998]
mov qword [rsp + 0xd9a0], rax
lea r8, [0x1402457f8]
mov rdx, qword [rsp + 0xd9a0]
lea rcx, [rsp + 0xd720]
call fcn.1400010b0
mov qword [rsp + 0xd9a8], rax
mov rcx, qword [rsp + 0xd990]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0xd9a8]
call fcn.140023510
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd700], eax
lea rcx, [rsp + 0xd720]
call fcn.140001490
nop
lea rcx, [rsp + 0xd718]
call fcn.140001490
nop
lea rcx, [rsp + 0xd710]
call fcn.140001490
nop
lea rcx, [rsp + 0xd708]
call fcn.140001490
cmp dword [rsp + 0xd700], 0
je 0x1401b4d8f
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b4d21
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245808]
call fcn.1400ef1c0
mov dword [rsp + 0xd728], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd728]
jmp 0x1401b6a66
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd730]
call fcn.140005df0
mov qword [rsp + 0xd9b0], rax
mov rax, qword [rsp + 0xd9b0]
mov qword [rsp + 0xd9b8], rax
lea r8, [0x140245840]
mov rdx, qword [rsp + 0xd9b8]
lea rcx, [rsp + 0xd738]
call fcn.1400010b0
mov qword [rsp + 0xd9c0], rax
mov rax, qword [rsp + 0xd9c0]
mov qword [rsp + 0xd9c8], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd740]
call fcn.140005df0
mov qword [rsp + 0xd9d0], rax
mov rax, qword [rsp + 0xd9d0]
mov qword [rsp + 0xd9d8], rax
lea r8, [0x140245888]
mov rdx, qword [rsp + 0xd9d8]
lea rcx, [rsp + 0xd748]
call fcn.1400010b0
mov qword [rsp + 0xd9e0], rax
mov rcx, qword [rsp + 0xd9c8]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0xd9e0]
call fcn.140023510
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd72c], eax
lea rcx, [rsp + 0xd748]
call fcn.140001490
nop
lea rcx, [rsp + 0xd740]
call fcn.140001490
nop
lea rcx, [rsp + 0xd738]
call fcn.140001490
nop
lea rcx, [rsp + 0xd730]
call fcn.140001490
cmp dword [rsp + 0xd72c], 0
je 0x1401b4fff
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd750]
call fcn.140005df0
mov qword [rsp + 0xd9e8], rax
mov rax, qword [rsp + 0xd9e8]
mov qword [rsp + 0xd9f0], rax
lea r8, [0x1402458a0]
mov rdx, qword [rsp + 0xd9f0]
lea rcx, [rsp + 0xd758]
call fcn.1400010b0
mov qword [rsp + 0xd9f8], rax
mov rcx, qword [rsp + 0xd9f8]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd758]
call fcn.140001490
nop
lea rcx, [rsp + 0xd750]
call fcn.140001490
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b4f91
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402458b0]
call fcn.1400ef1c0
mov dword [rsp + 0xd760], 0
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd760]
jmp 0x1401b6a66
xor edx, edx
lea rcx, [rsp + 0x2030]
call fcn.140149840
nop
movzx eax, word [rsp + 0x2b50]
mov word [rsp + 0x22f4], ax
lea rcx, [rsp + 0x2030]
call fcn.140081900
mov qword [rsp + 0x27d0], rax
cmp qword [rsp + 0x27d0], 1
je 0x1401b504d
cmp dword [rsp + 0x27c0], 0
je 0x1401b548c
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd768]
call fcn.140005df0
mov qword [rsp + 0xda00], rax
mov rax, qword [rsp + 0xda00]
mov qword [rsp + 0xda08], rax
lea r8, [0x1402458e8]
mov rdx, qword [rsp + 0xda08]
lea rcx, [rsp + 0xd770]
call fcn.1400010b0
mov qword [rsp + 0xda10], rax
mov rcx, qword [rsp + 0xda10]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd770]
call fcn.140001490
nop
lea rcx, [rsp + 0xd768]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd778]
call fcn.140005df0
mov qword [rsp + 0xda18], rax
mov rax, qword [rsp + 0xda18]
mov qword [rsp + 0xda20], rax
lea r8, [0x1402458f8]
mov rdx, qword [rsp + 0xda20]
lea rcx, [rsp + 0xd780]
call fcn.1400010b0
mov qword [rsp + 0xda28], rax
mov rcx, qword [rsp + 0xda28]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd780]
call fcn.140001490
nop
lea rcx, [rsp + 0xd778]
call fcn.140001490
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x24
lea rcx, [0x140245910]
call fcn.1400ef1c0
cmp eax, 6
jne 0x1401b53f8
mov edx, dword [rsp + 0x29a8]
lea rcx, [rsp + 0x73d0]
call fcn.1401cc270
nop
lea rcx, [rsp + 0x29b8]
call fcn.140023510
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x7718]
call fcn.1400fffd0
nop
mov dx, 0x2e
lea rcx, [rsp + 0x7718]
call fcn.1400068a0
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd788]
lea rcx, [rsp + 0x7718]
call fcn.140006a00
mov qword [rsp + 0xda30], rax
mov rcx, qword [rsp + 0xda30]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0x7710], eax
lea rcx, [rsp + 0xd788]
call fcn.140001490
lea rcx, [rsp + 0x7570]
mov r8d, dword [rsp + 0x7710]
lea rdx, [0x1402451b4]
call fcn.140002c40
lea rcx, [rsp + 0x7578]
lea rdx, [0x140245958]
call fcn.1400020a0
lea rcx, [rsp + 0xd790]
call fcn.14000edc0
lea r8, [0x140245988]
lea rdx, [rsp + 0xd798]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0xda38], rax
mov rax, qword [rsp + 0xda38]
mov qword [rsp + 0xda40], rax
lea rcx, [rsp + 0x7580]
mov rdx, qword [rsp + 0xda40]
call fcn.140002d80
nop
lea rcx, [rsp + 0xd798]
call fcn.140001490
lea rcx, [rsp + 0x73d0]
call fcn.1401b7bb0
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x968], 0
je 0x1401b531e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b5368
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call fcn.14007c95c
xor edx, edx
mov rcx, rax
call fcn.14007c03c
mov edx, 5
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x7718]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov r8, qword [rsp + 0xdae0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140104bd0
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b53c8
xor edx, edx
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x1402459b0]
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x7718]
call fcn.140001490
nop
lea rcx, [rsp + 0x73d0]
call fcn.140005db0
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x29a8]
mov r8d, dword [rsp + 0x2b54]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
mov dword [rsp + 0xd7a0], 0
lea rcx, [rsp + 0x2030]
call fcn.1401497c0
nop
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
mov eax, dword [rsp + 0xd7a0]
jmp 0x1401b6a66
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7a8]
call fcn.140005df0
mov qword [rsp + 0xda48], rax
mov rax, qword [rsp + 0xda48]
mov qword [rsp + 0xda50], rax
lea r8, [0x1402459f0]
mov rdx, qword [rsp + 0xda50]
lea rcx, [rsp + 0xd7b0]
call fcn.1400010b0
mov qword [rsp + 0xda58], rax
mov rcx, qword [rsp + 0xda58]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd7a8]
call fcn.140001490
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7b8]
call fcn.140005df0
mov qword [rsp + 0xda60], rax
mov rax, qword [rsp + 0xda60]
mov qword [rsp + 0xda68], rax
lea r8, [0x140245a00]
mov rdx, qword [rsp + 0xda68]
lea rcx, [rsp + 0xd7c0]
call fcn.1400010b0
mov qword [rsp + 0xda70], rax
mov rcx, qword [rsp + 0xda70]
call fcn.140023510
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd7b8]
call fcn.140001490
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x2030]
call fcn.1401497c0
nop
lea rcx, [rsp + 0x3370]
call fcn.140001490
nop
lea rcx, [rsp + 0x2810]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov r8d, 1
mov edx, 0x80e6
mov rcx, qword [rsp + 0xdae0]
call fcn.1401b3080
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0x775c], eax
cmp dword [rsp + 0x775c], 0
jge 0x1401b5684
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0x7f90]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x775c]
call fcn.1400823f0
mov dword [rsp + 0x8128], eax
lea rcx, [rsp + 0x7f90]
call fcn.1401b7390
test eax, eax
jne 0x1401b56e9
mov dword [rsp + 0xd7c8], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7c8]
jmp 0x1401b6a66
lea rcx, [rsp + 0x8138]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0x7724], eax
cmp dword [rsp + 0x7724], 2
je 0x1401b5747
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245a20]
call fcn.1400ef1c0
mov dword [rsp + 0xd7cc], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7cc]
jmp 0x1401b6a66
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_mount_this_image_
call fcn.1400ef1c0
cmp eax, 7
jne 0x1401b5784
mov dword [rsp + 0xd7d0], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7d0]
jmp 0x1401b6a66
lea rcx, [rsp + 0x8138]
call fcn.14015a170
lea rdx, [rsp + 0x8138]
lea r8, [0x140245af8]
lea rcx, [rsp + 0x7f70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0x8138]
call fcn.140023510
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140105400
lea rcx, [0x140245b10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x7760], rax
cmp qword [rsp + 0x7760], 0
jne 0x1401b5855
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245b30]
call fcn.1400ef1c0
mov dword [rsp + 0xd7d4], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7d4]
jmp 0x1401b6a66
lea rdx, [0x140245b88]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f78], rax
lea rdx, [0x140245ba0]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f80], rax
lea rdx, [0x140245bb0]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7750], rax
lea rdx, [0x140245bc8]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f88], rax
mov dword [rsp + 0x7738], 2
mov dword [rsp + 0x773c], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x7740], ax
mov eax, 0x47e9
mov word [rsp + 0x7742], ax
mov byte [rsp + 0x7744], 0x90
mov byte [rsp + 0x7745], 0x1f
mov byte [rsp + 0x7746], 0x71
mov byte [rsp + 0x7747], 0x41
mov byte [rsp + 0x7748], 0x5a
mov byte [rsp + 0x7749], 0x66
mov byte [rsp + 0x774a], 0x34
mov byte [rsp + 0x774b], 0x5b
mov dword [rsp + 0x7768], 1
lea rdi, [rsp + 0x776c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x776c], 1
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rdx, rax
lea rax, [rsp + 0x7730]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7768]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x7738]
call qword [rsp + 0x7f80]
test eax, eax
je 0x1401b5a10
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245be8]
call fcn.1400ef1c0
mov dword [rsp + 0xd7d8], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7d8]
jmp 0x1401b6a66
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7750]
test eax, eax
je 0x1401b5ac5
mov rcx, qword [rsp + 0x7730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x7730], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245c10]
call fcn.1400ef1c0
mov dword [rsp + 0xd7dc], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd7dc]
jmp 0x1401b6a66
lea rdx, [rsp + 0x8128]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140028170
mov rdx, rax
mov rax, qword [rsp + 0x7730]
mov qword [rdx], rax
xor eax, eax
mov word [rsp + 0x7770], ax
lea rdi, [rsp + 0x7772]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x7728], 0x800
lea r8, [rsp + 0x7770]
lea rdx, [rsp + 0x7728]
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7f88]
lea rcx, [0x140245c38]
call fcn.1400a8204
lea rcx, [rsp + rax*2 + 0x7770]
call fcn.1400a948c
mov dword [rsp + 0x7720], eax
mov eax, 0x43
mov word [rsp + 0x7758], ax
mov dword [rsp + 0x82d0], 0
jmp 0x1401b5b7f
mov eax, dword [rsp + 0x82d0]
add eax, 1
mov dword [rsp + 0x82d0], eax
cmp dword [rsp + 0x82d0], 0x14
jge 0x1401b5e46
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b5e46
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x82d4], eax
mov byte [rsp + 0x82d8], 0x43
jmp 0x1401b5bd1
movzx eax, byte [rsp + 0x82d8]
add al, 1
mov byte [rsp + 0x82d8], al
movsx eax, byte [rsp + 0x82d8]
cmp eax, 0x5a
jg 0x1401b5e41
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b5e41
movsx ecx, byte [rsp + 0x82d8]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x82d4]
and eax, ecx
test eax, eax
jne 0x1401b5c16
jmp 0x1401b5bc0
lea rcx, [rsp + 0xc2f8]
call fcn.140002db0
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140245c60]
lea rcx, [rsp + 0xc2f8]
call fcn.140002c40
lea rcx, [rsp + 0xc2f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401b5c6e
lea rcx, [rsp + 0xc2f8]
call fcn.140001490
jmp 0x1401b5bc0
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140245c68]
lea rcx, [rsp + 0xc2f8]
call fcn.140002c40
lea rcx, [rsp + 0xc2f8]
call fcn.140023510
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x82e0], rax
cmp qword [rsp + 0x82e0], 0xffffffffffffffff
jne 0x1401b5ced
lea rcx, [rsp + 0xc2f8]
call fcn.140001490
jmp 0x1401b5bc0
mov dword [rsp + 0xc2f0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0xc2f0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x82f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401b5e20
mov dword [rsp + 0xc300], 0
mov dword [rsp + 0xc300], 0
jmp 0x1401b5d6d
mov eax, dword [rsp + 0xc300]
add eax, 1
mov dword [rsp + 0xc300], eax
mov eax, dword [rsp + 0x82f0]
cmp dword [rsp + 0xc300], eax
jge 0x1401b5e20
cmp dword [rsp + 0x7720], 0xffffffff
je 0x1401b5da9
movsxd rax, dword [rsp + 0xc300]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x82f8]
cmp dword [rsp + 0x7720], eax
je 0x1401b5da9
jmp 0x1401b5d5c
lea rcx, [rsp + 0xc308]
call fcn.140002db0
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140245c78]
lea rcx, [rsp + 0xc308]
call fcn.140002c40
lea rcx, [rsp + 0xc308]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b5e0e
movsx ax, byte [rsp + 0x82d8]
mov word [rsp + 0x7758], ax
lea rcx, [rsp + 0xc308]
call fcn.140001490
jmp 0x1401b5e20
lea rcx, [rsp + 0xc308]
call fcn.140001490
jmp 0x1401b5d5c
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc2f8]
call fcn.140001490
jmp 0x1401b5bc0
jmp 0x1401b5b6e
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b5f86
cmp qword [rsp + 0x7730], 0xffffffffffffffff
je 0x1401b5f1c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7f78]
mov rcx, qword [rsp + 0x7730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x7730], 0xffffffffffffffff
lea r8, [rsp + 0x8128]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd7f0]
call fcn.140007970
lea rdi, [rsp + 0xd8f0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd7e0]
lea rsi, [rsp + 0xd8f0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd8c0]
lea rsi, [rsp + 0xd7e0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea r8, [rsp + 0xd8c0]
lea rdx, [rsp + 0xd800]
call fcn.140007030
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140245c88]
call fcn.1400ef1c0
mov dword [rsp + 0xd810], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
mov eax, dword [rsp + 0xd810]
jmp 0x1401b6a66
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x8140]
lea rdx, [0x140244424]
call fcn.1400020a0
lea rcx, [rsp + 0x8148]
mov r8d, dword [rsp + 0x7720]
lea rdx, [0x1402457a4]
call fcn.140002c40
lea rcx, [rsp + 0x7f90]
call fcn.1401b7780
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Image_mounting_successful.
call fcn.1400ef1c0
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x8128]
mov r8d, dword [rsp + 0x775c]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
cmp qword [rsp + 0xdaf0], 0
je 0x1401b603c
lea rax, str.:WindowsSystem32CCBootPnP
mov qword [rsp + 0xda78], rax
jmp 0x1401b604b
lea rax, [0x140245a14]
mov qword [rsp + 0xda78], rax
mov r8d, 1
movzx edx, word [rsp + 0x7758]
lea rcx, [rsp + 0xd818]
call fcn.140005df0
mov qword [rsp + 0xda80], rax
mov rax, qword [rsp + 0xda80]
mov qword [rsp + 0xda88], rax
mov r8, qword [rsp + 0xda78]
mov rdx, qword [rsp + 0xda88]
lea rcx, [rsp + 0xd820]
call fcn.1400010b0
mov qword [rsp + 0xda90], rax
mov rcx, qword [rsp + 0xda90]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd820]
call fcn.140001490
nop
lea rcx, [rsp + 0xd818]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov rax, qword [rsp + 0xdae0]
cmp dword [rax + 0x978], 0
je 0x1401b6127
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0xc314], eax
cmp dword [rsp + 0xc314], 0
jge 0x1401b615e
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0xc330]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xc314]
call fcn.1400823f0
mov dword [rsp + 0xc4c8], eax
lea rcx, [rsp + 0xc330]
call fcn.1401b7390
test eax, eax
jne 0x1401b61c3
mov dword [rsp + 0xd828], 0
lea rcx, [rsp + 0xc330]
call fcn.140005db0
mov eax, dword [rsp + 0xd828]
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd840]
call fcn.140017300
mov rdi, rax
lea r8, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd830]
call fcn.140007970
mov rdx, rdi
mov rcx, rax
call fcn.14000cc90
movzx eax, al
test eax, eax
je 0x1401b623c
mov dword [rsp + 0xd850], 0
lea rcx, [rsp + 0xc330]
call fcn.140005db0
mov eax, dword [rsp + 0xd850]
jmp 0x1401b6a66
lea rcx, [rsp + 0xc4d8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0xc310], eax
cmp dword [rsp + 0xc310], 2
je 0x1401b629a
xor r8d, r8d
mov edx, 0x40
lea rcx, str.This_function_only_supports_VHD_files__other_formats_are_not_supported.
call fcn.1400ef1c0
mov dword [rsp + 0xd854], 0
lea rcx, [rsp + 0xc330]
call fcn.140005db0
mov eax, dword [rsp + 0xd854]
jmp 0x1401b6a66
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_unmount_this_image_
call fcn.1400ef1c0
cmp eax, 7
jne 0x1401b62fb
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd858], 0
lea rcx, [rsp + 0xc330]
call fcn.140005db0
mov eax, dword [rsp + 0xd858]
jmp 0x1401b6a66
lea rdx, [rsp + 0xc4d8]
lea r8, [0x140245e08]
lea rcx, [rsp + 0xc320]
call fcn.1400010b0
nop
lea rcx, [0x140245e20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xc318], rax
cmp qword [rsp + 0xc318], 0
jne 0x1401b6390
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245e40]
call fcn.1400ef1c0
mov dword [rsp + 0xd85c], 0
lea rcx, [rsp + 0xc320]
call fcn.140001490
nop
lea rcx, [rsp + 0xc330]
call fcn.140005db0
mov eax, dword [rsp + 0xd85c]
jmp 0x1401b6a66
lea rdx, [0x140245e98]
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc328], rax
lea rdx, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140028170
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
call qword [rsp + 0xc328]
lea rdx, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140028170
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd870]
call fcn.140007970
lea rdi, [rsp + 0xd8e0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd860]
lea rsi, [rsp + 0xd8e0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd8d0]
lea rsi, [rsp + 0xd860]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea r8, [rsp + 0xd8d0]
lea rdx, [rsp + 0xd880]
call fcn.140007030
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_save_the_changes_
call fcn.1400ef1c0
cmp eax, 6
jne 0x1401b66db
mov edx, dword [rsp + 0xc4c8]
lea rcx, [rsp + 0xc670]
call fcn.1401cc270
nop
lea rcx, [rsp + 0xc4d8]
call fcn.140023510
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc9b8]
call fcn.1400fffd0
nop
mov dx, 0x2e
lea rcx, [rsp + 0xc9b8]
call fcn.1400068a0
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd890]
lea rcx, [rsp + 0xc9b8]
call fcn.140006a00
mov qword [rsp + 0xda98], rax
mov rcx, qword [rsp + 0xda98]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xc9b0], eax
lea rcx, [rsp + 0xd890]
call fcn.140001490
lea rcx, [rsp + 0xc810]
mov r8d, dword [rsp + 0xc9b0]
lea rdx, [0x140245ef4]
call fcn.140002c40
lea rcx, [rsp + 0xc818]
lea rdx, [0x140245f00]
call fcn.1400020a0
lea rcx, [rsp + 0xd898]
call fcn.14000edc0
lea r8, [0x140245f18]
lea rdx, [rsp + 0xd8a0]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0xdaa0], rax
mov rax, qword [rsp + 0xdaa0]
mov qword [rsp + 0xdaa8], rax
lea rcx, [rsp + 0xc820]
mov rdx, qword [rsp + 0xdaa8]
call fcn.140002d80
nop
lea rcx, [rsp + 0xd8a0]
call fcn.140001490
lea rcx, [rsp + 0xc670]
call fcn.1401b7bb0
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x968], 0
je 0x1401b6615
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b665f
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call fcn.14007c95c
xor edx, edx
mov rcx, rax
call fcn.14007c03c
mov edx, 5
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0xc9b8]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0xc320]
call fcn.140023510
mov r8, qword [rsp + 0xdae0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140104bd0
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b66c0
xor edx, edx
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rsp + 0xc9b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc670]
call fcn.140005db0
lea rcx, [rsp + 0xc4e0]
lea rdx, [0x14024446c]
call fcn.1400020a0
lea rcx, [rsp + 0xc4e8]
call fcn.1400019b0
lea rcx, [rsp + 0xc330]
call fcn.1401b7780
mov edx, 1
mov ecx, 1
call fcn.1401b7f70
lea rcx, [rsp + 0xc320]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140245f40]
call fcn.1400ef1c0
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0xc4c8]
mov r8d, dword [rsp + 0xc314]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a53d0
nop
lea rcx, [rsp + 0xc320]
call fcn.140001490
nop
lea rcx, [rsp + 0xc330]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0xcd10], eax
cmp dword [rsp + 0xcd10], 0
jge 0x1401b67da
xor eax, eax
jmp 0x1401b6a66
lea rcx, [rsp + 0xd020]
call fcn.14000e6a0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xcd10]
call fcn.1400823f0
mov dword [rsp + 0xd1b8], eax
lea rcx, [rsp + 0xd020]
call fcn.1401b7390
test eax, eax
jne 0x1401b683f
mov dword [rsp + 0xd8a8], 0
lea rcx, [rsp + 0xd020]
call fcn.140005db0
mov eax, dword [rsp + 0xd8a8]
jmp 0x1401b6a66
lea rcx, [rsp + 0xd1c8]
call fcn.140023510
mov rcx, rax
call fcn.1400f9010
mov dword [rsp + 0xc9c0], eax
cmp dword [rsp + 0xc9c0], 3
je 0x1401b6879
cmp dword [rsp + 0xc9c0], 4
je 0x1401b6879
cmp dword [rsp + 0xc9c0], 5
jne 0x1401b68b1
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Child_disk_can_not_be_created_with_this_image_format._nPlease_select_.vhd_or_.vmdk_format.
call fcn.1400ef1c0
mov dword [rsp + 0xd8ac], 0
lea rcx, [rsp + 0xd020]
call fcn.140005db0
mov eax, dword [rsp + 0xd8ac]
jmp 0x1401b6a66
mov edx, dword [rsp + 0xd1b8]
lea rcx, [rsp + 0xc9d0]
call fcn.1401cc270
nop
lea rcx, [rsp + 0xcff0]
call fcn.140007ac0
nop
lea rdx, [rsp + 0xcff0]
lea rcx, [rsp + 0xc9d0]
call fcn.1401b7170
lea rcx, [rsp + 0xcff0]
call fcn.140007b40
test rax, rax
jbe 0x1401b694f
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Please_merge_all_your_recovery_first_
call fcn.1400ef1c0
mov dword [rsp + 0xd8b0], 0
lea rcx, [rsp + 0xcff0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xc9d0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xd020]
call fcn.140005db0
mov eax, dword [rsp + 0xd8b0]
jmp 0x1401b6a66
xor edx, edx
lea rcx, [rsp + 0xcd20]
call fcn.14016aca0
nop
mov eax, dword [rsp + 0xd1b8]
mov dword [rsp + 0xcf30], eax
lea rcx, [rsp + 0xcd20]
call fcn.140081900
nop
lea rcx, [rsp + 0xcd20]
call fcn.14016ac40
nop
lea rcx, [rsp + 0xcff0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xc9d0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xd020]
call fcn.140005db0
xor eax, eax
jmp 0x1401b6a66
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000e740
mov dword [rsp + 0xd360], eax
xor edx, edx
lea rcx, [rsp + 0xd370]
call fcn.140142420
nop
mov dword [rsp + 0xd590], 0
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xd360]
call fcn.1400823f0
mov dword [rsp + 0xd594], eax
lea rcx, [rsp + 0xd370]
call fcn.140081900
cmp rax, 1
je 0x1401b6a50
mov dword [rsp + 0xd8b4], 0
lea rcx, [rsp + 0xd370]
call fcn.1401423b0
mov eax, dword [rsp + 0xd8b4]
jmp 0x1401b6a66
lea rcx, [rsp + 0xd370]
call fcn.1401423b0
xor eax, eax
jmp 0x1401b6a66
mov eax, 1
mov rcx, qword [rsp + 0xdab0]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0xdac8
pop rdi
pop rsi
ret