Function at 0x14000abf8
Capabilities:
Capture screenshot
Check for foreground window switch
Check for unmoving mouse cursor
Create a process with modified i/o handles and window
Delete file
Delete registry key
Delete registry value
Enumerate gui resources
Get common file path
Get file size
Link many functions at runtime
Open clipboard
Print debug messages
Query or enumerate registry key
Read clipboard data
Set registry value
Shutdown system
Write and execute a file
Write clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
test r8d, r8d
mov r12d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x14000ac26
and dword [rcx + 0x40328], r8d
and dword [rsp + 0x60], 0
xor edi, edi
mov qword [rcx + 0x40318], rdx
and dword [rsp + 0x68], edi
xor edx, edx
mov r8d, 0x40000
lea r13d, [rdi + 1]
xor esi, esi
xor r15d, r15d
call sub.msvcrt.dll_memset
lea r14, [rbx + 0x40000]
xor edx, edx
mov rcx, r14
mov r8d, pe_nt_image_headers64
call sub.msvcrt.dll_memset
xor r10d, r10d
cmp byte [rbp], r10b
mov r11, r10
mov rdx, r10
je 0x14000ad18
mov r12d, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x60]
mov r8, r10
mov al, byte [rbp]
cmp al, 0x20
jne 0x14000acc3
cmp r15d, r10d
jne 0x14000acc3
cmp r13d, r10d
jne 0x14000ad01
cmp r11, 0x3f
lea rax, [r8 + rdx]
mov r13d, 1
mov byte [rax + rbx], r10b
jge 0x14000acbb
add edi, r13d
add r11, r13
add r14, 4
add r8, 0x1000
mov esi, r10d
mov rdx, r10
jmp 0x14000ad01
cmp al, 0x22
jne 0x14000acd0
xor r15d, 1
mov r9d, r12d
jmp 0x14000acfe
cmp rdx, r10
jne 0x14000ace4
cmp al, 0x20
je 0x14000acfe
cmp r15d, r10d
mov dword [r14], r12d
je 0x14000ace4
mov dword [r14], r9d
cmp rdx, 0xfff
mov al, byte [rbp]
lea rcx, [r8 + rdx]
mov byte [rcx + rbx], al
jge 0x14000acfe
add esi, 1
add rdx, 1
mov r13d, r10d
add rbp, 1
add r12d, 1
cmp byte [rbp], r10b
jne 0x14000ac85
mov r12d, dword [rsp + 0x70]
movsxd rax, edi
movsxd rcx, esi
shl rax, 0xc
add rax, rbx
cmp edi, r10d
mov byte [rcx + rax], r10b
jne 0x14000ad3c
cmp esi, r10d
jne 0x14000ad3c
mov dword [rbx + 0x40100], r10d
jmp 0x14000ad45
lea eax, [rdi + 1]
mov dword [rbx + 0x40100], eax
movsxd rcx, dword [rbx + 0x40100]
cmp ecx, r10d
jle 0x14000ad6b
mov rax, rcx
shl rax, 0xc
cmp byte [rax + rbx - 0x1000], r10b
jne 0x14000ad6b
lea eax, [rcx - 1]
mov dword [rbx + 0x40100], eax
mov edx, r12d
mov rcx, rbx
call fcn.140006b34
and dword [rbx + 0x40110], 0
mov edx, r12d
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp 0x14000ad9c
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x17338
call fcn.140015af0
sub rsp, rax
movsxd r12, edx
mov rsi, rcx
cmp r12d, dword [rcx + 0x40100]
mov r14, r12
mov qword [rsp + 0x108], r12
jge 0x14000c12c
xor ebp, ebp
lea rdi, [0x1400173e0]
lea r13d, [rbp + 1]
lea r15d, [rbp + 2]
movsxd rbx, r12d
lea rdx, str.showerror
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000ae0d
mov dword [rsi + 0x40110], r13d
lea rdx, str.paramsfile
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x140011896
lea rdx, str.cmdwait
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000ae6a
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jge 0x14000ae6a
add r12d, 1
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
add r14, r13
mov qword [rsp + 0x108], r14
movsxd rbx, r12d
lea rdx, str.loop
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000ae98
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c142
lea rdx, str.remote
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000aebc
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c1b2
lea rdx, str.multiremote
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000aee0
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c1fc
lea rdx, str.qboxcom
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000af4f
lea r13d, [r12 + 2]
cmp r13d, dword [rsi + 0x40100]
jge 0x14000af4f
mov r9d, 0x24
mov rcx, qword [rsi + 0x40108]
lea eax, [r12 + 1]
movsxd r8, r13d
movsxd rdx, eax
shl r8, 0xc
shl rdx, 0xc
add r8, rsi
add rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x14000af45
add r14, r15
cmp r13d, dword [rsi + 0x40100]
mov r12d, r13d
jl 0x14000c10b
mov eax, 1
jmp 0x14000c12e
lea rdx, str.qboxcomtop
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000af78
lea r13d, [r12 + 2]
cmp r13d, dword [rsi + 0x40100]
jge 0x14000af78
mov r9d, 0x1024
jmp 0x14000af07
lea rdx, str.infobox
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000af9c
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c2bf
lea rdx, str.qbox
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000afc0
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c304
lea rdx, str.qboxtop
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000afe4
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c395
lea rdx, str.exec2
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b008
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c3a0
lea rdx, str.exec
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b02c
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c4d4
lea rdx, str.execmd
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b050
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c572
lea rdx, str.regsetval
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b193
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jge 0x14000b193
lea eax, [r12 + 2]
lea r8, [rsp + 0x17390]
lea rdx, [rsp + 0x17398]
movsxd rcx, eax
mov dword [rsp + 0x17390], ebp
shl rcx, 0xc
add rcx, rsi
call fcn.140012b10
cmp rax, rbp
mov qword [rsp + 0x180], rax
je 0x14000c989
mov r14d, dword [rsp + 0x17390]
cmp r14d, ebp
je 0x14000b0ec
mov rcx, qword [rsp + 0x17398]
mov r9d, r14d
lea rax, [rsp + 0x17398]
or r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [r12 + 1]
lea rdx, [0x140018824]
cdqe
shl rax, 0xc
add rax, rsi
mov rcx, rax
mov qword [rsp + 0x100], rax
call sub.msvcrt.dll__strcmpi
mov rcx, qword [rsp + 0x100]
lea rdx, str.EXPAND_SZ
cmp eax, ebp
mov eax, 1
mov r13d, ebp
cmove r13d, eax
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
cmove r13d, r15d
cmp r13d, ebp
jne 0x14000c8c7
mov r13, qword [rsp + 0x100]
lea rdx, str.DWORD
mov rcx, r13
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x14000c813
lea rdx, str.BINARY
mov rcx, r13
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x14000c636
cmp r14d, ebp
je 0x14000b18b
mov rcx, qword [rsp + 0x17398]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x108]
lea rdx, str.regdelval
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b1b7
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000c99d
lea rdx, str.regdelkey
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b1db
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ca95
lea rdx, str.regedit
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b1ff
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cbe0
lea rdx, str.inisetval
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b223
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cc28
lea rdx, str.inidelval
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b247
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cc6f
lea rdx, str.inidelsec
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b26b
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cca1
lea rdx, str.rasdialdlg
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b28f
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ccc6
lea rdx, str.inetdial
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b2b3
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cd98
lea rdx, str.rasdial
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b2d7
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ce23
lea rdx, str.moverecyclebin
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b2fb
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000cfe2
lea rdx, str.emptybin
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x140011843
lea rdx, str.rashangup
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x140011723
lea rdx, str.exitwin
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b34d
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d036
lea rdx, str.abortshutdown
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b36f
call fcn.140002848
cmp dword [rax + 0x10], r15d
je 0x14000d122
lea rdx, str.initshutdown
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b391
call fcn.140002848
cmp dword [rax + 0x10], r15d
je 0x14000d171
lea rdx, str.cmdshortcut
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b3b5
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d251
lea rdx, str.cmdshortcutkey
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b3d9
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d268
lea rdx, str.shortcut
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b3fd
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d27f
lea rdx, str.shexec
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b421
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d297
lea rdx, str.clonefiletime
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b445
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d2f6
lea rdx, str.setfiletime
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b469
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d432
lea rdx, str.setfilefoldertime
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b48d
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d462
lea rdx, str.setconsolemode
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b4b1
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d497
lea rdx, str.consolewrite
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b4d5
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d4f5
lea rdx, str.setconsolecolor
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b4f9
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d50e
lea rdx, str.debugwrite
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b51d
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d55d
lea rdx, str.setcursor
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b541
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d577
lea rdx, str.setcursorwin
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b565
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d5b0
lea rdx, str.restartexplorer
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x140011719
lea rdx, str.sendkeypress
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b5a0
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d625
lea rdx, str.sendkey
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b5c4
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d7d6
lea rdx, str.sendmouse
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b5e8
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000d89c
lea rdx, str.movecursor
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b60c
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000daa2
lea rdx, str.changebrightness
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b630
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000dafb
lea rdx, str.setbrightness
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b654
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000dc66
lea rdx, str.setprimarydisplay
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b678
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000dd4c
lea rdx, str.setdisplay
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000b69c
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ddf7
lea r8, str.closeprocess
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b6c3
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e038
lea r8, str.killprocess
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b6ea
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e0bc
lea r8, str.memdump
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b711
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e12c
lea r8, str.service
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b738
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e13c
lea r8, [0x140018d9c]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b75f
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e30f
lea r8, str.lockws
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400116e3
lea r8, [0x140018170]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b7a0
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000e40a
lea r8, str.setdialuplogon
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b7c7
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ea4b
lea r8, str.script
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b7ee
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ead0
lea r8, str.mediaplay
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b815
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000eb24
lea r8, str.urlshortcut
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b83c
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ec83
lea r8, str.monitor
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b863
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000edae
lea r8, str.screensaver
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400116c1
lea r8, str.screensavertimeout
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b8a4
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000eebf
lea r8, str.runassystem
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b8cb
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000eeed
lea r8, str.runinteractive
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b8f2
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000efab
lea r8, str.runinteractivecmd
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b919
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000efca
lea r8, str.elevate
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b940
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f055
lea r8, str.elevatecmd
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b967
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f0d9
lea r8, str.runas
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000b98e
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f14d
lea r8, str.standby
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
mov rcx, rsi
cmp eax, ebp
jne 0x140011691
lea r8, str.hibernate
mov edx, r12d
call fcn.140006cc0
mov rcx, rsi
cmp eax, ebp
jne 0x14001166b
lea r8, str.compname
mov edx, r12d
call fcn.140006cc0
cmp eax, ebp
je 0x14000b9e9
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f2ce
lea r8, str.cdrom
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000baa1
lea ebx, [r12 + 1]
cmp ebx, dword [rsi + 0x40100]
jge 0x14000baa1
xor eax, eax
lea r8, str.open
mov edx, ebx
mov rcx, rsi
mov byte [rsp + 0x150], bpl
mov qword [rsp + 0x151], rax
mov qword [rsp + 0x159], rax
mov qword [rsp + 0x161], rax
mov dword [rsp + 0x169], eax
mov word [rsp + 0x16d], ax
mov byte [rsp + 0x16f], al
call fcn.140006cc0
cmp eax, ebp
je 0x14000ba6a
lea rdx, str.Open
jmp 0x14000ba86
lea r8, str.close
mov edx, ebx
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000ba93
lea rdx, str.Closed
lea rcx, [rsp + 0x150]
call sub.msvcrt.dll_strcpy
cmp byte [rsp + 0x150], bpl
jne 0x14000f2e8
lea r8, str.beep
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bac8
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f481
lea r8, str.wait
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000baef
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f4ba
lea r8, str.suspendprocess
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bb16
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f4d5
lea r8, str.resumeprocess
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bb3d
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f5a2
lea r8, str.setprocesspriority
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bb64
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f64f
lea r8, str.setprocessaffinity
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bb8b
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f71b
lea r8, str.waitprocess
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bbb2
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f7ee
lea r8, str.setvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bbd9
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f8b9
lea r8, str.changevolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bc00
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000f9ea
lea r8, str.setsysvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bc27
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fa3b
lea r8, str.changesysvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bc4e
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fafb
lea r8, str.setsysvolume2
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bc75
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fba1
lea r8, str.changesysvolume2
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bc9c
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fc57
lea r8, str.mutesysvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bcc3
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fd27
lea r8, str.setappvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bcea
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fdcd
lea r8, str.changeappvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bd11
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fe54
lea r8, str.muteappvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bd38
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14000fed1
lea r8, str.mutesubunitvolume
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bd5f
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x14000ff37
lea r8, str.setsubunitvolumedb
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bd86
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x140010042
lea r8, str.setdefaultsounddevice
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bdad
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x140010169
lea r8, str.showsounddevices
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
mov rcx, rsi
cmp eax, ebp
jne 0x140011661
lea r8, str.regsvr
mov edx, r12d
call fcn.140006cc0
cmp eax, ebp
je 0x14000bdee
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x140010227
lea r8, [0x140019278]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000be67
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jge 0x14000be67
lea edx, [r12 + 1]
lea r8, str.install
mov rcx, rsi
mov qword [rsp + 0x150], rbp
mov qword [rsp + 0x158], rbp
mov qword [rsp + 0x160], rbp
mov qword [rsp + 0x168], rbp
call fcn.140006cc0
lea rcx, [rsp + 0x150]
cmp eax, ebp
jne 0x140010385
call fcn.140001a84
lea rcx, [rsp + 0x150]
call fcn.140001aac
lea r8, str.shellrefresh
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x140011649
lea r8, str.convertimages
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bea8
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x1400103ce
lea r8, str.convertimage
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000becf
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x14001057d
lea r8, str.deskrefresh
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400114f1
lea r8, str.sysrefreshfont
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400114c5
lea r8, str.sysrefreshcolor
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400114be
lea r8, str.sysrefresh
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14001141f
lea r8, str.stdbeep
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400113de
lea r8, str.returnval
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bf78
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x140010618
lea r8, [0x140019374]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bf9f
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jl 0x140010631
lea r8, str.speak
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bfc6
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x140010644
lea r8, str.dlgany
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000bfed
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jl 0x14001094c
lea r8, str.shellcopy
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000c014
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jl 0x140010964
lea r8, str.savescreenshot
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14000c040
lea r8, str.savescreenshotfull
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000c051
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x140011141
lea r8, str.savescreenshotwin
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000c078
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x140010a53
lea r8, str.filldelete
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000c09f
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x40100]
jl 0x140010c4a
lea r8, [0x140019434]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14000af45
mov rax, r14
shl rax, 0xc
cmp byte [rax + rsi], 0x3b
je 0x14000af45
lea r8, str.trayballoon
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000c0f1
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jl 0x140010efa
lea r8, str.help
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x1400110b2
mov r13d, 1
add r14, r13
add r12d, r13d
cmp r12d, dword [rsi + 0x40100]
mov qword [rsp + 0x108], r14
jl 0x14000ade9
xor eax, eax
add rsp, 0x17338
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 2]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
cmp ebx, ebp
mov r12d, eax
jbe 0x14000c1aa
lea edi, [rbx - 1]
mov dword [rsi + 0x4011c], ebp
movsxd rdx, dword [rsi + r14*4 + 0x4000c]
xor r8d, r8d
add rdx, qword [rsi + 0x40318]
mov rcx, rsi
call fcn.14000abf8
cmp ebp, edi
je 0x14000c1a3
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, r13d
cmp ebp, ebx
jb 0x14000c176
mov eax, r13d
jmp 0x14000c12e
add r12d, 1
lea rdx, str.copy
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000c1d6
mov ebp, r13d
add r12d, r13d
movsxd rdx, r12d
mov r9d, ebp
mov rcx, rsi
movsxd r8, dword [rsi + rdx*4 + 0x40004]
shl rdx, 0xc
add r8, qword [rsi + 0x40318]
add rdx, rsi
call fcn.14000a130
jmp 0x14000c1aa
add r12d, 1
lea rdx, str.copy
mov ebx, ebp
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000c222
mov ebx, r13d
add r12d, r13d
movsxd r12, r12d
lea rcx, [rsp + 0x110]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x120], ebp
mov qword [rsp + 0x110], rbp
shl rdx, 0xc
mov dword [rsp + 0x118], ebp
mov dword [rsp + 0x124], pe_nt_image_headers64
add rdx, rsi
mov dword [rsp + 0x11c], ebp
call fcn.1400036a8
cmp eax, ebp
je 0x14000c2ad
mov rax, qword [rsi + 0x40318]
cmp qword [rsp + 0x110], rbp
lea r8, [0x14000a408]
cmovne rdi, qword [rsp + 0x110]
mov qword [rsi + 0x40128], rax
movsxd rax, ebx
mov rdx, rsi
mov rcx, rdi
mov qword [rsi + 0x40120], r12
mov qword [rsi + 0x40130], rax
call fcn.14000276c
lea rcx, [rsp + 0x110]
call fcn.140003568
jmp 0x14000c1aa
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
je 0x14000c2da
mov al, byte [rcx]
neg al
sbb rbp, rbp
and rbp, rcx
mov rcx, qword [rsi + 0x40108]
lea eax, [r12 + 1]
mov r9d, 0x40
movsxd rdx, eax
mov r8, rbp
shl rdx, 0xc
add rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000af45
mov r9d, 0x24
mov rcx, qword [rsi + 0x40108]
lea eax, [r12 + 2]
movsxd r8, eax
lea eax, [r12 + 1]
movsxd rdx, eax
shl r8, 0xc
shl rdx, 0xc
add r8, rsi
add rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x14000af45
lea rcx, [rsp + 0xeb1]
xor edx, edx
mov r8d, 0xfff
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
movsxd r11, r12d
movsxd r8, dword [rsi + r11*4 + 0x4000c]
lea rdx, [rsp + 0xeb0]
mov rcx, rsi
add r8, qword [rsi + 0x40318]
call fcn.14000633c
mov edx, 5
lea rcx, [rsp + 0xeb0]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x14000af45
mov r9d, 0x1024
jmp 0x14000c30a
lea eax, [r12 + 1]
lea rdx, str.hide
movsxd rbx, eax
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
lea rdx, [0x140018514]
mov rcx, rbx
neg eax
sbb di, di
and di, 5
call sub.msvcrt.dll__strcmpi
lea rdx, [0x140018518]
cmp eax, ebp
mov r14d, 3
mov rcx, rbx
cmove di, r14w
call sub.msvcrt.dll__strcmpi
lea rcx, [rsp + 0xeb1]
cmp eax, ebp
lea eax, [r14 + 3]
mov r8d, 0xfff
cmove di, ax
xor edx, edx
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
movsxd r11, r12d
lea rdx, [rsp + 0xeb0]
movsxd r8, dword [rsi + r11*4 + 0x4000c]
mov rcx, rsi
add r8, qword [rsi + 0x40318]
call fcn.14000633c
lea r8d, [r14 + 0x5d]
lea rcx, [rsp + 0x68]
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
lea rdx, [rsp + 0xeb0]
lea ebx, [rax + 1]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
lea eax, [r12 + 2]
xor r9d, r9d
xor r8d, r8d
movsxd rcx, eax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x48], rax
shl rcx, 0xc
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
add rcx, rsi
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov word [rsp + 0xa0], di
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, ebx
jmp 0x14000c12e
lea eax, [r12 + 1]
lea rdx, str.hide
movsxd rbx, eax
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
lea rdx, [0x140018514]
mov rcx, rbx
neg eax
sbb edi, edi
and edi, 5
call sub.msvcrt.dll__strcmpi
lea rdx, [0x140018518]
cmp eax, ebp
mov r14d, 3
mov rcx, rbx
cmove edi, r14d
call sub.msvcrt.dll__strcmpi
lea rcx, [rsp + 0xeb1]
cmp eax, ebp
lea eax, [r14 + 3]
mov r8d, 0xfff
cmove edi, eax
xor edx, edx
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
movsxd r11, r12d
lea rdx, [rsp + 0xeb0]
movsxd r8, dword [rsi + r11*4 + 0x40008]
mov rcx, rsi
add r8, qword [rsi + 0x40318]
call fcn.14000633c
mov edx, edi
jmp 0x14000c382
lea rcx, [rsp + 0xeb1]
xor edx, edx
mov r8d, 0xfff
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x22c1]
xor edx, edx
mov r8d, 0x1063
mov byte [rsp + 0x22c0], bpl
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x61]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x60], bpl
call sub.msvcrt.dll_memset
call fcn.140002848
lea rcx, [rsp + 0x60]
cmp dword [rax + 0x10], r15d
lea rdx, str.cmd.exe
je 0x14000c5df
lea rdx, str.command.com
call sub.msvcrt.dll_strcpy
movsxd rax, r12d
lea rdx, [rsp + 0xeb0]
movsxd r8, dword [rsi + rax*4 + 0x40004]
mov rcx, rsi
add r8, qword [rsi + 0x40318]
call fcn.14000633c
lea r9, [rsp + 0xeb0]
lea r8, [rsp + 0x60]
lea rdx, str._s__c__s
lea rcx, [rsp + 0x22c0]
call sub.msvcrt.dll_sprintf
xor edx, edx
lea rcx, [rsp + 0x22c0]
jmp 0x14000c38a
lea eax, [r12 + 4]
movsxd rbx, eax
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_strlen
cmp eax, ebp
je 0x14000c7f7
cdqe
mov rcx, rax
mov qword [rsp + 0x108], rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp qword [rsp + 0x108], rbp
mov r13, rbp
mov qword [rsp + 0x110], rax
jle 0x14000c7ef
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x108]
mov esi, ebp
mov r14d, 1
mov cl, byte [rbx + r13]
cmp cl, 0x20
jne 0x14000c6a6
add r13, r14
jmp 0x14000c6f7
mov al, byte [rbx + r13 + 1]
xor edx, edx
mov byte [rsp + 0x17388], cl
lea rcx, [rsp + 0x17388]
lea r8d, [rdx + 0x10]
mov byte [rsp + 0x1738a], bpl
mov byte [rsp + 0x17389], al
call sub.msvcrt.dll_strtoul
mov rcx, qword [rsp + 0x100]
mov byte [rcx], al
mov rax, qword [rsp + 0x108]
add rcx, r14
add esi, r14d
mov qword [rsp + 0x100], rcx
add r13, r15
cmp r13, rax
jl 0x14000c698
mov r14d, dword [rsp + 0x17390]
mov dword [rsp + 0x17388], esi
cmp esi, ebp
mov rsi, qword [rsp + 0x17380]
je 0x14000c7e7
mov r13, qword [rsp + 0x110]
cmp r13, rbp
je 0x14000c7f7
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x17398]
lea rax, [rsp + 0x17380]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x100]
mov r9, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x14000c7cb
mov ecx, dword [rsp + 0x17388]
lea eax, [r12 + 3]
mov r9d, 3
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x100]
movsxd rdx, eax
shl rdx, 0xc
xor r8d, r8d
mov qword [rsp + 0x20], r13
add rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x100]
mov ebx, ebp
cmp eax, ebp
mov eax, 1
cmove ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jne 0x14000c7d5
xor edx, edx
mov rcx, rsi
call fcn.140006c2c
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r14d, dword [rsp + 0x17390]
jmp 0x14000c7f7
mov rax, qword [rsp + 0x110]
mov rcx, rax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp r14d, ebp
je 0x14000af45
mov rcx, qword [rsp + 0x17398]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000af45
lea eax, [r12 + 4]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x17398]
mov ebx, eax
lea rax, [rsp + 0x17380]
mov r9, rdi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x17390]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x14000c960
mov rcx, qword [rsp + 0x17390]
lea eax, [r12 + 3]
mov r13d, 4
movsxd rdx, eax
lea rax, [rsp + 0x17388]
mov r9d, r13d
shl rdx, 0xc
xor r8d, r8d
mov dword [rsp + 0x28], r13d
add rdx, rsi
mov dword [rsp + 0x17388], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x17390]
jmp 0x14000c948
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x17398]
lea rax, [rsp + 0x17388]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x17380]
mov r9, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x14000c960
mov rcx, qword [rsp + 0x17380]
lea eax, [r12 + 4]
mov r9d, r13d
movsxd r8, eax
lea eax, [r12 + 3]
movsxd rdx, eax
shl r8, 0xc
shl rdx, 0xc
add r8, rsi
add rdx, rsi
call fcn.140012d98
mov rcx, qword [rsp + 0x17380]
cmp eax, ebp
mov ebx, ebp
mov edi, 1
cmove ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jne 0x14000c96f
jmp 0x14000c965
mov edi, 1
xor edx, edx
mov rcx, rsi
call fcn.140006c2c
cmp r14d, ebp
je 0x14000c982
mov rcx, qword [rsp + 0x17398]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14000c12e
lea rdx, str.The_specified_key_is_not_valid__
mov rcx, rsi
call fcn.140006bf8
jmp 0x14000af45
lea eax, [r12 + 1]
lea r8, [rsp + 0x17388]
lea rdx, [rsp + 0x17380]
movsxd rcx, eax
mov dword [rsp + 0x17388], ebp
shl rcx, 0xc
add rcx, rsi
call fcn.140012b10
cmp rax, rbp
mov rbx, rax
je 0x14000c989
mov r13d, dword [rsp + 0x17388]
cmp r13d, ebp
je 0x14000ca08
mov rcx, qword [rsp + 0x17380]
mov r9d, r13d
lea rax, [rsp + 0x17380]
or r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x17380]
lea rax, [rsp + 0x17390]
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x14000ca70
mov rcx, qword [rsp + 0x17390]
lea eax, [r12 + 2]
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x17390]
mov ebx, ebp
cmp eax, ebp
mov edi, 1
cmove ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jne 0x14000ca7f
jmp 0x14000ca75
mov edi, 1
xor edx, edx
mov rcx, rsi
call fcn.140006c2c
cmp r13d, ebp
je 0x14000c982
mov rcx, qword [rsp + 0x17380]
jmp 0x14000c97c
lea eax, [r12 + 1]
lea r8, [rsp + 0x17388]
lea rdx, [rsp + 0x17380]
movsxd rcx, eax
mov dword [rsp + 0x17388], ebp
shl rcx, 0xc
add rcx, rsi
call fcn.140012b10
cmp rax, rbp
mov r13, rax
je 0x14000c989
mov r12d, dword [rsp + 0x17388]
cmp r12d, ebp
je 0x14000cb04
mov rcx, qword [rsp + 0x17380]
mov r9d, r12d
lea rax, [rsp + 0x17380]
or r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x17380]
lea rax, [rsp + 0x17390]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x14000cbab
mov rcx, qword [rsp + 0x17390]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x17388]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x17388], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x17390]
cmp eax, ebp
mov ebx, ebp
cmove ebx, dword [rsp + 0x17388]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jbe 0x14000cbab
lea rdx, str.Cannot_delete_the_key__because_it_contains_one_or_more_subkeys.
mov rcx, rsi
call fcn.140006bf8
jmp 0x14000cbca
mov rcx, qword [rsp + 0x17380]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebp
je 0x14000cbca
xor edx, edx
mov rcx, rsi
call fcn.140006c2c
cmp r12d, ebp
je 0x14000af45
mov rcx, qword [rsp + 0x17380]
jmp 0x14000c808
lea eax, [r12 + 2]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x110], rbp
movsxd r8, eax
lea eax, [r12 + 1]
mov qword [rsp + 0x118], rbp
movsxd rdx, eax
shl r8, 0xc
mov qword [rsp + 0x120], rbp
shl rdx, 0xc
add r8, rsi
add rdx, rsi
call fcn.140013288
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd r9, eax
lea eax, [r12 + 4]
movsxd r8, eax
lea eax, [r12 + 3]
shl r9, 0xc
movsxd rdx, eax
shl r8, 0xc
lea eax, [r12 + 2]
shl rdx, 0xc
movsxd rcx, eax
add r9, rsi
shl rcx, 0xc
add r8, rsi
add rdx, rsi
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd r9, eax
lea eax, [r12 + 3]
movsxd rdx, eax
shl r9, 0xc
lea eax, [r12 + 2]
shl rdx, 0xc
movsxd rcx, eax
add r9, rsi
shl rcx, 0xc
add rdx, rsi
add rcx, rsi
xor r8d, r8d
jmp 0x14000cc64
lea eax, [r12 + 1]
xor r8d, r8d
movsxd r9, eax
lea eax, [r12 + 2]
shl r9, 0xc
movsxd rcx, eax
shl rcx, 0xc
add r9, rsi
add rcx, rsi
xor edx, edx
jmp 0x14000cc64
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
jne 0x14000ccdc
mov rbx, rbp
jmp 0x14000cce6
mov al, byte [rcx]
neg al
sbb rbx, rbx
and rbx, rcx
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
jne 0x14000ccfc
mov rdi, rbp
jmp 0x14000cd06
mov al, byte [rcx]
neg al
sbb rdi, rdi
and rdi, rcx
lea rcx, str.rasdlg.dll
mov r14d, ebp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbp
mov r13, rax
je 0x14000cd89
lea rdx, str.RasDialDlgA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
mov r15, rax
je 0x14000cd77
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
lea edx, [r12 + 1]
lea r9, [rsp + 0x60]
movsxd rdx, edx
mov r8, rbx
mov rcx, rdi
shl rdx, 0xc
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x70], ebp
add rdx, rsi
mov qword [rsp + 0x68], rbp
call r15
mov r14d, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp r14d, ebp
jne 0x14000af45
xor edx, edx
mov rcx, rsi
call fcn.140006c2c
jmp 0x14000af45
mov r13, qword [rsi + 0x40108]
lea rcx, str.wininet.dll
mov r14d, 0xf0000
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbp
mov rdi, rax
je 0x14000ce17
lea rdx, str.InternetDialA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x14000cdfa
lea edx, [r12 + 1]
lea r9, [rsp + 0x17388]
mov r8d, 0x8000
movsxd rdx, edx
mov rcx, r13
mov dword [rsp + 0x20], ebp
shl rdx, 0xc
add rdx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, r14d
je 0x14000ce17
cmp ebx, ebp
je 0x14000af45
mov edx, ebx
jmp 0x14000cd8b
lea rdx, str.The_dialing_function_is_not_available_in_your_system__
jmp 0x14000c990
lea rcx, [rsp + 0x594]
xor edx, edx
mov r8d, 0x424
call sub.msvcrt.dll_memset
lea eax, [r12 + 1]
lea rcx, [rsp + 0x594]
movsxd rdx, eax
mov r14d, 0x41c
mov r8d, pe_nt_image_headers64
shl rdx, 0xc
mov qword [rsp + 0x17380], rbp
mov dword [rsp + 0x590], r14d
add rdx, rsi
call fcn.140002674
lea r11d, [r12 + 2]
movsxd rbx, r11d
shl rbx, 0xc
add rbx, rsi
cmp rbx, rbp
jne 0x14000ce89
mov rdx, rbp
jmp 0x14000ce93
mov al, byte [rbx]
neg al
sbb rdx, rdx
and rdx, rbx
lea r9, [rsp + 0x17388]
lea r8, [rsp + 0x590]
lea rcx, [rsi + 0x40138]
call fcn.140012ab4
cmp eax, ebp
mov edi, eax
jne 0x14000cfc8
movsxd rdi, r12d
lea rax, [rdi + 3]
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x14000ceec
lea eax, [r12 + 3]
lea rcx, [rsp + 0x797]
mov r8d, pe_nt_image_headers64
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140002674
lea rax, [rdi + 4]
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x14000cf1c
lea eax, [r12 + 4]
lea rcx, [rsp + 0x898]
mov r8d, pe_nt_image_headers64
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140002674
lea rax, [rdi + 5]
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x14000cf4c
lea eax, [r12 + 5]
lea rcx, [rsp + 0x999]
mov r8d, 0xf
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140002674
cmp rbx, rbp
mov dword [rsp + 0x590], r14d
jne 0x14000cf5e
mov rdi, rbp
jmp 0x14000cf68
mov al, byte [rbx]
neg al
sbb rdi, rdi
and rdi, rbx
cmp qword [rsi + 0x40138], rbp
jne 0x14000cf7d
lea rcx, [rsi + 0x40138]
call fcn.140012998
mov rax, qword [rsi + 0x40168]
cmp rax, rbp
je 0x14000cfb3
lea rcx, [rsp + 0x17380]
lea r8, [rsp + 0x590]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call rax
mov r13d, eax
jmp 0x14000cfb7
or r13d, 0xffffffff
cmp r13d, ebp
je 0x14000af45
mov edx, r13d
jmp 0x14000cd8b
lea rdx, str.Unable_to_receive_dialup_information_of_the_specified_entry__
mov rcx, rsi
call fcn.140006bf8
mov dword [rsi + 0x40328], edi
jmp 0x14000af45
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
lea eax, [r12 + 1]
mov r14d, 3
movsxd rcx, eax
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x68], r14d
shl rcx, 0xc
mov word [rsp + 0x80], 0x4454
add rcx, rsi
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [rsi + 0x40328], eax
jmp 0x14000af45
lea eax, [r12 + 1]
lea rdx, str.logoff
movsxd rbx, eax
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d084
mov ebx, ebp
lea eax, [r12 + 2]
lea rdx, str.force
movsxd rdi, eax
shl rdi, 0xc
add rdi, rsi
mov rcx, rdi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d0fb
or ebx, 4
jmp 0x14000d111
lea rdx, str.poweroff
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d09e
mov ebx, 8
jmp 0x14000d0d1
lea rdx, str.reboot
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d0b6
mov ebx, r15d
jmp 0x14000d0d1
lea rdx, str.shutdown
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
mov edx, 1
cmp eax, ebp
mov ebx, edx
cmove ebx, edx
call fcn.140002848
cmp dword [rax + 0x10], r15d
jne 0x14000d05a
lea rcx, str.SeShutdownPrivilege
call fcn.1400119f0
cmp eax, ebp
je 0x14000d05a
mov edx, eax
jmp 0x14000cd8b
lea rdx, str.forceifhung
mov rcx, rdi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d111
or ebx, 0x10
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
cmp eax, ebp
jmp 0x14000cd83
lea rcx, str.SeShutdownPrivilege
call fcn.1400119f0
cmp eax, ebp
jne 0x14000d0f4
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbp
mov rdi, rax
je 0x14000cd89
lea rdx, str.AbortSystemShutdownA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, ebp
jmp 0x14000cd83
lea rcx, str.SeShutdownPrivilege
call fcn.1400119f0
mov rcx, rsi
cmp eax, ebp
je 0x14000d18b
mov edx, eax
jmp 0x14000cd8e
lea rdx, str.force
xor r8d, r8d
call fcn.140006ba0
mov r13d, ebp
mov ebx, 1
cmp eax, ebp
lea rdx, str.reboot
mov rcx, rsi
cmovge r13d, ebx
xor r8d, r8d
call fcn.140006ba0
mov r14d, ebp
cmp eax, ebp
lea eax, [r12 + 1]
cmovge r14d, ebx
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
jne 0x14000d1d9
mov rbx, rbp
jmp 0x14000d1e3
mov al, byte [rcx]
neg al
sbb rbx, rbx
and rbx, rcx
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
lea rcx, str.advapi32.dll
mov r12d, ebp
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbp
mov rdi, rax
je 0x14000cd89
lea rdx, str.InitiateSystemShutdownA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x14000d240
mov r9d, r13d
mov r8d, r15d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call rax
mov r12d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp r12d, ebp
jmp 0x14000cd83
mov r8, qword [rsi + 0x40318]
mov edx, r12d
mov rcx, rsi
call fcn.140009c88
jmp 0x14000af45
mov r8, qword [rsi + 0x40318]
mov edx, r12d
mov rcx, rsi
call fcn.140009b04
jmp 0x14000af45
mov ebx, 1
mov edx, r12d
mov rcx, rsi
mov r8d, ebx
call fcn.140009dec
jmp 0x14000c4cd
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
je 0x14000d2b2
mov al, byte [rcx]
neg al
sbb rbp, rbp
and rbp, rcx
mov rcx, qword [rsi + 0x40108]
lea eax, [r12 + 2]
xor r9d, r9d
movsxd r8, eax
mov rdx, rbp
mov dword [rsp + 0x28], 5
shl r8, 0xc
mov qword [rsp + 0x20], rdi
add r8, rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x14000af45
lea rdx, str.Failed_to_execute_this_file__
jmp 0x14000c990
xor eax, eax
xor edx, edx
mov dword [rsp + 0x17398], ebp
mov dword [rsp + 0x1739c], eax
mov dword [rsp + 0x17394], eax
mov dword [rsp + 0x17384], eax
lea eax, [r12 + 1]
mov dword [rsp + 0x17390], ebp
mov dword [rsp + 0x17380], ebp
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002524
cmp rax, rbp
mov rdi, rax
je 0x14000af45
lea r9, [rsp + 0x17380]
lea r8, [rsp + 0x17390]
lea rdx, [rsp + 0x17398]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, ebp
je 0x14000af45
lea eax, [r12 + 2]
lea rcx, [rsp + 0x590]
or rdi, 0xffffffffffffffff
movsxd rdx, eax
mov byte [rsp + 0x598], bpl
mov byte [rsp + 0x960], bpl
shl rdx, 0xc
mov qword [rsp + 0x590], rdi
mov byte [rsp + 0x81c], bpl
add rdx, rsi
call fcn.140003780
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
je 0x14000d416
mov edi, 1
test byte [rsp + 0x6dc], 0x10
jne 0x14000d401
lea r9, [rsp + 0x17380]
lea r8, [rsp + 0x17390]
lea rdx, [rsp + 0x17398]
lea rcx, [rsp + 0x81c]
mov dword [rsp + 0x20], edi
call fcn.140002cd8
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
jne 0x14000d3ce
or rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x590]
cmp rcx, rdi
je 0x14000af45
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000af45
lea eax, [r12 + 1]
lea rcx, [0x1400074d0]
mov r8, rsi
movsxd rdx, eax
mov dword [rsi + 0x40320], ebp
mov dword [rsi + 0x40104], r12d
shl rdx, 0xc
add rdx, rsi
call fcn.140002918
jmp 0x14000af45
lea eax, [r12 + 1]
lea rcx, [0x1400074d0]
mov ebx, 1
movsxd rdx, eax
mov r8, rsi
mov dword [rsi + 0x40104], r12d
shl rdx, 0xc
mov dword [rsi + 0x40320], ebx
add rdx, rsi
call fcn.140002918
jmp 0x14000c4cd
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetConsoleDisplayMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x14000af45
lea r8, [rsp + 0x17388]
mov edx, ebx
mov rcx, rdi
call rax
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_puts
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 2]
movsxd rcx, ecx
mov edi, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov ecx, 0xfffffff5
mov ebx, eax
shl bx, 4
or bx, di
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, bx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14000af45
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 1]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 2]
movsxd rcx, ecx
mov edi, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov dword [rsp + 0x110], ebp
mov ebx, eax
xor eax, eax
mov dword [rsp + 0x114], eax
mov dword [rsp + 0x118], eax
mov dword [rsp + 0x11c], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x114]
mov ecx, dword [rsp + 0x110]
add edx, ebx
add ecx, edi
jmp 0x14000d5a5
add r12d, 1
cmp r12d, dword [rsi + 0x40100]
movsxd rbx, r12d
jge 0x14000d7c8
shl rbx, 0xc
add rbx, rsi
xor edx, edx
lea rcx, [rsp + 0x111]
mov byte [rsp + 0x110], bpl
lea r8d, [rdx + 0x3f]
call sub.msvcrt.dll_memset
xor eax, eax
mov r11d, ebp
mov dword [rsp + 0x17388], ebp
mov rdi, rbp
mov word [rsp + 0x150], bp
lea r15d, [rax + 1]
mov qword [rsp + 0x152], rax
mov qword [rsp + 0x15a], rax
mov qword [rsp + 0x162], rax
mov dword [rsp + 0x16a], eax
mov word [rsp + 0x16e], ax
movsxd rax, r11d
cmp byte [rax + rbx], bpl
je 0x14000d711
mov dword [rsp + 0x38], r11d
lea rax, [0x140018b88]
mov dword [rsp + 0x30], ebp
lea r9, [rsp + 0x17388]
lea rcx, [rsp + 0x110]
mov r8, rbx
mov edx, 0x3f
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.140002f7c
cmp eax, ebp
je 0x14000d711
lea rdx, [rsp + 0x110]
mov rcx, rsi
call fcn.14000836c
cmp ax, bp
mov word [rsp + rdi*2 + 0x150], ax
je 0x14000d701
add rdi, r15
cmp rdi, 0xf
jge 0x14000d711
mov r11d, dword [rsp + 0x17388]
jmp 0x14000d69d
cmp rdi, rbp
mov r15d, 2
mov r13, rbp
lea r14d, [r15 - 1]
jle 0x14000d766
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
movzx eax, word [rsp + r13*2 + 0x150]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov ecx, r14d
mov word [rsp + 0x68], ax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x6c], ebp
call qword [sym.imp.USER32.dll_SendInput]
add r13, r14
cmp r13, rdi
jl 0x14000d723
add rdi, 0xffffffffffffffff
cmp rdi, rbp
jl 0x14000d7af
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
movzx eax, word [rsp + rdi*2 + 0x150]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov ecx, r14d
mov word [rsp + 0x68], ax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x6c], r15d
call qword [sym.imp.USER32.dll_SendInput]
sub rdi, r14
jns 0x14000d76f
add r12d, r14d
add rbx, 0x1000
cmp r12d, dword [rsi + 0x40100]
jl 0x14000d640
jmp 0x14000d7ce
mov r14d, 1
mov eax, r14d
jmp 0x14000c12e
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
lea eax, [r12 + 1]
mov r13d, 1
movsxd rdx, eax
mov rcx, rsi
mov dword [rsp + 0x60], r13d
shl rdx, 0xc
add rdx, rsi
call fcn.14000836c
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x60]
lea r8d, [r13 + 0x27]
mov word [rsp + 0x68], ax
call sub.msvcrt.dll_memcpy
lea eax, [r12 + 2]
lea rdx, str.press
movsxd rbx, eax
mov dword [rsp + 0x94], r15d
mov edi, r13d
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d855
mov edi, r15d
jmp 0x14000d87d
lea rdx, str.down
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x14000d87d
lea rdx, [0x1400183d4]
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
cmove ebp, r13d
movsxd rax, ebp
mov r8d, 0x28
mov ecx, edi
lea rdx, [rax + rax*4]
lea rdx, [rsp + rdx*8 + 0x60]
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000c1aa
xor eax, eax
lea rcx, [rsp + 0x17380]
mov dword [rsp + 0x17380], ebp
mov dword [rsp + 0x17384], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
xor edx, edx
lea r8d, [rdx + 0x48]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
mov eax, dword [rsp + 0x17380]
lea rcx, [rsp + 0x88]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x17384]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x74], 0x8000
mov dword [rsp + 0x6c], eax
call sub.msvcrt.dll_memcpy
lea r11d, [r12 + 1]
movsxd rbx, r11d
lea rdx, str.right
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d93c
mov ebx, 8
or dword [rsp + 0x74], ebx
or dword [rsp + 0x9c], 0x10
jmp 0x14000da08
lea rdx, str.right
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d961
or dword [rsp + 0x74], 0x20
or dword [rsp + 0x9c], 0x40
jmp 0x14000da08
lea rdx, str.left
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d989
or dword [rsp + 0x74], r15d
mov r13d, 4
or dword [rsp + 0x9c], r13d
jmp 0x14000da08
lea rdx, str.wheel
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000d9bc
bts dword [rsp + 0x74], 0xb
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov dword [rsp + 0x70], eax
jmp 0x14000da08
lea rdx, str.move
mov rcx, rbx
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000da08
mov eax, 1
mov dword [rsp + 0x74], eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov dword [rsp + 0x68], eax
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov dword [rsp + 0x6c], eax
mov eax, 1
lea rdx, str.dblclick
mov r13d, ebp
mov edi, eax
mov ebx, eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rsi, rcx
mov rcx, rsi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000da3e
mov ebx, r15d
mov edi, r15d
jmp 0x14000da6e
lea rdx, [0x1400183d4]
mov rcx, rsi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
jne 0x14000da59
mov r12, rbx
mov r13d, r12d
jmp 0x14000da74
lea rdx, str.click
mov rcx, rsi
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
cmove ebx, r15d
mov r12d, 1
cmp edi, ebp
jle 0x14000da9a
movsxd rax, r13d
lea rcx, [rax + rax*4]
lea rsi, [rsp + rcx*8 + 0x60]
mov r8d, 0x28
mov rdx, rsi
mov ecx, ebx
call qword [sym.imp.USER32.dll_SendInput]
sub rdi, r12
jne 0x14000da84
mov eax, r12d
jmp 0x14000c12e
lea rcx, [rsp + 0x17380]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r11d, [r12 + 1]
movsxd rcx, r11d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
add dword [rsp + 0x17380], eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov edx, dword [rsp + 0x17384]
mov ecx, dword [rsp + 0x17380]
add edx, eax
mov dword [rsp + 0x17384], edx
jmp 0x14000d5a5
mov r14d, 3
mov qword [rsp + 0x30], rbp
lea rcx, str..LCD
lea ebx, [r14 - 2]
xor r9d, r9d
mov edx, 0x80000000
mov r8d, ebx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, rbp
mov rdi, rax
je 0x14000c4cd
lea eax, [r12 + 2]
mov r13d, r14d
cmp eax, dword [rsi + 0x40100]
jge 0x14000db59
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov r13d, eax
lea ecx, [r12 + 1]
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov r12d, 0x64
mov esi, eax
mov rax, rbx
test r13d, ebx
je 0x14000dc48
xor eax, eax
mov qword [rsp + 0x38], rbp
xor r9d, r9d
mov word [rsp + 0x17389], ax
lea rax, [rsp + 0x17380]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x17388]
mov edx, 0x230498
mov rcx, rdi
mov dword [rsp + 0x28], r14d
mov byte [rsp + 0x17388], bl
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x17380], ebp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebp
je 0x14000dc43
movzx ecx, byte [rsp + 0x17389]
movzx eax, byte [rsp + 0x1738a]
mov qword [rsp + 0x38], rbp
add ecx, esi
add eax, esi
lea r8, [rsp + 0x17388]
cmp ecx, ebp
mov r9d, r14d
mov edx, 0x23049c
cmovl ecx, ebp
cmp ecx, r12d
cmovg ecx, r12d
cmp eax, ebp
cmovl eax, ebp
mov byte [rsp + 0x17389], cl
mov rcx, rdi
cmp eax, r12d
cmovg eax, r12d
mov byte [rsp + 0x1738a], al
lea rax, [rsp + 0x17380]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, 1
add ebx, eax
cmp ebx, r15d
jbe 0x14000db78
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x14000c4cd
mov r14d, 3
mov qword [rsp + 0x30], rbp
lea rcx, str..LCD
lea r13d, [r14 - 2]
xor r9d, r9d
mov edx, 0x80000000
mov r8d, r13d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, rbp
mov rdi, rax
je 0x14000c1aa
lea ecx, [r12 + 1]
xor eax, eax
mov byte [rsp + 0x17388], r14b
movsxd rbx, ecx
mov word [rsp + 0x17389], ax
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_atoi
mov rcx, rbx
mov byte [rsp + 0x17389], al
call sub.msvcrt.dll_atoi
add r12d, r15d
cmp r12d, dword [rsi + 0x40100]
mov byte [rsp + 0x1738a], al
jge 0x14000dd03
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov byte [rsp + 0x17388], al
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x17380]
lea r8, [rsp + 0x17388]
mov qword [rsp + 0x30], rax
mov r9d, r14d
mov edx, 0x23049c
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x17380], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000c1aa
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x6c], 0x20
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x8c], 0x20
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x90], ebp
mov dword [rsp + 0x88], ebp
call fcn.140004124
lea r11d, [r12 + 1]
lea rcx, [rsp + 0x60]
movsxd rdx, r11d
shl rdx, 0xc
add rdx, rsi
call fcn.140004418
cmp rax, rbp
je 0x14000ddb7
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140004544
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x14000ddc9
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x90], ebp
cmp rcx, rbp
mov dword [rsp + 0x88], ebp
je 0x14000af45
call sub.msvcrt.dll_free
jmp 0x14000af45
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea edi, [r12 + 1]
movsxd r13, edi
lea rdx, str.monitor:
mov r8d, 8
shl r13, 0xc
add r13, rsi
mov rcx, r13
call sub.msvcrt.dll__strnicmp
cmp eax, ebp
jne 0x14000de53
lea rdx, [r13 + 8]
lea r8, [rsp + 0x190]
mov rcx, rsi
call fcn.1400088a0
mov r12d, edi
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
lea r8d, [rax + 0x7c]
mov byte [rsp + 0x60], bpl
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
call sub.msvcrt.dll_memset
lea eax, [r12 + 1]
mov word [rsp + 0x84], 0x9c
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov dword [rsp + 0xcc], eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov dword [rsp + 0xd0], eax
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
add r12d, 4
mov dword [rsp + 0x88], 0x1c0000
cmp r12d, dword [rsi + 0x40100]
mov r14d, 9
mov dword [rsp + 0xc8], eax
jge 0x14000df4a
movsxd rbx, r12d
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, rbp
movsxd rdx, eax
cmp rdx, rbp
jle 0x14000df32
mov al, byte [rcx + rbx]
sub al, 0x30
cmp al, r14b
ja 0x14000df4a
add rcx, 1
cmp rcx, rdx
jl 0x14000df1f
mov rcx, rbx
call sub.msvcrt.dll_atoi
bts dword [rsp + 0x88], 0x16
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xcc], 0x280
jb 0x14000e02c
cmp dword [rsp + 0xd0], 0x1e0
jb 0x14000e02c
mov r13d, 4
cmp dword [rsp + 0xc8], r13d
jb 0x14000e02c
lea rdx, str._updatereg
xor r8d, r8d
mov rcx, rsi
mov ebx, ebp
call fcn.140006ba0
cmp eax, ebp
jl 0x14000dfb4
lea rdx, str._allusers
xor r8d, r8d
mov rcx, rsi
lea ebx, [r13 - 3]
call fcn.140006ba0
cmp eax, ebp
cmovge ebx, r14d
cmp byte [rsp + 0x190], bpl
je 0x14000e007
lea rcx, str.user32.dll
mov r12d, 0xffff
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, rbp
je 0x14000e017
lea rdx, str.ChangeDisplaySettingsExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x14000e017
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x190]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call rax
jmp 0x14000e014
lea rcx, [rsp + 0x60]
mov edx, ebx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
mov r12d, eax
cmp r12d, ebp
je 0x14000af45
lea rdx, str.Failed_to_change_the_display_setting__
jmp 0x14000c990
lea rdx, str.Invalid_display_values__
jmp 0x14000c990
movsxd rax, r12d
mov ebx, 1
add rax, rbx
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000e07b
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ecx, eax
call fcn.140012600
cmp eax, ebp
jne 0x14000c4cd
lea rdx, str.Failed_to_close_the_specified_process__
jmp 0x14000e0af
call fcn.140011d98
cmp eax, ebp
je 0x14000e0a8
lea rcx, [0x1400079fc]
mov rdx, rsi
mov dword [rsi + 0x40118], ebp
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
cmp dword [rsi + 0x40118], ebp
jmp 0x14000e06c
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
jmp 0x14000c4cd
movsxd rax, r12d
mov ebx, 1
add rax, rbx
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000e0ff
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ecx, eax
call fcn.140012664
cmp eax, ebp
jne 0x14000c4cd
lea rdx, str.Failed_to_kill_the_specified_process__
jmp 0x14000e0af
call fcn.140011d98
cmp eax, ebp
je 0x14000e0a8
lea rcx, [0x1400079a8]
mov rdx, rsi
mov dword [rsi + 0x40114], ebp
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
cmp dword [rsi + 0x40114], ebp
jmp 0x14000e0f0
mov edx, r12d
mov rcx, rsi
call fcn.1400080ec
jmp 0x14000af45
call fcn.140013394
cmp eax, ebp
jne 0x14000e151
lea rdx, str.Unable_to_load_the_services_library__
jmp 0x14000c990
add r12d, 1
lea rdx, [0x1400186ec]
mov r8, r15
movsxd rbx, r12d
mov rdi, rbp
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcmp
mov r13d, 1
cmp eax, ebp
jne 0x14000e184
mov rdi, rbx
add r12d, r13d
lea r8, str.stop
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
mov r14d, 3
cmp eax, ebp
je 0x14000e1a5
mov ebx, r13d
jmp 0x14000e216
lea r8, str.pause
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e1c0
mov ebx, r15d
jmp 0x14000e216
lea r8, str.continue
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e1db
mov ebx, r14d
jmp 0x14000e216
lea r8, str.start
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e1f8
mov ebx, 0x101
jmp 0x14000e216
lea r8, str.restart
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
mov ebx, ebp
mov ecx, 0x102
cmp eax, ebp
cmovne ebx, ecx
lea r8, str.auto
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14000e299
lea r8, str.manual
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e247
mov r15d, r14d
jmp 0x14000e299
lea r8, str.disabled
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e265
mov r15d, 4
jmp 0x14000e299
lea r8, str.boot
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e280
mov r15d, ebp
jmp 0x14000e299
lea r8, str.system
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e2c1
mov r15d, r13d
lea eax, [r12 + 1]
mov r8d, r15d
mov rcx, rdi
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140013508
cmp eax, ebp
je 0x14000e2c1
mov edx, eax
mov rcx, rsi
call fcn.140006c2c
cmp ebx, ebp
je 0x14000e2ed
lea eax, [r12 + 1]
mov r8d, ebx
mov rcx, rdi
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.1400135d4
cmp eax, ebp
je 0x14000e2ed
mov edx, eax
mov rcx, rsi
call fcn.140006c2c
mov rcx, qword [0x14001c700]
cmp rcx, rbp
je 0x14000af45
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14001c700], rbp
jmp 0x14000af45
lea r8, str.handle
lea edx, [r12 + 2]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e350
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea r9d, [r12 + 4]
lea edx, [r12 + 1]
mov r8d, eax
mov rcx, rsi
call fcn.140008c98
lea r8, str.active
lea edx, [r12 + 2]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e383
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9d, [r12 + 3]
lea edx, [r12 + 1]
mov r8, rax
mov rcx, rsi
call fcn.140008c98
lea r8, str.foreground
lea edx, [r12 + 2]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e3b6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [r12 + 3]
lea edx, [r12 + 1]
mov r8, rax
mov rcx, rsi
call fcn.140008c98
lea r8, str.desktop
lea edx, [r12 + 2]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e3ee
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea r9d, [r12 + 3]
lea edx, [r12 + 1]
mov r8, rax
mov rcx, rsi
call fcn.140008c98
jmp 0x14000af45
lea rcx, [0x1400096ac]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14000af45
lea r8, str.clear
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e436
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000af45
xor ecx, ecx
jmp 0x14000e46d
lea r8, [0x140018dcc]
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e477
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000af45
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140003358
jmp 0x14000af45
lea r8, str.file
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14000e7bb
lea r8, str.readfile
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
jne 0x14000e7bb
lea r8, str.writefile
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e4cc
xor r8d, r8d
jmp 0x14000e507
lea r8, str.writeufile
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e4e9
xor r8d, r8d
jmp 0x14000e540
lea r8, str.addfile
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e522
mov r8d, 1
lea eax, [r12 + 2]
xor ecx, ecx
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140003250
jmp 0x14000af45
lea r8, str.addufile
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e55b
mov r8d, 1
lea eax, [r12 + 2]
xor ecx, ecx
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.1400030f8
jmp 0x14000af45
lea r8, str.copyimage
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e645
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e636
lea eax, [r12 + 2]
lea r8, [rsp + 0x17380]
lea rcx, [rsp + 0x60]
movsxd rdx, eax
mov qword [rsp + 0x17380], rbp
shl rdx, 0xc
add rdx, rsi
call fcn.140001e78
cmp eax, ebp
jne 0x14000e62a
mov rdx, qword [rsp + 0x17380]
lea rcx, [rsp + 0x60]
call fcn.14000237c
mov rdx, qword [rsp + 0x17380]
lea rcx, [rsp + 0x60]
call fcn.140001f64
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140001e54
lea rcx, [rsp + 0x60]
call fcn.140001ca0
jmp 0x14000af45
lea r8, str.saveimage
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e732
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000af45
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetClipboardData]
cmp rax, rbp
mov rbx, rax
je 0x14000e727
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e71d
lea eax, [r12 + 2]
lea rcx, [rsp + 0x60]
xor r8d, r8d
movsxd r9, eax
mov rdx, rbx
mov qword [rsp + 0x28], rbp
shl r9, 0xc
mov qword [rsp + 0x20], rbp
add r9, rsi
call fcn.14000222c
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140001e54
lea rcx, [rsp + 0x60]
call fcn.140001ca0
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14000af45
lea r8, str.loadclp
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000e770
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea r11d, [r12 + 2]
lea rcx, [rsp + 0x17388]
movsxd rdx, r11d
shl rdx, 0xc
add rdx, rsi
call fcn.140001854
jmp 0x14000e7b0
lea r8, str.saveclp
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000af45
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea r11d, [r12 + 2]
lea rcx, [rsp + 0x17388]
movsxd rdx, r11d
shl rdx, 0xc
add rdx, rsi
call fcn.14000146c
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14000af45
lea eax, [r12 + 2]
xor edx, edx
mov qword [rsp + 0x110], rbp
movsxd rcx, eax
mov dword [rsp + 0x118], ebp
mov dword [rsp + 0x11c], 0x1388
shl rcx, 0xc
add rcx, rsi
call fcn.140002524
or rdi, 0xffffffffffffffff
cmp rax, rdi
mov rbx, rax
je 0x14000af45
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rcx, [rsp + 0x110]
mov edi, eax
lea edx, [rdi + 0xa]
call fcn.1400039cc
mov r12, qword [rsp + 0x110]
xor edx, edx
lea r13, [rdi + r12]
lea r8d, [rdx + 9]
mov rcx, r13
call sub.msvcrt.dll_memset
xor r9d, r9d
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call fcn.140002cb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000ea35
call qword [sym.imp.USER32.dll_EmptyClipboard]
cmp byte [r12], 0xff
jne 0x14000e8bb
mov ebx, 0xfe
cmp byte [r12 + 1], bl
jne 0x14000e8bb
mov rdx, rdi
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbp
mov rbx, rax
je 0x14000ea2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [r12 + 2]
mov r8, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, 0xd
jmp 0x14000ea26
cmp byte [r12 + 1], bpl
jne 0x14000e8f5
cmp byte [r12 + 2], bpl
je 0x14000e8f5
lea eax, [rdi + 2]
mov ecx, 0x2000
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbp
mov rbx, rax
je 0x14000ea2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, r12
jmp 0x14000e89d
cmp byte [r12], 0xef
jne 0x14000e9e7
cmp byte [r12 + 1], 0xbb
jne 0x14000e9e7
cmp byte [r12 + 2], 0xbf
jne 0x14000e9e7
mov r14d, 0xfde9
lea r9d, [rdi - 2]
lea r8, [r12 + 3]
xor edx, edx
mov ecx, r14d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x110]
lea edx, [rax + rax + 0xa]
mov qword [rsp + 0x110], rbp
mov dword [rsp + 0x118], ebp
mov ebx, eax
mov dword [rsp + 0x11c], 0x1388
call fcn.1400039cc
mov r13, qword [rsp + 0x110]
lea r9d, [rdi - 2]
lea r8, [r12 + 3]
xor edx, edx
mov ecx, r14d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r11d, [rbx + rbx]
movsxd rdi, r11d
mov ecx, 0x2000
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbp
mov rbx, rax
je 0x14000e9d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
cmp r13, rbp
je 0x14000ea2f
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14000ea2f
lea edx, [rdi + 1]
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbp
mov rbx, rax
je 0x14000ea2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
mov byte [r13], bpl
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, 1
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
cmp r12, rbp
je 0x14000af45
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14000af45
lea eax, [r12 + 5]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
jne 0x14000ea61
mov r10, rbp
jmp 0x14000ea6b
mov al, byte [rcx]
neg al
sbb r10, r10
and r10, rcx
lea eax, [r12 + 4]
movsxd rdx, eax
lea eax, [r12 + 3]
movsxd rcx, eax
lea eax, [r12 + 2]
shl rdx, 0xc
movsxd r9, eax
shl rcx, 0xc
add rdx, rsi
add rcx, rsi
mov qword [rsp + 0x28], rdx
lea eax, [r12 + 1]
movsxd r8, eax
shl r9, 0xc
mov qword [rsp + 0x20], rcx
shl r8, 0xc
add r9, rsi
mov rdx, r10
add r8, rsi
mov rcx, rsi
call fcn.14000729c
cmp eax, ebp
je 0x14000af45
lea rdx, str.Failed_to_set_the_logon_details_for_this_dialup_item__
jmp 0x14000c990
mov r13d, 0x104
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8, r13
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
lea rcx, [rsp + 0x190]
movsxd rdx, r11d
mov r8d, r13d
shl rdx, 0xc
add rdx, rsi
call fcn.140002674
lea rdx, [rsp + 0x190]
mov rcx, rsi
call fcn.14000a06c
jmp 0x14000af45
mov rax, qword [str.mediaplay]
lea rcx, [rsp + 0x190]
xor edx, edx
mov qword [rcx], rax
movzx eax, word [0x140018ea8]
mov r8d, 0xf6
mov word [rcx + 8], ax
lea rcx, [rsp + 0x19a]
call sub.msvcrt.dll_memset
mov ebx, 0x3ff
lea rcx, [rsp + 0xab1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1ec1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x1ec0], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x591]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x590], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 2]
lea r9, [rsp + 0x190]
movsxd r8, r11d
lea rdx, str.open___s__type_mpegvideo_alias__s
lea rcx, [rsp + 0xab0]
shl r8, 0xc
add r8, rsi
call sub.msvcrt.dll_sprintf
lea r8, [rsp + 0x190]
lea rdx, str.play__s
lea rcx, [rsp + 0x1ec0]
call sub.msvcrt.dll_sprintf
lea r8, [rsp + 0x190]
lea rdx, str.close__s
lea rcx, [rsp + 0x590]
call sub.msvcrt.dll_sprintf
lea rcx, [rsp + 0xab0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINMM.dll_mciSendStringA]
lea rcx, [rsp + 0x1ec0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsi + 0x40328], eax
call qword [sym.imp.WINMM.dll_mciSendStringA]
mov dword [rsi + 0x40328], eax
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
cmp dword [rsi + 0x40328], ebp
jne 0x14000ec68
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x590]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINMM.dll_mciSendStringA]
jmp 0x14000af45
mov r13d, 0x104
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8, r13
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xab1]
mov r8, r13
xor edx, edx
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 2]
lea rcx, str._fav_
movsxd rbx, r11d
mov r8d, 5
shl rbx, 0xc
add rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll__strnicmp
lea rcx, [rsp + 0x190]
cmp eax, ebp
jne 0x14000ed1f
mov edx, 6
call fcn.14001382c
movsxd r11, r12d
shl r11, 0xc
cmp byte [r11 + rsi + 0x2005], 0x5c
jne 0x14000ed2a
lea rdx, [rbx + 5]
lea rcx, [rsp + 0x190]
mov r8d, r13d
call fcn.140002c64
jmp 0x14000ed2a
mov r8d, r13d
mov rdx, rbx
call fcn.140002674
lea eax, [r12 + 3]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xab0]
movsxd r8, eax
shl r8, 0xc
add r8, rsi
call fcn.140003d9c
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or r13d, 0xffffffff
cmp eax, r13d
jne 0x14000ed72
lea rcx, [rsp + 0x190]
call fcn.140002878
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebp
jl 0x14000eda2
lea eax, [r12 + 1]
lea rcx, [rsp + 0xab0]
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140003ca4
cmp eax, ebp
je 0x14000af45
lea rdx, str.Failed_to_create_the_internet_shortcut__
jmp 0x14000c990
call fcn.140002848
or rdi, 0xffffffffffffffff
cmp dword [rax + 0x10], r15d
jne 0x14000edd4
cmp dword [rax + 4], 5
jne 0x14000edcd
cmp dword [rax + 8], 1
jae 0x14000edcf
cmp dword [rax + 4], 5
jbe 0x14000edd4
mov rbx, rdi
jmp 0x14000eddd
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
add r12d, 1
lea r8, [0x140018f40]
mov rcx, rsi
mov edx, r12d
call fcn.140006cc0
cmp eax, ebp
je 0x14000edfc
mov r9, r15
jmp 0x14000ee33
lea r8, [0x140018f44]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000ee17
mov r9, rdi
jmp 0x14000ee33
lea r8, [0x1400182a4]
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000ee49
mov r9d, 1
mov edx, 0x112
mov r8d, 0xf170
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000eeaf
lea r8, str.async_off
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000ee64
mov r9, r15
jmp 0x14000ee9b
lea r8, str.async_on
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000ee7f
mov r9, rdi
jmp 0x14000ee9b
lea r8, str.async_low
mov edx, r12d
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x14000eeaf
mov r9d, 1
mov r8d, 0xf170
mov edx, 0x112
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov r9d, 3
xor r8d, r8d
lea ecx, [r9 + 0xc]
mov edx, eax
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x14000af45
mov r13d, 0x104
lea rcx, [rsp + 0xab1]
xor edx, edx
mov r8, r13
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x191]
mov r8, r13
xor edx, edx
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x190]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_strlen
lea rcx, str.winlogon.exe
mov rbx, rax
call sub.msvcrt.dll_strlen
lea rcx, [rbx + rax + 1]
cmp rcx, r13
jae 0x14000ef7c
lea r8, [rsp + 0xab0]
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0x190]
call fcn.1400028d8
jmp 0x14000ef84
mov byte [rsp + 0xab0], bpl
movsxd rax, r12d
lea rdx, [rsp + 0xab0]
mov rcx, rsi
movsxd r8, dword [rsi + rax*4 + 0x40004]
add r8, qword [rsi + 0x40318]
call fcn.140007d4c
jmp 0x14000af45
movsxd rax, r12d
movsxd rdx, dword [rsi + rax*4 + 0x40004]
add rdx, qword [rsi + 0x40318]
mov rcx, rsi
call fcn.140007a50
jmp 0x14000af45
mov r13d, 0x104
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8, r13
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x190]
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0xeb1]
xor edx, edx
mov r8d, 0xfff
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
movsxd r11, r12d
lea r8, [rsp + 0x190]
movsxd r9, dword [rsi + r11*4 + 0x40004]
lea rdx, str.__s___s
lea rcx, [rsp + 0xeb0]
add r9, qword [rsi + 0x40318]
call sub.msvcrt.dll_sprintf
lea rdx, [rsp + 0xeb0]
jmp 0x14000efbd
xor edx, edx
lea rcx, [rsp + 0x64]
lea r8d, [rdx + 0x6c]
call sub.msvcrt.dll_memset
lea rax, str.RunAs
mov dword [rsp + 0x60], 0x70
mov qword [rsp + 0x70], rax
lea eax, [r12 + 1]
movsxd rcx, eax
lea eax, [r12 + 2]
shl rcx, 0xc
add rcx, rsi
cmp eax, dword [rsi + 0x40100]
mov qword [rsp + 0x78], rcx
jge 0x14000f0b6
movsxd rax, r12d
movsxd rcx, dword [rsi + rax*4 + 0x40008]
add rcx, qword [rsi + 0x40318]
mov qword [rsp + 0x80], rcx
jmp 0x14000f0be
mov qword [rsp + 0x80], rbp
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x90], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x14000af45
mov r13d, 0x104
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8, r13
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x190]
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea rcx, [rsp + 0x64]
lea r8d, [rdx + 0x6c]
call sub.msvcrt.dll_memset
lea rax, str.RunAs
mov dword [rsp + 0x60], 0x70
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x78], rax
movsxd rax, r12d
movsxd rcx, dword [rsi + rax*4 + 0x40004]
jmp 0x14000f0a5
lea rcx, [rsp + 0xab1]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0xff
mov r13, rbp
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
movsxd rdi, r11d
lea rcx, [rsp + 0x190]
mov r8d, 0xff
shl rdi, 0xc
add rdi, rsi
mov rdx, rdi
call fcn.140002674
lea rcx, [rsp + 0x190]
mov edx, 0x40
call sub.msvcrt.dll_strchr
lea rcx, [rsp + 0x190]
mov edx, 0x5c
mov rbx, rax
call sub.msvcrt.dll_strchr
cmp rbx, rbp
jne 0x14000f1f9
cmp rax, rbp
je 0x14000f1f1
mov byte [rax], bpl
lea rdi, [rax + 1]
lea r13, [rsp + 0x190]
jmp 0x14000f1f9
lea r13, [rsp + 0xab0]
lea rcx, [rsp + 0xeb1]
xor edx, edx
mov r8d, 0x1000
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
movsxd r11, r12d
movsxd r8, dword [rsi + r11*4 + 0x4000c]
lea rdx, [rsp + 0xeb0]
mov rcx, rsi
add r8, qword [rsi + 0x40318]
call fcn.14000633c
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov ebx, 1
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
lea eax, [r12 + 2]
movsxd r8, eax
lea rax, [rsp + 0x110]
mov r9d, ebx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
shl r8, 0xc
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0xeb0]
mov dword [rsp + 0x30], ebp
add r8, rsi
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, rdi
mov qword [rsp + 0x110], rbp
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x20], rbp
call fcn.14000516c
mov dword [rsi + 0x40328], eax
jmp 0x14000c4cd
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetComputerNameA]
jmp 0x14000d11b
xor eax, eax
mov byte [rsp + 0x110], bpl
mov qword [rsp + 0x111], rax
mov qword [rsp + 0x119], rax
mov qword [rsp + 0x121], rax
mov dword [rsp + 0x129], eax
mov word [rsp + 0x12d], ax
mov byte [rsp + 0x12f], al
movabs rax, 0x6f696475414443
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea eax, [r12 + 2]
cmp eax, dword [rsi + 0x40100]
jge 0x14000f382
movsxd rax, r12d
lea rdx, [0x140019054]
lea rcx, [rsp + 0x60]
add rax, r15
mov byte [rsp + 0x111], 0x3a
mov byte [rsp + 0x112], bpl
shl rax, 0xc
mov al, byte [rax + rsi]
mov byte [rsp + 0x110], al
call sub.msvcrt.dll_strcpy
mov ebx, 0xfe
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x60]
lea rdx, str.Set__s_Door__s
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_sprintf
cmp byte [rsp + 0x110], bpl
je 0x14000f41d
lea rcx, [rsp + 0xab1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x110]
lea rdx, str.open__s_type_cdaudio_alias__s
lea rcx, [rsp + 0xab0]
call sub.msvcrt.dll_sprintf
lea rcx, [rsp + 0xab0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINMM.dll_mciSendStringA]
lea rcx, [rsp + 0x190]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINMM.dll_mciSendStringA]
cmp byte [rsp + 0x110], bpl
je 0x14000af45
lea rcx, [rsp + 0xab1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x60]
lea rdx, str.close__s
lea rcx, [rsp + 0xab0]
call sub.msvcrt.dll_sprintf
lea rcx, [rsp + 0xab0]
jmp 0x14000ec70
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 1]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov edx, ebx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x14000af45
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov ecx, eax
jmp 0x14000eeb4
movsxd rax, r12d
mov edi, 1
mov ebx, ebp
add rax, rdi
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000f506
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x14000f550
call fcn.140011d98
cmp eax, ebp
je 0x14000f541
lea rcx, [rsi + 0x40200]
xor edx, edx
mov r8d, 0x10c
call sub.msvcrt.dll_memset
lea rcx, [0x140007950]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
mov ebx, dword [rsi + 0x40200]
jmp 0x14000f550
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
cmp ebx, ebp
je 0x14000c982
mov r8d, ebx
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x14000f591
call fcn.1400118e8
mov rdx, qword [rax + 0x30]
cmp rdx, rbp
je 0x14000f583
mov rcx, rbx
call rdx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000c982
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x40328], eax
jmp 0x14000c982
movsxd rax, r12d
mov edi, 1
mov ebx, ebp
add rax, rdi
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000f5d3
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x14000f61d
call fcn.140011d98
cmp eax, ebp
je 0x14000f60e
lea rcx, [rsi + 0x40200]
xor edx, edx
mov r8d, 0x10c
call sub.msvcrt.dll_memset
lea rcx, [0x140007950]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
mov ebx, dword [rsi + 0x40200]
jmp 0x14000f61d
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
cmp ebx, ebp
je 0x14000c982
mov r8d, ebx
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x14000f591
call fcn.1400118e8
mov rdx, qword [rax + 0x38]
jmp 0x14000f579
movsxd rax, r12d
mov r13d, 1
mov ebx, ebp
add rax, r13
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000f681
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x14000f6cb
call fcn.140011d98
cmp eax, ebp
je 0x14000f6bc
lea rcx, [rsi + 0x40200]
xor edx, edx
mov r8d, 0x10c
call sub.msvcrt.dll_memset
lea rcx, [0x140007950]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
mov ebx, dword [rsi + 0x40200]
jmp 0x14000f6cb
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
lea eax, [r12 + 2]
mov rcx, rsi
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.14000789c
cmp ebx, ebp
mov edi, eax
je 0x14000c1aa
mov r8d, ebx
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x14000c1aa
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbx
jmp 0x14000dd41
movsxd rax, r12d
mov r13d, 1
mov ebx, ebp
add rax, r13
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000f74d
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x14000f797
call fcn.140011d98
cmp eax, ebp
je 0x14000f788
lea rcx, [rsi + 0x40200]
xor edx, edx
mov r8d, 0x10c
call sub.msvcrt.dll_memset
lea rcx, [0x140007950]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
mov ebx, dword [rsi + 0x40200]
jmp 0x14000f797
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
mov edi, ebp
add r12d, r15d
jmp 0x14000f7b9
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov ecx, eax
mov eax, r13d
shl eax, cl
or edi, eax
add r12d, r13d
cmp r12d, dword [rsi + 0x40100]
jl 0x14000f79e
mov r8d, ebx
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x14000c1aa
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
jmp 0x14000f713
movsxd rdi, r12d
mov ebx, ebp
lea rax, [rdi + 1]
shl rax, 0xc
cmp byte [rax + rsi], 0x2f
jne 0x14000f81b
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
lea rcx, [rcx + rsi + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x14000f865
call fcn.140011d98
cmp eax, ebp
je 0x14000f856
lea rcx, [rsi + 0x40200]
xor edx, edx
mov r8d, 0x10c
call sub.msvcrt.dll_memset
lea rcx, [0x140007950]
mov rdx, rsi
mov dword [rsi + 0x40104], r12d
call fcn.14001224c
mov ebx, dword [rsi + 0x40200]
jmp 0x14000f865
lea rdx, str.Failed_to_load_the_process_library__
mov rcx, rsi
call fcn.140006bf8
cmp ebx, ebp
je 0x14000af45
mov r8d, ebx
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x14000f89a
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rdx, dword [rsi + rdi*4 + 0x40008]
xor r8d, r8d
mov rcx, rsi
add rdx, qword [rsi + 0x40318]
call fcn.14000abf8
jmp 0x14000af45
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
jb 0x14000f994
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea r11d, [r12 + 1]
movsxd rcx, r11d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 2]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 3]
movsxd rcx, ecx
mov r11d, eax
shl rcx, 0xc
add rcx, rsi
cvtsi2sd xmm0, r11
mulsd xmm0, qword [0x140019c88]
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x17380], xmm0
call fcn.140002a8c
neg ebx
mov r11d, eax
sbb ebx, ebx
cvtsi2sd xmm0, r11
mulsd xmm0, qword [0x140019c88]
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x17384], xmm0
call fcn.140015648
cmp qword [rax], rbp
je 0x14000f982
lea rcx, [rsp + 0x17380]
lea edx, [rbx - 1]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov dword [rsp + 0x20], r15d
mov r9d, ecx
mov r8d, ecx
mov rcx, rax
call fcn.140014b44
call fcn.140015648
mov rcx, rax
call fcn.140015620
jmp 0x14000e7b0
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
movzx edi, ax
lea eax, [r12 + 2]
movsxd rcx, eax
shl edi, 0x10
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
movzx ebx, ax
lea eax, [r12 + 1]
movsxd rcx, eax
or ebx, edi
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov edx, ebx
mov ecx, eax
call qword [sym.imp.WINMM.dll_waveOutSetVolume]
jmp 0x14000af45
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
lea ecx, [r12 + 2]
movsxd rcx, ecx
mov edi, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
lea ecx, [r12 + 1]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov r8d, edi
mov edx, ebx
mov ecx, eax
call fcn.140005c08
jmp 0x14000af45
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
lea eax, [r12 + 2]
jb 0x14000fa6d
lea ebx, [rcx - 5]
mov r8d, ebx
mov edx, ebx
lea r9d, [r12 + 1]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000a838
jmp 0x14000c4cd
cmp eax, dword [rsi + 0x40100]
mov r13d, 4
jge 0x14000fa8d
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140005ae0
mov r13d, eax
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jge 0x14000faab
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
jmp 0x14000fac3
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x94], ebp
mov dword [rsp + 0x98], ebp
call fcn.14001569c
mov ebx, eax
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov dword [rsp + 0x28], ebx
mov ebx, 1
mov r8d, ebx
mov dword [rsp + 0x20], ebp
mov edx, ebx
mov r9d, eax
mov ecx, r13d
call fcn.14000586c
jmp 0x14000c4cd
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
lea eax, [r12 + 2]
jb 0x14000fb1d
lea ebx, [rcx - 5]
mov edx, r15d
mov r8d, ebx
jmp 0x14000fa57
cmp eax, dword [rsi + 0x40100]
mov r13d, 4
jge 0x14000fb3d
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140005ae0
mov r13d, eax
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jge 0x14000fb5b
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
jmp 0x14000fb73
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x94], ebp
mov dword [rsp + 0x98], ebp
call fcn.14001569c
mov ebx, eax
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov dword [rsp + 0x28], ebx
mov ebx, 1
mov r8d, ebx
mov dword [rsp + 0x20], ebp
mov edx, r15d
jmp 0x14000faeb
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
lea eax, [r12 + 3]
jb 0x14000fbc0
mov r8d, r15d
lea ebx, [rcx - 5]
jmp 0x14000fa55
cmp eax, dword [rsi + 0x40100]
mov r13d, 4
jge 0x14000fbe0
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140005ae0
mov r13d, eax
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jge 0x14000fbfe
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
jmp 0x14000fc16
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x94], ebp
mov dword [rsp + 0x98], ebp
call fcn.14001569c
mov edi, eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
lea ecx, [r12 + 1]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov ebx, 1
mov r8d, r15d
jmp 0x14000fae9
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
lea eax, [r12 + 3]
jb 0x14000fc87
lea r9d, [r12 + 1]
mov r8d, r15d
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000a838
jmp 0x14000af45
cmp eax, dword [rsi + 0x40100]
mov r13d, 4
jge 0x14000fca7
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140005ae0
mov r13d, eax
lea eax, [r12 + 4]
cmp eax, dword [rsi + 0x40100]
jge 0x14000fcc5
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
jmp 0x14000fcdd
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x94], ebp
mov dword [rsp + 0x98], ebp
call fcn.14001569c
mov edi, eax
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
lea ecx, [r12 + 1]
movsxd rcx, ecx
mov ebx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov r8d, r15d
mov edx, r15d
mov ecx, r13d
mov r9d, eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.14000586c
jmp 0x14000af45
call fcn.140002848
mov ecx, 6
cmp dword [rax + 4], ecx
lea eax, [r12 + 2]
jb 0x14000fd49
lea ebx, [rcx - 5]
lea edx, [rcx - 3]
mov r8d, ebx
jmp 0x14000fa57
cmp eax, dword [rsi + 0x40100]
mov r13d, 4
jge 0x14000fd69
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140005ae0
mov r13d, eax
lea eax, [r12 + 3]
cmp eax, dword [rsi + 0x40100]
jge 0x14000fd87
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
jmp 0x14000fd9f
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x94], ebp
mov dword [rsp + 0x98], ebp
call fcn.14001569c
mov ebx, eax
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
mov dword [rsp + 0x28], ebx
mov ebx, 1
mov dword [rsp + 0x20], ebp
mov r8d, ebx
lea edx, [rbx + 2]
jmp 0x14000faeb
lea eax, [r12 + 1]
mov r14d, 1
mov r13d, ebp
movsxd rbx, eax
movsxd rax, r12d
add rax, r14
shl rbx, 0xc
shl rax, 0xc
add rbx, rsi
cmp byte [rax + rsi], 0x2f
jne 0x14000fe04
lea rcx, [rbx + 1]
call fcn.140002a8c
mov rbx, rbp
mov r13d, eax
lea ecx, [r12 + 2]
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atof
add r12d, 3
cmp r12d, dword [rsi + 0x40100]
cvtsd2ss xmm1, xmm0
jge 0x14000fe33
movsxd rdi, r12d
shl rdi, 0xc
add rdi, rsi
movss dword [rsp + 0x28], xmm1
mov r9, rbx
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.14000a4f8
jmp 0x14000d7ce
lea eax, [r12 + 1]
mov r14d, ebp
movsxd r13, eax
movsxd rax, r12d
add rax, 1
shl r13, 0xc
shl rax, 0xc
add r13, rsi
cmp byte [rax + rsi], 0x2f
jne 0x14000fe86
lea rcx, [r13 + 1]
call fcn.140002a8c
mov r13, rbp
mov r14d, eax
lea ecx, [r12 + 2]
movsxd rbx, ecx
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_atof
mov r8d, r14d
cvtsd2ss xmm1, xmm0
movss dword [rsp + 0x28], xmm1
mov dword [rsp + 0x20], r15d
lea ecx, [r12 + 3]
mov r9, r13
cmp ecx, dword [rsi + 0x40100]
mov rcx, rsi
cmovl rdi, rbx
mov rdx, rdi
call fcn.14000a4f8
jmp 0x14000af45
lea eax, [r12 + 1]
mov r15d, ebp
movsxd r13, eax
movsxd rax, r12d
add rax, 1
shl r13, 0xc
shl rax, 0xc
add r13, rsi
cmp byte [rax + rsi], 0x2f
jne 0x14000ff03
lea rcx, [r13 + 1]
call fcn.140002a8c
mov r13, rbp
mov r15d, eax
lea ecx, [r12 + 2]
movsxd rbx, ecx
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll_atof
mov r14d, 3
mov r8d, r15d
cvtsd2ss xmm1, xmm0
movss dword [rsp + 0x28], xmm1
mov dword [rsp + 0x20], r14d
jmp 0x14000feaf
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.140013c2c
mov rcx, rax
call fcn.14001433c
mov ebx, 0x1fe
lea rcx, [rsp + 0xab2]
mov r8, rbx
xor edx, edx
mov word [rsp + 0xab0], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x192]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x190], bp
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
lea rax, [rsp + 0xab0]
movsxd r8, r11d
or rdi, 0xffffffffffffffff
xor edx, edx
shl r8, 0xc
xor ecx, ecx
mov r9d, edi
add r8, rsi
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r11d, [r12 + 2]
lea rax, [rsp + 0x190]
movsxd r8, r11d
mov r9d, edi
xor edx, edx
shl r8, 0xc
xor ecx, ecx
mov dword [rsp + 0x28], 0xff
add r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call fcn.140013c2c
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0xab0]
mov rcx, rax
call fcn.1400147b4
cmp rax, rbp
mov rdi, rax
je 0x14000e7b0
lea ecx, [r12 + 3]
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov ebx, eax
call fcn.140015648
mov r8d, ebx
mov rcx, rax
mov rdx, rdi
call fcn.1400154f8
jmp 0x14000e7b0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.140013c2c
mov rcx, rax
call fcn.14001433c
mov ebx, 0x1fe
lea rcx, [rsp + 0xab2]
mov r8, rbx
xor edx, edx
mov word [rsp + 0xab0], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x192]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x190], bp
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
lea rax, [rsp + 0xab0]
movsxd r8, r11d
or rdi, 0xffffffffffffffff
xor edx, edx
shl r8, 0xc
xor ecx, ecx
mov r9d, edi
add r8, rsi
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r11d, [r12 + 2]
lea rax, [rsp + 0x190]
movsxd r8, r11d
mov r9d, edi
xor edx, edx
shl r8, 0xc
xor ecx, ecx
mov dword [rsp + 0x28], 0xff
add r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call fcn.140013c2c
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0xab0]
mov rcx, rax
call fcn.1400147b4
cmp rax, rbp
mov rbx, rax
je 0x14000e7b0
lea ecx, [r12 + 3]
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atof
cvtsd2ss xmm1, xmm0
movss dword [rsp + 0x17388], xmm1
call fcn.140015648
lea r8d, [rdi + 2]
xor r9d, r9d
mov rcx, rax
lea rax, [rsp + 0x17388]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400155a4
jmp 0x14000e7b0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rsp + 0x192]
mov r8d, 0x1fe
xor edx, edx
mov word [rsp + 0x190], bp
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
lea rax, [rsp + 0x190]
movsxd r8, r11d
or r9d, 0xffffffff
xor edx, edx
shl r8, 0xc
xor ecx, ecx
mov dword [rsp + 0x28], 0xff
add r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0xab0]
call fcn.140013b38
add r12d, r15d
cmp r12d, dword [rsi + 0x40100]
jge 0x1400101ea
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov ebp, eax
lea rcx, [rsp + 0xab0]
call fcn.14001455c
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xab0]
mov r8d, ebp
call fcn.14001460c
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0xab0]
call fcn.140013ba8
jmp 0x14000af45
lea edx, [r12 + 1]
lea r8, str.unreg
mov rcx, rsi
call fcn.140006cc0
mov ebx, 1
mov byte [rsp + 0x598], bpl
cmp eax, ebp
mov r14d, ebx
lea eax, [r12 + 3]
cmovne r14d, ebp
or rdi, 0xffffffffffffffff
cmp eax, dword [rsi + 0x40100]
mov byte [rsp + 0x960], bpl
mov byte [rsp + 0x81c], bpl
mov r13, rdi
mov qword [rsp + 0x590], rdi
jge 0x140010291
movsxd rcx, eax
xor edx, edx
shl rcx, 0xc
add rcx, rsi
call fcn.140002554
mov r13, rax
lea ecx, [r12 + 2]
movsxd rdx, ecx
lea rcx, [rsp + 0x590]
shl rdx, 0xc
add rdx, rsi
call fcn.140003780
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
je 0x140010365
mov ebx, 0x3ff
test byte [rsp + 0x6dc], 0x10
jne 0x14001034b
lea rcx, [rsp + 0x191]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x81c]
mov edx, r14d
call fcn.140006064
cmp eax, ebp
jne 0x140010308
lea rdx, str._s:_Succeed_r_n
jmp 0x140010321
cmp eax, edi
jne 0x140010315
lea rdx, str._s:_Failed_to_load_the_library_r_n
jmp 0x140010321
cmp eax, 0xfffffffe
jne 0x140010336
lea rdx, str._s:_Failed_to_load_the_registration_function_r_n
lea r8, [rsp + 0x81c]
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_sprintf
cmp r13, rdi
je 0x14001034b
lea rdx, [rsp + 0x190]
mov rcx, r13
call fcn.140002584
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
jne 0x1400102c7
mov ebx, 1
cmp r13, rdi
je 0x140010373
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x590]
call fcn.14000375c
jmp 0x14000c4cd
lea eax, [r12 + 2]
xor r8d, r8d
movsxd rdx, eax
shl rdx, 0xc
add rdx, rsi
call fcn.140001bf4
cmp eax, ebp
jne 0x1400103af
lea rdx, str.Failed_the_install_the_specified_assembly
mov rcx, rsi
call fcn.140006bf8
lea rcx, [rsp + 0x150]
call fcn.140001a84
lea rcx, [rsp + 0x150]
call fcn.140001aac
jmp 0x14000af45
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e636
lea eax, [r12 + 1]
lea rcx, [rsp + 0x590]
or rdi, 0xffffffffffffffff
movsxd rdx, eax
mov byte [rsp + 0x598], bpl
mov byte [rsp + 0x960], bpl
shl rdx, 0xc
mov qword [rsp + 0x590], rdi
mov byte [rsp + 0x81c], bpl
add rdx, rsi
call fcn.140003780
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
je 0x14001055f
add r12d, r15d
mov r13d, 0x104
test byte [rsp + 0x6dc], 0x10
jne 0x14001054a
lea rcx, [rsp + 0x191]
mov r8, r13
xor edx, edx
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x81c]
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_strcpy
lea rcx, [rsp + 0x190]
mov edx, 0x2e
call sub.msvcrt.dll_strrchr
cmp rax, rbp
je 0x14001054a
mov byte [rax], bpl
lea rax, [r14 + 2]
shl rax, 0xc
cmp byte [rax + rsi], 0x2e
je 0x14001050e
lea rdx, [0x140017788]
lea rcx, [rsp + 0x190]
mov r8d, r13d
call fcn.140002c64
movsxd rdx, r12d
lea rcx, [rsp + 0x190]
mov r8d, r13d
shl rdx, 0xc
add rdx, rsi
call fcn.140002c64
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x81c]
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
call fcn.1400022ac
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
jne 0x140010492
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140001e54
lea rcx, [rsp + 0x590]
call fcn.14000375c
jmp 0x14000e636
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e636
lea eax, [r12 + 2]
lea rcx, [rsp + 0x60]
xor r9d, r9d
movsxd r8, eax
lea eax, [r12 + 1]
mov qword [rsp + 0x20], rbp
movsxd rdx, eax
shl r8, 0xc
shl rdx, 0xc
add r8, rsi
add rdx, rsi
call fcn.1400022ac
jmp 0x14000e62a
lea eax, [r12 + 1]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call fcn.140002e70
jmp 0x14000d02b
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.140008c50
jmp 0x14000af45
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x17380]
lea r9, [0x1400179a8]
lea rcx, [0x140017998]
lea r8d, [rdx + 0x17]
mov qword [rsp + 0x17380], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp qword [rsp + 0x17380], rbp
je 0x14000e7b0
lea rcx, [rsp + 0x3332]
xor edx, edx
mov r8d, 0x3ffe
mov word [rsp + 0x3330], bp
call sub.msvcrt.dll_memset
lea eax, [r12 + 2]
movsxd r8, eax
lea rax, [rsp + 0x3330]
or rdi, 0xffffffffffffffff
shl r8, 0xc
xor edx, edx
xor ecx, ecx
mov r9d, edi
add r8, rsi
mov dword [rsp + 0x28], 0x1fff
mov qword [rsp + 0x17390], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, str.file
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
lea r13d, [rdi + 5]
cmp eax, ebp
je 0x140010704
mov r15d, r13d
jmp 0x140010726
lea r8, [0x140019380]
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.140006cc0
mov r15d, ebp
mov ebx, 8
cmp eax, ebp
cmovne r15d, ebx
lea ecx, [r12 + 3]
mov r14d, 3
cmp ecx, dword [rsi + 0x40100]
jge 0x14001076c
movsxd rax, r12d
add rax, r14
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x14001076c
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov rcx, qword [rsp + 0x17380]
mov r8, qword [rcx]
mov edx, eax
call qword [r8 + 0xe0]
lea ecx, [r12 + 4]
cmp ecx, dword [rsi + 0x40100]
jge 0x1400107ad
movsxd rax, r12d
add rax, r13
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x1400107ad
movsxd rcx, ecx
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov rcx, qword [rsp + 0x17380]
mov r8, qword [rcx]
movzx edx, ax
call qword [r8 + 0xf0]
lea r13d, [r12 + 5]
cmp r13d, dword [rsi + 0x40100]
jge 0x140010907
movsxd rbx, r12d
lea rax, [rbx + 5]
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x140010907
lea rcx, [rsp + 0x192]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x190], bp
call sub.msvcrt.dll_memset
movsxd r8, r13d
shl r8, 0xc
lea rax, [rsp + 0x190]
mov r13d, 0x104
mov r9d, edi
xor edx, edx
xor ecx, ecx
add r8, rsi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea r11, [rsp + 0x17390]
lea r9, [0x1400194a0]
lea rcx, [0x140016e20]
lea r8d, [rdx + 0x17]
mov qword [rsp + 0x20], r11
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp qword [rsp + 0x17390], rbp
je 0x140010907
add r12d, 6
mov qword [rsp + 0x17398], rbp
mov ecx, 0x11
cmp r12d, dword [rsi + 0x40100]
jge 0x14001088e
lea rax, [rbx + 6]
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x14001088e
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call fcn.1400046ac
mov ecx, eax
lea r8, [rsp + 0x17398]
lea rdx, [rsp + 0x110]
call fcn.140004d10
mov rcx, qword [rsp + 0x17390]
mov rbx, qword [rsp + 0x17398]
mov rax, qword [rcx]
movabs rdx, 0xefffffffffffffff
lea r9, [0x140017370]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x190]
mov r8d, r14d
mov qword [rsp + 0x20], rbx
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x17380]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x17390]
mov r8d, 1
call qword [rax + 0x68]
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x17380]
lea rdx, [rsp + 0x3330]
xor r9d, r9d
mov rax, qword [rcx]
mov r8d, r15d
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x17390]
cmp rcx, rbp
je 0x140010939
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x17380]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000e7b0
mov ebx, 1
mov edx, r12d
mov rcx, rsi
mov r8d, ebx
call fcn.140008c50
jmp 0x14000c4cd
xor edx, edx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x60], rbp
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
lea edi, [r12 + 3]
movzx ebx, bp
cmp edi, dword [rsi + 0x40100]
jge 0x140010a0e
mov r13d, 4
lea r15d, [r13 - 3]
lea r8, str.yestoall
mov edx, edi
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x1400109b0
or bx, 0x10
lea r8, str.noerrorui
mov edx, edi
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x1400109ca
or bx, 0x400
lea r8, str.silent
mov edx, edi
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x1400109e3
or bx, r13w
lea r8, str.nosecattr
mov edx, edi
mov rcx, rsi
call fcn.140006cc0
cmp eax, ebp
je 0x1400109fd
or bx, 0x800
add edi, r15d
cmp edi, dword [rsi + 0x40100]
jl 0x140010997
mov r15d, 2
lea eax, [r12 + 1]
mov dword [rsp + 0x68], r15d
mov word [rsp + 0x80], bx
movsxd rcx, eax
lea eax, [r12 + 2]
shl rcx, 0xc
add rcx, rsi
mov qword [rsp + 0x70], rcx
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x14000af45
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e636
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x110], ebp
mov r13, rax
mov qword [rsp + 0x17380], rax
xor eax, eax
mov dword [rsp + 0x114], eax
mov dword [rsp + 0x118], eax
mov dword [rsp + 0x11c], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [rsp + 0x118]
mov ebx, dword [rsp + 0x11c]
sub edi, dword [rsp + 0x110]
sub ebx, dword [rsp + 0x114]
mov eax, 1
add edi, eax
add ebx, eax
mov rcx, r13
mov r8d, ebx
mov edx, edi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r13
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, r14
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [rsp + 0x114]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x110]
mov qword [rsp + 0x17390], rax
mov rax, qword [rsp + 0x17380]
mov dword [rsp + 0x30], ecx
mov r9d, edi
mov qword [rsp + 0x28], rax
mov rcx, r13
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
lea r11d, [r12 + 1]
lea rdx, str.clipboard
movsxd rbx, r11d
shl rbx, 0xc
add rbx, rsi
mov rcx, rbx
call sub.msvcrt.dll__stricmp
cmp eax, ebp
jne 0x140010bfd
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000e62a
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rsp + 0x17390]
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x140010c3d
lea rcx, [rsp + 0x60]
mov r9, rbx
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.14000222c
mov rdx, qword [rsp + 0x17390]
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rsp + 0x17380]
jmp 0x1400113d1
lea eax, [r12 + 1]
lea rcx, [rsp + 0x590]
or rdi, 0xffffffffffffffff
movsxd rdx, eax
mov rbx, rbp
mov byte [rsp + 0x598], bpl
shl rdx, 0xc
mov qword [rsp + 0x590], rdi
mov byte [rsp + 0x960], bpl
add rdx, rsi
mov byte [rsp + 0x81c], bpl
mov dword [rsp + 0x80], 0x400
mov dword [rsp + 0x84], pe_nt_image_headers64
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x64], ebp
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov r15d, ebp
mov dword [rsp + 0x88], ebp
mov dword [rsp + 0x68], ebp
call fcn.140003780
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
je 0x140010d11
test byte [rsp + 0x6dc], 0x10
jne 0x140010cf3
lea rdx, [rsp + 0x81c]
lea rcx, [rsp + 0x60]
mov r8d, edi
call fcn.14000342c
lea rcx, [rsp + 0x590]
call fcn.1400037fc
cmp eax, ebp
jne 0x140010cd4
mov r15d, dword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
cmp r15d, ebp
mov eax, ebp
mov rcx, rbp
mov dword [rsp + 0x17390], eax
mov qword [rsp + 0x100], rcx
jle 0x140010ede
mov r14d, 3
or r13d, 0xffffffff
mov r12d, 0xffff
cmp rcx, rbp
jl 0x140010d52
cmp eax, r15d
jge 0x140010d52
mov eax, dword [rbx + rcx*4]
add rax, qword [rsp + 0x78]
jmp 0x140010d55
mov rax, rbp
cmp rax, rbp
lea r15, [0x1400173e0]
cmovne r15, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, r13d
je 0x140010d7f
and eax, 0xfffffff8
mov rcx, r15
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov r8d, r14d
mov edx, 0xc0000000
mov rcx, r15
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, rdi
mov qword [rsp + 0x110], rax
je 0x140010ea0
lea rdx, [rsp + 0x17388]
mov rcx, rax
mov dword [rsp + 0x17388], ebp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rcx, [rsp + 0x7331]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x7330], bpl
mov ebx, eax
call sub.msvcrt.dll_memset
mov eax, dword [rsp + 0x17388]
shr rbx, 0x10
shl rax, 0x10
or rbx, rax
add rbx, 1
je 0x140010e7b
mov eax, dword [rsp + 0x17390]
mov rcx, qword [rsp + 0x100]
mov r15d, dword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov edx, 1
add eax, edx
add rcx, rdx
cmp eax, r15d
mov dword [rsp + 0x17390], eax
mov qword [rsp + 0x100], rcx
jl 0x140010d3e
lea rcx, [rsp + 0x60]
call fcn.1400033f0
lea rcx, [rsp + 0x590]
call fcn.14000375c
jmp 0x14000af45
mov rcx, rsi
call fcn.140006254
mov ebx, 0x3ff
lea rcx, [rsp + 0x191]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x17380], rbp
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 3]
movsxd rdx, r11d
lea rcx, [rsp + 0x190]
mov r8d, ebx
shl rdx, 0xc
add rdx, rsi
call fcn.140002674
lea rcx, [rsp + 0x190]
mov edx, 0x2c
call sub.msvcrt.dll_strrchr
mov edx, ebp
cmp rax, rbp
je 0x140010f6f
lea rcx, [rax + 1]
mov byte [rax], bpl
call sub.msvcrt.dll_atoi
mov edx, eax
lea r9, [rsp + 0x17380]
lea rcx, [rsp + 0x190]
mov edi, 1
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.SHELL32.dll_ExtractIconExA]
mov rax, qword [rsi + 0x40310]
mov rdx, qword [rsp + 0x17380]
lea r13, [0x140019b28]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x74], 0x41e
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x80], rbp
call fcn.14001395c
lea r11d, [r12 + 4]
movsxd rcx, r11d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
lea ecx, [r12 + 1]
movsxd r8, ecx
lea ecx, [r12 + 2]
mov r9d, eax
movsxd rdx, ecx
mov rcx, qword [rsp + 0x17380]
shl r8, 0xc
mov qword [rsp + 0x28], rcx
shl rdx, 0xc
lea rcx, [rsp + 0x60]
add r8, rsi
add rdx, rsi
mov ebx, eax
mov dword [rsp + 0x20], ebp
call fcn.140013a8c
mov rcx, qword [rsi + 0x40310]
xor r9d, r9d
mov r8d, ebx
xor edx, edx
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x140011058
lea rcx, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
cmp eax, ebp
jne 0x14001103c
lea rcx, [rsp + 0x191]
mov r8d, 0x3ff
xor edx, edx
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
add r12d, 1
cmp r12d, dword [rsi + 0x40100]
lea rcx, [rsp + 0x190]
jge 0x1400110fc
movsxd r8, r12d
lea rdx, [0x140019448]
shl r8, 0xc
add r8, rsi
call sub.msvcrt.dll_sprintf
jmp 0x140011108
lea rdx, [0x140019470]
call sub.msvcrt.dll_strcpy
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll__strlwr
lea r8, [rsp + 0x190]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x14000af45
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call fcn.140001e08
cmp eax, ebp
jne 0x14000e636
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 8
mov dword [rsp + 0x17380], ebp
mov rcx, rax
mov rdi, rax
mov dword [rsp + 0x17388], ebp
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea r8, str.savescreenshotfull
mov edx, r12d
mov rcx, rsi
mov ebx, eax
mov dword [rsp + 0x17390], eax
call fcn.140006cc0
cmp eax, ebp
je 0x140011244
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov dword [rsp + 0x17380], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4e
mov dword [rsp + 0x17388], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov r14d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov dword [rsp + 0x17390], eax
lea r13d, [r12 + 5]
cmp r13d, dword [rsi + 0x40100]
jge 0x1400112b7
lea eax, [r12 + 2]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov dword [rsp + 0x17380], eax
lea eax, [r12 + 3]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
mov dword [rsp + 0x17388], eax
lea eax, [r12 + 4]
movsxd rcx, eax
shl rcx, 0xc
add rcx, rsi
call sub.msvcrt.dll_atoi
movsxd rcx, r13d
shl rcx, 0xc
mov r14d, eax
add rcx, rsi
call sub.msvcrt.dll_atoi
mov ebx, eax
mov dword [rsp + 0x17390], eax
mov r8d, ebx
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rdi
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, r13
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r14d
mov qword [rsp + 0x17398], rax
mov eax, dword [rsp + 0x17388]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x17380]
xor edx, edx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x17390]
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
lea r11d, [r12 + 1]
lea rdx, str.clipboard
movsxd rcx, r11d
shl rcx, 0xc
add rsi, rcx
mov rcx, rsi
call sub.msvcrt.dll__stricmp
cmp eax, ebp
jne 0x14001138e
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebp
je 0x14000e62a
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r13
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rsp + 0x17398]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x1400113ce
lea rcx, [rsp + 0x60]
mov r9, rsi
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.14000222c
mov rdx, qword [rsp + 0x17398]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x14000e62a
or rdi, 0xffffffffffffffff
call fcn.140002848
lea ebx, [rdi + 2]
cmp dword [rax + 0x10], ebx
cmove edi, ebx
add r12d, ebx
cmp r12d, dword [rsi + 0x40100]
jge 0x140011412
movsxd rcx, r12d
shl rcx, 0xc
add rcx, rsi
call fcn.140002a8c
cmp eax, ebp
cmove eax, edi
mov edi, eax
mov ecx, edi
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14000c4cd
movsxd rax, r12d
mov ebx, 1
add rax, rbx
shl rax, 0xc
cmp byte [rax + rsi], bpl
je 0x140011493
lea rcx, [rsp + 0xeb1]
xor edx, edx
mov r8d, 0x1000
mov byte [rsp + 0xeb0], bpl
call sub.msvcrt.dll_memset
lea r11d, [r12 + 1]
movsxd rdx, r11d
lea rcx, [rsp + 0xeb0]
shl rdx, 0xc
add rdx, rsi
call sub.msvcrt.dll_strcpy
mov r11b, byte [rsp + 0xeb0]
lea eax, [r11 - 0x61]
cmp al, 0x19
ja 0x140011489
add r11b, 0xe0
mov byte [rsp + 0xeb0], r11b
lea r9, [rsp + 0xeb0]
jmp 0x140011496
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov ecx, 0xffff
lea edx, [r8 + 0x1a]
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x14000c4cd
mov edx, 0x15
jmp 0x1400114ca
mov edx, 0x1d
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xffff
mov dword [rsp + 0x28], 0x1388
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x14000af45
mov rax, qword [str.Shell_Icon_BPP]
lea rcx, [rsp + 0x110]
lea rdx, str.Control_PanelDesktopWindowMetrics
mov qword [rcx], rax
mov eax, dword [0x140019300]
mov r9d, 0x2001f
mov dword [rcx + 8], eax
movzx eax, word [0x140019304]
xor r8d, r8d
mov word [rcx + 0xc], ax
mov al, byte [0x140019306]
mov byte [rcx + 0xe], al
lea rax, [rsp + 0x17380]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x14000af45
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x190], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xab1]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0xab0], bpl
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x17380]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x110]
mov r9d, 0xff
call fcn.140012d6c
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_atoi
cmp eax, ebp
jle 0x14000cbd3
lea ecx, [rax + 1]
lea rdx, [rsp + 0xab0]
mov r8d, 0xa
call sub.msvcrt.dll__itoa
mov rcx, qword [rsp + 0x17380]
mov ebx, 1
lea r8, [rsp + 0xab0]
lea rdx, [rsp + 0x110]
mov r9d, ebx
call fcn.140012d98
mov qword [rsp + 0x30], rbp
lea edx, [rbx + 0x19]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xffff
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov rcx, qword [rsp + 0x17380]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x110]
mov r9d, ebx
call fcn.140012d98
jmp 0x14000cbd3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x14000af45
call fcn.14000a700
jmp 0x14000af45
lea edx, [r12 + 1]
lea r8, str.force
call fcn.140006cc0
lea rcx, str.SeShutdownPrivilege
call fcn.1400119f0
mov ebx, 1
xor ecx, ecx
jmp 0x1400116b5
lea edx, [r12 + 1]
lea r8, str.force
call fcn.140006cc0
lea rcx, str.SeShutdownPrivilege
call fcn.1400119f0
mov ebx, 1
mov ecx, ebx
mov edx, ebx
call fcn.140011b34
jmp 0x14000c4cd
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r9d, r9d
mov edx, 0x112
mov rcx, rax
mov r8d, 0xf140
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000af45
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, rbp
je 0x14000af45
lea rdx, str.LockWorkStation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x14000af45
call rax
jmp 0x14000af45
call fcn.140005474
jmp 0x14000af45
lea r14d, [r12 + 1]
cmp r14d, dword [rsi + 0x40100]
jge 0x140011836
mov ecx, 0x2b80
mov r12, rbp
mov dword [rsp + 0x17388], ebp
mov dword [rsp + 0x17380], ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r9, [rsp + 0x17388]
lea r8, [rsp + 0x17380]
lea rcx, [rsi + 0x40138]
mov rdx, rax
mov rdi, rax
mov dword [rax], 0x2b8
call fcn.140012a58
cmp eax, ebp
jne 0x1400117c7
cmp dword [rsp + 0x17388], ebp
mov ebx, ebp
jbe 0x1400117c7
movsxd r14, r14d
shl r14, 0xc
add r14, rsi
mov eax, ebx
mov rdx, r14
imul rax, rax, 0x2b8
lea rcx, [rax + rdi + 0xc]
call sub.msvcrt.dll__strcmpi
cmp eax, ebp
je 0x1400117b9
add ebx, 1
cmp ebx, dword [rsp + 0x17388]
jb 0x140011791
jmp 0x1400117c7
mov eax, ebx
imul rax, rax, 0x2b8
mov r12, qword [rax + rdi + 4]
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp r12, rbp
je 0x14001182a
cmp qword [rsi + 0x40138], rbp
jne 0x1400117e9
lea rcx, [rsi + 0x40138]
call fcn.140012998
mov rax, qword [rsi + 0x40158]
cmp rax, rbp
je 0x1400117ff
mov rcx, r12
call rax
mov r13d, eax
jmp 0x140011803
or r13d, 0xffffffff
cmp r13d, ebp
mov rcx, rsi
je 0x140011817
lea rdx, str.Failed_to_hung_up_this_RAS_item
jmp 0x14000c993
mov r8d, 0xbb8
mov rdx, r12
call fcn.140006ce4
jmp 0x14000af45
lea rdx, str.Cannot_find_the_specified_connection_name__
jmp 0x14000c990
mov rcx, rsi
call fcn.140006e20
jmp 0x14000af45
add r12d, 1
cmp r12d, dword [rsi + 0x40100]
jge 0x14001187d
call fcn.1400136f0
mov r11, qword [0x14001c710]
cmp r11, rbp
je 0x14000af45
movsxd rdx, r12d
shl rdx, 0xc
add rdx, rsi
xor ecx, ecx
lea r8d, [rcx + 7]
call r11
jmp 0x14000af45
call fcn.1400136f0
mov r11, qword [0x14001c710]
cmp r11, rbp
je 0x14000af45
xor edx, edx
jmp 0x14001186f
lea edx, [r12 + 4]
cmp edx, dword [rsi + 0x40100]
jge 0x14000c12c
lea eax, [r12 + 3]
movsxd rcx, eax
lea eax, [r12 + 2]
movsxd r9, eax
shl rcx, 0xc
lea eax, [r12 + 1]
add rcx, rsi
movsxd r8, eax
shl r9, 0xc
shl r8, 0xc
mov qword [rsp + 0x20], rcx
add r9, rsi
add r8, rsi
mov rcx, rsi
call fcn.14000a9c0
jmp 0x14000c12e