Function at 0x1401b4020
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get disk information
Link many functions at runtime
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0xdac8
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0xd900], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0xdab0], rax
mov rax, qword [rsp + 0xdae8]
mov qword [rsp + 0xd908], rax
cmp qword [rsp + 0xd908], 0x8156
ja 0x1401b40d7
cmp qword [rsp + 0xd908], 0x8156
je 0x1401b7959
mov rax, qword [rsp + 0xd908]
sub rax, 0x804f
mov qword [rsp + 0xd908], rax
cmp qword [rsp + 0xd908], 0xa6
ja case.0x1401b40d5.32848
lea rcx, [0x140000000]
mov rax, qword [rsp + 0xd908]
movzx eax, byte [rcx + rax + 0x1b7a4c]
mov eax, dword [rcx + rax*4 + 0x1b7a20]
add rax, rcx
jmp rax
cmp qword [rsp + 0xd908], 0x816e
je 0x1401b4693
cmp qword [rsp + 0xd908], 0x8172
je 0x1401b65d0
jmp case.0x1401b40d5.32848
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1401588b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400819f8
cmp rax, 1
je 0x1401b413e
mov dword [rsp + 0xd640], 0
lea rcx, [rsp + 0x40]
call fcn.140158670
mov eax, dword [rsp + 0xd640]
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
call fcn.14000f500
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x250]
mov r8d, eax
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
nop
lea rcx, [rsp + 0x40]
call fcn.140158670
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
jge 0x1401b41c2
xor eax, eax
jmp 0x1401b7a06
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.1401588b0
nop
mov dword [rsp + 0x494], 1
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x270]
call fcn.1400824e8
mov dword [rsp + 0x490], eax
lea rcx, [rsp + 0x280]
call fcn.1400819f8
cmp rax, 1
je 0x1401b4236
mov dword [rsp + 0xd644], 0
lea rcx, [rsp + 0x280]
call fcn.140158670
mov eax, dword [rsp + 0xd644]
jmp 0x1401b7a06
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x490]
mov r8d, dword [rsp + 0x270]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
nop
lea rcx, [rsp + 0x280]
call fcn.140158670
xor eax, eax
jmp 0x1401b7a06
xor r8d, r8d
lea rdx, [rsp + 0xd650]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d6e0
mov qword [rsp + 0xd910], rax
lea rdx, [0x140245ef0]
mov rcx, qword [rsp + 0xd910]
call fcn.140006d30
mov byte [rsp + 0xd648], al
lea rcx, [rsp + 0xd650]
call fcn.140001470
movzx edx, byte [rsp + 0xd648]
test edx, edx
je 0x1401b42d2
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 0
jge 0x1401b4309
xor eax, eax
jmp 0x1401b7a06
cmp dword [rsp + 0x4b0], 0
jl 0x1401b43c7
lea rcx, [rsp + 0x4c0]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.1400824e8
mov dword [rsp + 0x658], eax
lea rcx, [rsp + 0x4c0]
call fcn.1401d0390
test eax, eax
je 0x1401b438d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140245f10]
call fcn.1400ef150
mov dword [rsp + 0xd658], 1
lea rcx, [rsp + 0x4c0]
call fcn.140005d50
mov eax, dword [rsp + 0xd658]
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, dword [rsp + 0x4b0]
call fcn.14000f050
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x4c0]
call fcn.140005d50
jmp 0x1401b4309
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x4b0], eax
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_delete_the_image_
call fcn.1400ef150
cmp eax, 7
jne 0x1401b440d
xor eax, eax
jmp 0x1401b7a06
cmp dword [rsp + 0x4b0], 0
jl 0x1401b467d
lea rcx, [rsp + 0xb70]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.1400824e8
mov dword [rsp + 0xd08], eax
lea rcx, [rsp + 0xb70]
call fcn.1401b8330
lea rcx, [rsp + 0x800]
call fcn.1401cd320
nop
lea rcx, [rsp + 0xb40]
call fcn.140007bb0
nop
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x800]
call fcn.1401cfcb0
mov dword [rsp + 0xeb0], 0
jmp 0x1401b44a7
mov eax, dword [rsp + 0xeb0]
add eax, 1
mov dword [rsp + 0xeb0], eax
mov edi, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c30
cmp rdi, rax
jae 0x1401b4601
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1f0
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
cmp eax, dword [rsp + 0xd08]
je 0x1401b4531
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1f8
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
cmp eax, dword [rsp + 0xd08]
je 0x1401b4531
jmp 0x1401b4496
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c60
mov eax, dword [rax + 0x198]
mov dword [rsp + 0x998], eax
lea rcx, [rsp + 0x800]
call fcn.1401d1f50
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1f0
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
cmp eax, dword [rsp + 0xd08]
jne 0x1401b45a7
lea rcx, [rsp + 0x9f0]
lea rdx, [0x140244f54]
call fcn.140002060
mov edx, dword [rsp + 0xeb0]
lea rcx, [rsp + 0xb40]
call fcn.140007c60
mov rcx, rax
add rcx, 0x1f8
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
cmp eax, dword [rsp + 0xd08]
jne 0x1401b45ef
lea rcx, [rsp + 0x9f8]
lea rdx, [0x140244f64]
call fcn.140002060
lea rcx, [rsp + 0x800]
call fcn.1401cfa40
jmp 0x1401b4496
lea rcx, [rsp + 0xb70]
call fcn.1401b8640
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x4b0]
call fcn.14000ef80
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0xb40]
call fcn.140007c00
nop
lea rcx, [rsp + 0x800]
call fcn.140005d50
nop
lea rcx, [rsp + 0xb70]
call fcn.140005d50
jmp 0x1401b440d
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x1220], eax
cmp dword [rsp + 0x1220], 0
jge 0x1401b46ca
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0x1250]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x1220]
call fcn.1400824e8
mov dword [rsp + 0x13e8], eax
lea rcx, [rsp + 0x1250]
call fcn.1401b8330
test eax, eax
jne 0x1401b472f
mov dword [rsp + 0xd65c], 0
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd65c]
jmp 0x1401b7a06
lea rcx, [rsp + 0x13f8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0xeb4], eax
cmp dword [rsp + 0xeb4], 2
je 0x1401b4779
mov dword [rsp + 0xd660], 0
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd660]
jmp 0x1401b7a06
lea rcx, [rsp + 0x1250]
call fcn.1401d0390
test eax, eax
je 0x1401b47bf
xor r8d, r8d
xor edx, edx
lea rcx, str.You_cant_compact_an_image_that_is_used_in_super_client
call fcn.1400ef150
mov dword [rsp + 0xd664], 0
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd664]
jmp 0x1401b7a06
lea rdx, [rsp + 0x13f8]
lea rcx, [rsp + 0x1240]
call fcn.140001440
nop
mov dx, 0x2e
lea rcx, [rsp + 0x1240]
call fcn.140006840
mov dword [rsp + 0x1598], eax
cmp dword [rsp + 0x1598], 0xffffffff
je 0x1401b4815
mov edx, dword [rsp + 0x1598]
add edx, 1
lea r8, str.001.
lea rcx, [rsp + 0x1240]
call fcn.140006080
lea rcx, [rsp + 0x1240]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b4875
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_need_to_merge_the_image_before_compacting_it
call fcn.1400ef150
mov dword [rsp + 0xd668], 0
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd668]
jmp 0x1401b7a06
lea rcx, [rsp + 0x13f8]
call fcn.14015a0a0
mov edx, dword [rsp + 0x13e8]
lea rcx, [rsp + 0xee0]
call fcn.14000eef0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140007bb0
nop
lea rdx, [rsp + 0x15a0]
lea rcx, [rsp + 0xee0]
call fcn.1401b8110
lea rcx, [rsp + 0x15a0]
call fcn.140007c30
test rax, rax
jbe 0x1401b492e
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.You_cant_compact_an_image_that_has_child_disks
call fcn.1400ef150
mov dword [rsp + 0xd66c], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xee0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd66c]
jmp 0x1401b7a06
lea rcx, [0x140246120]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x1230], rax
cmp qword [rsp + 0x1230], 0
jne 0x1401b49b0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140246140]
call fcn.1400ef150
mov dword [rsp + 0xd670], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xee0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd670]
jmp 0x1401b7a06
lea rdx, str.CompactVirtualDisk
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1228], rax
lea rdx, [0x1402461b0]
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1590], rax
mov qword [rsp + 0xed8], 0xffffffffffffffff
mov dword [rsp + 0xec0], 2
mov dword [rsp + 0xec4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0xec8], ax
mov eax, 0x47e9
mov word [rsp + 0xeca], ax
mov byte [rsp + 0xecc], 0x90
mov byte [rsp + 0xecd], 0x1f
mov byte [rsp + 0xece], 0x71
mov byte [rsp + 0xecf], 0x41
mov byte [rsp + 0xed0], 0x5a
mov byte [rsp + 0xed1], 0x66
mov byte [rsp + 0xed2], 0x34
mov byte [rsp + 0xed3], 0x5b
mov dword [rsp + 0x1238], 1
lea rdi, [rsp + 0x123c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x123c], 1
lea rcx, [rsp + 0x13f8]
call fcn.1400012c0
mov rdx, rax
lea rax, [rsp + 0xed8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0xec0]
call qword [rsp + 0x1590]
test eax, eax
je 0x1401b4b35
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402461c0]
call fcn.1400ef150
mov dword [rsp + 0xd674], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xee0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd674]
jmp 0x1401b7a06
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x1248]
call fcn.1400a8070
mov dword [rsp + 0x1248], 1
xor r9d, r9d
lea r8, [rsp + 0x1248]
xor edx, edx
mov rcx, qword [rsp + 0xed8]
call qword [rsp + 0x1228]
test eax, eax
je 0x1401b4be5
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402461e8]
call fcn.1400ef150
mov dword [rsp + 0xd678], 0
lea rcx, [rsp + 0x15a0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xee0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
mov eax, dword [rsp + 0xd678]
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Compact_image_successfully
call fcn.1400ef150
nop
lea rcx, [rsp + 0x15a0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xee0]
call fcn.140005d50
nop
lea rcx, [rsp + 0x1240]
call fcn.140001470
nop
lea rcx, [rsp + 0x1250]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x15d0], eax
cmp dword [rsp + 0x15d0], 0
jge 0x1401b4c7d
xor eax, eax
jmp 0x1401b7a06
xor r8d, r8d
lea rdx, [rsp + 0xd680]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d6e0
mov qword [rsp + 0xd918], rax
lea rdx, [0x140246250]
mov rcx, qword [rsp + 0xd918]
call fcn.140006cf0
mov byte [rsp + 0xd67c], al
lea rcx, [rsp + 0xd680]
call fcn.140001470
movzx edx, byte [rsp + 0xd67c]
test edx, edx
je 0x1401b4ec5
lea rcx, [rsp + 0x15e0]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x15d0]
call fcn.1400824e8
mov dword [rsp + 0x1778], eax
lea rcx, [rsp + 0x15e0]
call fcn.1401b8330
test eax, eax
jne 0x1401b4d3a
mov dword [rsp + 0xd688], 0
lea rcx, [rsp + 0x15e0]
call fcn.140005d50
mov eax, dword [rsp + 0xd688]
jmp 0x1401b7a06
lea rdx, [rsp + 0x1788]
lea rcx, [rsp + 0x15d8]
call fcn.140001440
nop
lea rcx, [rsp + 0x15d8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0x15d4], eax
cmp dword [rsp + 0x15d4], 5
jne 0x1401b4ddd
lea rcx, [0x140246270]
call fcn.1400a81f4
mov r8d, eax
lea rdx, [rsp + 0xd690]
lea rcx, [rsp + 0x15d8]
call fcn.1400069a0
mov qword [rsp + 0xd920], rax
mov rcx, qword [rsp + 0xd920]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd690]
call fcn.140001470
cmp dword [rsp + 0x15d4], 1
je 0x1401b4dff
cmp dword [rsp + 0x15d4], 2
je 0x1401b4dff
cmp dword [rsp + 0x15d4], 8
jne 0x1401b4eaa
lea r8, [rsp + 0x15d8]
lea rdx, str._n__select__
lea rcx, [rsp + 0xd698]
call fcn.140006c30
mov qword [rsp + 0xd928], rax
mov rax, qword [rsp + 0xd928]
mov qword [rsp + 0xd930], rax
lea r8, [0x1402450fc]
mov rdx, qword [rsp + 0xd930]
lea rcx, [rsp + 0xd6a0]
call fcn.1400010b0
mov qword [rsp + 0xd938], rax
mov rcx, qword [rsp + 0xd938]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1402462a0]
lea rdx, [0x1402462c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd6a0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd698]
call fcn.140001470
nop
lea rcx, [rsp + 0x15d8]
call fcn.140001470
nop
lea rcx, [rsp + 0x15e0]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
xor r8d, r8d
lea rdx, [rsp + 0xd6b0]
mov rcx, qword [rsp + 0xdae0]
call fcn.14018d6e0
mov qword [rsp + 0xd940], rax
lea rdx, [0x1402462d0]
mov rcx, qword [rsp + 0xd940]
call fcn.140006cf0
mov byte [rsp + 0xd6a8], al
lea rcx, [rsp + 0xd6b0]
call fcn.140001470
movzx edx, byte [rsp + 0xd6a8]
test edx, edx
je 0x1401b5076
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x1c70], eax
cmp dword [rsp + 0x1c70], 0
jge 0x1401b4f5b
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0x1930]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x1c70]
call fcn.1400824e8
mov dword [rsp + 0x1ac8], eax
lea rcx, [rsp + 0x1930]
call fcn.1401b8330
lea rcx, [rsp + 0x1ad8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0x1920], eax
cmp dword [rsp + 0x1920], 3
je 0x1401b4fd2
cmp dword [rsp + 0x1920], 4
je 0x1401b4fd2
cmp dword [rsp + 0x1920], 5
jne 0x1401b4ff6
mov dword [rsp + 0xd6b8], 0
lea rcx, [rsp + 0x1930]
call fcn.140005d50
mov eax, dword [rsp + 0xd6b8]
jmp 0x1401b7a06
lea rcx, [rsp + 0x1ad8]
call fcn.14015a0a0
xor edx, edx
lea rcx, [rsp + 0x1c80]
call fcn.14015abd0
nop
mov eax, dword [rsp + 0x1ac8]
mov dword [rsp + 0x1f58], eax
lea rcx, [rsp + 0x1c80]
call fcn.1400819f8
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x1ac8]
mov r8d, dword [rsp + 0x1c70]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
nop
lea rcx, [rsp + 0x1c80]
call fcn.14015ab20
nop
lea rcx, [rsp + 0x1930]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xdae0]
lea r8, [0x1401b2880]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1401b7a06
mov rax, qword [rsp + 0xdae0]
cmp dword [rax + 0x978], 0
je 0x1401b50cf
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x2b54], eax
cmp dword [rsp + 0x2b54], 0
jge 0x1401b5106
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0x2810]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x2b54]
call fcn.1400824e8
mov dword [rsp + 0x29a8], eax
lea rcx, [rsp + 0x2810]
call fcn.1401b8330
test eax, eax
jne 0x1401b516b
mov dword [rsp + 0xd6bc], 0
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6bc]
jmp 0x1401b7a06
lea rcx, [rsp + 0x29b8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0x2024], eax
cmp dword [rsp + 0x2024], 2
je 0x1401b51b5
mov dword [rsp + 0xd6c0], 0
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6c0]
jmp 0x1401b7a06
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, [0x1402462f0]
call fcn.1400ef150
cmp eax, 7
jne 0x1401b5216
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd6c4], 0
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6c4]
jmp 0x1401b7a06
lea rcx, [rsp + 0x29b8]
call fcn.14015a0a0
lea rdx, [rsp + 0x29b8]
lea r8, [0x140246348]
lea rcx, [rsp + 0x3370]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0x29b8]
call fcn.1400012c0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140105390
lea rcx, [0x140246360]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x2b58], rax
cmp qword [rsp + 0x2b58], 0
jne 0x1401b52f9
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140246380]
call fcn.1400ef150
mov dword [rsp + 0xd6c8], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6c8]
jmp 0x1401b7a06
lea rdx, [0x1402463d8]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3378], rax
lea rdx, [0x1402463f0]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3380], rax
lea rdx, [0x140246400]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2800], rax
lea rdx, [0x140246418]
mov rcx, qword [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x3388], rax
mov qword [rsp + 0x27f8], 0xffffffffffffffff
mov dword [rsp + 0x27e0], 2
mov dword [rsp + 0x27e4], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x27e8], ax
mov eax, 0x47e9
mov word [rsp + 0x27ea], ax
mov byte [rsp + 0x27ec], 0x90
mov byte [rsp + 0x27ed], 0x1f
mov byte [rsp + 0x27ee], 0x71
mov byte [rsp + 0x27ef], 0x41
mov byte [rsp + 0x27f0], 0x5a
mov byte [rsp + 0x27f1], 0x66
mov byte [rsp + 0x27f2], 0x34
mov byte [rsp + 0x27f3], 0x5b
mov dword [rsp + 0x2b60], 1
lea rdi, [rsp + 0x2b64]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x2b64], 1
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rdx, rax
lea rax, [rsp + 0x27f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x27e0]
call qword [rsp + 0x3380]
test eax, eax
je 0x1401b54c4
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140246438]
call fcn.1400ef150
mov dword [rsp + 0xd6cc], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6cc]
jmp 0x1401b7a06
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x2800]
test eax, eax
je 0x1401b556d
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140246460]
call fcn.1400ef150
mov dword [rsp + 0xd6d0], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6d0]
jmp 0x1401b7a06
xor eax, eax
mov word [rsp + 0x2b70], ax
lea rdi, [rsp + 0x2b72]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x27d8], 0x800
lea r8, [rsp + 0x2b70]
lea rdx, [rsp + 0x27d8]
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3388]
lea rcx, [0x140246488]
call fcn.1400a81f4
lea rcx, [rsp + rax*2 + 0x2b70]
call fcn.1400a947c
mov dword [rsp + 0x2020], eax
mov eax, 0x43
mov word [rsp + 0x2b50], ax
mov dword [rsp + 0x3390], 0
jmp 0x1401b55fd
mov eax, dword [rsp + 0x3390]
add eax, 1
mov dword [rsp + 0x3390], eax
cmp dword [rsp + 0x3390], 0x14
jge 0x1401b58c4
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b58c4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x3394], eax
mov byte [rsp + 0x3398], 0x43
jmp 0x1401b564f
movzx eax, byte [rsp + 0x3398]
add al, 1
mov byte [rsp + 0x3398], al
movsx eax, byte [rsp + 0x3398]
cmp eax, 0x5a
jg 0x1401b58bf
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b58bf
movsx ecx, byte [rsp + 0x3398]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x3394]
and eax, ecx
test eax, eax
jne 0x1401b5694
jmp 0x1401b563e
lea rcx, [rsp + 0x73b8]
call fcn.140002d50
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x1402464b0]
lea rcx, [rsp + 0x73b8]
call fcn.140002be0
lea rcx, [rsp + 0x73b8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401b56ec
lea rcx, [rsp + 0x73b8]
call fcn.140001470
jmp 0x1401b563e
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x1402464b8]
lea rcx, [rsp + 0x73b8]
call fcn.140002be0
lea rcx, [rsp + 0x73b8]
call fcn.1400012c0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x33a0], rax
cmp qword [rsp + 0x33a0], 0xffffffffffffffff
jne 0x1401b576b
lea rcx, [rsp + 0x73b8]
call fcn.140001470
jmp 0x1401b563e
mov dword [rsp + 0x73b0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x73b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x33b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401b589e
mov dword [rsp + 0x73c0], 0
mov dword [rsp + 0x73c0], 0
jmp 0x1401b57eb
mov eax, dword [rsp + 0x73c0]
add eax, 1
mov dword [rsp + 0x73c0], eax
mov eax, dword [rsp + 0x33b0]
cmp dword [rsp + 0x73c0], eax
jge 0x1401b589e
cmp dword [rsp + 0x2020], 0xffffffff
je 0x1401b5827
movsxd rax, dword [rsp + 0x73c0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x33b8]
cmp dword [rsp + 0x2020], eax
je 0x1401b5827
jmp 0x1401b57da
lea rcx, [rsp + 0x73c8]
call fcn.140002d50
nop
movsx r8d, byte [rsp + 0x3398]
lea rdx, [0x1402464c8]
lea rcx, [rsp + 0x73c8]
call fcn.140002be0
lea rcx, [rsp + 0x73c8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b588c
movsx ax, byte [rsp + 0x3398]
mov word [rsp + 0x2b50], ax
lea rcx, [rsp + 0x73c8]
call fcn.140001470
jmp 0x1401b589e
lea rcx, [rsp + 0x73c8]
call fcn.140001470
jmp 0x1401b57da
mov rcx, qword [rsp + 0x33a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x73b8]
call fcn.140001470
jmp 0x1401b563e
jmp 0x1401b55ec
movzx eax, word [rsp + 0x2b50]
cmp eax, 0x43
jne 0x1401b597c
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b590e
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402464e0]
call fcn.1400ef150
mov dword [rsp + 0xd6d4], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6d4]
jmp 0x1401b7a06
call fcn.1400d6b80
test eax, eax
jne 0x1401b5a30
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b59c2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140246508]
call fcn.1400ef150
mov dword [rsp + 0xd6d8], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd6d8]
jmp 0x1401b7a06
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd6e0]
call fcn.140005d90
mov qword [rsp + 0xd948], rax
mov rax, qword [rsp + 0xd948]
mov qword [rsp + 0xd950], rax
lea r8, [0x140246540]
mov rdx, qword [rsp + 0xd950]
lea rcx, [rsp + 0xd6e8]
call fcn.1400010b0
mov qword [rsp + 0xd958], rax
mov rcx, qword [rsp + 0xd958]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd6e8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd6e0]
call fcn.140001470
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd6f0]
call fcn.140005d90
mov qword [rsp + 0xd960], rax
mov rax, qword [rsp + 0xd960]
mov qword [rsp + 0xd968], rax
lea r8, [0x140246550]
mov rdx, qword [rsp + 0xd968]
lea rcx, [rsp + 0xd6f8]
call fcn.1400010b0
mov qword [rsp + 0xd970], rax
mov rcx, qword [rsp + 0xd970]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd6f8]
call fcn.140001470
nop
lea rcx, [rsp + 0xd6f0]
call fcn.140001470
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd708]
call fcn.140005d90
mov qword [rsp + 0xd978], rax
mov rax, qword [rsp + 0xd978]
mov qword [rsp + 0xd980], rax
lea r8, [0x140246570]
mov rdx, qword [rsp + 0xd980]
lea rcx, [rsp + 0xd710]
call fcn.1400010b0
mov qword [rsp + 0xd988], rax
mov rax, qword [rsp + 0xd988]
mov qword [rsp + 0xd990], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd718]
call fcn.140005d90
mov qword [rsp + 0xd998], rax
mov rax, qword [rsp + 0xd998]
mov qword [rsp + 0xd9a0], rax
lea r8, [0x1402465b8]
mov rdx, qword [rsp + 0xd9a0]
lea rcx, [rsp + 0xd720]
call fcn.1400010b0
mov qword [rsp + 0xd9a8], rax
mov rcx, qword [rsp + 0xd990]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0xd9a8]
call fcn.1400012c0
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd700], eax
lea rcx, [rsp + 0xd720]
call fcn.140001470
nop
lea rcx, [rsp + 0xd718]
call fcn.140001470
nop
lea rcx, [rsp + 0xd710]
call fcn.140001470
nop
lea rcx, [rsp + 0xd708]
call fcn.140001470
cmp dword [rsp + 0xd700], 0
je 0x1401b5d2f
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b5cc1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402465c8]
call fcn.1400ef150
mov dword [rsp + 0xd728], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd728]
jmp 0x1401b7a06
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd730]
call fcn.140005d90
mov qword [rsp + 0xd9b0], rax
mov rax, qword [rsp + 0xd9b0]
mov qword [rsp + 0xd9b8], rax
lea r8, [0x140246600]
mov rdx, qword [rsp + 0xd9b8]
lea rcx, [rsp + 0xd738]
call fcn.1400010b0
mov qword [rsp + 0xd9c0], rax
mov rax, qword [rsp + 0xd9c0]
mov qword [rsp + 0xd9c8], rax
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd740]
call fcn.140005d90
mov qword [rsp + 0xd9d0], rax
mov rax, qword [rsp + 0xd9d0]
mov qword [rsp + 0xd9d8], rax
lea r8, [0x140246648]
mov rdx, qword [rsp + 0xd9d8]
lea rcx, [rsp + 0xd748]
call fcn.1400010b0
mov qword [rsp + 0xd9e0], rax
mov rcx, qword [rsp + 0xd9c8]
call fcn.1400012c0
mov rdi, rax
mov rcx, qword [rsp + 0xd9e0]
call fcn.1400012c0
mov r8, rdi
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0xd72c], eax
lea rcx, [rsp + 0xd748]
call fcn.140001470
nop
lea rcx, [rsp + 0xd740]
call fcn.140001470
nop
lea rcx, [rsp + 0xd738]
call fcn.140001470
nop
lea rcx, [rsp + 0xd730]
call fcn.140001470
cmp dword [rsp + 0xd72c], 0
je 0x1401b5f9f
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd750]
call fcn.140005d90
mov qword [rsp + 0xd9e8], rax
mov rax, qword [rsp + 0xd9e8]
mov qword [rsp + 0xd9f0], rax
lea r8, [0x140246660]
mov rdx, qword [rsp + 0xd9f0]
lea rcx, [rsp + 0xd758]
call fcn.1400010b0
mov qword [rsp + 0xd9f8], rax
mov rcx, qword [rsp + 0xd9f8]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd758]
call fcn.140001470
nop
lea rcx, [rsp + 0xd750]
call fcn.140001470
cmp qword [rsp + 0x27f8], 0xffffffffffffffff
je 0x1401b5f31
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140246670]
call fcn.1400ef150
mov dword [rsp + 0xd760], 0
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd760]
jmp 0x1401b7a06
xor edx, edx
lea rcx, [rsp + 0x2030]
call fcn.140149770
nop
movzx eax, word [rsp + 0x2b50]
mov word [rsp + 0x22f4], ax
lea rcx, [rsp + 0x2030]
call fcn.1400819f8
mov qword [rsp + 0x27d0], rax
cmp qword [rsp + 0x27d0], 1
je 0x1401b5fed
cmp dword [rsp + 0x27c0], 0
je 0x1401b642c
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd768]
call fcn.140005d90
mov qword [rsp + 0xda00], rax
mov rax, qword [rsp + 0xda00]
mov qword [rsp + 0xda08], rax
lea r8, [0x1402466a8]
mov rdx, qword [rsp + 0xda08]
lea rcx, [rsp + 0xd770]
call fcn.1400010b0
mov qword [rsp + 0xda10], rax
mov rcx, qword [rsp + 0xda10]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd770]
call fcn.140001470
nop
lea rcx, [rsp + 0xd768]
call fcn.140001470
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd778]
call fcn.140005d90
mov qword [rsp + 0xda18], rax
mov rax, qword [rsp + 0xda18]
mov qword [rsp + 0xda20], rax
lea r8, [0x1402466b8]
mov rdx, qword [rsp + 0xda20]
lea rcx, [rsp + 0xd780]
call fcn.1400010b0
mov qword [rsp + 0xda28], rax
mov rcx, qword [rsp + 0xda28]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd780]
call fcn.140001470
nop
lea rcx, [rsp + 0xd778]
call fcn.140001470
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0x24
lea rcx, [0x1402466d0]
call fcn.1400ef150
cmp eax, 6
jne 0x1401b6398
mov edx, dword [rsp + 0x29a8]
lea rcx, [rsp + 0x73d0]
call fcn.1401cd210
nop
lea rcx, [rsp + 0x29b8]
call fcn.1400012c0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x7718]
call fcn.1400fff60
nop
mov dx, 0x2e
lea rcx, [rsp + 0x7718]
call fcn.140006840
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd788]
lea rcx, [rsp + 0x7718]
call fcn.1400069a0
mov qword [rsp + 0xda30], rax
mov rcx, qword [rsp + 0xda30]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0x7710], eax
lea rcx, [rsp + 0xd788]
call fcn.140001470
lea rcx, [rsp + 0x7570]
mov r8d, dword [rsp + 0x7710]
lea rdx, [0x140245f74]
call fcn.140002be0
lea rcx, [rsp + 0x7578]
lea rdx, [0x140246718]
call fcn.140002060
lea rcx, [rsp + 0xd790]
call fcn.14000f6f0
lea r8, [0x140246748]
lea rdx, [rsp + 0xd798]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0xda38], rax
mov rax, qword [rsp + 0xda38]
mov qword [rsp + 0xda40], rax
lea rcx, [rsp + 0x7580]
mov rdx, qword [rsp + 0xda40]
call fcn.140002d20
nop
lea rcx, [rsp + 0xd798]
call fcn.140001470
lea rcx, [rsp + 0x73d0]
call fcn.1401b8b50
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x968], 0
je 0x1401b62be
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b6308
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call fcn.14007c98c
xor edx, edx
mov rcx, rax
call fcn.14007c06c
mov edx, 5
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x7718]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov r8, qword [rsp + 0xdae0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140104b60
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b6368
xor edx, edx
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140246770]
call fcn.1400ef150
nop
lea rcx, [rsp + 0x7718]
call fcn.140001470
nop
lea rcx, [rsp + 0x73d0]
call fcn.140005d50
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x29a8]
mov r8d, dword [rsp + 0x2b54]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
mov dword [rsp + 0xd7a0], 0
lea rcx, [rsp + 0x2030]
call fcn.1401496f0
nop
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
mov eax, dword [rsp + 0xd7a0]
jmp 0x1401b7a06
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7a8]
call fcn.140005d90
mov qword [rsp + 0xda48], rax
mov rax, qword [rsp + 0xda48]
mov qword [rsp + 0xda50], rax
lea r8, [0x1402467b0]
mov rdx, qword [rsp + 0xda50]
lea rcx, [rsp + 0xd7b0]
call fcn.1400010b0
mov qword [rsp + 0xda58], rax
mov rcx, qword [rsp + 0xda58]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7b0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd7a8]
call fcn.140001470
mov r8d, 1
movzx edx, word [rsp + 0x2b50]
lea rcx, [rsp + 0xd7b8]
call fcn.140005d90
mov qword [rsp + 0xda60], rax
mov rax, qword [rsp + 0xda60]
mov qword [rsp + 0xda68], rax
lea r8, [0x1402467c0]
mov rdx, qword [rsp + 0xda68]
lea rcx, [rsp + 0xd7c0]
call fcn.1400010b0
mov qword [rsp + 0xda70], rax
mov rcx, qword [rsp + 0xda70]
call fcn.1400012c0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rcx, [rsp + 0xd7c0]
call fcn.140001470
nop
lea rcx, [rsp + 0xd7b8]
call fcn.140001470
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x27f8]
call qword [rsp + 0x3378]
mov rcx, qword [rsp + 0x27f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3370]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
mov qword [rsp + 0x27f8], 0xffffffffffffffff
lea rcx, [rsp + 0x2030]
call fcn.1401496f0
nop
lea rcx, [rsp + 0x3370]
call fcn.140001470
nop
lea rcx, [rsp + 0x2810]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov r8d, 1
mov edx, 0x80e6
mov rcx, qword [rsp + 0xdae0]
call fcn.1401b4020
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0x775c], eax
cmp dword [rsp + 0x775c], 0
jge 0x1401b6624
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0x7f90]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0x775c]
call fcn.1400824e8
mov dword [rsp + 0x8128], eax
lea rcx, [rsp + 0x7f90]
call fcn.1401b8330
test eax, eax
jne 0x1401b6689
mov dword [rsp + 0xd7c8], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7c8]
jmp 0x1401b7a06
lea rcx, [rsp + 0x8138]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0x7724], eax
cmp dword [rsp + 0x7724], 2
je 0x1401b66e7
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x1402467e0]
call fcn.1400ef150
mov dword [rsp + 0xd7cc], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7cc]
jmp 0x1401b7a06
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_mount_this_image_
call fcn.1400ef150
cmp eax, 7
jne 0x1401b6724
mov dword [rsp + 0xd7d0], 0
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7d0]
jmp 0x1401b7a06
lea rcx, [rsp + 0x8138]
call fcn.14015a0a0
lea rdx, [rsp + 0x8138]
lea r8, [0x1402468b8]
lea rcx, [rsp + 0x7f70]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0x8138]
call fcn.1400012c0
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140105390
lea rcx, [0x1402468d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x7760], rax
cmp qword [rsp + 0x7760], 0
jne 0x1401b67f5
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x1402468f0]
call fcn.1400ef150
mov dword [rsp + 0xd7d4], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7d4]
jmp 0x1401b7a06
lea rdx, [0x140246948]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f78], rax
lea rdx, [0x140246960]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f80], rax
lea rdx, [0x140246970]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7750], rax
lea rdx, [0x140246988]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x7f88], rax
mov dword [rsp + 0x7738], 2
mov dword [rsp + 0x773c], 0xec984aec
mov eax, 0xa0f9
mov word [rsp + 0x7740], ax
mov eax, 0x47e9
mov word [rsp + 0x7742], ax
mov byte [rsp + 0x7744], 0x90
mov byte [rsp + 0x7745], 0x1f
mov byte [rsp + 0x7746], 0x71
mov byte [rsp + 0x7747], 0x41
mov byte [rsp + 0x7748], 0x5a
mov byte [rsp + 0x7749], 0x66
mov byte [rsp + 0x774a], 0x34
mov byte [rsp + 0x774b], 0x5b
mov dword [rsp + 0x7768], 1
lea rdi, [rsp + 0x776c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x776c], 1
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rdx, rax
lea rax, [rsp + 0x7730]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7768]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3f0000
lea rcx, [rsp + 0x7738]
call qword [rsp + 0x7f80]
test eax, eax
je 0x1401b69b0
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402469a8]
call fcn.1400ef150
mov dword [rsp + 0xd7d8], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7d8]
jmp 0x1401b7a06
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7750]
test eax, eax
je 0x1401b6a65
mov rcx, qword [rsp + 0x7730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x7730], 0xffffffffffffffff
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x1402469d0]
call fcn.1400ef150
mov dword [rsp + 0xd7dc], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd7dc]
jmp 0x1401b7a06
lea rdx, [rsp + 0x8128]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140006f40
mov rdx, rax
mov rax, qword [rsp + 0x7730]
mov qword [rdx], rax
xor eax, eax
mov word [rsp + 0x7770], ax
lea rdi, [rsp + 0x7772]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x7728], 0x800
lea r8, [rsp + 0x7770]
lea rdx, [rsp + 0x7728]
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7f88]
lea rcx, [0x1402469f8]
call fcn.1400a81f4
lea rcx, [rsp + rax*2 + 0x7770]
call fcn.1400a947c
mov dword [rsp + 0x7720], eax
mov eax, 0x43
mov word [rsp + 0x7758], ax
mov dword [rsp + 0x82d0], 0
jmp 0x1401b6b1f
mov eax, dword [rsp + 0x82d0]
add eax, 1
mov dword [rsp + 0x82d0], eax
cmp dword [rsp + 0x82d0], 0x14
jge 0x1401b6de6
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b6de6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x82d4], eax
mov byte [rsp + 0x82d8], 0x43
jmp 0x1401b6b71
movzx eax, byte [rsp + 0x82d8]
add al, 1
mov byte [rsp + 0x82d8], al
movsx eax, byte [rsp + 0x82d8]
cmp eax, 0x5a
jg 0x1401b6de1
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b6de1
movsx ecx, byte [rsp + 0x82d8]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x82d4]
and eax, ecx
test eax, eax
jne 0x1401b6bb6
jmp 0x1401b6b60
lea rcx, [rsp + 0xc2f8]
call fcn.140002d50
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140246a20]
lea rcx, [rsp + 0xc2f8]
call fcn.140002be0
lea rcx, [rsp + 0xc2f8]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1401b6c0e
lea rcx, [rsp + 0xc2f8]
call fcn.140001470
jmp 0x1401b6b60
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140246a28]
lea rcx, [rsp + 0xc2f8]
call fcn.140002be0
lea rcx, [rsp + 0xc2f8]
call fcn.1400012c0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x82e0], rax
cmp qword [rsp + 0x82e0], 0xffffffffffffffff
jne 0x1401b6c8d
lea rcx, [rsp + 0xc2f8]
call fcn.140001470
jmp 0x1401b6b60
mov dword [rsp + 0xc2f0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0xc2f0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x82f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401b6dc0
mov dword [rsp + 0xc300], 0
mov dword [rsp + 0xc300], 0
jmp 0x1401b6d0d
mov eax, dword [rsp + 0xc300]
add eax, 1
mov dword [rsp + 0xc300], eax
mov eax, dword [rsp + 0x82f0]
cmp dword [rsp + 0xc300], eax
jge 0x1401b6dc0
cmp dword [rsp + 0x7720], 0xffffffff
je 0x1401b6d49
movsxd rax, dword [rsp + 0xc300]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x82f8]
cmp dword [rsp + 0x7720], eax
je 0x1401b6d49
jmp 0x1401b6cfc
lea rcx, [rsp + 0xc308]
call fcn.140002d50
nop
movsx r8d, byte [rsp + 0x82d8]
lea rdx, [0x140246a38]
lea rcx, [rsp + 0xc308]
call fcn.140002be0
lea rcx, [rsp + 0xc308]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401b6dae
movsx ax, byte [rsp + 0x82d8]
mov word [rsp + 0x7758], ax
lea rcx, [rsp + 0xc308]
call fcn.140001470
jmp 0x1401b6dc0
lea rcx, [rsp + 0xc308]
call fcn.140001470
jmp 0x1401b6cfc
mov rcx, qword [rsp + 0x82e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc2f8]
call fcn.140001470
jmp 0x1401b6b60
jmp 0x1401b6b0e
movzx eax, word [rsp + 0x7758]
cmp eax, 0x43
jne 0x1401b6f26
cmp qword [rsp + 0x7730], 0xffffffffffffffff
je 0x1401b6ebc
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x7730]
call qword [rsp + 0x7f78]
mov rcx, qword [rsp + 0x7730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x7730], 0xffffffffffffffff
lea r8, [rsp + 0x8128]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd7f0]
call fcn.140007a20
lea rdi, [rsp + 0xd8f0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd7e0]
lea rsi, [rsp + 0xd8f0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd8c0]
lea rsi, [rsp + 0xd7e0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea r8, [rsp + 0xd8c0]
lea rdx, [rsp + 0xd800]
call fcn.1400070e0
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x7f70]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [0x140246a48]
call fcn.1400ef150
mov dword [rsp + 0xd810], 0
lea rcx, [rsp + 0x7f70]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
mov eax, dword [rsp + 0xd810]
jmp 0x1401b7a06
mov rcx, qword [rsp + 0x7760]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x8140]
lea rdx, [0x140245194]
call fcn.140002060
lea rcx, [rsp + 0x8148]
mov r8d, dword [rsp + 0x7720]
lea rdx, [0x140246564]
call fcn.140002be0
lea rcx, [rsp + 0x7f90]
call fcn.1401b8720
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
xor r8d, r8d
mov edx, 0x40
lea rcx, str.Image_mounting_successful.
call fcn.1400ef150
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0x8128]
mov r8d, dword [rsp + 0x775c]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
cmp qword [rsp + 0xdaf0], 0
je 0x1401b6fdc
lea rax, str.:WindowsSystem32CCBootPnP
mov qword [rsp + 0xda78], rax
jmp 0x1401b6feb
lea rax, [0x1402467d4]
mov qword [rsp + 0xda78], rax
mov r8d, 1
movzx edx, word [rsp + 0x7758]
lea rcx, [rsp + 0xd818]
call fcn.140005d90
mov qword [rsp + 0xda80], rax
mov rax, qword [rsp + 0xda80]
mov qword [rsp + 0xda88], rax
mov r8, qword [rsp + 0xda78]
mov rdx, qword [rsp + 0xda88]
lea rcx, [rsp + 0xd820]
call fcn.1400010b0
mov qword [rsp + 0xda90], rax
mov rcx, qword [rsp + 0xda90]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0xd820]
call fcn.140001470
nop
lea rcx, [rsp + 0xd818]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f70]
call fcn.140001470
nop
lea rcx, [rsp + 0x7f90]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov rax, qword [rsp + 0xdae0]
cmp dword [rax + 0x978], 0
je 0x1401b70c7
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0xc314], eax
cmp dword [rsp + 0xc314], 0
jge 0x1401b70fe
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0xc330]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xc314]
call fcn.1400824e8
mov dword [rsp + 0xc4c8], eax
lea rcx, [rsp + 0xc330]
call fcn.1401b8330
test eax, eax
jne 0x1401b7163
mov dword [rsp + 0xd828], 0
lea rcx, [rsp + 0xc330]
call fcn.140005d50
mov eax, dword [rsp + 0xd828]
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd840]
call fcn.140017da0
mov rdi, rax
lea r8, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd830]
call fcn.140007a20
mov rdx, rdi
mov rcx, rax
call fcn.140023a80
movzx eax, al
test eax, eax
je 0x1401b71dc
mov dword [rsp + 0xd850], 0
lea rcx, [rsp + 0xc330]
call fcn.140005d50
mov eax, dword [rsp + 0xd850]
jmp 0x1401b7a06
lea rcx, [rsp + 0xc4d8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0xc310], eax
cmp dword [rsp + 0xc310], 2
je 0x1401b723a
xor r8d, r8d
mov edx, 0x40
lea rcx, str.This_function_only_supports_VHD_files__other_formats_are_not_supported.
call fcn.1400ef150
mov dword [rsp + 0xd854], 0
lea rcx, [rsp + 0xc330]
call fcn.140005d50
mov eax, dword [rsp + 0xd854]
jmp 0x1401b7a06
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 1
xor r8d, r8d
mov edx, 0x44
lea rcx, str.Do_you_want_to_unmount_this_image_
call fcn.1400ef150
cmp eax, 7
jne 0x1401b729b
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
mov dword [rsp + 0xd858], 0
lea rcx, [rsp + 0xc330]
call fcn.140005d50
mov eax, dword [rsp + 0xd858]
jmp 0x1401b7a06
lea rdx, [rsp + 0xc4d8]
lea r8, [0x140246bc8]
lea rcx, [rsp + 0xc320]
call fcn.1400010b0
nop
lea rcx, [0x140246be0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xc318], rax
cmp qword [rsp + 0xc318], 0
jne 0x1401b7330
mov rax, qword [rsp + 0xdae0]
mov dword [rax + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140246c00]
call fcn.1400ef150
mov dword [rsp + 0xd85c], 0
lea rcx, [rsp + 0xc320]
call fcn.140001470
nop
lea rcx, [rsp + 0xc330]
call fcn.140005d50
mov eax, dword [rsp + 0xd85c]
jmp 0x1401b7a06
lea rdx, [0x140246c58]
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc328], rax
lea rdx, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140006f40
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
call qword [rsp + 0xc328]
lea rdx, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
call fcn.140006f40
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0xc4c8]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea rdx, [rsp + 0xd870]
call fcn.140007a20
lea rdi, [rsp + 0xd8e0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd860]
lea rsi, [rsp + 0xd8e0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xd8d0]
lea rsi, [rsp + 0xd860]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xdae0]
add rcx, 0x1320
lea r8, [rsp + 0xd8d0]
lea rdx, [rsp + 0xd880]
call fcn.1400070e0
mov rcx, qword [rsp + 0xc318]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_save_the_changes_
call fcn.1400ef150
cmp eax, 6
jne 0x1401b767b
mov edx, dword [rsp + 0xc4c8]
lea rcx, [rsp + 0xc670]
call fcn.1401cd210
nop
lea rcx, [rsp + 0xc4d8]
call fcn.1400012c0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc9b8]
call fcn.1400fff60
nop
mov dx, 0x2e
lea rcx, [rsp + 0xc9b8]
call fcn.140006840
mov r8d, eax
sub r8d, 3
lea rdx, [rsp + 0xd890]
lea rcx, [rsp + 0xc9b8]
call fcn.1400069a0
mov qword [rsp + 0xda98], rax
mov rcx, qword [rsp + 0xda98]
call fcn.1400012c0
mov rcx, rax
call fcn.1400a947c
mov dword [rsp + 0xc9b0], eax
lea rcx, [rsp + 0xd890]
call fcn.140001470
lea rcx, [rsp + 0xc810]
mov r8d, dword [rsp + 0xc9b0]
lea rdx, [0x140246cb4]
call fcn.140002be0
lea rcx, [rsp + 0xc818]
lea rdx, [0x140246cc0]
call fcn.140002060
lea rcx, [rsp + 0xd898]
call fcn.14000f6f0
lea r8, [0x140246cd8]
lea rdx, [rsp + 0xd8a0]
mov rcx, rax
call fcn.14000f090
mov qword [rsp + 0xdaa0], rax
mov rax, qword [rsp + 0xdaa0]
mov qword [rsp + 0xdaa8], rax
lea rcx, [rsp + 0xc820]
mov rdx, qword [rsp + 0xdaa8]
call fcn.140002d20
nop
lea rcx, [rsp + 0xd8a0]
call fcn.140001470
lea rcx, [rsp + 0xc670]
call fcn.1401b8b50
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x968], 0
je 0x1401b75b5
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x968]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b75ff
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call fcn.14007c98c
xor edx, edx
mov rcx, rax
call fcn.14007c06c
mov edx, 5
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0xc9b8]
call fcn.1400012c0
mov rdi, rax
lea rcx, [rsp + 0xc320]
call fcn.1400012c0
mov r8, qword [rsp + 0xdae0]
mov r8, qword [r8 + 0x968]
mov rdx, rdi
mov rcx, rax
call fcn.140104b60
mov rax, qword [rsp + 0xdae0]
cmp qword [rax + 0x970], 0
je 0x1401b7660
xor edx, edx
mov rcx, qword [rsp + 0xdae0]
mov rcx, qword [rcx + 0x970]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rsp + 0xc9b8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc670]
call fcn.140005d50
lea rcx, [rsp + 0xc4e0]
lea rdx, [0x1402451e4]
call fcn.140002060
lea rcx, [rsp + 0xc4e8]
call fcn.140001960
lea rcx, [rsp + 0xc330]
call fcn.1401b8720
mov edx, 1
mov ecx, 1
call fcn.1401b8f10
lea rcx, [rsp + 0xc320]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0xdae0]
mov dword [rdx + 0x978], 0
xor r8d, r8d
mov edx, 0x40
lea rcx, [0x140246d00]
call fcn.1400ef150
mov rdx, qword [rsp + 0xdae0]
add rdx, 0xf18
mov r9d, dword [rsp + 0xc4c8]
mov r8d, dword [rsp + 0xc314]
mov rcx, qword [rsp + 0xdae0]
call fcn.1401a6370
nop
lea rcx, [rsp + 0xc320]
call fcn.140001470
nop
lea rcx, [rsp + 0xc330]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0xcd10], eax
cmp dword [rsp + 0xcd10], 0
jge 0x1401b777a
xor eax, eax
jmp 0x1401b7a06
lea rcx, [rsp + 0xd020]
call fcn.14000efb0
nop
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xcd10]
call fcn.1400824e8
mov dword [rsp + 0xd1b8], eax
lea rcx, [rsp + 0xd020]
call fcn.1401b8330
test eax, eax
jne 0x1401b77df
mov dword [rsp + 0xd8a8], 0
lea rcx, [rsp + 0xd020]
call fcn.140005d50
mov eax, dword [rsp + 0xd8a8]
jmp 0x1401b7a06
lea rcx, [rsp + 0xd1c8]
call fcn.1400012c0
mov rcx, rax
call fcn.1400f8fa0
mov dword [rsp + 0xc9c0], eax
cmp dword [rsp + 0xc9c0], 3
je 0x1401b7819
cmp dword [rsp + 0xc9c0], 4
je 0x1401b7819
cmp dword [rsp + 0xc9c0], 5
jne 0x1401b7851
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Child_disk_can_not_be_created_with_this_image_format._nPlease_select_.vhd_or_.vmdk_format.
call fcn.1400ef150
mov dword [rsp + 0xd8ac], 0
lea rcx, [rsp + 0xd020]
call fcn.140005d50
mov eax, dword [rsp + 0xd8ac]
jmp 0x1401b7a06
mov edx, dword [rsp + 0xd1b8]
lea rcx, [rsp + 0xc9d0]
call fcn.1401cd210
nop
lea rcx, [rsp + 0xcff0]
call fcn.140007bb0
nop
lea rdx, [rsp + 0xcff0]
lea rcx, [rsp + 0xc9d0]
call fcn.1401b8110
lea rcx, [rsp + 0xcff0]
call fcn.140007c30
test rax, rax
jbe 0x1401b78ef
xor r8d, r8d
mov edx, gethostbyname
lea rcx, str.Please_merge_all_your_recovery_first_
call fcn.1400ef150
mov dword [rsp + 0xd8b0], 0
lea rcx, [rsp + 0xcff0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xc9d0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xd020]
call fcn.140005d50
mov eax, dword [rsp + 0xd8b0]
jmp 0x1401b7a06
xor edx, edx
lea rcx, [rsp + 0xcd20]
call fcn.14016abd0
nop
mov eax, dword [rsp + 0xd1b8]
mov dword [rsp + 0xcf30], eax
lea rcx, [rsp + 0xcd20]
call fcn.1400819f8
nop
lea rcx, [rsp + 0xcd20]
call fcn.14016ab70
nop
lea rcx, [rsp + 0xcff0]
call fcn.140007c00
nop
lea rcx, [rsp + 0xc9d0]
call fcn.140005d50
nop
lea rcx, [rsp + 0xd020]
call fcn.140005d50
xor eax, eax
jmp 0x1401b7a06
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov r8d, 2
mov edx, 0xffffffff
call fcn.14000f050
mov dword [rsp + 0xd360], eax
xor edx, edx
lea rcx, [rsp + 0xd370]
call fcn.140142350
nop
mov dword [rsp + 0xd590], 0
mov rcx, qword [rsp + 0xdae0]
add rcx, 0xf18
mov edx, dword [rsp + 0xd360]
call fcn.1400824e8
mov dword [rsp + 0xd594], eax
lea rcx, [rsp + 0xd370]
call fcn.1400819f8
cmp rax, 1
je 0x1401b79f0
mov dword [rsp + 0xd8b4], 0
lea rcx, [rsp + 0xd370]
call fcn.1401422e0
mov eax, dword [rsp + 0xd8b4]
jmp 0x1401b7a06
lea rcx, [rsp + 0xd370]
call fcn.1401422e0
xor eax, eax
jmp 0x1401b7a06
mov eax, 1
mov rcx, qword [rsp + 0xdab0]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0xdac8
pop rdi
pop rsi
ret