Function at 0x1401b7e30
Capabilities:
Create process on windows
Manipulate boot configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x15b8
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x14a0], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x15a8], rax
cmp dword [rsp + 0x15d8], 0x46e
jne 0x1401b8077
cmp qword [rsp + 0x15e8], 0x201
jne 0x1401b8077
mov rax, qword [rsp + 0x15d0]
cmp dword [rax + 0x8e8], 0
je 0x1401b8077
mov rcx, qword [rsp + 0x15d0]
call fcn.14000ce00
test eax, eax
jne 0x1401b8070
mov rax, qword [rsp + 0x15d0]
cmp qword [rax + 0x8e0], 0
jne 0x1401b8070
mov ecx, 0x220
call fcn.140002560
mov qword [rsp + 0x11c0], rax
cmp qword [rsp + 0x11c0], 0
je 0x1401b7f09
xor edx, edx
mov rcx, qword [rsp + 0x11c0]
call fcn.140158790
mov qword [rsp + 0x14a8], rax
jmp 0x1401b7f15
mov qword [rsp + 0x14a8], 0
mov rax, qword [rsp + 0x14a8]
mov qword [rsp + 0x11b8], rax
mov rcx, qword [rsp + 0x15d0]
mov rax, qword [rsp + 0x11b8]
mov qword [rcx + 0x8e0], rax
mov rax, qword [rsp + 0x15d0]
mov rax, qword [rax + 0x8e0]
mov rcx, qword [rsp + 0x15d0]
mov rcx, qword [rcx + 0x8e0]
mov rax, qword [rax]
call qword [rax + 0x298]
cmp rax, 2
jne 0x1401b7fe6
mov rax, qword [rsp + 0x15d0]
mov rax, qword [rax + 0x8e0]
mov qword [rsp + 0x11d0], rax
mov rax, qword [rsp + 0x11d0]
mov qword [rsp + 0x11c8], rax
cmp qword [rsp + 0x11c8], 0
je 0x1401b7fc0
mov rax, qword [rsp + 0x11c8]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x11c8]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x14b0], rax
jmp 0x1401b7fcc
mov qword [rsp + 0x14b0], 0
mov rax, qword [rsp + 0x15d0]
mov qword [rax + 0x8e0], 0
xor eax, eax
jmp 0x1401b9d9b
mov rax, qword [rsp + 0x15d0]
mov rax, qword [rax + 0x8e0]
mov qword [rsp + 0x11e0], rax
mov rax, qword [rsp + 0x11e0]
mov qword [rsp + 0x11d8], rax
cmp qword [rsp + 0x11d8], 0
je 0x1401b803d
mov rax, qword [rsp + 0x11d8]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x11d8]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x14b8], rax
jmp 0x1401b8049
mov qword [rsp + 0x14b8], 0
mov rax, qword [rsp + 0x15d0]
mov qword [rax + 0x8e0], 0
mov rax, qword [rsp + 0x15d0]
mov dword [rax + 0x8e8], 0
jmp 0x1401b8077
xor eax, eax
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x8040
jne 0x1401b81db
lea rcx, [rsp + 0x11e8]
call fcn.140001000
mov qword [rsp + 0x14c0], rax
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x14c8], rax
lea r8, [0x14024a308]
mov rdx, qword [rsp + 0x14c8]
lea rcx, [rsp + 0x378]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x11e8]
call fcn.140001490
lea rcx, [rsp + 0x370]
call fcn.140002de0
nop
lea rcx, [rsp + 0x30]
call fcn.1401d19d0
nop
mov eax, dword [rsp + 0x15e8]
mov dword [rsp + 0x1c8], eax
lea rcx, [rsp + 0x30]
call fcn.1401d6a40
cmp qword [rsp + 0x15e0], 0
jne 0x1401b811f
mov qword [rsp + 0x15e0], 0x170c
mov rax, qword [rsp + 0x15e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x378]
lea rdx, [0x14024a320]
lea rcx, [rsp + 0x370]
call fcn.140002c70
lea rcx, [rsp + 0x378]
call fcn.14000f8f0
mov rdi, rax
lea rcx, [rsp + 0x370]
call fcn.14000f8f0
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004930
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x8b8
mov edx, dword [rsp + 0x15e8]
call fcn.14000cdc0
mov qword [rsp + 0x11f0], 0
lea rcx, [rsp + 0x30]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x370]
call fcn.140001490
nop
lea rcx, [rsp + 0x378]
call fcn.140001490
mov rax, qword [rsp + 0x11f0]
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x8045
jne 0x1401b9577
cmp qword [rsp + 0x15e0], 0
je 0x1401b8202
cmp qword [rsp + 0x15e8], 0
jne 0x1401b8209
xor eax, eax
jmp 0x1401b9d9b
mov dword [rsp + 0x3c8], 0
mov dword [rsp + 0x830], 0
xor r8d, r8d
lea rdx, [rsp + 0x1200]
mov rcx, qword [rsp + 0x15d0]
call fcn.140193f10
mov qword [rsp + 0x14d0], rax
lea rdx, [0x14024a350]
mov rcx, qword [rsp + 0x14d0]
call fcn.140006d50
mov byte [rsp + 0x11f8], al
lea rcx, [rsp + 0x1200]
call fcn.140001490
movzx edx, byte [rsp + 0x11f8]
test edx, edx
je 0x1401b82e7
mov dword [rsp + 0x3c8], 0
jmp 0x1401b8291
mov eax, dword [rsp + 0x3c8]
add eax, 1
mov dword [rsp + 0x3c8], eax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
call fcn.14000cd90
cmp dword [rsp + 0x3c8], eax
jge 0x1401b82e7
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov edx, dword [rsp + 0x3c8]
call fcn.140082c64
mov rdx, rax
mov eax, dword [rsp + 0x15e0]
cmp rdx, rax
jne 0x1401b82e5
mov dword [rsp + 0x830], 1
jmp 0x1401b82e7
jmp 0x1401b8280
xor r8d, r8d
lea rdx, [rsp + 0x1210]
mov rcx, qword [rsp + 0x15d0]
call fcn.140193f10
mov qword [rsp + 0x14d8], rax
lea rdx, [0x14024a370]
mov rcx, qword [rsp + 0x14d8]
call fcn.140006d50
mov byte [rsp + 0x1208], al
lea rcx, [rsp + 0x1210]
call fcn.140001490
movzx edx, byte [rsp + 0x1208]
test edx, edx
je 0x1401b8413
lea rcx, [rsp + 0x850]
call fcn.1401d19d0
nop
mov eax, dword [rsp + 0x15e0]
mov dword [rsp + 0x9e8], eax
lea rcx, [rsp + 0x850]
call fcn.1401d6a40
test eax, eax
jne 0x1401b8392
mov qword [rsp + 0x1218], 0
lea rcx, [rsp + 0x850]
call fcn.140014ec0
mov rax, qword [rsp + 0x1218]
jmp 0x1401b9d9b
mov dword [rsp + 0x3c8], 0
jmp 0x1401b83b0
mov eax, dword [rsp + 0x3c8]
add eax, 1
mov dword [rsp + 0x3c8], eax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
call fcn.14000cd90
cmp dword [rsp + 0x3c8], eax
jge 0x1401b8406
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov edx, dword [rsp + 0x3c8]
call fcn.140082c64
mov rdx, rax
mov eax, dword [rsp + 0x15e0]
cmp rdx, rax
jne 0x1401b8404
mov dword [rsp + 0x830], 1
jmp 0x1401b8406
jmp 0x1401b839f
lea rcx, [rsp + 0x850]
call fcn.140014ec0
cmp dword [rsp + 0x830], 0
jne 0x1401b8424
xor eax, eax
jmp 0x1401b9d9b
lea rcx, [rsp + 0x750]
call fcn.140002de0
nop
mov r8, qword [rsp + 0x15e8]
lea rdx, [0x140248814]
lea rcx, [rsp + 0x750]
call fcn.140002c70
mov edx, 0xa
lea rcx, [rsp + 0x388]
call fcn.140088690
nop
lea rcx, [rsp + 0x750]
call fcn.14000f8f0
lea rdx, [rsp + 0x388]
mov rcx, rax
call fcn.1400dfcf0
lea rcx, [rsp + 0x3e0]
call fcn.1401d19d0
nop
mov dword [rsp + 0x380], 0
mov eax, dword [rsp + 0x15e0]
mov dword [rsp + 0x578], eax
lea rcx, [rsp + 0x3e0]
call fcn.1401d6a40
lea rcx, [rsp + 0x760]
call fcn.1400e7060
nop
lea rcx, [rsp + 0x1220]
call fcn.140001000
mov qword [rsp + 0x14e0], rax
mov rax, qword [rsp + 0x14e0]
mov qword [rsp + 0x14e8], rax
lea r8, [0x14024a398]
mov rdx, qword [rsp + 0x14e8]
lea rcx, [rsp + 0x1228]
call fcn.1400010b0
mov qword [rsp + 0x14f0], rax
mov rax, qword [rsp + 0x14f0]
mov qword [rsp + 0x14f8], rax
mov rcx, qword [rsp + 0x14f8]
call fcn.14000f8f0
mov dword [rsp + 0x20], 0
mov r9d, reloc.WSOCK32.dll_WSACleanup
mov r8, rax
lea rdx, [rsp + 0x1230]
lea rcx, [rsp + 0x760]
call fcn.1400ea430
nop
lea rcx, [rsp + 0x1228]
call fcn.140001490
nop
lea rcx, [rsp + 0x1220]
call fcn.140001490
lea rcx, [rsp + 0x3d0]
call fcn.140002de0
nop
mov r8, qword [rsp + 0x5a8]
lea rdx, [0x14024a3b0]
lea rcx, [rsp + 0x3d0]
call fcn.140002c70
lea rdx, [0x14024a420]
lea rcx, [rsp + 0x720]
call fcn.140002100
nop
lea rcx, [rsp + 0x720]
call fcn.14000f8f0
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x728]
lea rcx, [rsp + 0x760]
call fcn.1400ead90
nop
lea rcx, [rsp + 0x728]
call fcn.1400e34c0
test rax, rax
jne 0x1401b86da
xor r9d, r9d
lea r8, [0x14024808c]
lea rdx, [rsp + 0xb90]
lea rcx, [rsp + 0x760]
call fcn.1400ead90
nop
xor edx, edx
lea rcx, [rsp + 0xb90]
call fcn.1400e3490
lea rdx, [rsp + 0x1248]
mov rcx, rax
call fcn.1400e6730
lea r8, str.server
lea rdx, [rsp + 0x1250]
mov rcx, rax
call fcn.1400e9810
xor r9d, r9d
lea r8, str.__server
lea rdx, [rsp + 0x1258]
lea rcx, [rsp + 0x760]
call fcn.1400ead90
mov qword [rsp + 0x1500], rax
mov rax, qword [rsp + 0x1500]
mov qword [rsp + 0x1508], rax
mov rdx, qword [rsp + 0x1508]
lea rcx, [rsp + 0xb90]
call fcn.1400e50e0
nop
lea rcx, [rsp + 0x1258]
call fcn.1400e3510
xor edx, edx
lea rcx, [rsp + 0xb90]
call fcn.1400e3490
lea rdx, [rsp + 0x1280]
mov rcx, rax
call fcn.1400e6730
lea r8, str.initiatorinfo
lea rdx, [rsp + 0x1288]
mov rcx, rax
call fcn.1400e9810
nop
lea rcx, [rsp + 0xb90]
call fcn.1400e3510
mov dx, 0x2f
lea rcx, [rsp + 0x720]
call fcn.1400068a0
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x1290]
lea rcx, [rsp + 0x720]
call fcn.1400022a0
mov qword [rsp + 0x1510], rax
mov rax, qword [rsp + 0x1510]
mov qword [rsp + 0x1518], rax
mov rdx, qword [rsp + 0x1518]
lea rcx, [rsp + 0x720]
call fcn.140002db0
nop
lea rcx, [rsp + 0x1290]
call fcn.140001490
lea rcx, [rsp + 0x3d0]
call fcn.14000f8f0
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x838]
lea rcx, [rsp + 0x760]
call fcn.1400eacc0
lea rcx, [rsp + 0x1298]
call fcn.1400e5260
mov rdx, rax
lea rcx, [rsp + 0x838]
call fcn.1400e51b0
movzx eax, al
test eax, eax
je 0x1401b88cc
xor r9d, r9d
lea r8, [0x14024a4c0]
lea rdx, [rsp + 0xbc0]
lea rcx, [rsp + 0x760]
call fcn.1400eacc0
lea rcx, [rsp + 0xbb8]
call fcn.1400e4480
lea rcx, [rsp + 0xbd0]
call fcn.1400e4480
lea rdx, [rsp + 0x12b0]
lea rcx, [rsp + 0xbc0]
call fcn.1400e6730
mov rcx, rax
call fcn.1400e42b0
mov rdi, rax
lea rdx, [rsp + 0x12a8]
lea rcx, [rsp + 0xbc0]
call fcn.1400e6730
mov r8, rdi
lea rdx, [rsp + 0x12b8]
mov rcx, rax
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xbb8], rax
lea r8, [0x14024a4f0]
lea rdx, [rsp + 0x12c0]
lea rcx, [rsp + 0xbb8]
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xbd0], rax
lea rcx, [rsp + 0x5a8]
call fcn.14000f8f0
mov rdi, rax
lea r8, [0x14024a4f8]
lea rdx, [rsp + 0x12c8]
lea rcx, [rsp + 0xbd0]
call fcn.1400e8e60
mov rdx, rdi
mov rcx, rax
call fcn.1400e8c60
lea rcx, [rsp + 0x3d0]
call fcn.14000f8f0
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x12d0]
lea rcx, [rsp + 0x760]
call fcn.1400eacc0
lea rdi, [rsp + 0x1490]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x838]
lea rsi, [rsp + 0x1490]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x388]
call fcn.140088608
mov qword [rsp + 0x3c0], rax
cmp qword [rsp + 0x3c0], 0
je 0x1401b9448
lea rdx, [0x14024a508]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b893d
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, 9
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rdx, [0x14024a520]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b8a0d
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
lea rdx, [0x140249944]
call fcn.140006180
test eax, eax
jne 0x1401b8986
lea rax, [0x1402480c4]
mov qword [rsp + 0x1520], rax
jmp 0x1401b8995
lea rax, [0x14024a538]
mov qword [rsp + 0x1520], rax
mov rdx, qword [rsp + 0x3c0]
add rdx, 8
mov r8, qword [rsp + 0x1520]
lea rcx, [rsp + 0x12e0]
call fcn.1400010b0
mov qword [rsp + 0x1528], rax
mov rax, qword [rsp + 0x1528]
mov qword [rsp + 0x1530], rax
mov rcx, qword [rsp + 0x1530]
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayLock
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
nop
lea rcx, [rsp + 0x12e0]
call fcn.140001490
lea rdx, str.gpu_temp
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b8add
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
lea rdx, [0x14024a554]
call fcn.140006180
test eax, eax
jne 0x1401b8a56
lea rax, [0x1402480fc]
mov qword [rsp + 0x1538], rax
jmp 0x1401b8a65
lea rax, [0x14024a560]
mov qword [rsp + 0x1538], rax
mov rdx, qword [rsp + 0x3c0]
add rdx, 8
mov r8, qword [rsp + 0x1538]
lea rcx, [rsp + 0x12e8]
call fcn.1400010b0
mov qword [rsp + 0x1540], rax
mov rax, qword [rsp + 0x1540]
mov qword [rsp + 0x1548], rax
mov rcx, qword [rsp + 0x1548]
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.WSOCK32.dll_setsockopt
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
nop
lea rcx, [rsp + 0x12e8]
call fcn.140001490
lea rdx, str.activeprocess
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b8b2a
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.WSOCK32.dll_shutdown
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rdx, [0x14024a588]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b8d5a
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rcx, [rsp + 0xbd8]
call fcn.140002de0
nop
lea rdx, [rsp + 0x12f0]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a590]
lea rdx, [rsp + 0xbe0]
mov rcx, rax
call fcn.1400e5c40
lea rcx, [rsp + 0x12f8]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xbe0]
call fcn.1400e4380
movzx eax, al
test eax, eax
je 0x1401b8c0d
lea r8, [0x14024a598]
lea rdx, [rsp + 0x1300]
lea rcx, [rsp + 0xbe0]
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
lea rcx, [rsp + 0xbd8]
call fcn.1400020d0
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xbd8]
call fcn.140006180
test eax, eax
je 0x1401b8d4d
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.140006eb0
movzx eax, al
test eax, eax
jne 0x1401b8d4d
lea rcx, [rsp + 0x1308]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xbe0]
call fcn.1400e43c0
movzx eax, al
test eax, eax
je 0x1401b8cad
lea rdx, [rsp + 0x1310]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a5a8]
lea rdx, [rsp + 0x1318]
mov rcx, rax
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xbe0], rax
lea rcx, [rsp + 0x1328]
call fcn.1400e46a0
mov rdi, rax
lea r8, [0x14024a5b0]
lea rdx, [rsp + 0x1320]
lea rcx, [rsp + 0xbe0]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e45e0
movzx eax, al
test eax, eax
je 0x1401b8d07
lea r8, [0x14024a5c0]
lea rdx, [rsp + 0x1330]
lea rcx, [rsp + 0xbe0]
call fcn.1400e8e60
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdi, rax
lea r8, [0x14024a5d0]
lea rdx, [rsp + 0x1338]
lea rcx, [rsp + 0xbe0]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e8c60
mov dword [rsp + 0x380], 1
lea rcx, [rsp + 0xbd8]
call fcn.140001490
lea rdx, [0x14024a5dc]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b8f8a
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.WSOCK32.dll_select
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rcx, [rsp + 0xbe8]
call fcn.140002de0
nop
lea rdx, [rsp + 0x1340]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a5e4]
lea rdx, [rsp + 0xbf0]
mov rcx, rax
call fcn.1400e5c40
lea rcx, [rsp + 0x1348]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xbf0]
call fcn.1400e4380
movzx eax, al
test eax, eax
je 0x1401b8e3d
lea r8, [0x14024a5f0]
lea rdx, [rsp + 0x1350]
lea rcx, [rsp + 0xbf0]
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
lea rcx, [rsp + 0xbe8]
call fcn.1400020d0
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xbe8]
call fcn.140006180
test eax, eax
je 0x1401b8f7d
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.140006eb0
movzx eax, al
test eax, eax
jne 0x1401b8f7d
lea rcx, [rsp + 0x1358]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xbf0]
call fcn.1400e43c0
movzx eax, al
test eax, eax
je 0x1401b8edd
lea rdx, [rsp + 0x1360]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a5fc]
lea rdx, [rsp + 0x1368]
mov rcx, rax
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xbf0], rax
lea rcx, [rsp + 0x1378]
call fcn.1400e46a0
mov rdi, rax
lea r8, [0x14024a608]
lea rdx, [rsp + 0x1370]
lea rcx, [rsp + 0xbf0]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e45e0
movzx eax, al
test eax, eax
je 0x1401b8f37
lea r8, [0x14024a618]
lea rdx, [rsp + 0x1380]
lea rcx, [rsp + 0xbf0]
call fcn.1400e8e60
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdi, rax
lea r8, [0x14024a628]
lea rdx, [rsp + 0x1388]
lea rcx, [rsp + 0xbf0]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e8c60
mov dword [rsp + 0x380], 1
lea rcx, [rsp + 0xbe8]
call fcn.140001490
lea rdx, [0x14024a638]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b91ba
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.WSOCK32.dll_recvfrom
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rcx, [rsp + 0xbf8]
call fcn.140002de0
nop
lea rdx, [rsp + 0x1390]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a640]
lea rdx, [rsp + 0xc00]
mov rcx, rax
call fcn.1400e5c40
lea rcx, [rsp + 0x1398]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xc00]
call fcn.1400e4380
movzx eax, al
test eax, eax
je 0x1401b906d
lea r8, [0x14024a648]
lea rdx, [rsp + 0x13a0]
lea rcx, [rsp + 0xc00]
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
lea rcx, [rsp + 0xbf8]
call fcn.1400020d0
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xbf8]
call fcn.140006180
test eax, eax
je 0x1401b91ad
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.140006eb0
movzx eax, al
test eax, eax
jne 0x1401b91ad
lea rcx, [rsp + 0x13a8]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xc00]
call fcn.1400e43c0
movzx eax, al
test eax, eax
je 0x1401b910d
lea rdx, [rsp + 0x13b0]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a658]
lea rdx, [rsp + 0x13b8]
mov rcx, rax
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xc00], rax
lea rcx, [rsp + 0x13c8]
call fcn.1400e46a0
mov rdi, rax
lea r8, [0x14024a660]
lea rdx, [rsp + 0x13c0]
lea rcx, [rsp + 0xc00]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e45e0
movzx eax, al
test eax, eax
je 0x1401b9167
lea r8, [0x14024a670]
lea rdx, [rsp + 0x13d0]
lea rcx, [rsp + 0xc00]
call fcn.1400e8e60
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdi, rax
lea r8, [0x14024a680]
lea rdx, [rsp + 0x13d8]
lea rcx, [rsp + 0xc00]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e8c60
mov dword [rsp + 0x380], 1
lea rcx, [rsp + 0xbf8]
call fcn.140001490
lea rdx, [0x14024a690]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b9207
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetLBound
mov edx, dword [rsp + 0x3c8]
call fcn.140082c34
lea rdx, [0x14024a698]
mov rcx, qword [rsp + 0x3c0]
call fcn.140006180
test eax, eax
jne 0x1401b9426
mov rcx, qword [rsp + 0x3c0]
add rcx, 8
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xc10]
call fcn.1400de940
nop
lea rcx, [rsp + 0xc08]
call fcn.140002de0
nop
lea rdx, [rsp + 0x13e0]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a6a0]
lea rdx, [rsp + 0xc18]
mov rcx, rax
call fcn.1400e5c40
lea rcx, [rsp + 0x13e8]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xc18]
call fcn.1400e4380
movzx eax, al
test eax, eax
je 0x1401b92d7
lea r8, [0x14024a6a8]
lea rdx, [rsp + 0x13f0]
lea rcx, [rsp + 0xc18]
call fcn.1400e5b90
mov rcx, rax
call fcn.1400e44c0
mov rdx, rax
lea rcx, [rsp + 0xc08]
call fcn.1400020d0
lea rcx, [rsp + 0xc10]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xc08]
call fcn.140006180
test eax, eax
je 0x1401b940b
lea rcx, [rsp + 0xc10]
call fcn.140006eb0
movzx eax, al
test eax, eax
jne 0x1401b940b
lea rcx, [rsp + 0x13f8]
call fcn.1400e4480
mov rdx, rax
lea rcx, [rsp + 0xc18]
call fcn.1400e43c0
movzx eax, al
test eax, eax
je 0x1401b936f
lea rdx, [rsp + 0x1400]
lea rcx, [rsp + 0x838]
call fcn.1400e6730
lea r8, [0x14024a6b8]
lea rdx, [rsp + 0x1408]
mov rcx, rax
call fcn.1400e9810
mov rax, qword [rax]
mov qword [rsp + 0xc18], rax
lea rcx, [rsp + 0x1418]
call fcn.1400e46a0
mov rdi, rax
lea r8, [0x14024a6c0]
lea rdx, [rsp + 0x1410]
lea rcx, [rsp + 0xc18]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e45e0
movzx eax, al
test eax, eax
je 0x1401b93c9
lea r8, [0x14024a6d0]
lea rdx, [rsp + 0x1420]
lea rcx, [rsp + 0xc18]
call fcn.1400e8e60
lea rcx, [rsp + 0xc10]
call fcn.14000f8f0
mov rdi, rax
lea r8, [0x14024a6e0]
lea rdx, [rsp + 0x1428]
lea rcx, [rsp + 0xc18]
call fcn.1400e5b90
mov rdx, rdi
mov rcx, rax
call fcn.1400e8c60
mov dword [rsp + 0x380], 1
lea rcx, [rsp + 0xc08]
call fcn.140001490
nop
lea rcx, [rsp + 0xc10]
call fcn.140001490
mov rdx, qword [rsp + 0x3c0]
lea rcx, [rsp + 0x388]
call fcn.140088638
mov qword [rsp + 0x3c0], rax
jmp 0x1401b88e1
cmp dword [rsp + 0x380], 0
je 0x1401b94fd
lea rcx, [rsp + 0x1430]
call fcn.140001000
mov qword [rsp + 0x1550], rax
mov rax, qword [rsp + 0x1550]
mov qword [rsp + 0x1558], rax
lea r8, [0x14024a6f0]
mov rdx, qword [rsp + 0x1558]
lea rcx, [rsp + 0x1438]
call fcn.1400010b0
mov qword [rsp + 0x1560], rax
mov rax, qword [rsp + 0x1560]
mov qword [rsp + 0x1568], rax
mov rcx, qword [rsp + 0x1568]
call fcn.14000f8f0
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, [0x140248134]
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.1400eae10
nop
lea rcx, [rsp + 0x1438]
call fcn.140001490
nop
lea rcx, [rsp + 0x1430]
call fcn.140001490
mov qword [rsp + 0x1440], 0
lea rcx, [rsp + 0x728]
call fcn.1400e3510
nop
lea rcx, [rsp + 0x720]
call fcn.140001490
nop
lea rcx, [rsp + 0x3d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x760]
call fcn.1400e5930
nop
lea rcx, [rsp + 0x3e0]
call fcn.140014ec0
nop
lea rcx, [rsp + 0x388]
call fcn.14008886c
nop
lea rcx, [rsp + 0x750]
call fcn.140001490
mov rax, qword [rsp + 0x1440]
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x804c
jne 0x1401b969c
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
call fcn.14000cd60
mov qword [rsp + 0xc20], rax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
xor edx, edx
call fcn.14000cd20
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc20]
call fcn.14000cce0
mov qword [rsp + 0xc20], rax
cmp qword [rsp + 0xc20], 0
je 0x1401b9635
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc20]
call fcn.140082df0
cmp rax, 0x3fc
jne 0x1401b960f
jmp 0x1401b9635
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc20]
call fcn.14000cca0
mov qword [rsp + 0xc20], rax
jmp 0x1401b95de
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc20]
call fcn.14000cd20
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov r8d, 1
mov rdx, qword [rsp + 0xc20]
call fcn.14000cc60
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov r8d, 2
mov rdx, qword [rsp + 0xc20]
call fcn.14000cc60
xor eax, eax
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x8056
jne 0x1401b97c1
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
call fcn.14000cd60
mov qword [rsp + 0xc28], rax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
xor edx, edx
call fcn.14000cd20
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc28]
call fcn.14000cce0
mov qword [rsp + 0xc28], rax
cmp qword [rsp + 0xc28], 0
je 0x1401b975a
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc28]
call fcn.140082df0
cmp rax, 0xa1
jne 0x1401b9734
jmp 0x1401b975a
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc28]
call fcn.14000cca0
mov qword [rsp + 0xc28], rax
jmp 0x1401b9703
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov rdx, qword [rsp + 0xc28]
call fcn.14000cd20
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov r8d, 1
mov rdx, qword [rsp + 0xc28]
call fcn.14000cc60
mov rcx, qword [rsp + 0x15d0]
add rcx, 0x1278
mov r8d, 2
mov rdx, qword [rsp + 0xc28]
call fcn.14000cc60
xor eax, eax
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x8017
je 0x1401b97df
cmp dword [rsp + 0x15d8], 0x8039
jne 0x1401b9a7c
mov dword [rsp + 0xc30], 0
xor r8d, r8d
lea rdx, [rsp + 0x1450]
mov rcx, qword [rsp + 0x15d0]
call fcn.140193f10
mov qword [rsp + 0x1570], rax
lea rdx, [0x14024a708]
mov rcx, qword [rsp + 0x1570]
call fcn.140006d50
mov byte [rsp + 0x1448], al
lea rcx, [rsp + 0x1450]
call fcn.140001490
movzx edx, byte [rsp + 0x1448]
test edx, edx
je 0x1401b98d7
mov dword [rsp + 0xc30], 0
jmp 0x1401b9860
mov eax, dword [rsp + 0xc30]
add eax, 1
mov dword [rsp + 0xc30], eax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
call fcn.14000cd90
cmp dword [rsp + 0xc30], eax
jge 0x1401b98ab
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov edx, dword [rsp + 0xc30]
call fcn.140082c64
mov rdx, rax
mov eax, dword [rsp + 0x15e8]
cmp rdx, rax
jne 0x1401b98a9
jmp 0x1401b98ab
jmp 0x1401b984f
mov rdx, qword [rsp + 0x15d0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x15e8]
mov r8d, dword [rsp + 0xc30]
mov rcx, qword [rsp + 0x15d0]
call fcn.1401a96a0
xor r8d, r8d
lea rdx, [rsp + 0x1460]
mov rcx, qword [rsp + 0x15d0]
call fcn.140193f10
mov qword [rsp + 0x1578], rax
lea rdx, [0x14024a728]
mov rcx, qword [rsp + 0x1578]
call fcn.140006d50
mov byte [rsp + 0x1458], al
lea rcx, [rsp + 0x1460]
call fcn.140001490
movzx edx, byte [rsp + 0x1458]
test edx, edx
je 0x1401b9a75
lea rcx, [rsp + 0xc40]
call fcn.1401d19d0
nop
mov eax, dword [rsp + 0x15e8]
mov dword [rsp + 0xdd8], eax
lea rcx, [rsp + 0xc40]
call fcn.1401d6a40
test eax, eax
jne 0x1401b9982
mov qword [rsp + 0x1468], 0
lea rcx, [rsp + 0xc40]
call fcn.140014ec0
mov rax, qword [rsp + 0x1468]
jmp 0x1401b9d9b
lea rcx, [rsp + 0xe28]
call fcn.14000f8f0
mov rcx, rax
call fcn.1400a99f8
mov edi, eax
xor edx, edx
mov rcx, qword [rsp + 0x15d0]
call fcn.140192390
cmp edi, eax
je 0x1401b99d2
mov qword [rsp + 0x1470], 0
lea rcx, [rsp + 0xc40]
call fcn.140014ec0
mov rax, qword [rsp + 0x1470]
jmp 0x1401b9d9b
mov dword [rsp + 0xc30], 0
jmp 0x1401b99f0
mov eax, dword [rsp + 0xc30]
add eax, 1
mov dword [rsp + 0xc30], eax
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
call fcn.14000cd90
cmp dword [rsp + 0xc30], eax
jge 0x1401b9a3b
mov rcx, qword [rsp + 0x15d0]
add rcx, 0xdc8
mov edx, dword [rsp + 0xc30]
call fcn.140082c64
mov rdx, rax
mov eax, dword [rsp + 0x15e8]
cmp rdx, rax
jne 0x1401b9a39
jmp 0x1401b9a3b
jmp 0x1401b99df
mov rdx, qword [rsp + 0x15d0]
add rdx, 0xdc8
mov r9d, dword [rsp + 0x15e8]
mov r8d, dword [rsp + 0xc30]
mov rcx, qword [rsp + 0x15d0]
call fcn.1401a96a0
nop
lea rcx, [rsp + 0xc40]
call fcn.140014ec0
xor eax, eax
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x804f
jne 0x1401b9ac3
mov rdx, qword [rsp + 0x15d0]
add rdx, 0x4e8
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rax, qword [rsp + 0x15d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x15d0]
call qword [rax + 0x2b0]
xor eax, eax
jmp 0x1401b9d9b
cmp dword [rsp + 0x15d8], 0x8024
jne 0x1401b9d77
lea rcx, [rsp + 0xf90]
call fcn.14018aa70
nop
lea rcx, [rsp + 0xf88]
call fcn.140002de0
nop
mov dword [rsp + 0xf80], 0
lea rcx, [rsp + 0xf90]
call fcn.14000f8f0
mov rcx, rax
call fcn.140005220
test eax, eax
je 0x1401b9ba2
xor eax, eax
mov word [rsp + 0xfa0], ax
lea rdi, [rsp + 0xfa2]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rcx, [rsp + 0xf90]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xfa0]
call fcn.1400a99dc
lea rdx, [rsp + 0xfa0]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
mov r8d, 0x804a
mov edx, 0xfffffffd
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov dword [rsp + 0xf80], eax
cmp dword [rsp + 0xf80], 0xffffffff
jne 0x1401b9ba0
lea rdx, [rsp + 0xfa0]
lea rcx, [rsp + 0xf88]
call fcn.1400020d0
jmp 0x1401b9bfa
mov edx, 0x69
lea rcx, [rsp + 0x1478]
call fcn.1400f02a0
mov qword [rsp + 0x1580], rax
mov rax, qword [rsp + 0x1580]
mov qword [rsp + 0x1588], rax
mov rdx, qword [rsp + 0x1588]
lea rcx, [rsp + 0xf88]
call fcn.140002db0
nop
lea rcx, [rsp + 0x1478]
call fcn.140001490
mov dword [rsp + 0xf80], 0xffffffff
lea rcx, [rsp + 0x1480]
call fcn.140001000
mov qword [rsp + 0x1590], rax
mov rax, qword [rsp + 0x1590]
mov qword [rsp + 0x1598], rax
lea r8, [0x14024a750]
mov rdx, qword [rsp + 0x1598]
lea rcx, [rsp + 0x1488]
call fcn.1400010b0
mov qword [rsp + 0x15a0], rax
mov rcx, qword [rsp + 0x15a0]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, str.RegCode
lea rcx, [0x14024a778]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rcx, [rsp + 0x1488]
call fcn.140001490
nop
lea rcx, [rsp + 0x1480]
call fcn.140001490
cmp dword [rsp + 0xf80], 0xffffffff
jne 0x1401b9d5c
lea rdx, str.License_is_locked__please_go_to_http:__cp.youngzsoft.com__to_active_it.
lea rcx, [rsp + 0xf88]
call fcn.140006100
test eax, eax
jne 0x1401b9d35
xor r8d, r8d
mov edx, reloc.WSOCK32.dll_gethostbyname
lea rcx, str.License_is_locked__Do_you_want_to_go_to_http:__cp.youngzsoft.com__to_active_it_
call fcn.1400ef950
cmp eax, 7
jne 0x1401b9ccd
jmp 0x1401b9d5c
lea rcx, [rsp + 0x11b0]
call fcn.140002de0
nop
mov r8, qword [rsp + 0xf90]
lea rdx, str.http:__user.youngzsoft.com_active.php_regsoftwareccbootregsn_s
lea rcx, [rsp + 0x11b0]
call fcn.140002c70
lea rcx, [rsp + 0x11b0]
call fcn.14000f8f0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140001490
jmp 0x1401b9d5c
lea rcx, [rsp + 0xf88]
call fcn.14000f8f0
xor r8d, r8d
mov edx, gethostbyname
mov rcx, rax
call fcn.1400ef950
xor eax, eax
test eax, eax
jne 0x1401b9c93
lea rcx, [rsp + 0xf88]
call fcn.140001490
nop
lea rcx, [rsp + 0xf90]
call fcn.140001490
mov r9, qword [rsp + 0x15e8]
mov r8, qword [rsp + 0x15e0]
mov edx, dword [rsp + 0x15d8]
mov rcx, qword [rsp + 0x15d0]
call fcn.1400f2cd0
mov rcx, qword [rsp + 0x15a8]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x15b8
pop rdi
pop rsi
ret