Function at 0x1401c9fe0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Delete file
Get disk size
Get local ipv4 addresses
Get socket information
Manipulate boot configuration
Read .ini file
Set socket configuration
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x12240
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x11a98], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x12230], rax
mov dword [rsp + 0x11a94], 0
mov rax, qword [rsp + 0x12258]
cmp dword [rax + 0x28], 0x65
jne 0x1401ca046
mov rcx, qword [rsp + 0x12250]
call fcn.1401c8440
mov eax, 1
jmp 0x1401d172e
mov rax, qword [rsp + 0x12258]
cmp dword [rax + 0x28], 0x66
jne 0x1401ca06b
mov rcx, qword [rsp + 0x12250]
call fcn.1401c7920
mov eax, 1
jmp 0x1401d172e
lea rcx, [rsp + 0x790]
call fcn.14000d210
nop
mov dword [rsp + 0x928], 1
lea rcx, [rsp + 0x790]
call fcn.1401d56b0
mov dword [rsp + 0xad0], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xad0]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x12258]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0x4010
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x12258]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WSOCK32.dll_setsockopt]
mov rdx, qword [rsp + 0x12258]
mov eax, dword [rdx + 0x14]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x450]
call fcn.1401d19d0
nop
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x450]
call fcn.1401d7890
mov rax, qword [rsp + 0x12250]
cmp dword [rax + 0x220], 0
je 0x1401d16a3
mov rax, qword [rsp + 0x12258]
cmp dword [rax], 2
jne 0x1401d16a3
mov byte [rsp + 0xae0], 0
lea rdi, [rsp + 0xae1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r9d, 0x1000
lea r8, [rsp + 0xae0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
test eax, eax
jne 0x1401ca19c
jmp 0x1401d16a3
lea rcx, [0x1402243e8]
call fcn.1400a98c0
mov r8, rax
lea rdx, str.getservercmd
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cb074
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
call fcn.14000e350
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x113e8], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11400]
call fcn.1400518c0
mov rdi, rax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea r8, [rsp + 0x113e8]
lea rdx, [rsp + 0x113f0]
call fcn.140020d90
mov rdx, rdi
mov rcx, rax
call fcn.14001c7b0
movzx eax, al
test eax, eax
je 0x1401ca270
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11410], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11410]
call fcn.140020bd0
mov rcx, rax
call fcn.14001f630
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1ae0], eax
lea rdx, [0x140224408]
lea rcx, [rsp + 0x11418]
call fcn.140002100
nop
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11414], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11414]
call fcn.140020bd0
lea rdx, [rsp + 0x11418]
mov rcx, rax
call fcn.1400104f0
nop
lea rcx, [rsp + 0x11418]
call fcn.140001490
lea rcx, [rsp + 0x11428]
call fcn.140001000
mov qword [rsp + 0x11aa0], rax
mov rax, qword [rsp + 0x11aa0]
mov qword [rsp + 0x11aa8], rax
lea r8, [0x140222724]
mov rdx, qword [rsp + 0x11aa8]
lea rcx, [rsp + 0x11430]
call fcn.1400010b0
mov qword [rsp + 0x11ab0], rax
mov rax, qword [rsp + 0x11ab0]
mov qword [rsp + 0x11ab8], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11ab8]
lea rcx, [rsp + 0x11438]
call fcn.1400010b0
mov qword [rsp + 0x11ac0], rax
mov rax, qword [rsp + 0x11ac0]
mov qword [rsp + 0x11ac8], rax
lea r8, [0x140224428]
mov rdx, qword [rsp + 0x11ac8]
lea rcx, [rsp + 0x11440]
call fcn.1400010b0
mov qword [rsp + 0x11ad0], rax
mov rcx, qword [rsp + 0x11ad0]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, [0x140224438]
lea rcx, [0x140224458]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x11420], eax
lea rcx, [rsp + 0x11440]
call fcn.140001490
nop
lea rcx, [rsp + 0x11438]
call fcn.140001490
nop
lea rcx, [rsp + 0x11430]
call fcn.140001490
nop
lea rcx, [rsp + 0x11428]
call fcn.140001490
cmp dword [rsp + 0x11420], 0
je 0x1401ca461
lea rdx, [0x140224468]
lea rcx, [rsp + 0x11450]
call fcn.140002100
nop
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11448], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11448]
call fcn.140020bd0
lea rdx, [rsp + 0x11450]
mov rcx, rax
call fcn.1400104f0
nop
lea rcx, [rsp + 0x11450]
call fcn.140001490
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
mov rax, qword [rsp + 0x12250]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov rax, qword [rsp + 0x12250]
cmp dword [rax + 0x220], 0
je 0x1401cb06f
mov rax, qword [rsp + 0x12258]
cmp dword [rax], 2
jne 0x1401cb06f
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
call fcn.14000e350
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11458], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11470]
call fcn.1400518c0
mov rdi, rax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea r8, [rsp + 0x11458]
lea rdx, [rsp + 0x11460]
call fcn.140020d90
mov rdx, rdi
mov rcx, rax
call fcn.14001c7f0
movzx eax, al
test eax, eax
je 0x1401ca550
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
mov rax, qword [rsp + 0x12250]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401ca482
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11480], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11480]
call fcn.140020bd0
mov rdx, rax
lea rcx, [rsp + 0x1ae8]
call fcn.140020e80
nop
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x11484], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x11484]
call fcn.140020bd0
mov rcx, rax
call fcn.14001f630
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
mov rax, qword [rsp + 0x12250]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov dword [rsp + 0x1ae4], 0
mov dword [rsp + 0x1b18], 0
jmp 0x1401ca607
mov eax, dword [rsp + 0x1b18]
add eax, 1
mov dword [rsp + 0x1b18], eax
movsxd rdi, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001be50
cmp rdi, rax
jae 0x1401cad96
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
mov r8, rax
lea rdx, str.servercmd
lea rcx, [rsp + 0x11488]
call fcn.140006c90
mov qword [rsp + 0x11ad8], rax
mov rax, qword [rsp + 0x11ad8]
mov qword [rsp + 0x11ae0], rax
lea r8, [0x140224488]
mov rdx, qword [rsp + 0x11ae0]
lea rcx, [rsp + 0x11490]
call fcn.1400010b0
mov qword [rsp + 0x11ae8], rax
mov rax, qword [rsp + 0x11ae8]
mov qword [rsp + 0x11af0], rax
mov rcx, qword [rsp + 0x11af0]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11498]
call fcn.1400d9d00
mov qword [rsp + 0x11af8], rax
mov rax, qword [rsp + 0x11af8]
mov qword [rsp + 0x11b00], rax
mov rcx, qword [rsp + 0x11b00]
call fcn.14000f8f0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11498]
call fcn.140001490
nop
lea rcx, [rsp + 0x11490]
call fcn.140001490
nop
lea rcx, [rsp + 0x11488]
call fcn.140001490
mov r9d, 0x1000
lea r8, [rsp + 0xae0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
test eax, eax
jne 0x1401ca760
mov dword [rsp + 0x1ae4], 1
jmp 0x1401cad96
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
lea rdx, str.vnc_start
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ca7d3
lea rcx, [0x1402244c0]
call fcn.1400a98c0
lea rcx, [rsp + rax + 0xae0]
call fcn.1400ae190
mov dword [rsp + 0x1b1c], eax
mov eax, dword [rsp + 0x5e8]
movsxd r9, dword [rsp + 0x1b1c]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
lea rdx, str.vnc_monitor
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ca846
lea rcx, str.vnc_ready
call fcn.1400a98c0
lea rcx, [rsp + rax + 0xae0]
call fcn.1400ae190
mov dword [rsp + 0x1b20], eax
mov eax, dword [rsp + 0x5e8]
movsxd r9, dword [rsp + 0x1b20]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
lea rdx, [0x1402244f8]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ca90d
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
cmp rax, 2
jbe 0x1401ca90d
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
mov byte [rsp + rax + 0xade], 0
lea rdx, [rsp + 0xae0]
lea rcx, [rsp + 0x114a0]
call fcn.1400dd9c0
mov qword [rsp + 0x11b08], rax
mov rax, qword [rsp + 0x11b08]
mov qword [rsp + 0x11b10], rax
mov rcx, qword [rsp + 0x11b10]
call fcn.14000f8f0
mov r9d, dword [rsp + 0x5e8]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403b58d0]
call fcn.1401c2760
nop
lea rcx, [rsp + 0x114a0]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
lea rdx, str.processinfo
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ca9f4
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
cmp rax, 2
jbe 0x1401ca9f4
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
mov byte [rsp + rax + 0xade], 0
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
call fcn.14000e350
lea rdx, [rsp + 0xae0]
lea rcx, [rsp + 0x114a8]
call fcn.1400dd9c0
mov qword [rsp + 0x11b18], rax
mov rax, qword [rsp + 0x11b18]
mov qword [rsp + 0x11b20], rax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x2c0
mov rdx, qword [rsp + 0x11b20]
call fcn.140002db0
nop
lea rcx, [rsp + 0x114a8]
call fcn.140001490
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
mov rax, qword [rsp + 0x12250]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
movsxd rdx, dword [rsp + 0x1b18]
lea rcx, [rsp + 0x1ae8]
call fcn.14001fd00
lea rdx, [0x140224530]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cad91
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
cmp rax, 2
jbe 0x1401caabb
lea rcx, [rsp + 0xae0]
call fcn.1400a98c0
mov byte [rsp + rax + 0xade], 0
lea rdx, [rsp + 0xae0]
lea rcx, [rsp + 0x114b0]
call fcn.1400dd9c0
mov qword [rsp + 0x11b28], rax
mov rax, qword [rsp + 0x11b28]
mov qword [rsp + 0x11b30], rax
mov rcx, qword [rsp + 0x11b30]
call fcn.14000f8f0
mov r9d, dword [rsp + 0x5e8]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403b58d0]
call fcn.1401c2760
nop
lea rcx, [rsp + 0x114b0]
call fcn.140001490
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x450]
call fcn.1401d7890
lea rcx, [rsp + 0x790]
call fcn.1401d56b0
lea rcx, [rsp + 0x650]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cad91
lea rcx, [rsp + 0x9d0]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
cmp eax, 1
jne 0x1401cad91
mov edx, dword [rsp + 0x5e8]
lea rcx, [0x1403b36c0]
call fcn.14013a2d0
mov qword [rsp + 0x1b30], rax
mov qword [rsp + 0x1b48], 0
mov qword [rsp + 0x1b38], 0
mov qword [rsp + 0x1b28], 0
lea rcx, [rsp + 0x1b50]
call fcn.140002de0
nop
mov edx, dword [rsp + 0x5e8]
lea rcx, [0x1403b36c0]
call fcn.14013dc70
mov dword [rsp + 0x1b40], eax
cmp dword [rsp + 0x1b40], 0
jne 0x1401cab97
lea rcx, [rsp + 0x1b50]
call fcn.140001490
jmp 0x1401ca5f6
mov r8d, dword [rsp + 0x1b40]
lea rdx, [0x140224550]
lea rcx, [rsp + 0x1b50]
call fcn.140002c70
lea rcx, [rsp + 0x1b50]
call fcn.14000f8f0
lea r9, [rsp + 0x1b28]
lea r8, [rsp + 0x1b38]
lea rdx, [rsp + 0x1b48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1401cabf7
lea rcx, [rsp + 0x1b50]
call fcn.140001490
jmp 0x1401ca5f6
mov rax, qword [rsp + 0x1b28]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jge 0x1401cac15
addsd xmm0, qword [0x140261550]
mulsd xmm0, qword [0x140261560]
mov rax, qword [rsp + 0x1b38]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jge 0x1401cac3b
addsd xmm1, qword [0x140261550]
divsd xmm0, xmm1
comisd xmm0, xmmword [0x140263648]
jbe 0x1401cac5b
lea rcx, [rsp + 0x1b50]
call fcn.140001490
jmp 0x1401ca5f6
xor edx, edx
lea rcx, [rsp + 0x1b50]
call fcn.140006dd0
movzx edx, ax
lea rcx, [0x1403b36c0]
call fcn.14013dad0
cmp dword [rsp + 0x5e8], eax
jne 0x1401cad84
mov rax, qword [rsp + 0x1b28]
imul rax, rax, 0x64
xor edx, edx
div qword [rsp + 0x1b38]
mov rdi, rax
xor edx, edx
mov rax, qword [rsp + 0x1b30]
mov ecx, 0x400
div rcx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov eax, dword [rsp + 0x1b40]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x5f0]
lea rdx, str.Reboot__s___d_M__avoid_write_back_disk___c:__full__free__d___
xor ecx, ecx
call fcn.1400dcf70
lea rdx, str.servercmd_reboot_ready_30_r_n
lea rcx, [rsp + 0x114b8]
call fcn.1400d9d00
mov qword [rsp + 0x11b38], rax
mov rax, qword [rsp + 0x11b38]
mov qword [rsp + 0x11b40], rax
mov rcx, qword [rsp + 0x11b40]
call fcn.14000f8f0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x114b8]
call fcn.140001490
mov r9d, 0x1000
lea r8, [rsp + 0xae0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
test eax, eax
jne 0x1401cad84
mov dword [rsp + 0x1ae4], 1
lea rcx, [rsp + 0x1b50]
call fcn.140001490
jmp 0x1401cad96
lea rcx, [rsp + 0x1b50]
call fcn.140001490
jmp 0x1401ca5f6
lea rcx, [rsp + 0x1ae8]
call fcn.14001f630
cmp dword [rsp + 0x1ae4], 0
je 0x1401cadbf
lea rcx, [rsp + 0x1ae8]
call fcn.1400104c0
jmp 0x1401cb06f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1ae0]
cmp eax, 0x1e
jbe 0x1401cb051
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
call fcn.14000e350
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x114c0], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x114c0]
call fcn.140020bd0
mov rcx, rax
call fcn.14001be50
cmp rax, 0xa
jae 0x1401cb009
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x114c8]
call fcn.140002100
nop
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x114c4], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x114c4]
call fcn.140020bd0
lea rdx, [rsp + 0x114c8]
mov rcx, rax
call fcn.1400104f0
nop
lea rcx, [rsp + 0x114c8]
call fcn.140001490
lea rcx, [rsp + 0x114d8]
call fcn.140001000
mov qword [rsp + 0x11b48], rax
mov rax, qword [rsp + 0x11b48]
mov qword [rsp + 0x11b50], rax
lea r8, [0x14022274c]
mov rdx, qword [rsp + 0x11b50]
lea rcx, [rsp + 0x114e0]
call fcn.1400010b0
mov qword [rsp + 0x11b58], rax
mov rax, qword [rsp + 0x11b58]
mov qword [rsp + 0x11b60], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11b60]
lea rcx, [rsp + 0x114e8]
call fcn.1400010b0
mov qword [rsp + 0x11b68], rax
mov rax, qword [rsp + 0x11b68]
mov qword [rsp + 0x11b70], rax
lea r8, [0x140224638]
mov rdx, qword [rsp + 0x11b70]
lea rcx, [rsp + 0x114f0]
call fcn.1400010b0
mov qword [rsp + 0x11b78], rax
mov rcx, qword [rsp + 0x11b78]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, [0x140224648]
lea rcx, [0x140224668]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x114d0], eax
lea rcx, [rsp + 0x114f0]
call fcn.140001490
nop
lea rcx, [rsp + 0x114e8]
call fcn.140001490
nop
lea rcx, [rsp + 0x114e0]
call fcn.140001490
nop
lea rcx, [rsp + 0x114d8]
call fcn.140001490
cmp dword [rsp + 0x114d0], 0
je 0x1401cb009
lea rdx, str.gettemperature
lea rcx, [rsp + 0x11500]
call fcn.140002100
nop
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x114f8], eax
mov rcx, qword [rsp + 0x12250]
add rcx, 0x268
lea rdx, [rsp + 0x114f8]
call fcn.140020bd0
lea rdx, [rsp + 0x11500]
mov rcx, rax
call fcn.1400104f0
nop
lea rcx, [rsp + 0x11500]
call fcn.140001490
mov rcx, qword [rsp + 0x12250]
add rcx, 0x230
mov rax, qword [rsp + 0x12250]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1ae0], eax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x450]
call fcn.1401d7890
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x1ae8]
call fcn.1400104c0
jmp 0x1401ca482
jmp 0x1401d16a3
mov r8d, 4
lea rdx, str.Sync
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cb0b4
lea r8, [rsp + 0xae0]
mov rdx, qword [rsp + 0x12258]
mov rcx, qword [rsp + 0x12250]
call fcn.1401c9410
jmp 0x1401d16a3
lea rcx, [0x1402246a0]
call fcn.1400a98c0
mov r8, rax
lea rdx, str.setpnpid
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cb4ef
lea rcx, [rsp + 0x6a8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cb15d
lea rcx, [rsp + 0x650]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cb15d
lea rdx, [rsp + 0x11510]
lea rcx, [rsp + 0x450]
call fcn.1401d3d40
mov qword [rsp + 0x11b80], rax
mov eax, dword [rsp + 0x11a94]
or eax, 1
mov dword [rsp + 0x11a94], eax
mov rcx, qword [rsp + 0x11b80]
call fcn.140001a40
test eax, eax
jne 0x1401cb15d
mov dword [rsp + 0x11b88], 1
jmp 0x1401cb168
mov dword [rsp + 0x11b88], 0
movzx eax, byte [rsp + 0x11b88]
mov byte [rsp + 0x11508], al
mov eax, dword [rsp + 0x11a94]
and eax, 1
test eax, eax
je 0x1401cb19a
and dword [rsp + 0x11a94], 0xfffffffe
lea rcx, [rsp + 0x11510]
call fcn.140001490
movzx eax, byte [rsp + 0x11508]
test eax, eax
je 0x1401cb1cb
lea r8, [0x1402246c0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401d16a3
lea r8, [0x1402246d8]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
mov byte [rsp + 0x1f90], 0
lea rdi, [rsp + 0x1f91]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1f90]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
test eax, eax
jne 0x1401cb234
jmp 0x1401d16a3
mov byte [rsp + 0x1b70], 0
lea rdi, [rsp + 0x1b71]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1b70]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
test eax, eax
jne 0x1401cb27d
jmp 0x1401d16a3
lea rdx, [rsp + 0x1f90]
lea rcx, [rsp + 0x11518]
call fcn.14000e700
mov qword [rsp + 0x11b90], rax
mov rax, qword [rsp + 0x11b90]
mov qword [rsp + 0x11b98], rax
mov rcx, qword [rsp + 0x11b98]
call fcn.1400118c0
mov rdx, rax
lea rcx, [rsp + 0x1b58]
call fcn.140002100
nop
lea rcx, [rsp + 0x11518]
call fcn.140002ea0
lea rdx, [rsp + 0x1b70]
lea rcx, [rsp + 0x11520]
call fcn.14000e700
mov qword [rsp + 0x11ba0], rax
mov rax, qword [rsp + 0x11ba0]
mov qword [rsp + 0x11ba8], rax
mov rcx, qword [rsp + 0x11ba8]
call fcn.1400118c0
mov rdx, rax
lea rcx, [rsp + 0x1f70]
call fcn.140002100
nop
lea rcx, [rsp + 0x11520]
call fcn.140002ea0
lea r8, [0x1402239bc]
lea rdx, [0x1402246e0]
lea rcx, [rsp + 0x1b58]
call fcn.140006300
lea r8, [0x140223acc]
lea rdx, [0x1402246e8]
lea rcx, [rsp + 0x1f70]
call fcn.140006300
lea r8, [0x1402246f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
mov r9d, 0x400
lea r8, [rsp + 0x1f90]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9690
mov dword [rsp + 0x1f80], 0
lea rdx, [rsp + 0x11528]
lea rcx, [rsp + 0x450]
call fcn.1401d6430
mov qword [rsp + 0x11bb0], rax
mov rax, qword [rsp + 0x11bb0]
mov qword [rsp + 0x11bb8], rax
lea r9, [rsp + 0x1f80]
lea r8, [0x140223b0c]
lea rdx, [rsp + 0x1f78]
mov rcx, qword [rsp + 0x11bb8]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x11528]
call fcn.140001490
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x1f78]
call fcn.1400068a0
mov dword [rsp + 0x1b60], eax
cmp dword [rsp + 0x1b60], 0
jge 0x1401cb464
lea rcx, [rsp + 0x1f78]
call fcn.140001490
nop
lea rcx, [rsp + 0x1f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b58]
call fcn.140001490
jmp 0x1401d16a3
mov r8d, dword [rsp + 0x1b60]
add r8d, 1
lea rdx, [rsp + 0x11530]
lea rcx, [rsp + 0x1f78]
call fcn.140006a00
mov qword [rsp + 0x11bc0], rax
mov rax, qword [rsp + 0x11bc0]
mov qword [rsp + 0x11bc8], rax
mov rdx, qword [rsp + 0x11bc8]
lea rcx, [rsp + 0x1f78]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11530]
call fcn.140001490
nop
lea rcx, [rsp + 0x1f78]
call fcn.140001490
nop
lea rcx, [rsp + 0x1f70]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b58]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x1402246f8]
call fcn.1400a98c0
mov r8, rax
lea rdx, str.getcmd
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cce90
mov r8d, 0x800
lea rdx, [rsp + 0x3750]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x3750]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea rdx, [rsp + 0x3750]
lea rcx, [rsp + 0x3748]
call fcn.140002100
nop
lea rdx, [0x140224708]
lea rcx, [rsp + 0x3748]
call fcn.1400060d0
lea rcx, [rsp + 0x2f00]
call fcn.140002de0
nop
mov dword [rsp + 0x3740], 0
mov dword [rsp + 0x2ef0], 0
lea rcx, [rsp + 0x6d8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cb5fb
lea rcx, [rsp + 0x650]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cb5fb
lea rcx, [rsp + 0x6a8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
jne 0x1401cb5fb
lea rcx, [rsp + 0x6b8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
je 0x1401cb61d
lea r8, str.setupdate_1_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cb63d
lea r8, str.setupdate_0_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
lea rcx, [rsp + 0x6d8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
je 0x1401cb678
lea r8, str.setsuper_1_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cb698
lea r8, str.setsuper_0_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
lea rcx, [rsp + 0x688]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
je 0x1401cb73d
lea rcx, [rsp + 0x690]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11538]
call fcn.140002e10
mov qword [rsp + 0x11bd0], rax
mov rax, qword [rsp + 0x11bd0]
mov qword [rsp + 0x11bd8], rax
mov rcx, qword [rsp + 0x11bd8]
call fcn.140002ec0
mov r8, rax
lea rdx, str.setdisplay__s_r_n
lea rcx, [rsp + 0x3f60]
call fcn.1400ad4a8
nop
lea rcx, [rsp + 0x11538]
call fcn.140002ea0
lea r8, [rsp + 0x3f60]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
lea rdx, [rsp + 0x978]
lea rcx, [rsp + 0x2ef8]
call fcn.140001430
nop
lea rcx, [rsp + 0x668]
call fcn.140001a40
test eax, eax
je 0x1401cb779
lea rdx, [rsp + 0x668]
lea rcx, [rsp + 0x2ef8]
call fcn.140002db0
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x3f58]
call fcn.140001430
nop
lea rcx, [rsp + 0x670]
call fcn.140001a40
test eax, eax
je 0x1401cb7b5
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x3f58]
call fcn.140002db0
lea rcx, [rsp + 0x3f58]
call fcn.140001a40
test eax, eax
je 0x1401cb84a
mov r8d, 1
lea rdx, [rsp + 0x11548]
lea rcx, [rsp + 0x2ef8]
call fcn.140006a60
mov qword [rsp + 0x11be0], rax
lea rdx, [0x140223b34]
mov rcx, qword [rsp + 0x11be0]
call fcn.140006d90
mov byte [rsp + 0x11540], al
lea rcx, [rsp + 0x11548]
call fcn.140001490
movzx edx, byte [rsp + 0x11540]
test edx, edx
je 0x1401cb835
lea rdx, [0x140224144]
lea rcx, [rsp + 0x2ef8]
call fcn.1400060d0
lea rdx, [rsp + 0x3f58]
lea rcx, [rsp + 0x2ef8]
call fcn.1400060a0
mov r8, qword [rsp + 0x2ef8]
lea rdx, str.setdns__s_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11550]
call fcn.140002e10
mov qword [rsp + 0x11be8], rax
mov rax, qword [rsp + 0x11be8]
mov qword [rsp + 0x11bf0], rax
mov rcx, qword [rsp + 0x11bf0]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11550]
call fcn.140002ea0
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x2f40]
lea r8, [0x14022420c]
lea rdx, [0x140224788]
lea rcx, [0x140224798]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x2f40]
cmp eax, 0x47
jne 0x1401cb932
lea rdx, str.setgmenu_1_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
jmp 0x1401cb946
lea rdx, str.setgmenu_0_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11558]
call fcn.140002e10
mov qword [rsp + 0x11bf8], rax
mov rax, qword [rsp + 0x11bf8]
mov qword [rsp + 0x11c00], rax
mov rcx, qword [rsp + 0x11c00]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11558]
call fcn.140002ea0
lea rcx, [rsp + 0x950]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x2390]
call fcn.1400a99dc
lea rcx, [rsp + 0x660]
call fcn.140001a40
test eax, eax
je 0x1401cb9fe
lea rcx, [rsp + 0x660]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x2390]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x2390]
lea rdx, str.route_delete_0.0.0.0_r_nroute_add_0.0.0.0_mask_0.0.0.0__s_metric_1_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11560]
call fcn.140002e10
mov qword [rsp + 0x11c08], rax
mov rax, qword [rsp + 0x11c08]
mov qword [rsp + 0x11c10], rax
mov rcx, qword [rsp + 0x11c10]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11560]
call fcn.140002ea0
lea rcx, [rsp + 0x6e0]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
test eax, eax
je 0x1401cbd21
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x4360]
call fcn.140001430
nop
mov dword [rsp + 0x4368], 0
cmp dword [rsp + 0x4368], 0xffffffff
je 0x1401cbd14
lea r9, [rsp + 0x4368]
lea r8, [0x14022421c]
lea rdx, [rsp + 0x4378]
lea rcx, [rsp + 0x4360]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x4378]
call fcn.140001a40
test eax, eax
jne 0x1401cbb1a
lea rcx, [rsp + 0x4378]
call fcn.140001490
jmp 0x1401cbd14
mov dword [rsp + 0x436c], 0x10
lea r8, [rsp + 0x436c]
lea rdx, [rsp + 0x4380]
mov rcx, qword [rsp + 0x12258]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WSOCK32.dll_getsockname]
mov ecx, dword [rsp + 0x4384]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x11568]
call fcn.14000e700
mov qword [rsp + 0x11c18], rax
mov rax, qword [rsp + 0x11c18]
mov qword [rsp + 0x11c20], rax
mov rcx, qword [rsp + 0x11c20]
call fcn.1400118c0
mov rdx, rax
lea rcx, [rsp + 0x4370]
call fcn.140002100
nop
lea rcx, [rsp + 0x11568]
call fcn.140002ea0
lea rdx, [rsp + 0x4370]
lea rcx, [rsp + 0x4378]
call fcn.14001bc00
movzx eax, al
test eax, eax
je 0x1401cbcf4
lea rdx, str.net_start_MSiSCSI_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11570]
call fcn.140002e10
mov qword [rsp + 0x11c28], rax
mov rax, qword [rsp + 0x11c28]
mov qword [rsp + 0x11c30], rax
mov rcx, qword [rsp + 0x11c30]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11570]
call fcn.140002ea0
lea r9, [0x1402248a0]
mov r8, qword [rsp + 0x4378]
lea rdx, str.iscsicli_AddTargetPortal__s_3260_r_niscsicli_LoginTarget__s:00_T______0x00000002__________0_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11578]
call fcn.140002e10
mov qword [rsp + 0x11c38], rax
mov rax, qword [rsp + 0x11c38]
mov qword [rsp + 0x11c40], rax
mov rcx, qword [rsp + 0x11c40]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11578]
call fcn.140002ea0
nop
lea rcx, [rsp + 0x4370]
call fcn.140001490
nop
lea rcx, [rsp + 0x4378]
call fcn.140001490
jmp 0x1401cbd14
lea rcx, [rsp + 0x4370]
call fcn.140001490
nop
lea rcx, [rsp + 0x4378]
call fcn.140001490
jmp 0x1401cbac4
lea rcx, [rsp + 0x4360]
call fcn.140001490
lea rcx, [rsp + 0x998]
lea rdx, [0x14022431c]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cc454
lea r8, [rsp + 0x3750]
lea rdx, [0x1402249c8]
lea rcx, [rsp + 0x3748]
call fcn.140002c70
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
lea rdx, [0x140224364]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x43a0], rax
cmp qword [rsp + 0x43a0], 0
je 0x1401cbedb
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa3d8
test eax, eax
jne 0x1401cbeae
mov byte [rsp + 0x46f0], 0
lea rdi, [rsp + 0x46f1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43a0]
mov edx, 0x1000
lea rcx, [rsp + 0x46f0]
call fcn.1400aaa24
lea rcx, [rsp + 0x46f0]
call fcn.1400a98c0
test rax, rax
jne 0x1401cbdeb
jmp 0x1401cbd8f
mov r8d, 5
lea rdx, [0x1402249ec]
lea rcx, [rsp + 0x46f0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cbe5c
lea rax, [rsp + 0x11580]
mov qword [rsp + 0x11588], rax
lea rdx, [rsp + 0x46f5]
mov rcx, qword [rsp + 0x11588]
call fcn.1400dcca0
mov qword [rsp + 0x11c48], rax
mov r8, qword [rsp + 0x11c48]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1401c7500
jmp 0x1401cbd8f
lea rcx, [0x1402249f8]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140224a08]
lea rcx, [rsp + 0x46f0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cbe88
jmp 0x1401cbd8f
lea r8, [rsp + 0x46f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cbd8f
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa608
lea r8, [0x14022437c]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
lea rcx, [rsp + 0x638]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0x4390], eax
lea rcx, [rsp + 0x43b0]
call fcn.1401d1960
nop
mov eax, dword [rsp + 0x4390]
mov dword [rsp + 0x4548], eax
lea rcx, [rsp + 0x43b0]
call fcn.1401bf080
lea rdx, [rsp + 0x4550]
lea rcx, [rsp + 0x4398]
call fcn.140001430
nop
cmp dword [rsp + 0x4390], 0
jne 0x1401cbf54
lea rdx, [0x140224a18]
lea rcx, [rsp + 0x4398]
call fcn.1400020d0
cmp dword [rsp + 0x4390], 0xffffffff
jne 0x1401cbf72
lea rdx, str.Non_PXE
lea rcx, [rsp + 0x4398]
call fcn.1400020d0
mov r9, qword [rsp + 0x4398]
lea r8, [rsp + 0x3750]
lea rdx, [0x140224a38]
lea rcx, [rsp + 0x3748]
call fcn.140002c70
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
lea rdx, [0x1402244bc]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x43a0], rax
cmp qword [rsp + 0x43a0], 0
je 0x1401cc0ef
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa3d8
test eax, eax
jne 0x1401cc0c2
movzx eax, byte [0x140217f5f]
mov byte [rsp + 0x56f0], al
lea rdi, [rsp + 0x56f1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43a0]
mov edx, 0x1000
lea rcx, [rsp + 0x56f0]
call fcn.1400aaa24
lea rcx, [rsp + 0x56f0]
call fcn.1400a98c0
test rax, rax
jne 0x1401cc02b
jmp 0x1401cbfc9
mov r8d, 5
lea rdx, [0x140224a54]
lea rcx, [rsp + 0x56f0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cc09c
lea rax, [rsp + 0x11590]
mov qword [rsp + 0x11598], rax
lea rdx, [rsp + 0x56f5]
mov rcx, qword [rsp + 0x11598]
call fcn.1400dcca0
mov qword [rsp + 0x11c50], rax
mov r8, qword [rsp + 0x11c50]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1401c7500
jmp 0x1401cbfc9
lea r8, [rsp + 0x56f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cbfc9
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa608
lea r8, [0x1402245dc]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x115a0]
call fcn.14000e700
mov qword [rsp + 0x11c58], rax
mov rax, qword [rsp + 0x11c58]
mov qword [rsp + 0x11c60], rax
mov rcx, qword [rsp + 0x11c60]
call fcn.1400118c0
mov r9, rax
lea r8, [rsp + 0x3750]
lea rdx, [0x140224a60]
lea rcx, [rsp + 0x3748]
call fcn.140002c70
nop
lea rcx, [rsp + 0x115a0]
call fcn.140002ea0
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
lea rdx, [0x1402249c4]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x43a0], rax
cmp qword [rsp + 0x43a0], 0
je 0x1401cc2bb
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa3d8
test eax, eax
jne 0x1401cc28e
movzx eax, byte [0x140217f63]
mov byte [rsp + 0x66f0], al
lea rdi, [rsp + 0x66f1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43a0]
mov edx, 0x1000
lea rcx, [rsp + 0x66f0]
call fcn.1400aaa24
lea rcx, [rsp + 0x66f0]
call fcn.1400a98c0
test rax, rax
jne 0x1401cc1f7
jmp 0x1401cc195
mov r8d, 5
lea rdx, [0x140224a7c]
lea rcx, [rsp + 0x66f0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cc268
lea rax, [rsp + 0x115a8]
mov qword [rsp + 0x115b0], rax
lea rdx, [rsp + 0x66f5]
mov rcx, qword [rsp + 0x115b0]
call fcn.1400dcca0
mov qword [rsp + 0x11c68], rax
mov r8, qword [rsp + 0x11c68]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1401c7500
jmp 0x1401cc195
lea r8, [rsp + 0x66f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cc195
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa608
lea r8, [0x140224a04]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
mov r9, qword [rsp + 0x5f0]
lea r8, [rsp + 0x3750]
lea rdx, str._sCmd_s.txt
lea rcx, [rsp + 0x3748]
call fcn.140002c70
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
lea rdx, [0x140224a14]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x43a0], rax
cmp qword [rsp + 0x43a0], 0
je 0x1401cc439
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa3d8
test eax, eax
jne 0x1401cc40b
movzx eax, byte [0x140217f67]
mov byte [rsp + 0x76f0], al
lea rdi, [rsp + 0x76f1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43a0]
mov edx, 0x1000
lea rcx, [rsp + 0x76f0]
call fcn.1400aaa24
lea rcx, [rsp + 0x76f0]
call fcn.1400a98c0
test rax, rax
jne 0x1401cc374
jmp 0x1401cc312
mov r8d, 5
lea rdx, [0x140224aa4]
lea rcx, [rsp + 0x76f0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cc3e5
lea rax, [rsp + 0x115b8]
mov qword [rsp + 0x115c0], rax
lea rdx, [rsp + 0x76f5]
mov rcx, qword [rsp + 0x115c0]
call fcn.1400dcca0
mov qword [rsp + 0x11c70], rax
mov r8, qword [rsp + 0x11c70]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1401c7500
jmp 0x1401cc312
lea r8, [rsp + 0x76f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cc312
mov rcx, qword [rsp + 0x43a0]
call fcn.1400aa608
lea r8, [0x140224aac]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x4398]
call fcn.140001490
nop
lea rcx, [rsp + 0x43b0]
call fcn.140014ec0
lea rcx, [rsp + 0x9d8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0x3f50], eax
lea rdx, [rsp + 0x9e0]
lea rcx, [rsp + 0x2ee8]
call fcn.140001430
nop
lea rcx, [rsp + 0x9d8]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401cc670
lea rcx, [rsp + 0x998]
lea rdx, [0x140224ab0]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cc670
lea rcx, [rsp + 0x115c8]
call fcn.140001000
mov qword [rsp + 0x11c78], rax
mov rax, qword [rsp + 0x11c78]
mov qword [rsp + 0x11c80], rax
lea r8, [0x140224ab8]
mov rdx, qword [rsp + 0x11c80]
lea rcx, [rsp + 0x86f8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x115c8]
call fcn.140001490
lea rcx, [rsp + 0x86f8]
call fcn.14000f8f0
lea rdx, [0x140224ab4]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x86f0], rax
cmp qword [rsp + 0x86f0], 0
je 0x1401cc618
mov rcx, qword [rsp + 0x86f0]
call fcn.1400aa3d8
test eax, eax
jne 0x1401cc60b
xor eax, eax
mov word [rsp + 0x8700], ax
lea rdi, [rsp + 0x8702]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x86f0]
mov edx, 0x2000
lea rcx, [rsp + 0x8700]
call fcn.1400aa448
lea rcx, [rsp + 0x8700]
call fcn.1400a8944
test rax, rax
jne 0x1401cc59d
jmp 0x1401cc53f
lea rcx, [0x140224ad8]
call fcn.1400a8944
mov r8, rax
lea rdx, [0x140224af0]
lea rcx, [rsp + 0x8700]
call fcn.1400ab814
test eax, eax
jne 0x1401cc606
mov dword [rsp + 0x3f50], 1
lea rcx, [0x140224b08]
call fcn.1400a8944
lea rdx, [rsp + rax*2 + 0x8700]
lea rcx, [rsp + 0x2ee8]
call fcn.1400020d0
lea rdx, [0x140224b20]
lea rcx, [rsp + 0x2ee8]
call fcn.1400069d0
jmp 0x1401cc60b
jmp 0x1401cc53f
mov rcx, qword [rsp + 0x86f0]
call fcn.1400aa608
lea rcx, [rsp + 0x9d8]
mov r8d, dword [rsp + 0x3f50]
lea rdx, [0x140224b28]
call fcn.140002c70
lea rcx, [rsp + 0x9e0]
lea rdx, [rsp + 0x2ee8]
call fcn.140002db0
lea rcx, [rsp + 0x790]
call fcn.1401bf470
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
nop
lea rcx, [rsp + 0x86f8]
call fcn.140001490
cmp dword [rsp + 0x3f50], 0
je 0x1401cc756
lea r8, [rsp + 0x2ee8]
lea rdx, [0x140224b38]
lea rcx, [rsp + 0x115d0]
call fcn.140006c90
mov qword [rsp + 0x11c88], rax
mov rax, qword [rsp + 0x11c88]
mov qword [rsp + 0x11c90], rax
lea r8, [0x140224b30]
mov rdx, qword [rsp + 0x11c90]
lea rcx, [rsp + 0xa700]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x115d0]
call fcn.140001490
lea rcx, [rsp + 0xa700]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x115d8]
call fcn.1400d9cc0
mov qword [rsp + 0x11c98], rax
mov rax, qword [rsp + 0x11c98]
mov qword [rsp + 0x11ca0], rax
mov rcx, qword [rsp + 0x11ca0]
call fcn.14000f8f0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x115d8]
call fcn.140001490
nop
lea rcx, [rsp + 0xa700]
call fcn.140001490
lea r8, [rsp + 0x3750]
lea rdx, str._sCCBoot.ini
lea rcx, [rsp + 0x3748]
call fcn.140002c70
lea rcx, [rsp + 0x2b90]
call fcn.140002de0
nop
lea rcx, [rsp + 0x2ba0]
call fcn.14000d040
nop
lea rcx, [rsp + 0x2f08]
call fcn.140006ef0
nop
lea rdx, [rsp + 0x2f08]
lea rcx, [rsp + 0x2ba0]
call fcn.1401bee60
lea rdx, [0x140224b6c]
lea rcx, [rsp + 0x2b90]
call fcn.1400020d0
mov dword [rsp + 0xa708], 0
jmp 0x1401cc7e3
mov eax, dword [rsp + 0xa708]
add eax, 1
mov dword [rsp + 0xa708], eax
movsxd rdi, dword [rsp + 0xa708]
lea rcx, [rsp + 0x2f08]
call fcn.140006f70
cmp rdi, rax
jae 0x1401cca0c
movsxd rdx, dword [rsp + 0xa708]
lea rcx, [rsp + 0x2f08]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1a8
lea rdx, [0x140224b70]
call fcn.140006180
test eax, eax
je 0x1401cc832
jmp 0x1401cc7d2
movsxd rdx, dword [rsp + 0xa708]
lea rcx, [rsp + 0x2f08]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1c0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x115e0]
call fcn.1400022a0
mov qword [rsp + 0x11ca8], rax
mov rax, qword [rsp + 0x11ca8]
mov qword [rsp + 0x11cb0], rax
movsxd rdx, dword [rsp + 0xa708]
lea rcx, [rsp + 0x2f08]
call fcn.140006fa0
mov rcx, rax
add rcx, 0x1a0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x115e8]
call fcn.1400022a0
mov qword [rsp + 0x11cb8], rax
mov rax, qword [rsp + 0x11cb8]
mov qword [rsp + 0x11cc0], rax
mov r8, qword [rsp + 0x11cc0]
lea rdx, [rsp + 0x2b90]
lea rcx, [rsp + 0x115f0]
call fcn.140006bd0
mov qword [rsp + 0x11cc8], rax
mov rax, qword [rsp + 0x11cc8]
mov qword [rsp + 0x11cd0], rax
lea r8, [0x140224b80]
mov rdx, qword [rsp + 0x11cd0]
lea rcx, [rsp + 0x115f8]
call fcn.1400010b0
mov qword [rsp + 0x11cd8], rax
mov rax, qword [rsp + 0x11cd8]
mov qword [rsp + 0x11ce0], rax
mov r8, qword [rsp + 0x11cb0]
mov rdx, qword [rsp + 0x11ce0]
lea rcx, [rsp + 0x11600]
call fcn.140006bd0
mov qword [rsp + 0x11ce8], rax
mov rax, qword [rsp + 0x11ce8]
mov qword [rsp + 0x11cf0], rax
lea r8, [0x140224b7c]
mov rdx, qword [rsp + 0x11cf0]
lea rcx, [rsp + 0x11608]
call fcn.1400010b0
mov qword [rsp + 0x11cf8], rax
mov rax, qword [rsp + 0x11cf8]
mov qword [rsp + 0x11d00], rax
mov rdx, qword [rsp + 0x11d00]
lea rcx, [rsp + 0x2b90]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11608]
call fcn.140001490
nop
lea rcx, [rsp + 0x11600]
call fcn.140001490
nop
lea rcx, [rsp + 0x115f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x115f0]
call fcn.140001490
nop
lea rcx, [rsp + 0x115e8]
call fcn.140001490
nop
lea rcx, [rsp + 0x115e0]
call fcn.140001490
jmp 0x1401cc7d2
lea rcx, [rsp + 0x2ee0]
call fcn.140002de0
nop
mov dword [rsp + 0x3740], 0
cmp dword [rsp + 0x3740], 0xffffffff
je 0x1401ccbb8
lea r9, [rsp + 0x3740]
lea r8, [0x140224b84]
lea rdx, [rsp + 0xaf20]
lea rcx, [rsp + 0x2b90]
call fcn.1400065a0
nop
lea rcx, [rsp + 0xaf20]
call fcn.140001a40
test eax, eax
jne 0x1401cca7b
lea rcx, [rsp + 0xaf20]
call fcn.140001490
jmp 0x1401ccbb8
mov r8d, 1
lea rdx, [rsp + 0x11610]
lea rcx, [rsp + 0xaf20]
call fcn.140006b20
mov qword [rsp + 0x11d08], rax
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0x11d08]
call fcn.14000f8f0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xa710]
lea r8, [0x140224b88]
mov rdx, rax
lea rcx, [0x140224b90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x11610]
call fcn.140001490
movzx eax, word [rsp + 0xa710]
test eax, eax
jne 0x1401ccb12
lea rcx, [rsp + 0xaf20]
call fcn.140001490
jmp 0x1401cca25
lea rdx, [rsp + 0xa710]
lea rcx, [rsp + 0x2ee0]
call fcn.1400060d0
lea rdx, [0x140224bb4]
lea rcx, [rsp + 0x2ee0]
call fcn.1400060d0
mov r8d, 1
lea rdx, [rsp + 0x11618]
lea rcx, [rsp + 0xaf20]
call fcn.140006a60
mov qword [rsp + 0x11d10], rax
mov rax, qword [rsp + 0x11d10]
mov qword [rsp + 0x11d18], rax
mov rdx, qword [rsp + 0x11d18]
lea rcx, [rsp + 0x2ee0]
call fcn.1400060a0
nop
lea rcx, [rsp + 0x11618]
call fcn.140001490
lea rdx, [0x140224bb8]
lea rcx, [rsp + 0x2ee0]
call fcn.1400060d0
nop
lea rcx, [rsp + 0xaf20]
call fcn.140001490
jmp 0x1401cca25
lea rcx, [rsp + 0x2ee0]
call fcn.140001a40
test eax, eax
je 0x1401ccc55
mov r8, qword [rsp + 0x2ee0]
lea rdx, [0x140224bc0]
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11620]
call fcn.140002e10
mov qword [rsp + 0x11d20], rax
mov rax, qword [rsp + 0x11d20]
mov qword [rsp + 0x11d28], rax
mov rcx, qword [rsp + 0x11d28]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11620]
call fcn.140002ea0
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, str.SetMkLink
lea rcx, [0x140224c00]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401ccd1a
lea rcx, [rsp + 0xaf28]
call fcn.140002de0
nop
mov r9, qword [rsp + 0x5f0]
mov r8, qword [rsp + 0x12250]
mov r8, qword [r8 + 0x2b0]
lea rdx, [0x140224c10]
lea rcx, [rsp + 0xaf28]
call fcn.140002c70
lea rcx, [rsp + 0xaf28]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401cccec
lea rcx, [rsp + 0xaf28]
call fcn.14000f8f0
mov rcx, rax
call fcn.140004bf0
lea r8, str.setmklink__r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xaf28]
call fcn.140001490
lea rcx, [rsp + 0x3748]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, str.USBWriteProtect
lea rcx, [0x140224c50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401ccd56
lea rax, [0x140224bbc]
mov qword [rsp + 0x11d30], rax
jmp 0x1401ccd65
lea rax, [0x140224bfc]
mov qword [rsp + 0x11d30], rax
mov r8, qword [rsp + 0x11d30]
lea rdx, str.setusbwriteprotect__s_r_n
lea rcx, [rsp + 0x2f00]
call fcn.140002c70
lea rcx, [rsp + 0x2f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11628]
call fcn.140002e10
mov qword [rsp + 0x11d38], rax
mov rax, qword [rsp + 0x11d38]
mov qword [rsp + 0x11d40], rax
mov rcx, qword [rsp + 0x11d40]
call fcn.140002ec0
mov r8, rax
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x11628]
call fcn.140002ea0
lea r8, str._r_n:end_r_n_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x2ee0]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f08]
call fcn.140006f40
nop
lea rcx, [rsp + 0x2ba0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x2b90]
call fcn.140001490
nop
lea rcx, [rsp + 0x2ee8]
call fcn.140001490
nop
lea rcx, [rsp + 0x3f58]
call fcn.140001490
nop
lea rcx, [rsp + 0x2ef8]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f00]
call fcn.140001490
nop
lea rcx, [rsp + 0x3748]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140224ca0]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140224cb0]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cd5be
lea rcx, str.superenable
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xb748]
call fcn.1400dd9c0
nop
lea rdx, [0x140224cd0]
lea rcx, [rsp + 0xb748]
call fcn.1400069d0
mov dword [rsp + 0xaf30], 0
lea rcx, [rsp + 0xb748]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11630]
call fcn.1400dcd20
mov qword [rsp + 0x11d48], rax
mov rcx, qword [rsp + 0x11d48]
call fcn.14000f8f0
lea rdx, [rsp + 0xaf30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xaf38], rax
lea rcx, [rsp + 0x11630]
call fcn.140001490
cmp dword [rsp + 0xaf30], 1
jge 0x1401ccf9f
mov rcx, qword [rsp + 0xaf38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [0x140224cd8]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xb748]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [0x140224cf0]
lea rcx, [rsp + 0xb740]
call fcn.140002100
nop
mov dword [rsp + 0xaf34], 0
mov dword [rsp + 0xb750], 0
jmp 0x1401ccfdd
mov eax, dword [rsp + 0xb750]
add eax, 1
mov dword [rsp + 0xb750], eax
mov eax, dword [rsp + 0xaf30]
cmp dword [rsp + 0xb750], eax
jge 0x1401cd194
lea rcx, [0x140224d10]
call fcn.1400a8944
mov r8, rax
movsxd rax, dword [rsp + 0xb750]
lea rdx, [0x140224d20]
mov rcx, qword [rsp + 0xaf38]
mov rcx, qword [rcx + rax*8]
call fcn.1400ab814
test eax, eax
jne 0x1401cd0c5
movsxd rax, dword [rsp + 0xb750]
mov rdx, qword [rsp + 0xaf38]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x11638]
call fcn.1400dcce0
mov qword [rsp + 0x11d50], rax
mov rax, qword [rsp + 0x11d50]
mov qword [rsp + 0x11d58], rax
mov r8d, 5
lea rdx, [rsp + 0x11640]
mov rcx, qword [rsp + 0x11d58]
call fcn.140006a00
mov qword [rsp + 0x11d60], rax
mov rax, qword [rsp + 0x11d60]
mov qword [rsp + 0x11d68], rax
mov rdx, qword [rsp + 0x11d68]
lea rcx, [rsp + 0xb740]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11640]
call fcn.140001490
nop
lea rcx, [rsp + 0x11638]
call fcn.140001490
lea rcx, [0x140224d30]
call fcn.1400a8944
mov r8, rax
movsxd rax, dword [rsp + 0xb750]
lea rdx, str._SuperType
mov rcx, qword [rsp + 0xaf38]
mov rcx, qword [rcx + rax*8]
call fcn.1400ab814
test eax, eax
jne 0x1401cd18f
movsxd rax, dword [rsp + 0xb750]
mov rdx, qword [rsp + 0xaf38]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x11648]
call fcn.1400dcce0
mov qword [rsp + 0x11d70], rax
mov rax, qword [rsp + 0x11d70]
mov qword [rsp + 0x11d78], rax
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, [rsp + 0x11650]
mov rcx, qword [rsp + 0x11d78]
call fcn.140006a00
mov qword [rsp + 0x11d80], rax
mov rcx, qword [rsp + 0x11d80]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xaf34], eax
lea rcx, [rsp + 0x11650]
call fcn.140001490
nop
lea rcx, [rsp + 0x11648]
call fcn.140001490
jmp 0x1401ccfcc
mov rcx, qword [rsp + 0xaf38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x140224d60]
lea rcx, [rsp + 0xb740]
call fcn.140006100
test eax, eax
jne 0x1401cd1fb
lea r8, [0x140224d80]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xb740]
call fcn.140001490
nop
lea rcx, [rsp + 0xb748]
call fcn.140001490
jmp 0x1401d16a3
xor eax, eax
mov word [rsp + 0xaf40], ax
lea rdi, [rsp + 0xaf42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11658]
call fcn.140001000
mov qword [rsp + 0x11d88], rax
mov rax, qword [rsp + 0x11d88]
mov qword [rsp + 0x11d90], rax
lea r8, [0x140224c1c]
mov rdx, qword [rsp + 0x11d90]
lea rcx, [rsp + 0x11660]
call fcn.1400010b0
mov qword [rsp + 0x11d98], rax
mov rax, qword [rsp + 0x11d98]
mov qword [rsp + 0x11da0], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11da0]
lea rcx, [rsp + 0x11668]
call fcn.1400010b0
mov qword [rsp + 0x11da8], rax
mov rax, qword [rsp + 0x11da8]
mov qword [rsp + 0x11db0], rax
lea r8, [0x140224d98]
mov rdx, qword [rsp + 0x11db0]
lea rcx, [rsp + 0x11670]
call fcn.1400010b0
mov qword [rsp + 0x11db8], rax
mov rcx, qword [rsp + 0x11db8]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xaf40]
lea r8, [0x140224cac]
lea rdx, [0x140224da8]
lea rcx, [0x140224dc0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x11670]
call fcn.140001490
nop
lea rcx, [rsp + 0x11668]
call fcn.140001490
nop
lea rcx, [rsp + 0x11660]
call fcn.140001490
nop
lea rcx, [rsp + 0x11658]
call fcn.140001490
lea rdx, [rsp + 0xaf40]
lea rcx, [rsp + 0x11680]
call fcn.140004e30
mov qword [rsp + 0x11dc0], rax
mov rcx, qword [rsp + 0x11dc0]
call fcn.140006eb0
mov byte [rsp + 0x11678], al
lea rcx, [rsp + 0x11680]
call fcn.140001490
movzx edx, byte [rsp + 0x11678]
test edx, edx
je 0x1401cd3c7
lea r8, [0x140224dd0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xb740]
call fcn.140001490
nop
lea rcx, [rsp + 0xb748]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [rsp + 0xaf40]
lea rcx, [rsp + 0x11690]
call fcn.140004e30
mov qword [rsp + 0x11dc8], rax
mov rax, qword [rsp + 0x11dc8]
mov qword [rsp + 0x11dd0], rax
mov rcx, qword [rsp + 0x11dd0]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xb740]
call fcn.140006100
mov dword [rsp + 0x11688], eax
lea rcx, [rsp + 0x11690]
call fcn.140001490
cmp dword [rsp + 0x11688], 0
je 0x1401cd470
lea r8, [0x140224df0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xb740]
call fcn.140001490
nop
lea rcx, [rsp + 0xb748]
call fcn.140001490
jmp 0x1401d16a3
mov r8d, dword [rsp + 0xaf34]
mov edx, dword [rsp + 0x5e8]
lea rcx, [0x1403b36c0]
call fcn.1401407b0
mov dword [rsp + 0x11dd8], eax
cmp dword [rsp + 0x11dd8], 0xfffffffd
je 0x1401cd4cd
cmp dword [rsp + 0x11dd8], 0xfffffffe
je 0x1401cd4f2
cmp dword [rsp + 0x11dd8], 0xffffffff
je 0x1401cd517
cmp dword [rsp + 0x11dd8], 0
je 0x1401cd539
cmp dword [rsp + 0x11dd8], 1
je 0x1401cd55b
jmp 0x1401cd57d
lea r8, str._ERR_DEVICEID_NOT_MATCH_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cd59e
lea r8, str._ERR_ALREADY_SUPER_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cd59e
lea r8, [0x140224e40]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cd59e
lea r8, [0x140224e60]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cd59e
lea r8, [0x140224e78]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cd59e
lea r8, [0x140224e80]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xb740]
call fcn.140001490
nop
lea rcx, [rsp + 0xb748]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140224ea0]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140224eb0]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cdcee
lea rcx, str.superdisable
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xbf80]
call fcn.1400dd9c0
nop
lea rdx, [0x140224ed0]
lea rcx, [rsp + 0xbf80]
call fcn.1400069d0
mov dword [rsp + 0xb754], 0
lea rcx, [rsp + 0xbf80]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11698]
call fcn.1400dcd20
mov qword [rsp + 0x11de0], rax
mov rcx, qword [rsp + 0x11de0]
call fcn.14000f8f0
lea rdx, [rsp + 0xb754]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xb760], rax
lea rcx, [rsp + 0x11698]
call fcn.140001490
cmp dword [rsp + 0xb754], 3
jge 0x1401cd6cd
mov rcx, qword [rsp + 0xb760]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, str._ERR_INVALID_CMD_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf80]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [0x140224ef0]
lea rcx, [rsp + 0xbf70]
call fcn.140002100
nop
mov dword [rsp + 0xbf78], 0
mov dword [rsp + 0xb758], 0
mov dword [rsp + 0xbf88], 0
jmp 0x1401cd716
mov eax, dword [rsp + 0xbf88]
add eax, 1
mov dword [rsp + 0xbf88], eax
mov eax, dword [rsp + 0xb754]
cmp dword [rsp + 0xbf88], eax
jge 0x1401cd921
movsxd rax, dword [rsp + 0xbf88]
mov rdx, qword [rsp + 0xb760]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x116a0]
call fcn.1400dcce0
mov qword [rsp + 0x11de8], rax
mov rax, qword [rsp + 0x11de8]
mov qword [rsp + 0x11df0], rax
mov rdx, qword [rsp + 0x11df0]
lea rcx, [rsp + 0xbf80]
call fcn.140002db0
nop
lea rcx, [rsp + 0x116a0]
call fcn.140001490
lea rcx, [0x140224f10]
call fcn.1400a8944
mov r8, rax
movsxd rax, dword [rsp + 0xbf88]
lea rdx, str._Pwd
mov rcx, qword [rsp + 0xb760]
mov rcx, qword [rcx + rax*8]
call fcn.1400ab814
test eax, eax
jne 0x1401cd814
mov r8d, 5
lea rdx, [rsp + 0x116a8]
lea rcx, [rsp + 0xbf80]
call fcn.140006a00
mov qword [rsp + 0x11df8], rax
mov rax, qword [rsp + 0x11df8]
mov qword [rsp + 0x11e00], rax
mov rdx, qword [rsp + 0x11e00]
lea rcx, [rsp + 0xbf70]
call fcn.140002db0
nop
lea rcx, [rsp + 0x116a8]
call fcn.140001490
jmp 0x1401cd705
lea rcx, [0x140224f30]
call fcn.1400a8944
mov r8, rax
movsxd rax, dword [rsp + 0xbf88]
lea rdx, [0x140224f48]
mov rcx, qword [rsp + 0xb760]
mov rcx, qword [rcx + rax*8]
call fcn.1400ab814
test eax, eax
jne 0x1401cd898
mov r8d, 8
lea rdx, [rsp + 0x116b0]
lea rcx, [rsp + 0xbf80]
call fcn.140006a00
mov qword [rsp + 0x11e08], rax
mov rcx, qword [rsp + 0x11e08]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xbf78], eax
lea rcx, [rsp + 0x116b0]
call fcn.140001490
jmp 0x1401cd705
lea rcx, [0x140224f60]
call fcn.1400a8944
mov r8, rax
movsxd rax, dword [rsp + 0xbf88]
lea rdx, [0x140224f78]
mov rcx, qword [rsp + 0xb760]
mov rcx, qword [rcx + rax*8]
call fcn.1400ab814
test eax, eax
jne 0x1401cd91c
mov r8d, 0xa
lea rdx, [rsp + 0x116b8]
lea rcx, [rsp + 0xbf80]
call fcn.140006a00
mov qword [rsp + 0x11e10], rax
mov rcx, qword [rsp + 0x11e10]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xb758], eax
lea rcx, [rsp + 0x116b8]
call fcn.140001490
jmp 0x1401cd705
jmp 0x1401cd705
mov rcx, qword [rsp + 0xb760]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.VERSION_ERROR
lea rcx, [rsp + 0xbf70]
call fcn.140006100
test eax, eax
jne 0x1401cd988
lea r8, [0x140224fb0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf70]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf80]
call fcn.140001490
jmp 0x1401d16a3
xor eax, eax
mov word [rsp + 0xb770], ax
lea rdi, [rsp + 0xb772]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x116c0]
call fcn.140001000
mov qword [rsp + 0x11e18], rax
mov rax, qword [rsp + 0x11e18]
mov qword [rsp + 0x11e20], rax
lea r8, [0x140224cbc]
mov rdx, qword [rsp + 0x11e20]
lea rcx, [rsp + 0x116c8]
call fcn.1400010b0
mov qword [rsp + 0x11e28], rax
mov rax, qword [rsp + 0x11e28]
mov qword [rsp + 0x11e30], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11e30]
lea rcx, [rsp + 0x116d0]
call fcn.1400010b0
mov qword [rsp + 0x11e38], rax
mov rax, qword [rsp + 0x11e38]
mov qword [rsp + 0x11e40], rax
lea r8, [0x140224fc8]
mov rdx, qword [rsp + 0x11e40]
lea rcx, [rsp + 0x116d8]
call fcn.1400010b0
mov qword [rsp + 0x11e48], rax
mov rcx, qword [rsp + 0x11e48]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb770]
lea r8, [0x140224d0c]
lea rdx, [0x140224fd8]
lea rcx, [0x140224ff0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x116d8]
call fcn.140001490
nop
lea rcx, [rsp + 0x116d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x116c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x116c0]
call fcn.140001490
lea rdx, [rsp + 0xb770]
lea rcx, [rsp + 0x116e8]
call fcn.140004e30
mov qword [rsp + 0x11e50], rax
mov rcx, qword [rsp + 0x11e50]
call fcn.140006eb0
mov byte [rsp + 0x116e0], al
lea rcx, [rsp + 0x116e8]
call fcn.140001490
movzx edx, byte [rsp + 0x116e0]
test edx, edx
je 0x1401cdb54
lea r8, [0x140225000]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf70]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf80]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [rsp + 0xb770]
lea rcx, [rsp + 0x116f8]
call fcn.140004e30
mov qword [rsp + 0x11e58], rax
mov rax, qword [rsp + 0x11e58]
mov qword [rsp + 0x11e60], rax
mov rcx, qword [rsp + 0x11e60]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xbf70]
call fcn.140006100
mov dword [rsp + 0x116f0], eax
lea rcx, [rsp + 0x116f8]
call fcn.140001490
cmp dword [rsp + 0x116f0], 0
je 0x1401cdbfd
lea r8, [0x140225020]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf70]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf80]
call fcn.140001490
jmp 0x1401d16a3
mov r9d, dword [rsp + 0xb758]
mov r8d, dword [rsp + 0xbf78]
mov edx, dword [rsp + 0x5e8]
lea rcx, [0x1403b36c0]
call fcn.140139910
mov dword [rsp + 0x11e68], eax
cmp dword [rsp + 0x11e68], 0xffffffff
je 0x1401cdc47
cmp dword [rsp + 0x11e68], 0
je 0x1401cdc69
cmp dword [rsp + 0x11e68], 1
je 0x1401cdc8b
jmp 0x1401cdcad
lea r8, str._ERR_GET_DEVICEID_FAILED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cdcce
lea r8, str._ERR_INVALID_CLIENTID_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cdcce
lea r8, str.OK_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401cdcce
lea r8, str._ERR_OPERATION_FAILURE_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf70]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf80]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140225098]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x1402250a0]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cea04
lea rcx, str.upload
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xc7c0]
call fcn.1400dd9c0
nop
lea rdx, [0x1402250b0]
lea rcx, [rsp + 0xc7c0]
call fcn.1400069d0
mov dword [rsp + 0xc7d4], 0
lea r9, [rsp + 0xc7d4]
lea r8, [0x140224d1c]
lea rdx, [rsp + 0x11700]
lea rcx, [rsp + 0xc7c0]
call fcn.1400065a0
mov qword [rsp + 0x11e70], rax
mov rcx, qword [rsp + 0x11e70]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xc7d0], eax
lea rcx, [rsp + 0x11700]
call fcn.140001490
cmp dword [rsp + 0xc7d4], 0xffffffff
jne 0x1401cddcb
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea r9, [rsp + 0xc7d4]
lea r8, [0x140224d2c]
lea rdx, [rsp + 0x11708]
lea rcx, [rsp + 0xc7c0]
call fcn.1400065a0
mov qword [rsp + 0x11e78], rax
mov rcx, qword [rsp + 0x11e78]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xc7b8], eax
lea rcx, [rsp + 0x11708]
call fcn.140001490
cmp dword [rsp + 0xc7d4], 0xffffffff
jne 0x1401cde3c
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xc7c8]
call fcn.140002de0
nop
mov edx, dword [rsp + 0xc7d4]
lea rcx, [rsp + 0xc7c0]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401cded8
mov eax, dword [rsp + 0xc7d4]
add eax, 1
mov dword [rsp + 0xc7d4], eax
lea r9, [rsp + 0xc7d4]
lea r8, [0x140224d7c]
lea rdx, [rsp + 0x11710]
lea rcx, [rsp + 0xc7c0]
call fcn.1400065a0
mov qword [rsp + 0x11e80], rax
mov rax, qword [rsp + 0x11e80]
mov qword [rsp + 0x11e88], rax
mov rdx, qword [rsp + 0x11e88]
lea rcx, [rsp + 0xc7c8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11710]
call fcn.140001490
jmp 0x1401cdf37
lea r9, [rsp + 0xc7d4]
lea r8, [0x140224f0c]
lea rdx, [rsp + 0x11718]
lea rcx, [rsp + 0xc7c0]
call fcn.1400065a0
mov qword [rsp + 0x11e90], rax
mov rax, qword [rsp + 0x11e90]
mov qword [rsp + 0x11e98], rax
mov rdx, qword [rsp + 0x11e98]
lea rcx, [rsp + 0xc7c8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11718]
call fcn.140001490
cmp dword [rsp + 0xc7d4], 0xffffffff
jne 0x1401cdf52
lea rax, [0x140224f1c]
mov qword [rsp + 0x11ea0], rax
jmp 0x1401cdfb4
lea r9, [rsp + 0xc7d4]
lea r8, [0x140224f2c]
lea rdx, [rsp + 0x11720]
lea rcx, [rsp + 0xc7c0]
call fcn.1400065a0
mov qword [rsp + 0x11ea8], rax
mov rax, qword [rsp + 0x11ea8]
mov qword [rsp + 0x11eb0], rax
mov eax, dword [rsp + 0x11a94]
or eax, 2
mov dword [rsp + 0x11a94], eax
mov rcx, qword [rsp + 0x11eb0]
call fcn.14000f8f0
mov qword [rsp + 0x11ea0], rax
mov rdx, qword [rsp + 0x11ea0]
lea rcx, [rsp + 0xc7b0]
call fcn.140002100
nop
mov eax, dword [rsp + 0x11a94]
and eax, 2
test eax, eax
je 0x1401cdfed
and dword [rsp + 0x11a94], 0xfffffffd
lea rcx, [rsp + 0x11720]
call fcn.140001490
xor eax, eax
mov word [rsp + 0xbfa0], ax
lea rdi, [rsp + 0xbfa2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11728]
call fcn.140001000
mov qword [rsp + 0x11eb8], rax
mov rax, qword [rsp + 0x11eb8]
mov qword [rsp + 0x11ec0], rax
lea r8, [0x140224fac]
mov rdx, qword [rsp + 0x11ec0]
lea rcx, [rsp + 0x11730]
call fcn.1400010b0
mov qword [rsp + 0x11ec8], rax
mov rax, qword [rsp + 0x11ec8]
mov qword [rsp + 0x11ed0], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11ed0]
lea rcx, [rsp + 0x11738]
call fcn.1400010b0
mov qword [rsp + 0x11ed8], rax
mov rax, qword [rsp + 0x11ed8]
mov qword [rsp + 0x11ee0], rax
lea r8, [0x1402250b8]
mov rdx, qword [rsp + 0x11ee0]
lea rcx, [rsp + 0x11740]
call fcn.1400010b0
mov qword [rsp + 0x11ee8], rax
mov rcx, qword [rsp + 0x11ee8]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xbfa0]
lea r8, [0x1402250c4]
lea rdx, [0x1402250c8]
lea rcx, [0x1402250e0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x11740]
call fcn.140001490
nop
lea rcx, [rsp + 0x11738]
call fcn.140001490
nop
lea rcx, [rsp + 0x11730]
call fcn.140001490
nop
lea rcx, [rsp + 0x11728]
call fcn.140001490
lea rdx, [rsp + 0xbfa0]
lea rcx, [rsp + 0x11750]
call fcn.140004e30
mov qword [rsp + 0x11ef0], rax
mov rcx, qword [rsp + 0x11ef0]
call fcn.140006eb0
mov byte [rsp + 0x11748], al
lea rcx, [rsp + 0x11750]
call fcn.140001490
movzx edx, byte [rsp + 0x11748]
test edx, edx
je 0x1401ce1c7
lea r8, [0x1402250f0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xc7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [rsp + 0xbfa0]
lea rcx, [rsp + 0x11760]
call fcn.140004e30
mov qword [rsp + 0x11ef8], rax
mov rax, qword [rsp + 0x11ef8]
mov qword [rsp + 0x11f00], rax
mov rcx, qword [rsp + 0x11f00]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xc7b0]
call fcn.140006100
mov dword [rsp + 0x11758], eax
lea rcx, [rsp + 0x11760]
call fcn.140001490
cmp dword [rsp + 0x11758], 0
je 0x1401ce27e
lea r8, [0x140225110]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xc7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0x940]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xc7a8]
call fcn.1400022a0
nop
mov r8d, 1
lea rdx, [rsp + 0x11770]
lea rcx, [rsp + 0xc7a8]
call fcn.140006a60
mov qword [rsp + 0x11f08], rax
lea rdx, [0x140225128]
mov rcx, qword [rsp + 0x11f08]
call fcn.140006d90
mov byte [rsp + 0x11768], al
lea rcx, [rsp + 0x11770]
call fcn.140001490
movzx edx, byte [rsp + 0x11768]
test edx, edx
je 0x1401ce308
lea rdx, [0x14022512c]
lea rcx, [rsp + 0xc7a8]
call fcn.1400060d0
lea rcx, [rsp + 0xc7c8]
call fcn.14000f8f0
lea rdx, [0x140225130]
mov rcx, rax
call fcn.1400aa128
test rax, rax
jne 0x1401ce383
lea r8, [rsp + 0xc7c8]
lea rdx, [rsp + 0xc7a8]
lea rcx, [rsp + 0x11778]
call fcn.140006bd0
mov qword [rsp + 0x11f10], rax
mov rax, qword [rsp + 0x11f10]
mov qword [rsp + 0x11f18], rax
mov rdx, qword [rsp + 0x11f18]
lea rcx, [rsp + 0xc7a8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11778]
call fcn.140001490
jmp 0x1401ce398
lea rdx, [rsp + 0xc7c8]
lea rcx, [rsp + 0xc7a8]
call fcn.140002db0
lea rcx, [rsp + 0xc7a8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401ce428
mov r8, qword [rsp + 0xc7a8]
lea rdx, [0x140225150]
mov ecx, 1
call fcn.1400dcf70
lea r8, [0x140225138]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xc7a8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
mov r8, qword [rsp + 0xc7a8]
lea rdx, [0x1402251b0]
xor ecx, ecx
call fcn.1400dcf70
lea rcx, [rsp + 0xc7a8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movsxd rdi, dword [rsp + 0xc7b8]
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
lea rcx, [rsp + 0xc7a8]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140102860
mov dword [rsp + 0xc7a0], eax
cmp dword [rsp + 0xc7a0], 0
jne 0x1401ce52d
lea rcx, [rsp + 0xc7a8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rsp + 0xc7a8]
lea rdx, str._ERROR__Ceate_image__s_error
mov ecx, 1
call fcn.1400dcf70
lea r8, str._ERR_CREATE_VMDK_FAILED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xc7a8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xc7e0]
call fcn.14000c880
nop
lea rax, [rsp + 0x11780]
mov qword [rsp + 0x11788], rax
lea rdx, [rsp + 0xc7a8]
mov rcx, qword [rsp + 0x11788]
call fcn.140001430
mov qword [rsp + 0x11f20], rax
mov rdx, qword [rsp + 0x11f20]
lea rcx, [rsp + 0xc7e0]
call fcn.1401d50b0
test eax, eax
jne 0x1401ce5f2
lea rdx, [0x1402251d8]
lea rcx, [rsp + 0x11790]
call fcn.1400ef320
mov qword [rsp + 0x11f28], rax
mov rax, qword [rsp + 0x11f28]
mov qword [rsp + 0x11f30], rax
lea rcx, [rsp + 0xc980]
mov rdx, qword [rsp + 0x11f30]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11790]
call fcn.140001490
lea rcx, [rsp + 0xc988]
lea rdx, [rsp + 0xc7a8]
call fcn.140002db0
lea rcx, [rsp + 0xc7e0]
call fcn.1401d48c0
lea rcx, [rsp + 0xbf98]
call fcn.140002de0
nop
lea rcx, [rsp + 0xbf90]
call fcn.140002de0
nop
lea rax, [rsp + 0x11798]
mov qword [rsp + 0x117a0], rax
lea rdx, [0x140225134]
mov rcx, qword [rsp + 0x117a0]
call fcn.140002100
mov qword [rsp + 0x11f38], rax
mov rax, qword [rsp + 0x11f38]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xbf90]
lea rdx, [rsp + 0xbf98]
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call fcn.140014020
lea rcx, [rsp + 0xbf90]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401ce695
lea rdx, [0x140225258]
lea rcx, [rsp + 0xbf90]
call fcn.1400020d0
lea rcx, [rsp + 0xbf98]
call fcn.140006910
mov rax, qword [rsp + 0x12258]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x450]
call fcn.1401d7890
test eax, eax
jne 0x1401ce86f
lea rax, [rsp + 0x117a8]
mov qword [rsp + 0x117b0], rax
lea rdx, [rsp + 0xbf98]
mov rcx, qword [rsp + 0x117b0]
call fcn.140001430
mov qword [rsp + 0x11f40], rax
mov rdx, qword [rsp + 0x11f40]
lea rcx, [rsp + 0x450]
call fcn.1401d7720
test eax, eax
jne 0x1401ce7e7
lea rax, [rsp + 0x117b8]
mov qword [rsp + 0x117c0], rax
lea rax, [rsp + 0x117c8]
mov qword [rsp + 0x117d0], rax
lea rdx, [rsp + 0xbf90]
mov rcx, qword [rsp + 0x117c0]
call fcn.140001430
mov qword [rsp + 0x11f48], rax
mov rax, qword [rsp + 0x11f48]
mov qword [rsp + 0x11f50], rax
lea rdx, [rsp + 0xbf98]
mov rcx, qword [rsp + 0x117d0]
call fcn.140001430
mov qword [rsp + 0x11f58], rax
mov rax, qword [rsp + 0x11f50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x11f58]
mov rax, qword [rsp + 0x12258]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x450]
call fcn.1401d79f0
lea rcx, [rsp + 0x638]
lea rdx, [0x140225268]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ce7d5
lea rcx, [rsp + 0x638]
lea rdx, [0x140225270]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
jmp 0x1401ce86d
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
lea rcx, [rsp + 0x608]
mov rdx, rax
call fcn.14000cb30
lea rcx, [rsp + 0x5f0]
lea rdx, [rsp + 0xbf90]
call fcn.140002db0
lea rcx, [rsp + 0x6d0]
lea rdx, [0x140225274]
call fcn.1400020d0
lea rcx, [rsp + 0x638]
lea rdx, [0x140225278]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ce860
lea rcx, [rsp + 0x638]
lea rdx, [0x140225280]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
jmp 0x1401ce8e9
lea rcx, [rsp + 0x618]
lea rdx, [rsp + 0xbf98]
call fcn.140002db0
lea rcx, [rsp + 0x5f0]
lea rdx, [rsp + 0xbf90]
call fcn.140002db0
lea rcx, [rsp + 0x6d0]
lea rdx, [0x140225284]
call fcn.1400020d0
lea rcx, [rsp + 0x638]
lea rdx, [0x140225288]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ce8dc
lea rcx, [rsp + 0x638]
lea rdx, [0x140225290]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
lea rcx, [rsp + 0x6d8]
lea rdx, [0x140225294]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
mov edx, dword [rsp + 0x5e8]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
lea rcx, [0x1403b36c0]
call fcn.14001f9f0
mov r8d, eax
lea rdx, str.OK__d_r_n
lea rcx, [rsp + 0xae0]
call fcn.1400ad4a8
lea r8, [rsp + 0xae0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xbf90]
call fcn.140001490
nop
lea rcx, [rsp + 0xbf98]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7e0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xc7a8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7b0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7c0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x1402252a8]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x1402252b8]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cfb33
lea rcx, str.disk2vhd
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xd5b0]
call fcn.1400dd9c0
nop
lea rdx, [0x1402252d4]
lea rcx, [rsp + 0xd5b0]
call fcn.1400069d0
mov dword [rsp + 0xd5c4], 0
lea r9, [rsp + 0xd5c4]
lea r8, [0x1402252dc]
lea rdx, [rsp + 0x117d8]
lea rcx, [rsp + 0xd5b0]
call fcn.1400065a0
mov qword [rsp + 0x11f60], rax
mov rcx, qword [rsp + 0x11f60]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xd5c0], eax
lea rcx, [rsp + 0x117d8]
call fcn.140001490
cmp dword [rsp + 0xd5c4], 0xffffffff
jne 0x1401ceb02
lea r8, [0x1402252e0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xd5b8]
call fcn.140002de0
nop
mov edx, dword [rsp + 0xd5c4]
lea rcx, [rsp + 0xd5b0]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401ceb9e
mov eax, dword [rsp + 0xd5c4]
add eax, 1
mov dword [rsp + 0xd5c4], eax
lea r9, [rsp + 0xd5c4]
lea r8, [0x1402252f4]
lea rdx, [rsp + 0x117e0]
lea rcx, [rsp + 0xd5b0]
call fcn.1400065a0
mov qword [rsp + 0x11f68], rax
mov rax, qword [rsp + 0x11f68]
mov qword [rsp + 0x11f70], rax
mov rdx, qword [rsp + 0x11f70]
lea rcx, [rsp + 0xd5b8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x117e0]
call fcn.140001490
jmp 0x1401cebfd
lea r9, [rsp + 0xd5c4]
lea r8, [0x1402252f8]
lea rdx, [rsp + 0x117e8]
lea rcx, [rsp + 0xd5b0]
call fcn.1400065a0
mov qword [rsp + 0x11f78], rax
mov rax, qword [rsp + 0x11f78]
mov qword [rsp + 0x11f80], rax
mov rdx, qword [rsp + 0x11f80]
lea rcx, [rsp + 0xd5b8]
call fcn.140002db0
nop
lea rcx, [rsp + 0x117e8]
call fcn.140001490
cmp dword [rsp + 0xd5c4], 0xffffffff
jne 0x1401cec18
lea rax, [0x1402252fc]
mov qword [rsp + 0x11f88], rax
jmp 0x1401cec7a
lea r9, [rsp + 0xd5c4]
lea r8, [0x140225300]
lea rdx, [rsp + 0x117f0]
lea rcx, [rsp + 0xd5b0]
call fcn.1400065a0
mov qword [rsp + 0x11f90], rax
mov rax, qword [rsp + 0x11f90]
mov qword [rsp + 0x11f98], rax
mov eax, dword [rsp + 0x11a94]
or eax, 4
mov dword [rsp + 0x11a94], eax
mov rcx, qword [rsp + 0x11f98]
call fcn.14000f8f0
mov qword [rsp + 0x11f88], rax
mov rdx, qword [rsp + 0x11f88]
lea rcx, [rsp + 0xd580]
call fcn.140002100
nop
mov eax, dword [rsp + 0x11a94]
and eax, 4
test eax, eax
je 0x1401cecb3
and dword [rsp + 0x11a94], 0xfffffffb
lea rcx, [rsp + 0x117f0]
call fcn.140001490
xor eax, eax
mov word [rsp + 0xcd70], ax
lea rdi, [rsp + 0xcd72]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x117f8]
call fcn.140001000
mov qword [rsp + 0x11fa0], rax
mov rax, qword [rsp + 0x11fa0]
mov qword [rsp + 0x11fa8], rax
lea r8, [0x140225304]
mov rdx, qword [rsp + 0x11fa8]
lea rcx, [rsp + 0x11800]
call fcn.1400010b0
mov qword [rsp + 0x11fb0], rax
mov rax, qword [rsp + 0x11fb0]
mov qword [rsp + 0x11fb8], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x11fb8]
lea rcx, [rsp + 0x11808]
call fcn.1400010b0
mov qword [rsp + 0x11fc0], rax
mov rax, qword [rsp + 0x11fc0]
mov qword [rsp + 0x11fc8], rax
lea r8, [0x140225308]
mov rdx, qword [rsp + 0x11fc8]
lea rcx, [rsp + 0x11810]
call fcn.1400010b0
mov qword [rsp + 0x11fd0], rax
mov rcx, qword [rsp + 0x11fd0]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xcd70]
lea r8, [0x140225314]
lea rdx, [0x140225318]
lea rcx, [0x140225330]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x11810]
call fcn.140001490
nop
lea rcx, [rsp + 0x11808]
call fcn.140001490
nop
lea rcx, [rsp + 0x11800]
call fcn.140001490
nop
lea rcx, [rsp + 0x117f8]
call fcn.140001490
lea rdx, [rsp + 0xcd70]
lea rcx, [rsp + 0x11820]
call fcn.140004e30
mov qword [rsp + 0x11fd8], rax
mov rcx, qword [rsp + 0x11fd8]
call fcn.140006eb0
mov byte [rsp + 0x11818], al
lea rcx, [rsp + 0x11820]
call fcn.140001490
movzx edx, byte [rsp + 0x11818]
test edx, edx
je 0x1401cee8d
lea r8, [0x140225340]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xd580]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [rsp + 0xcd70]
lea rcx, [rsp + 0x11830]
call fcn.140004e30
mov qword [rsp + 0x11fe0], rax
mov rax, qword [rsp + 0x11fe0]
mov qword [rsp + 0x11fe8], rax
mov rcx, qword [rsp + 0x11fe8]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xd580]
call fcn.140006100
mov dword [rsp + 0x11828], eax
lea rcx, [rsp + 0x11830]
call fcn.140001490
cmp dword [rsp + 0x11828], 0
je 0x1401cef44
lea r8, [0x140225360]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xd580]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0x940]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xd578]
call fcn.1400022a0
nop
mov r8d, 1
lea rdx, [rsp + 0x11840]
lea rcx, [rsp + 0xd578]
call fcn.140006a60
mov qword [rsp + 0x11ff0], rax
lea rdx, [0x140225378]
mov rcx, qword [rsp + 0x11ff0]
call fcn.140006d90
mov byte [rsp + 0x11838], al
lea rcx, [rsp + 0x11840]
call fcn.140001490
movzx edx, byte [rsp + 0x11838]
test edx, edx
je 0x1401cefce
lea rdx, [0x14022537c]
lea rcx, [rsp + 0xd578]
call fcn.1400060d0
lea rcx, [rsp + 0xd5b8]
call fcn.14000f8f0
lea rdx, [0x140225380]
mov rcx, rax
call fcn.1400aa128
test rax, rax
jne 0x1401cf049
lea r8, [rsp + 0xd5b8]
lea rdx, [rsp + 0xd578]
lea rcx, [rsp + 0x11848]
call fcn.140006bd0
mov qword [rsp + 0x11ff8], rax
mov rax, qword [rsp + 0x11ff8]
mov qword [rsp + 0x12000], rax
mov rdx, qword [rsp + 0x12000]
lea rcx, [rsp + 0xd578]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11848]
call fcn.140001490
jmp 0x1401cf05e
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0xd578]
call fcn.140002db0
lea rcx, [rsp + 0xd578]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401cf0ee
mov r8, qword [rsp + 0xd578]
lea rdx, str._ERROR__Cannot_create_image___s_exists
mov ecx, 1
call fcn.1400dcf70
lea r8, str._ERR_FILE_EXISTS_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xd578]
call fcn.140001490
nop
lea rcx, [rsp + 0xd580]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
mov r8, qword [rsp + 0xd578]
lea rdx, str.Create_new_image__s
xor ecx, ecx
call fcn.1400dcf70
lea rcx, [rsp + 0xd578]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140225384]
lea rcx, [rsp + 0xcd60]
call fcn.140002100
nop
lea rdx, str._echo_off_r_n_t_t_t_t_t_t_t___REM_CCBootShare_Required_Services_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:rpc_endpoint_mapper_r_n_t_t_t_t_t_t_t___REM_RPC_Endpoint_Mapper_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_mapper_service_r_n_t_t_t_t_t_t_t___sc_config_nsi_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_nsi_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:dcom_server_process_launcher_r_n_t_t_t_t_t_t_t___REM_DCOM_Server_Process_Launcher_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_dcom_service_r_n_t_t_t_t_t_t_t___sc_config_DcomLaunch_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_DcomLaunch_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:remote_procedure_call_r_n_t_t_t_t_t_t_t___REM_Remote_Procedure_Call__RPC__r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_service_r_n_t_t_t_t_t_t_t___sc_config_RpcSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_RpcSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:security_accounts_manager_r_n_t_t_t_t_t_t_t___REM_Security_Accounts_Manager_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_security_service_r_n_t_t_t_t_t_t_t___sc_config_SamSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_SamSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:server_service_r_n_t_t_t_t_t_t_t___REM_Server_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_server_service_r_n_t_t_t_t_t_t_t___sc_config_LanmanServer_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_LanmanServer_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:bat_exit_r_n_t_t_t_t_t_t_t___echo_12__get_sid_gust_variable_r_n_t_t_t_t_t_t_t___for__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_t_t_t_t_t_t_t___if_not____a__SID____r_n_t_t_t_t_t_t_t___set_sid_guest__a_r_n_t_t_t_t_t_t_t___goto_loop_end_r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:loop_end_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_13__create_script_for_regini_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_14__add_permission_for_machine_security_r_n_t_t_t_t_t_t_t___net_user_guest__active:yes_r_n_t_t_t_t_t_t_t___regini_x_r_n_t_t_t_t_t_t_t___del_x_r_n_t_t_t_t_t_t_t____echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_t_t_t_t_t_t_t____echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_t_t_t_t_t_t_t____echo__hex_0_:42_00_00_00____y.reg_r_n_t_t_t_t_t_t_t___reg_import_y.reg_r_n_t_t_t_t_t_t_t___del_y.reg_r_n_t_t_t_t_t_t_t____echo_on_r_n
lea rcx, [rsp + 0xcd60]
call fcn.1400020d0
mov rdx, qword [rsp + 0x12250]
add rdx, 0x228
lea r8, [0x140226bd8]
lea rcx, [rsp + 0xd588]
call fcn.1400010b0
nop
lea rcx, [rsp + 0xd590]
call fcn.140092c60
nop
lea rcx, [rsp + 0xd588]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0xd590]
call fcn.1400933e8
test eax, eax
je 0x1401cf28e
lea rcx, [rsp + 0xd590]
call fcn.140023c90
lea rcx, [rsp + 0xcd60]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x11850]
call fcn.1400d9cc0
mov qword [rsp + 0x12008], rax
mov rax, qword [rsp + 0x12008]
mov qword [rsp + 0x12010], rax
lea rcx, [rsp + 0xcd60]
call fcn.140001a40
mov edi, eax
mov rcx, qword [rsp + 0x12010]
call fcn.14000f8f0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd590]
call fcn.1400928e0
nop
lea rcx, [rsp + 0x11850]
call fcn.140001490
lea rcx, [rsp + 0xd590]
call fcn.140092bd8
lea rcx, [rsp + 0xd588]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004930
lea rcx, [rsp + 0xd588]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rdx, [rsp + 0xd578]
lea rcx, [rsp + 0xcb58]
call fcn.140001430
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0xcb58]
call fcn.140006200
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xcb58]
call fcn.1400068a0
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x11858]
lea rcx, [rsp + 0xcb58]
call fcn.1400022a0
mov qword [rsp + 0x12018], rax
mov rax, qword [rsp + 0x12018]
mov qword [rsp + 0x12020], rax
mov rdx, qword [rsp + 0x12020]
lea rcx, [rsp + 0xcb58]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11858]
call fcn.140001490
lea rcx, [rsp + 0xcb58]
call fcn.140001a40
cmp eax, 2
jne 0x1401cf3a4
mov edx, 1
lea rcx, [rsp + 0xcb58]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x3a
jne 0x1401cf3a4
lea r8, [0x140226bd4]
lea rdx, [rsp + 0xcb58]
lea rcx, [rsp + 0x11860]
call fcn.1400010b0
mov qword [rsp + 0x12028], rax
mov rax, qword [rsp + 0x12028]
mov qword [rsp + 0x12030], rax
mov rdx, qword [rsp + 0x12030]
lea rcx, [rsp + 0xcb58]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11860]
call fcn.140001490
mov r8, qword [rsp + 0xcb58]
lea rdx, str.SetAcl___s__start
xor ecx, ecx
call fcn.1400dcf70
xor edx, edx
lea rcx, [rsp + 0xcb80]
call fcn.14017c720
nop
lea rax, [rsp + 0x11868]
mov qword [rsp + 0x11870], rax
lea rax, [rsp + 0x11878]
mov qword [rsp + 0x11880], rax
lea rax, [rsp + 0x11888]
mov qword [rsp + 0x11890], rax
lea rdx, [0x140226c28]
mov rcx, qword [rsp + 0x11870]
call fcn.140002100
mov qword [rsp + 0x12038], rax
mov rax, qword [rsp + 0x12038]
mov qword [rsp + 0x12040], rax
lea rdx, str.Everyone
mov rcx, qword [rsp + 0x11880]
call fcn.140002100
mov qword [rsp + 0x12048], rax
mov rax, qword [rsp + 0x12048]
mov qword [rsp + 0x12050], rax
lea rdx, [rsp + 0xcb58]
mov rcx, qword [rsp + 0x11890]
call fcn.140001430
mov qword [rsp + 0x12058], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x12040]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x12050]
mov r8d, 1
mov rdx, qword [rsp + 0x12058]
lea rcx, [rsp + 0xcb80]
call fcn.140187b80
mov dword [rsp + 0xd570], eax
mov r9, qword [rsp + 0xcb58]
mov r8d, dword [rsp + 0xd570]
lea rdx, str.SetAcl___d____s_
xor ecx, ecx
call fcn.1400dcf70
xor r8d, r8d
lea rdx, [0x140226c78]
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea rcx, [0x140226c90]
call fcn.1400268c0
mov qword [rsp + 0xcb20], rax
mov dword [rsp + 0xcb28], 0
mov qword [rsp + 0xcb30], 0
mov dword [rsp + 0xcb38], 0x7f
mov dword [rsp + 0xcb3c], 0xffffffff
mov dword [rsp + 0xcb40], 0
lea rcx, [rsp + 0xcb58]
call fcn.140020b50
mov rcx, rax
call fcn.1400268c0
mov qword [rsp + 0xcb48], rax
lea rcx, [0x140226ca8]
call fcn.1400268c0
mov qword [rsp + 0xcb50], rax
xor r9d, r9d
lea r8, [rsp + 0xcb20]
mov edx, 2
xor ecx, ecx
call sub.NETAPI32.dll_NetShareAdd
mov dword [rsp + 0xcb68], eax
cmp dword [rsp + 0xcb68], 0
je 0x1401cf63a
lea rdx, str._ERROR__Sharing_of_image_file_failed.
mov ecx, 1
call fcn.1400dcf70
lea r8, str._ERR_SHARE_FAILED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xcb80]
call fcn.14017c630
nop
lea rcx, [rsp + 0xcb58]
call fcn.140001490
nop
lea rcx, [rsp + 0xd590]
call fcn.140092eac
nop
lea rcx, [rsp + 0xd588]
call fcn.140001490
nop
lea rcx, [rsp + 0xcd60]
call fcn.140001490
nop
lea rcx, [rsp + 0xd578]
call fcn.140001490
nop
lea rcx, [rsp + 0xd580]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xd5d0]
call fcn.14000c880
nop
lea rax, [rsp + 0x11898]
mov qword [rsp + 0x118a0], rax
lea rdx, [rsp + 0xd578]
mov rcx, qword [rsp + 0x118a0]
call fcn.140001430
mov qword [rsp + 0x12060], rax
mov rdx, qword [rsp + 0x12060]
lea rcx, [rsp + 0xd5d0]
call fcn.1401d50b0
test eax, eax
jne 0x1401cf6ff
lea rdx, [0x140226d30]
lea rcx, [rsp + 0x118a8]
call fcn.1400ef320
mov qword [rsp + 0x12068], rax
mov rax, qword [rsp + 0x12068]
mov qword [rsp + 0x12070], rax
lea rcx, [rsp + 0xd770]
mov rdx, qword [rsp + 0x12070]
call fcn.140002db0
nop
lea rcx, [rsp + 0x118a8]
call fcn.140001490
lea rcx, [rsp + 0xd778]
lea rdx, [rsp + 0xd578]
call fcn.140002db0
lea rcx, [rsp + 0xd5d0]
call fcn.1401d48c0
lea rcx, [rsp + 0xcb70]
call fcn.140002de0
nop
lea rcx, [rsp + 0xcb60]
call fcn.140002de0
nop
lea rax, [rsp + 0x118b0]
mov qword [rsp + 0x118b8], rax
lea rdx, [0x140226c24]
mov rcx, qword [rsp + 0x118b8]
call fcn.140002100
mov qword [rsp + 0x12078], rax
mov rax, qword [rsp + 0x12078]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xcb60]
lea rdx, [rsp + 0xcb70]
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call fcn.140014020
lea rcx, [rsp + 0xcb60]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401cf7a2
lea rdx, str.Master
lea rcx, [rsp + 0xcb60]
call fcn.1400020d0
lea rcx, [rsp + 0xcb70]
call fcn.140006910
mov rax, qword [rsp + 0x12258]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x450]
call fcn.1401d7890
test eax, eax
jne 0x1401cf97c
lea rax, [rsp + 0x118c0]
mov qword [rsp + 0x118c8], rax
lea rdx, [rsp + 0xcb70]
mov rcx, qword [rsp + 0x118c8]
call fcn.140001430
mov qword [rsp + 0x12080], rax
mov rdx, qword [rsp + 0x12080]
lea rcx, [rsp + 0x450]
call fcn.1401d7720
test eax, eax
jne 0x1401cf8f4
lea rax, [rsp + 0x118d0]
mov qword [rsp + 0x118d8], rax
lea rax, [rsp + 0x118e0]
mov qword [rsp + 0x118e8], rax
lea rdx, [rsp + 0xcb60]
mov rcx, qword [rsp + 0x118d8]
call fcn.140001430
mov qword [rsp + 0x12088], rax
mov rax, qword [rsp + 0x12088]
mov qword [rsp + 0x12090], rax
lea rdx, [rsp + 0xcb70]
mov rcx, qword [rsp + 0x118e8]
call fcn.140001430
mov qword [rsp + 0x12098], rax
mov rax, qword [rsp + 0x12090]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x12098]
mov rax, qword [rsp + 0x12258]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x450]
call fcn.1401d79f0
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d58]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cf8e2
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d2c]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
jmp 0x1401cf97a
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
lea rcx, [rsp + 0x608]
mov rdx, rax
call fcn.14000cb30
lea rcx, [rsp + 0x5f0]
lea rdx, [rsp + 0xcb60]
call fcn.140002db0
lea rcx, [rsp + 0x6d0]
lea rdx, [0x140226d60]
call fcn.1400020d0
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d64]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cf96d
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d6c]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
jmp 0x1401cf9f6
lea rcx, [rsp + 0x618]
lea rdx, [rsp + 0xcb70]
call fcn.140002db0
lea rcx, [rsp + 0x5f0]
lea rdx, [rsp + 0xcb60]
call fcn.140002db0
lea rcx, [rsp + 0x6d0]
lea rdx, [0x140226d70]
call fcn.1400020d0
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d74]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cf9e9
lea rcx, [rsp + 0x638]
lea rdx, [0x140226d7c]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
lea rcx, [rsp + 0x6d8]
lea rdx, [0x140226d80]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
mov edx, dword [rsp + 0x5e8]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
lea r8, [0x140226d84]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xcb60]
call fcn.140001490
nop
lea rcx, [rsp + 0xcb70]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5d0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xcb80]
call fcn.14017c630
nop
lea rcx, [rsp + 0xcb58]
call fcn.140001490
nop
lea rcx, [rsp + 0xd590]
call fcn.140092eac
nop
lea rcx, [rsp + 0xd588]
call fcn.140001490
nop
lea rcx, [rsp + 0xcd60]
call fcn.140001490
nop
lea rcx, [rsp + 0xd578]
call fcn.140001490
nop
lea rcx, [rsp + 0xd580]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b0]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140226d90]
call fcn.1400a98c0
mov r8, rax
lea rdx, str.endupload
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cfdd5
cmp dword [rsp + 0x5e8], 0
jbe 0x1401cfd9f
lea rcx, [rsp + 0x6d8]
lea rdx, [0x140226dac]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401cfd9f
lea rcx, [rsp + 0x6d8]
lea rdx, [0x140226db0]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
lea rcx, [0x140226db8]
call fcn.1400a98c0
mov r8, rax
lea rdx, str.endupload_ok
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401cfd50
lea rcx, [rsp + 0xd910]
call fcn.14000c880
nop
lea rax, [rsp + 0x118f0]
mov qword [rsp + 0x118f8], rax
lea rdx, [0x140226dd8]
mov rcx, qword [rsp + 0x118f8]
call fcn.1400ef320
mov qword [rsp + 0x120a0], rax
mov rdx, qword [rsp + 0x120a0]
lea rcx, [rsp + 0xd910]
call fcn.1401d4f50
test eax, eax
je 0x1401cfd43
lea rcx, [rsp + 0x11900]
call fcn.14000e290
lea r8, str._m_d_H_M
lea rdx, [rsp + 0x11908]
mov rcx, rax
call fcn.14000c960
mov qword [rsp + 0x120a8], rax
mov rax, qword [rsp + 0x120a8]
mov qword [rsp + 0x120b0], rax
mov r8, qword [rsp + 0x120b0]
lea rdx, [0x140226e08]
lea rcx, [rsp + 0x11910]
call fcn.140006c90
mov qword [rsp + 0x120b8], rax
mov rax, qword [rsp + 0x120b8]
mov qword [rsp + 0x120c0], rax
lea rcx, [rsp + 0xdab0]
mov rdx, qword [rsp + 0x120c0]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11910]
call fcn.140001490
nop
lea rcx, [rsp + 0x11908]
call fcn.140001490
lea rcx, [rsp + 0xd910]
call fcn.1401bf470
lea rcx, [rsp + 0x640]
mov r8d, dword [rsp + 0xdaa8]
lea rdx, [0x140226e10]
call fcn.140002c70
lea rcx, [rsp + 0x648]
lea rdx, [0x140226db4]
call fcn.1400020d0
lea rcx, [rsp + 0x450]
call fcn.1401d4410
lea rcx, [rsp + 0x930]
mov r8d, dword [rsp + 0x5e8]
lea rdx, [0x140226e18]
call fcn.140002c70
lea rcx, [rsp + 0x790]
call fcn.1401bf470
nop
lea rcx, [rsp + 0xd910]
call fcn.140014ec0
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
mov edx, dword [rsp + 0x5e8]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
xor r8d, r8d
lea rdx, str.Disk2VHD
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea r8, [0x140226e34]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401d16a3
lea rcx, [0x140226e40]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140226e50]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401d0508
lea rcx, str.multisyncto
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xe468]
call fcn.1400dd9c0
nop
lea rdx, [0x140226e70]
lea rcx, [rsp + 0xe468]
call fcn.1400069d0
mov dword [rsp + 0xe470], 0
lea r9, [rsp + 0xe470]
lea r8, [0x140226e78]
lea rdx, [rsp + 0x11918]
lea rcx, [rsp + 0xe468]
call fcn.1400065a0
mov qword [rsp + 0x120c8], rax
mov rcx, qword [rsp + 0x120c8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov dword [rsp + 0xdc58], eax
lea rcx, [rsp + 0x11918]
call fcn.140001490
cmp dword [rsp + 0xe470], 0xffffffff
jne 0x1401cfed3
lea r8, [0x140226e80]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
lea r9, [rsp + 0xe470]
lea r8, [0x140226e7c]
lea rdx, [rsp + 0xe460]
lea rcx, [rsp + 0xe468]
call fcn.1400065a0
nop
xor eax, eax
mov word [rsp + 0xdc60], ax
lea rdi, [rsp + 0xdc62]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11920]
call fcn.140001000
mov qword [rsp + 0x120d0], rax
mov rax, qword [rsp + 0x120d0]
mov qword [rsp + 0x120d8], rax
lea r8, [0x140226ea4]
mov rdx, qword [rsp + 0x120d8]
lea rcx, [rsp + 0x11928]
call fcn.1400010b0
mov qword [rsp + 0x120e0], rax
mov rax, qword [rsp + 0x120e0]
mov qword [rsp + 0x120e8], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x120e8]
lea rcx, [rsp + 0x11930]
call fcn.1400010b0
mov qword [rsp + 0x120f0], rax
mov rax, qword [rsp + 0x120f0]
mov qword [rsp + 0x120f8], rax
lea r8, [0x140226e98]
mov rdx, qword [rsp + 0x120f8]
lea rcx, [rsp + 0x11938]
call fcn.1400010b0
mov qword [rsp + 0x12100], rax
mov rcx, qword [rsp + 0x12100]
call fcn.14000f8f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xdc60]
lea r8, [0x140226ea8]
lea rdx, [0x140226eb0]
lea rcx, [0x140226ec8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x11938]
call fcn.140001490
nop
lea rcx, [rsp + 0x11930]
call fcn.140001490
nop
lea rcx, [rsp + 0x11928]
call fcn.140001490
nop
lea rcx, [rsp + 0x11920]
call fcn.140001490
lea rdx, [rsp + 0xdc60]
lea rcx, [rsp + 0x11948]
call fcn.140004e30
mov qword [rsp + 0x12108], rax
mov rcx, qword [rsp + 0x12108]
call fcn.140006eb0
mov byte [rsp + 0x11940], al
lea rcx, [rsp + 0x11948]
call fcn.140001490
movzx edx, byte [rsp + 0x11940]
test edx, edx
je 0x1401d00c4
lea r8, str._ERR_NEED_SET_ADMIN_PASSWORD_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xe460]
call fcn.140001490
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
lea rdx, [rsp + 0xdc60]
lea rcx, [rsp + 0x11958]
call fcn.140004e30
mov qword [rsp + 0x12110], rax
mov rax, qword [rsp + 0x12110]
mov qword [rsp + 0x12118], rax
mov rcx, qword [rsp + 0x12118]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xe460]
call fcn.140006100
mov dword [rsp + 0x11950], eax
lea rcx, [rsp + 0x11958]
call fcn.140001490
cmp dword [rsp + 0x11950], 0
je 0x1401d016d
lea r8, str._ERR_NO_PERMISSION_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xe460]
call fcn.140001490
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xdc50]
call fcn.140002de0
nop
cmp dword [rsp + 0xdc58], 0
jne 0x1401d04b9
mov edx, dword [rsp + 0xe470]
lea rcx, [rsp + 0xe468]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401d0217
mov eax, dword [rsp + 0xe470]
add eax, 1
mov dword [rsp + 0xe470], eax
lea r9, [rsp + 0xe470]
lea r8, [0x140226f10]
lea rdx, [rsp + 0x11960]
lea rcx, [rsp + 0xe468]
call fcn.1400065a0
mov qword [rsp + 0x12120], rax
mov rax, qword [rsp + 0x12120]
mov qword [rsp + 0x12128], rax
mov rdx, qword [rsp + 0x12128]
lea rcx, [rsp + 0xdc50]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11960]
call fcn.140001490
jmp 0x1401d0276
lea r9, [rsp + 0xe470]
lea r8, [0x140226f14]
lea rdx, [rsp + 0x11968]
lea rcx, [rsp + 0xe468]
call fcn.1400065a0
mov qword [rsp + 0x12130], rax
mov rax, qword [rsp + 0x12130]
mov qword [rsp + 0x12138], rax
mov rdx, qword [rsp + 0x12138]
lea rcx, [rsp + 0xdc50]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11968]
call fcn.140001490
lea rcx, [rsp + 0xe480]
call fcn.14000c880
nop
lea rax, [rsp + 0x11970]
mov qword [rsp + 0x11978], rax
lea rdx, [rsp + 0xdc50]
mov rcx, qword [rsp + 0x11978]
call fcn.140001430
mov qword [rsp + 0x12140], rax
mov rdx, qword [rsp + 0x12140]
lea rcx, [rsp + 0xe480]
call fcn.1401d4f50
test eax, eax
je 0x1401d04ac
mov edx, dword [rsp + 0xe618]
lea rcx, [rsp + 0xeb00]
call fcn.14000c6c0
nop
lea rcx, [rsp + 0xee70]
call fcn.140006ef0
nop
lea rdx, [rsp + 0xee70]
lea rcx, [rsp + 0xeb00]
call fcn.1401bee60
lea rcx, [rsp + 0xee70]
call fcn.140006f70
test rax, rax
jbe 0x1401d0391
lea r8, str._ERR_CHILD_IMAGE_CHECKED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xee70]
call fcn.140006f40
nop
lea rcx, [rsp + 0xeb00]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xe480]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xdc50]
call fcn.140001490
nop
lea rcx, [rsp + 0xe460]
call fcn.140001490
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
mov edx, dword [rsp + 0xe618]
lea rcx, [rsp + 0xe7c0]
call fcn.1401d18c0
nop
lea rcx, [rsp + 0xee40]
call fcn.140006ef0
nop
lea rdx, [rsp + 0xee40]
lea rcx, [rsp + 0xe7c0]
call fcn.1401bee60
lea rcx, [rsp + 0xee40]
call fcn.140006f70
test rax, rax
jbe 0x1401d0474
lea r8, str._ERR_RECOVERY_POINT_CHECKED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xee40]
call fcn.140006f40
nop
lea rcx, [rsp + 0xe7c0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xee70]
call fcn.140006f40
nop
lea rcx, [rsp + 0xeb00]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xe480]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xdc50]
call fcn.140001490
nop
lea rcx, [rsp + 0xe460]
call fcn.140001490
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xee40]
call fcn.140006f40
nop
lea rcx, [rsp + 0xe7c0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xee70]
call fcn.140006f40
nop
lea rcx, [rsp + 0xeb00]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xe480]
call fcn.140014ec0
lea r8, [0x140226f58]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xdc50]
call fcn.140001490
nop
lea rcx, [rsp + 0xe460]
call fcn.140001490
nop
lea rcx, [rsp + 0xe468]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140226f60]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140226f70]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401d0d4b
lea rcx, str.robocopyready
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0xf218]
call fcn.1400dd9c0
nop
lea rdx, [0x140226f90]
lea rcx, [rsp + 0xf218]
call fcn.1400069d0
mov dword [rsp + 0xf228], 0
lea rcx, [rsp + 0xf220]
call fcn.140002de0
nop
lea rcx, [rsp + 0xf208]
call fcn.140002de0
nop
mov edx, dword [rsp + 0xf228]
lea rcx, [rsp + 0xf218]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401d061e
mov eax, dword [rsp + 0xf228]
add eax, 1
mov dword [rsp + 0xf228], eax
lea r9, [rsp + 0xf228]
lea r8, [0x140226f98]
lea rdx, [rsp + 0x11980]
lea rcx, [rsp + 0xf218]
call fcn.1400065a0
mov qword [rsp + 0x12148], rax
mov rax, qword [rsp + 0x12148]
mov qword [rsp + 0x12150], rax
mov rdx, qword [rsp + 0x12150]
lea rcx, [rsp + 0xf220]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11980]
call fcn.140001490
jmp 0x1401d067d
lea r9, [rsp + 0xf228]
lea r8, [0x140226f9c]
lea rdx, [rsp + 0x11988]
lea rcx, [rsp + 0xf218]
call fcn.1400065a0
mov qword [rsp + 0x12158], rax
mov rax, qword [rsp + 0x12158]
mov qword [rsp + 0x12160], rax
mov rdx, qword [rsp + 0x12160]
lea rcx, [rsp + 0xf220]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11988]
call fcn.140001490
cmp dword [rsp + 0xf228], 0xffffffff
jne 0x1401d06d6
lea r8, [0x140226fa0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xf208]
call fcn.140001490
nop
lea rcx, [rsp + 0xf220]
call fcn.140001490
nop
lea rcx, [rsp + 0xf218]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xf220]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401d0739
lea r8, [0x140226fb8]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xf208]
call fcn.140001490
nop
lea rcx, [rsp + 0xf220]
call fcn.140001490
nop
lea rcx, [rsp + 0xf218]
call fcn.140001490
jmp 0x1401d16a3
mov edx, dword [rsp + 0xf228]
lea rcx, [rsp + 0xf218]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401d07c7
mov eax, dword [rsp + 0xf228]
add eax, 1
mov dword [rsp + 0xf228], eax
lea r9, [rsp + 0xf228]
lea r8, [0x140226fcc]
lea rdx, [rsp + 0x11990]
lea rcx, [rsp + 0xf218]
call fcn.1400065a0
mov qword [rsp + 0x12168], rax
mov rax, qword [rsp + 0x12168]
mov qword [rsp + 0x12170], rax
mov rdx, qword [rsp + 0x12170]
lea rcx, [rsp + 0xf208]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11990]
call fcn.140001490
jmp 0x1401d0826
lea r9, [rsp + 0xf228]
lea r8, [0x140226fd0]
lea rdx, [rsp + 0x11998]
lea rcx, [rsp + 0xf218]
call fcn.1400065a0
mov qword [rsp + 0x12178], rax
mov rax, qword [rsp + 0x12178]
mov qword [rsp + 0x12180], rax
mov rdx, qword [rsp + 0x12180]
lea rcx, [rsp + 0xf208]
call fcn.140002db0
nop
lea rcx, [rsp + 0x11998]
call fcn.140001490
mov rax, qword [rsp + 0x12258]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x119a0]
call fcn.14000e700
mov qword [rsp + 0x12188], rax
mov rax, qword [rsp + 0x12188]
mov qword [rsp + 0x12190], rax
mov rcx, qword [rsp + 0x12190]
call fcn.1400118c0
mov rdx, rax
lea rcx, [rsp + 0xeeb0]
call fcn.140002100
nop
lea rcx, [rsp + 0x119a0]
call fcn.140002ea0
lea r8, [rsp + 0xeeb0]
lea rdx, [0x140226ff8]
lea rcx, [rsp + 0x119a8]
call fcn.140006c90
mov qword [rsp + 0x12198], rax
mov rax, qword [rsp + 0x12198]
mov qword [rsp + 0x121a0], rax
lea r8, [0x140226fd8]
mov rdx, qword [rsp + 0x121a0]
lea rcx, [rsp + 0x119b0]
call fcn.1400010b0
mov qword [rsp + 0x121a8], rax
mov rax, qword [rsp + 0x121a8]
mov qword [rsp + 0x121b0], rax
lea r8, [rsp + 0xf220]
mov rdx, qword [rsp + 0x121b0]
lea rcx, [rsp + 0xf200]
call fcn.140006bd0
nop
lea rcx, [rsp + 0x119b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x119a8]
call fcn.140001490
lea r8, [rsp + 0xf220]
lea rdx, [0x140227000]
lea rcx, [rsp + 0xf210]
call fcn.140006c90
nop
lea rcx, [rsp + 0xeec0]
call fcn.14000d040
nop
lea rax, [rsp + 0x119b8]
mov qword [rsp + 0x119c0], rax
lea rdx, [0x140227008]
mov rcx, qword [rsp + 0x119c0]
call fcn.140002100
mov qword [rsp + 0x121b8], rax
mov rdx, qword [rsp + 0x121b8]
lea rcx, [rsp + 0xeec0]
call fcn.1401d6df0
test eax, eax
je 0x1401d0a39
lea rdx, [rsp + 0xf060]
lea r8, [0x140226fd4]
lea rcx, [rsp + 0x119c8]
call fcn.1400010b0
mov qword [rsp + 0x121c0], rax
mov rax, qword [rsp + 0x121c0]
mov qword [rsp + 0x121c8], rax
lea r8, [rsp + 0xf220]
mov rdx, qword [rsp + 0x121c8]
lea rcx, [rsp + 0x119d0]
call fcn.140006bd0
mov qword [rsp + 0x121d0], rax
mov rax, qword [rsp + 0x121d0]
mov qword [rsp + 0x121d8], rax
mov rdx, qword [rsp + 0x121d8]
lea rcx, [rsp + 0xf210]
call fcn.140002db0
nop
lea rcx, [rsp + 0x119d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x119c8]
call fcn.140001490
mov dword [rsp + 0xeea0], 1
lea rcx, [rsp + 0xf230]
call fcn.14000c880
nop
lea rax, [rsp + 0x119d8]
mov qword [rsp + 0x119e0], rax
lea rdx, [rsp + 0xf208]
mov rcx, qword [rsp + 0x119e0]
call fcn.140001430
mov qword [rsp + 0x121e0], rax
mov rdx, qword [rsp + 0x121e0]
lea rcx, [rsp + 0xf230]
call fcn.1401d4f50
test eax, eax
je 0x1401d0ab8
lea rdx, [rsp + 0xf3d8]
lea rcx, [rsp + 0xf210]
call fcn.140002db0
mov dword [rsp + 0xeea0], 0
xor r8d, r8d
lea rdx, [0x140227014]
lea rcx, [rsp + 0xf200]
call fcn.140006780
cmp eax, 0xffffffff
je 0x1401d0af0
mov r8, qword [rsp + 0xf200]
lea rdx, [0x140227018]
lea rcx, [rsp + 0xf200]
call fcn.140002c70
xor r8d, r8d
lea rdx, [0x140227024]
lea rcx, [rsp + 0xf210]
call fcn.140006780
cmp eax, 0xffffffff
je 0x1401d0b28
mov r8, qword [rsp + 0xf210]
lea rdx, [0x140227028]
lea rcx, [rsp + 0xf210]
call fcn.140002c70
lea r8, [rsp + 0xeeb0]
lea rdx, [0x140227054]
lea rcx, [rsp + 0x119e8]
call fcn.140006c90
mov qword [rsp + 0x121e8], rax
mov rax, qword [rsp + 0x121e8]
mov qword [rsp + 0x121f0], rax
lea r8, [0x140227038]
mov rdx, qword [rsp + 0x121f0]
lea rcx, [rsp + 0xeea8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x119e8]
call fcn.140001490
lea rax, [0x140227060]
mov qword [rsp + 0x20], rax
lea r9, str.CCBootSyncTo
mov r8, qword [rsp + 0xeea8]
lea rdx, [0x1402270a0]
lea rcx, [rsp + 0xf218]
call fcn.140002c70
lea rcx, [rsp + 0xf218]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004930
mov r9, qword [rsp + 0xf210]
mov r8, qword [rsp + 0xf200]
lea rdx, str.cmd.exe__C_Copy__s__s__Y
lea rcx, [rsp + 0xf218]
call fcn.140002c70
lea rcx, [rsp + 0xf218]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004930
lea rcx, [rsp + 0xeea8]
call fcn.140020b50
mov rcx, rax
call fcn.1400268c0
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call sub.NETAPI32.dll_NetUseDel
cmp dword [rsp + 0xeea0], 0
je 0x1401d0ca8
lea rcx, [rsp + 0xf3d0]
lea rdx, [rsp + 0xf208]
call fcn.140002db0
lea rcx, [rsp + 0xf3d8]
lea rdx, [rsp + 0xf210]
call fcn.140002db0
lea rcx, [rsp + 0xf230]
call fcn.1401d48c0
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
lea r8, [0x14022710c]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xeea8]
call fcn.140001490
nop
lea rcx, [rsp + 0xf230]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xeec0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xf210]
call fcn.140001490
nop
lea rcx, [rsp + 0xf200]
call fcn.140001490
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xf208]
call fcn.140001490
nop
lea rcx, [rsp + 0xf220]
call fcn.140001490
nop
lea rcx, [rsp + 0xf218]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [0x140227118]
call fcn.1400a98c0
mov r8, rax
lea rdx, [0x140227130]
lea rcx, [rsp + 0xae0]
call fcn.1400cd4f8
test eax, eax
jne 0x1401d167c
lea rcx, str.multisynctofile
call fcn.1400a98c0
lea rdx, [rsp + rax + 0xae0]
lea rcx, [rsp + 0x10d20]
call fcn.1400dcca0
nop
lea rdx, [0x14022715c]
lea rcx, [rsp + 0x10d20]
call fcn.1400069d0
mov dword [rsp + 0x10d30], 0
lea r9, [rsp + 0x10d30]
lea r8, [0x140227164]
lea rdx, [rsp + 0x119f0]
lea rcx, [rsp + 0x10d20]
call fcn.1400065a0
mov qword [rsp + 0x121f8], rax
mov rcx, qword [rsp + 0x121f8]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a9a04
mov qword [rsp + 0xf8d0], rax
lea rcx, [rsp + 0x119f0]
call fcn.140001490
cmp dword [rsp + 0x10d30], 0xffffffff
jne 0x1401d0e4a
lea r8, str._ERR_PARAM_ERROR_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x10d20]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0x119f8]
call fcn.140001000
mov qword [rsp + 0x12200], rax
mov rax, qword [rsp + 0x12200]
mov qword [rsp + 0x12208], rax
lea r8, str._syncdb.xml
mov rdx, qword [rsp + 0x12208]
lea rcx, [rsp + 0xf8c8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x119f8]
call fcn.140001490
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xf8c8]
call fcn.1400068a0
mov dword [rsp + 0xf8c0], eax
cmp dword [rsp + 0xf8c0], 0xffffffff
je 0x1401d0f13
mov r8d, dword [rsp + 0xf8c0]
lea rdx, [rsp + 0x11a00]
lea rcx, [rsp + 0xf8c8]
call fcn.140006b20
mov qword [rsp + 0x12210], rax
mov rax, qword [rsp + 0x12210]
mov qword [rsp + 0x12218], rax
mov rcx, qword [rsp + 0x12218]
call fcn.14000f8f0
mov rcx, rax
call fcn.140004bf0
nop
lea rcx, [rsp + 0x11a00]
call fcn.140001490
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
lea rdx, [0x140227198]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x10d28], rax
cmp qword [rsp + 0x10d28], 0
jne 0x1401d0f83
lea r8, [0x1402271a0]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xf8c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d20]
call fcn.140001490
jmp 0x1401d16a3
mov byte [rsp + 0xfc20], 0
lea rdi, [rsp + 0xfc21]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x10d34], 0
jmp 0x1401d0fba
mov eax, dword [rsp + 0x10d34]
add eax, 1
mov dword [rsp + 0x10d34], eax
mov edi, dword [rsp + 0x10d34]
xor edx, edx
mov rax, qword [rsp + 0xf8d0]
mov ecx, 0x1000
div rcx
cmp rdi, rax
jae 0x1401d1043
mov qword [rsp + 0x10d38], 0x1000
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x10d38]
lea r8, [rsp + 0xfc20]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9460
test eax, eax
jne 0x1401d101b
jmp 0x1401d1043
mov r9, qword [rsp + 0x10d28]
mov r8d, 1
mov rdx, qword [rsp + 0x10d38]
lea rcx, [rsp + 0xfc20]
call fcn.1400acb98
jmp 0x1401d0fa9
xor edx, edx
mov rax, qword [rsp + 0xf8d0]
mov ecx, 0x1000
div rcx
mov qword [rsp + 0xf570], rdx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0xf570]
lea r8, [rsp + 0xfc20]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9460
mov r9, qword [rsp + 0x10d28]
mov r8d, 1
mov rdx, qword [rsp + 0xf570]
lea rcx, [rsp + 0xfc20]
call fcn.1400acb98
mov rcx, qword [rsp + 0x10d28]
call fcn.1400aa608
lea rcx, [rsp + 0x10c50]
call fcn.1400e7060
nop
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov dword [rsp + 0x20], 0
mov r9d, reloc.WSOCK32.dll_WSACleanup
mov r8, rax
lea rdx, [rsp + 0x11a08]
lea rcx, [rsp + 0x10c50]
call fcn.1400ea430
mov rcx, rax
call fcn.1400e4160
movzx eax, al
test eax, eax
jne 0x1401d118d
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401d113e
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [0x1402271b8]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x10c50]
call fcn.1400e5930
nop
lea rcx, [rsp + 0xf8c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d20]
call fcn.140001490
jmp 0x1401d16a3
xor r9d, r9d
lea r8, [0x1402271d0]
lea rdx, [rsp + 0x10c20]
lea rcx, [rsp + 0x10c50]
call fcn.1400ead90
nop
lea rcx, [rsp + 0x10c20]
call fcn.1400e34c0
test rax, rax
jne 0x1401d1250
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401d11f3
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._ERR_COPY_FILE_FAILED_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0x10c20]
call fcn.1400e3510
nop
lea rcx, [rsp + 0x10c50]
call fcn.1400e5930
nop
lea rcx, [rsp + 0xf8c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d20]
call fcn.140001490
jmp 0x1401d16a3
lea rcx, [rsp + 0xf8e0]
call fcn.1401d19d0
nop
lea rcx, [rsp + 0xf8e0]
call fcn.1401bf280
mov dword [rsp + 0x10d40], 0
jmp 0x1401d1289
mov eax, dword [rsp + 0x10d40]
add eax, 1
mov dword [rsp + 0x10d40], eax
mov edi, dword [rsp + 0x10d40]
lea rcx, [rsp + 0x10c20]
call fcn.1400e34c0
cmp rdi, rax
jae 0x1401d13a7
lea rcx, [rsp + 0x10d50]
call fcn.1401d19d0
nop
mov dword [rsp + 0x10ee8], 0
lea rcx, [rsp + 0x10d50]
call fcn.1401d6a40
mov dword [rsp + 0x11090], 0
jmp 0x1401d12ea
mov eax, dword [rsp + 0x11090]
add eax, 1
mov dword [rsp + 0x11090], eax
mov eax, dword [rsp + 0x11080]
cmp dword [rsp + 0x11090], eax
jae 0x1401d1387
mov eax, dword [rsp + 0x11090]
lea rcx, [rsp + rax*8 + 0x10d58]
call fcn.14000f8f0
mov rdi, rax
mov edx, dword [rsp + 0x10d40]
lea rcx, [rsp + 0x10c20]
call fcn.1400e3490
lea rdx, [rsp + 0x11a20]
mov rcx, rax
call fcn.1400e6730
mov r8, rdi
lea rdx, [rsp + 0x11a28]
mov rcx, rax
call fcn.1400e5c40
lea r8, [0x140227228]
lea rdx, [rsp + 0x11a30]
mov rcx, rax
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
mov eax, dword [rsp + 0x11090]
lea rcx, [rsp + rax*8 + 0x10ef0]
call fcn.1400020d0
jmp 0x1401d12d9
lea rcx, [rsp + 0x10d50]
call fcn.1401bf8a0
nop
lea rcx, [rsp + 0x10d50]
call fcn.140014ec0
jmp 0x1401d1278
lea rcx, [rsp + 0xf580]
call fcn.1401d1960
nop
lea rcx, [rsp + 0xf580]
call fcn.1401bf280
xor r9d, r9d
lea r8, [0x140227238]
lea rdx, [rsp + 0x11a38]
lea rcx, [rsp + 0x10c50]
call fcn.1400ead90
mov qword [rsp + 0x12220], rax
mov rax, qword [rsp + 0x12220]
mov qword [rsp + 0x12228], rax
mov rdx, qword [rsp + 0x12228]
lea rcx, [rsp + 0x10c20]
call fcn.1400e50e0
nop
lea rcx, [rsp + 0x11a38]
call fcn.1400e3510
mov dword [rsp + 0x11094], 0
jmp 0x1401d143a
mov eax, dword [rsp + 0x11094]
add eax, 1
mov dword [rsp + 0x11094], eax
mov edi, dword [rsp + 0x11094]
lea rcx, [rsp + 0x10c20]
call fcn.1400e34c0
cmp rdi, rax
jae 0x1401d15aa
lea rcx, [rsp + 0x110a0]
call fcn.1401d1960
nop
mov edx, dword [rsp + 0x11094]
lea rcx, [rsp + 0x10c20]
call fcn.1400e3490
lea rdx, [rsp + 0x11a60]
mov rcx, rax
call fcn.1400e6730
lea r8, [0x140227264]
lea rdx, [rsp + 0x11a68]
mov rcx, rax
call fcn.1400e5c40
lea r8, [0x140227270]
lea rdx, [rsp + 0x11a70]
mov rcx, rax
call fcn.1400e5b90
xor edx, edx
mov rcx, rax
call fcn.1400e70a0
mov dword [rsp + 0x113e0], eax
mov dword [rsp + 0x113e4], 0
jmp 0x1401d14e6
mov eax, dword [rsp + 0x113e4]
add eax, 1
mov dword [rsp + 0x113e4], eax
mov eax, dword [rsp + 0x113d0]
cmp dword [rsp + 0x113e4], eax
jae 0x1401d1583
mov eax, dword [rsp + 0x113e4]
lea rcx, [rsp + rax*8 + 0x110a8]
call fcn.14000f8f0
mov rdi, rax
mov edx, dword [rsp + 0x11094]
lea rcx, [rsp + 0x10c20]
call fcn.1400e3490
lea rdx, [rsp + 0x11a78]
mov rcx, rax
call fcn.1400e6730
mov r8, rdi
lea rdx, [rsp + 0x11a80]
mov rcx, rax
call fcn.1400e5c40
lea r8, [0x140227280]
lea rdx, [rsp + 0x11a88]
mov rcx, rax
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
mov eax, dword [rsp + 0x113e4]
lea rcx, [rsp + rax*8 + 0x11240]
call fcn.1400020d0
jmp 0x1401d14d5
mov edx, dword [rsp + 0x113e0]
lea rcx, [rsp + 0x110a0]
call fcn.1401d3960
nop
lea rcx, [rsp + 0x110a0]
call fcn.140014ec0
jmp 0x1401d1429
mov edx, 1
xor ecx, ecx
call fcn.1401bfc60
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8056
xor edx, edx
lea rcx, [0x1403b58d0]
call fcn.1401c2a00
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401d1606
lea rcx, [rsp + 0xf8c8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str.OK__r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
nop
lea rcx, [rsp + 0xf580]
call fcn.140014ec0
nop
lea rcx, [rsp + 0xf8e0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x10c20]
call fcn.1400e3510
nop
lea rcx, [rsp + 0x10c50]
call fcn.1400e5930
nop
lea rcx, [rsp + 0xf8c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10d20]
call fcn.140001490
jmp 0x1401d16a3
lea r8, str._ERR_VERSION_ERROR_r_n
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9fb0
jmp 0x1401d16a3
mov edx, 1
mov rcx, qword [rsp + 0x12258]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WSOCK32.dll_shutdown]
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0x400
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x12258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x12250]
call fcn.1400d9460
mov dword [rsp + 0x11a90], 0
lea rcx, [rsp + 0x450]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x790]
call fcn.140014ec0
mov eax, dword [rsp + 0x11a90]
mov rcx, qword [rsp + 0x12230]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x12240
pop rdi
ret