Function at 0x1400f2930
Capabilities:
Check if file exists
Copy file
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1390
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0x11b8], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x1380], rax
cmp qword [rsp + 0x13a8], 1
je 0x1400f2981
cmp qword [rsp + 0x13a8], 2
jne 0x1400f29b6
mov rax, qword [rsp + 0x13a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x13a0]
call qword [rax + 0x2d0]
mov edx, 2
mov rcx, qword [rsp + 0x13a0]
call fcn.1400784a0
mov eax, 1
jmp 0x1400f3974
mov rax, qword [rsp + 0x13a8]
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x11c0], eax
cmp dword [rsp + 0x11c0], 0x8043
jg 0x1400f2a6d
cmp dword [rsp + 0x11c0], 0x8043
je 0x1400f2cf5
cmp dword [rsp + 0x11c0], 0x800d
jg 0x1400f2a46
cmp dword [rsp + 0x11c0], 0x800d
je 0x1400f2b64
cmp dword [rsp + 0x11c0], 0x50d
je 0x1400f333c
cmp dword [rsp + 0x11c0], 0x8003
je 0x1400f2cb8
cmp dword [rsp + 0x11c0], 0x800c
je 0x1400f2ac7
jmp 0x1400f3957
cmp dword [rsp + 0x11c0], 0x8011
je 0x1400f3014
cmp dword [rsp + 0x11c0], 0x803f
je 0x1400f2e0b
jmp 0x1400f3957
cmp dword [rsp + 0x11c0], 0x80a1
je 0x1400f2c1c
cmp dword [rsp + 0x11c0], 0x815c
je 0x1400f33e5
cmp dword [rsp + 0x11c0], 0x815d
je 0x1400f3483
cmp dword [rsp + 0x11c0], 0x8160
je 0x1400f3896
cmp dword [rsp + 0x11c0], 0xe146
je 0x1400f31a8
jmp 0x1400f3957
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
call fcn.14001c690
test rax, rax
je 0x1400f2b5a
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800c
call fcn.14000f350
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800d
call fcn.14000f350
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x8030
call fcn.14000f350
mov eax, 1
jmp 0x1400f3974
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x75
call fcn.1400f0ec0
cmp eax, 6
jne 0x1400f2c12
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
call fcn.14001c690
test rax, rax
je 0x1400f2c12
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800c
call fcn.14000f350
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800d
call fcn.14000f350
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x8030
call fcn.14000f350
mov eax, 1
jmp 0x1400f3974
lea rcx, [rsp + 0x1068]
call fcn.140001000
mov qword [rsp + 0x11c8], rax
mov rax, qword [rsp + 0x11c8]
mov qword [rsp + 0x11d0], rax
lea r8, [0x1402176ac]
mov rdx, qword [rsp + 0x11d0]
lea rcx, [rsp + 0x1070]
call fcn.1400010b0
mov qword [rsp + 0x11d8], rax
mov rcx, qword [rsp + 0x11d8]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1070]
call fcn.140001470
nop
lea rcx, [rsp + 0x1068]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
mov rdx, qword [rsp + 0x13a0]
add rdx, 0x4e8
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rax, qword [rsp + 0x13a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x13a0]
call qword [rax + 0x2b0]
mov eax, 1
jmp 0x1400f3974
lea rcx, [rsp + 0x840]
call fcn.140002d50
nop
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x40]
call fcn.14000d0b0
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, [0x140217ac0]
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.1400aec68
lea rcx, [rsp + 0x1078]
call fcn.14000f6f0
lea r8, [0x140217ad0]
lea rdx, [rsp + 0x1080]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0x11e0], rax
mov rax, qword [rsp + 0x11e0]
mov qword [rsp + 0x11e8], rax
mov r9, qword [rsp + 0x11e8]
mov r9, qword [r9]
lea r8, [rsp + 0x40]
lea rdx, str._sLog__s.txt
lea rcx, [rsp + 0x840]
call fcn.140002be0
nop
lea rcx, [rsp + 0x1080]
call fcn.140001470
lea rcx, [rsp + 0x840]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x840]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
lea rcx, [rsp + 0x1050]
call fcn.140002d50
nop
xor eax, eax
mov word [rsp + 0x850], ax
lea rdi, [rsp + 0x852]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x850]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x850]
call fcn.14000d0b0
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, str.Log
mov edx, 0x400
lea rcx, [rsp + 0x850]
call fcn.1400aec68
lea rcx, [rsp + 0x1088]
call fcn.14000f6f0
lea r8, [0x140217b18]
lea rdx, [rsp + 0x1090]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0x11f0], rax
mov rax, qword [rsp + 0x11f0]
mov qword [rsp + 0x11f8], rax
mov r9, qword [rsp + 0x11f8]
mov r9, qword [r9]
lea r8, [rsp + 0x850]
lea rdx, str._sFatal__s.txt
lea rcx, [rsp + 0x1050]
call fcn.140002be0
nop
lea rcx, [rsp + 0x1090]
call fcn.140001470
lea rcx, [rsp + 0x1050]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400f2f2e
xor r8d, r8d
mov edx, 0x40
lea rcx, str.No_errors
call fcn.1400ef150
nop
lea rcx, [rsp + 0x1050]
call fcn.140001470
jmp 0x1400f3957
lea rcx, [rsp + 0x1050]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x140217b78]
lea rcx, [rsp + 0x10a0]
call fcn.1400eeb20
mov qword [rsp + 0x1200], rax
lea rdx, [0x140217b68]
mov rcx, qword [rsp + 0x1200]
call fcn.140006d30
mov byte [rsp + 0x1098], al
lea rcx, [rsp + 0x10a0]
call fcn.140001470
movzx edx, byte [rsp + 0x1098]
test edx, edx
je 0x1400f2fbe
lea rcx, [rsp + 0x1050]
call fcn.140001470
jmp 0x1400f3957
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_see_how_to_fix_common_errors_
call fcn.1400ef150
cmp eax, 6
jne 0x1400f2ffd
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__www.ccboot.com_wiki_how_to_view_server_error_log.htm
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1050]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
lea rdx, [0x140217c80]
lea rcx, [rsp + 0x10b0]
call fcn.1400eeb20
mov qword [rsp + 0x1208], rax
lea rdx, [0x140217c68]
mov rcx, qword [rsp + 0x1208]
call fcn.140006d30
mov byte [rsp + 0x10a8], al
lea rcx, [rsp + 0x10b0]
call fcn.140001470
movzx edx, byte [rsp + 0x10a8]
test edx, edx
je 0x1400f30c2
lea rdx, [0x140217c98]
lea rcx, [rsp + 0x10b8]
call fcn.1400eeb20
mov qword [rsp + 0x1210], rax
mov rcx, qword [rsp + 0x1210]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10b8]
call fcn.140001470
xor eax, eax
jmp 0x1400f3974
call fcn.140010a50
mov rdx, rax
lea rcx, [rsp + 0x10c0]
call fcn.140002090
mov qword [rsp + 0x1218], rax
mov rax, qword [rsp + 0x1218]
mov qword [rsp + 0x1220], rax
mov r8, qword [rsp + 0x1220]
lea rdx, [0x140217cd0]
lea rcx, [rsp + 0x10c8]
call fcn.140006c30
mov qword [rsp + 0x1228], rax
mov rax, qword [rsp + 0x1228]
mov qword [rsp + 0x1230], rax
lea r8, [0x140217cb0]
mov rdx, qword [rsp + 0x1230]
lea rcx, [rsp + 0x10d0]
call fcn.1400010b0
mov qword [rsp + 0x1238], rax
mov rcx, qword [rsp + 0x1238]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10d0]
call fcn.140001470
nop
lea rcx, [rsp + 0x10c8]
call fcn.140001470
nop
lea rcx, [rsp + 0x10c0]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
lea rdx, [0x140217d00]
lea rcx, [rsp + 0x10e0]
call fcn.1400eeb20
mov qword [rsp + 0x1240], rax
lea rdx, [0x140217ce8]
mov rcx, qword [rsp + 0x1240]
call fcn.140006d30
mov byte [rsp + 0x10d8], al
lea rcx, [rsp + 0x10e0]
call fcn.140001470
movzx edx, byte [rsp + 0x10d8]
test edx, edx
je 0x1400f3256
lea rdx, [0x140217d18]
lea rcx, [rsp + 0x10e8]
call fcn.1400eeb20
mov qword [rsp + 0x1248], rax
mov rcx, qword [rsp + 0x1248]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10e8]
call fcn.140001470
xor eax, eax
jmp 0x1400f3974
call fcn.140010a50
mov rdx, rax
lea rcx, [rsp + 0x10f0]
call fcn.140002090
mov qword [rsp + 0x1250], rax
mov rax, qword [rsp + 0x1250]
mov qword [rsp + 0x1258], rax
mov r8, qword [rsp + 0x1258]
lea rdx, str.http:__www.
lea rcx, [rsp + 0x10f8]
call fcn.140006c30
mov qword [rsp + 0x1260], rax
mov rax, qword [rsp + 0x1260]
mov qword [rsp + 0x1268], rax
lea r8, str..com__refprog
mov rdx, qword [rsp + 0x1268]
lea rcx, [rsp + 0x1100]
call fcn.1400010b0
mov qword [rsp + 0x1270], rax
mov rcx, qword [rsp + 0x1270]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1100]
call fcn.140001470
nop
lea rcx, [rsp + 0x10f8]
call fcn.140001470
nop
lea rcx, [rsp + 0x10f0]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
lea rcx, [rsp + 0x1108]
call fcn.140185b10
mov qword [rsp + 0x1278], rax
mov rax, qword [rsp + 0x1278]
mov qword [rsp + 0x1280], rax
call fcn.140010a50
mov rdx, rax
lea rcx, [rsp + 0x1110]
call fcn.1400eeb20
mov qword [rsp + 0x1288], rax
mov rax, qword [rsp + 0x1288]
mov qword [rsp + 0x1290], rax
mov rcx, qword [rsp + 0x1280]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0x1290]
call fcn.1400012c0
lea r9, str.https:__update.youngzsoft.com_updatesystem_update.php
mov r8, rdi
mov rdx, rax
xor ecx, ecx
call fcn.1400ded80
nop
lea rcx, [rsp + 0x1110]
call fcn.140001470
nop
lea rcx, [rsp + 0x1108]
call fcn.140001470
mov eax, 1
jmp 0x1400f3974
lea rcx, [rsp + 0x1118]
call fcn.140001000
mov qword [rsp + 0x1298], rax
mov rax, qword [rsp + 0x1298]
mov qword [rsp + 0x12a0], rax
lea r8, [0x140217df0]
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rsp + 0x1120]
call fcn.1400010b0
mov qword [rsp + 0x12a8], rax
mov rcx, qword [rsp + 0x12a8]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x140217e10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1120]
call fcn.140001470
nop
lea rcx, [rsp + 0x1118]
call fcn.140001470
xor eax, eax
jmp 0x1400f3974
lea rcx, [rsp + 0x1128]
call fcn.140001000
mov qword [rsp + 0x12b0], rax
mov rax, qword [rsp + 0x12b0]
mov qword [rsp + 0x12b8], rax
lea r8, [0x140217d68]
mov rdx, qword [rsp + 0x12b8]
lea rcx, [rsp + 0x1130]
call fcn.1400010b0
mov qword [rsp + 0x12c0], rax
mov rax, qword [rsp + 0x12c0]
mov qword [rsp + 0x12c8], rax
mov rcx, qword [rsp + 0x12c8]
call fcn.1400012c0
mov rcx, rax
call fcn.140004b80
nop
lea rcx, [rsp + 0x1130]
call fcn.140001470
nop
lea rcx, [rsp + 0x1128]
call fcn.140001470
lea rcx, [rsp + 0x1140]
call fcn.140001000
mov qword [rsp + 0x12d0], rax
mov rax, qword [rsp + 0x12d0]
mov qword [rsp + 0x12d8], rax
lea r8, [0x140217e20]
mov rdx, qword [rsp + 0x12d8]
lea rcx, [rsp + 0x1148]
call fcn.1400010b0
mov qword [rsp + 0x12e0], rax
mov rcx, qword [rsp + 0x12e0]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x1138], eax
lea rcx, [rsp + 0x1148]
call fcn.140001470
nop
lea rcx, [rsp + 0x1140]
call fcn.140001470
cmp dword [rsp + 0x1138], 0
je 0x1400f388f
lea rcx, [rsp + 0x1150]
call fcn.140001000
mov qword [rsp + 0x12e8], rax
mov rax, qword [rsp + 0x12e8]
mov qword [rsp + 0x12f0], rax
lea r8, [0x140217e40]
mov rdx, qword [rsp + 0x12f0]
lea rcx, [rsp + 0x1158]
call fcn.1400010b0
mov qword [rsp + 0x12f8], rax
mov rax, qword [rsp + 0x12f8]
mov qword [rsp + 0x1300], rax
lea rcx, [rsp + 0x1160]
call fcn.140001000
mov qword [rsp + 0x1308], rax
mov rax, qword [rsp + 0x1308]
mov qword [rsp + 0x1310], rax
lea r8, str.RemoteMe.exe
mov rdx, qword [rsp + 0x1310]
lea rcx, [rsp + 0x1168]
call fcn.1400010b0
mov qword [rsp + 0x1318], rax
mov rcx, qword [rsp + 0x1300]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0x1318]
call fcn.1400012c0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x1168]
call fcn.140001470
nop
lea rcx, [rsp + 0x1160]
call fcn.140001470
nop
lea rcx, [rsp + 0x1158]
call fcn.140001470
nop
lea rcx, [rsp + 0x1150]
call fcn.140001470
lea rcx, [rsp + 0x1178]
call fcn.140001000
mov qword [rsp + 0x1320], rax
mov rax, qword [rsp + 0x1320]
mov qword [rsp + 0x1328], rax
lea r8, str.RemoteMeRemoteMe.exe
mov rdx, qword [rsp + 0x1328]
lea rcx, [rsp + 0x1180]
call fcn.1400010b0
mov qword [rsp + 0x1330], rax
mov rcx, qword [rsp + 0x1330]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x1170], eax
lea rcx, [rsp + 0x1180]
call fcn.140001470
nop
lea rcx, [rsp + 0x1178]
call fcn.140001470
cmp dword [rsp + 0x1170], 0
je 0x1400f388f
lea rcx, [rsp + 0x1058]
call fcn.140002d50
nop
lea rcx, [rsp + 0x1188]
call fcn.1400020f0
mov qword [rsp + 0x1338], rax
mov rax, qword [rsp + 0x1338]
mov qword [rsp + 0x1340], rax
lea rcx, [rsp + 0x1190]
call fcn.140001000
mov qword [rsp + 0x1348], rax
mov rax, qword [rsp + 0x1348]
mov qword [rsp + 0x1350], rax
call fcn.140010a50
mov r9, rax
mov rax, qword [rsp + 0x1340]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x1350]
mov r8, qword [r8]
lea rdx, str._sRemoteMeRemoteMe.exe__product_s__version_s
lea rcx, [rsp + 0x1058]
call fcn.140002be0
nop
lea rcx, [rsp + 0x1190]
call fcn.140001470
nop
lea rcx, [rsp + 0x1188]
call fcn.140001470
lea rcx, [rsp + 0x1198]
call fcn.140001000
mov qword [rsp + 0x1358], rax
mov rax, qword [rsp + 0x1358]
mov qword [rsp + 0x1360], rax
lea r8, str.RemoteMe
mov rdx, qword [rsp + 0x1360]
lea rcx, [rsp + 0x11a0]
call fcn.1400010b0
mov qword [rsp + 0x1368], rax
mov rax, qword [rsp + 0x1368]
mov qword [rsp + 0x1370], rax
mov rcx, qword [rsp + 0x1370]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0x1058]
call fcn.1400012c0
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1400048c0
nop
lea rcx, [rsp + 0x11a0]
call fcn.140001470
nop
lea rcx, [rsp + 0x1198]
call fcn.140001470
nop
lea rcx, [rsp + 0x1058]
call fcn.140001470
xor eax, eax
jmp 0x1400f3974
lea rdx, [0x140217f58]
lea rcx, [rsp + 0x11b0]
call fcn.1400eeb20
mov qword [rsp + 0x1378], rax
lea rdx, [0x140217f40]
mov rcx, qword [rsp + 0x1378]
call fcn.140006d30
mov byte [rsp + 0x11a8], al
lea rcx, [rsp + 0x11b0]
call fcn.140001470
movzx edx, byte [rsp + 0x11a8]
test edx, edx
je 0x1400f38ed
xor eax, eax
jmp 0x1400f3974
lea rcx, [rsp + 0x1060]
call fcn.140002d50
nop
call fcn.140010a50
mov r8, rax
lea rdx, str.https:__user.youngzsoft.com_video.php_product_s
lea rcx, [rsp + 0x1060]
call fcn.140002be0
lea rcx, [rsp + 0x1060]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1060]
call fcn.140001470
xor eax, eax
jmp 0x1400f3974
mov r8, qword [rsp + 0x13b0]
mov rdx, qword [rsp + 0x13a8]
mov rcx, qword [rsp + 0x13a0]
call fcn.14007e4b8
mov rcx, qword [rsp + 0x1380]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x1390
pop rdi
ret