Function at 0x140052b58
Capabilities:
Copy file
Create process on windows
Create thread
Schedule task via at
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d50
call fcn.140001a50
sub rsp, rax
mov qword [rsp + 0xaf0], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d40], rax
mov qword [rsp + 0x50], r9
mov ebx, edx
mov r13, rcx
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x48], r15d
mov eax, dword [rcx + 0x930]
lea rax, [rax + rax*4]
shl rax, 5
cmp dword [rax + rcx + 0x870], r15d
jne 0x140052bc1
mov edi, r15d
jmp 0x140052bd9
movsxd rcx, dword [rax + rcx + 0x820]
mov rax, qword [rax + r13 + 0x880]
mov rcx, qword [rax + rcx*8]
mov rdi, qword [rcx + 0x18]
mov dword [rsp + 0x20], r15d
lea r9, [0x140176b60]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
mov rsi, rax
mov r12d, 1
mov ecx, r12d
sub ecx, dword [r13 + 0x930]
lea rax, [rcx + rcx*4]
shl rax, 5
cmp dword [rax + r13 + 0x870], r15d
jne 0x140052c20
mov rcx, r15
jmp 0x140052c38
movsxd rcx, dword [rax + r13 + 0x820]
mov rax, qword [rax + r13 + 0x880]
mov rcx, qword [rax + rcx*8]
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x20], r15d
lea r9, [0x140176b60]
lea r8, [0x140175f00]
xor edx, edx
call sub.msvcrt.dll___RTDynamicCast
mov rcx, rax
mov qword [rsp + 0x68], rax
mov eax, 0x5a25
cmp ebx, eax
ja 0x140054d6c
je 0x140054d51
mov eax, 0x59b8
cmp ebx, eax
ja 0x140054438
je 0x140054426
cmp ebx, 0x5987
ja 0x140053f85
je 0x140053d18
mov r8d, 0x5924
cmp ebx, r8d
ja 0x140053b84
je 0x140057059
sub ebx, 0x58f3
je 0x140053b2d
sub ebx, 0x1d
je 0x140053a57
dec ebx
je 0x140053a00
dec ebx
je 0x1400539a9
sub ebx, 4
je 0x140052f81
dec ebx
je 0x140052ced
cmp ebx, 8
jne 0x14005706b
mov r8d, 0x591f
jmp 0x140057059
test rsi, rsi
je 0x14005706b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x68]
test al, al
jne 0x140052d72
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], r15
mov edx, reloc.WS2_32.dll_inet_addr
lea rcx, [rsp + 0xf8]
call fcn.1400e7ab4
lea rdx, [0x14012da68]
cmp qword [rsp + 0x100], r15
cmovne rdx, qword [rsp + 0x100]
mov r9d, reloc.SHELL32.dll_ILFindLastID
lea r8, [0x14010f168]
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xf8]
jmp 0x14005544b
mov qword [rsp + 0x78], r15
lea rax, vtable.mc::MyStrPath.0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x50]
test al, al
jne 0x140052dac
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x70]
jmp 0x14005544b
lea rcx, [rsp + 0x70]
call fcn.14006a2c4
cmp eax, 0xd
je 0x140052d96
cmp eax, 0x16
je 0x140052d96
jle 0x140052f3d
cmp eax, 0x18
jle 0x140052eaf
cmp eax, 0x1a
je 0x140052e75
cmp eax, 0x1e
je 0x140052e16
cmp eax, 0x1f
jne 0x140052f3d
lea ecx, [rax + 0x29]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140052e0e
lea r8, [rsp + 0x70]
mov rdx, r13
mov rcx, rax
call fcn.140061c44
mov rbx, rax
jmp 0x140052e11
mov rbx, r15
jmp 0x140052ee4
mov qword [rsp + 0x928], r15
lea r14, [0x14012da68]
mov rbx, r14
cmp qword [rsp + 0x78], r15
cmovne rbx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
lea rdx, str.edit
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x920], rdi
lea rcx, [rsp + 0x920]
jmp 0x140052f76
mov ecx, 0x358
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140052eaa
mov byte [rsp + 0x20], r15b
mov r9d, 2
lea r8, [rsp + 0x70]
mov rdx, r13
mov rcx, rax
call fcn.14006e018
mov rbx, rax
jmp 0x140052ead
mov rbx, r15
jmp 0x140052ee4
mov ecx, 0x358
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140052ee1
mov byte [rsp + 0x20], r15b
mov r9d, r12d
lea r8, [rsp + 0x70]
mov rdx, r13
mov rcx, rax
call fcn.14006e018
mov rbx, rax
jmp 0x140052ee4
mov rbx, r15
test rbx, rbx
je 0x140052f3d
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xdb0]
call fcn.1400e6fc8
mov edx, dword [r13 + 0x930]
lea r8, [rdx + rdx*4]
shl r8, 5
lea rcx, [r13 + 0x7f0]
add rcx, r8
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140052f34
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
lea rdi, vtable.micro::utils::QString.0
jmp 0x140052f7c
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2d8], r15
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x70]
call fcn.1400ed6b0
mov qword [rsp + 0x2d0], rdi
lea rcx, [rsp + 0x2d0]
call fcn.1400e712c
nop
jmp 0x140052d9d
mov dword [rsp + 0x20], r15d
lea r9, [0x140177660]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140052fbb
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x5916
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
test rsi, rsi
je 0x14005706b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x68]
lea rdi, vtable.micro::utils::QString.0
test al, al
jne 0x140053040
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], r15
mov edx, reloc.WS2_32.dll_inet_addr
lea rcx, [rsp + 0xc8]
call fcn.1400e7ab4
lea rdx, [0x14012da68]
cmp qword [rsp + 0xd0], r15
cmovne rdx, qword [rsp + 0xd0]
mov r9d, reloc.SHELL32.dll_ILFindLastID
lea r8, [0x14010f168]
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov qword [rsp + 0xc8], rdi
lea rcx, [rsp + 0xc8]
jmp 0x14005544b
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x50]
test al, al
je 0x14005399a
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x158]
call fcn.1400ea694
lea rax, vtable.mc::MyStrPath.0
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.14006a2c4
mov edx, eax
cmp eax, 0x1c
jg 0x1400535b8
je 0x1400534cd
sub edx, 0xd
je 0x14005349b
sub edx, 8
je 0x140053469
dec edx
je 0x140053437
dec edx
je 0x1400533bf
dec edx
je 0x140053386
dec edx
je 0x1400531e8
dec edx
je 0x14005316f
dec edx
jne 0x140053663
mov ecx, 0x368
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14005314d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x720]
call fcn.1400ea694
nop
mov r14d, 0x20
mov dword [rsp + 0x48], r14d
mov byte [rsp + 0x20], r12b
mov r9d, r12d
lea r8, [rsp + 0x720]
mov rdx, r13
mov rcx, rbx
call fcn.14006e018
lea rax, vtable.mc::MyOfficeViewer.0
mov qword [rbx], rax
mov qword [rbx + 0x358], rdi
mov qword [rbx + 0x360], r15
jmp 0x140053150
mov rbx, r15
test r14b, 0x20
je 0x140053930
mov qword [rsp + 0x720], rdi
lea rcx, [rsp + 0x720]
jmp 0x14005392b
mov ecx, 0x358
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r10, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400531c6
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x560]
call fcn.1400ea694
nop
mov r14d, reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x48], r14d
mov byte [rsp + 0x20], r12b
lea r9d, [r14 - 0xe]
lea r8, [rsp + 0x560]
mov rdx, r13
mov rcx, r10
call fcn.14006e018
mov rbx, rax
jmp 0x1400531c9
mov rbx, r15
test r14b, 0x10
je 0x140053930
mov qword [rsp + 0x560], rdi
lea rcx, [rsp + 0x560]
jmp 0x14005392b
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], r15
lea rcx, [rsp + 0x140]
call fcn.1400e8fa0
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], r15
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0x338], r15
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], r15
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x128]
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x158]
call fcn.1400ea830
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xcd0]
call fcn.140011d2c
lea r8, str..mht
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.140008a10
nop
lea r14, [0x14012da68]
mov rdx, r14
cmp qword [rsp + 0x170], r15
cmovne rdx, qword [rsp + 0x170]
mov rcx, r14
cmp qword [rsp + 0x60], r15
cmovne rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_CopyFileExW]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x58]
call fcn.1400e7b9c
nop
mov qword [rsp + 0x168], rdi
lea rcx, [rsp + 0x168]
call fcn.1400e712c
nop
mov qword [rsp + 0x1d0], rdi
lea rcx, [rsp + 0x1d0]
call fcn.1400e712c
nop
mov qword [rsp + 0x128], rdi
lea rcx, [rsp + 0x128]
call fcn.1400e712c
nop
mov qword [rsp + 0x330], rdi
lea rcx, [rsp + 0x330]
call fcn.1400e712c
nop
mov qword [rsp + 0x1f0], rdi
lea rcx, [rsp + 0x1f0]
call fcn.1400e712c
nop
mov qword [rsp + 0x140], rdi
lea rcx, [rsp + 0x140]
call fcn.1400e712c
jmp 0x14005338d
lea r14, [0x14012da68]
mov ecx, 0x100
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400533b7
lea r8, [rsp + 0x58]
mov rdx, r13
mov rcx, rax
call fcn.140090dec
mov rbx, rax
jmp 0x1400533ba
mov rbx, r15
jmp 0x140053937
mov ecx, 0x358
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r10, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053415
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x570]
call fcn.1400ea694
nop
mov r14d, 8
mov dword [rsp + 0x48], r14d
mov byte [rsp + 0x20], r12b
mov r9d, r12d
lea r8, [rsp + 0x570]
mov rdx, r13
mov rcx, r10
call fcn.14006e018
mov rbx, rax
jmp 0x140053418
mov rbx, r15
test r14b, 8
je 0x140053930
mov qword [rsp + 0x570], rdi
lea rcx, [rsp + 0x570]
jmp 0x14005392b
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053461
lea r8, [rsp + 0x58]
mov rdx, r13
mov rcx, rax
call fcn.140046c00
mov rbx, rax
jmp 0x140053464
mov rbx, r15
jmp 0x140053930
mov ecx, 0x150
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053493
lea r8, [rsp + 0x58]
mov rdx, r13
mov rcx, rax
call fcn.140066b74
mov rbx, rax
jmp 0x140053496
mov rbx, r15
jmp 0x140053930
mov ecx, 0x138
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400534c5
lea r8, [rsp + 0x58]
mov rdx, r13
mov rcx, rax
call fcn.14006154c
mov rbx, rax
jmp 0x1400534c8
mov rbx, r15
jmp 0x140053930
call fcn.14006a398
mov ebx, eax
test eax, eax
jne 0x140053546
mov ecx, reloc.SHELL32.dll_ILGetSize
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053524
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x3d0]
call fcn.1400ea694
nop
lea r14d, [rbx + 0x40]
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x3d0]
mov rdx, r13
mov rcx, r9
call fcn.14008bf20
mov rbx, rax
jmp 0x140053527
mov rbx, r15
test r14b, 0x40
je 0x140053930
mov qword [rsp + 0x3d0], rdi
lea rcx, [rsp + 0x3d0]
jmp 0x14005392b
mov ecx, IUnknown_GetWindow
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r10, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053597
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x650]
call fcn.1400ea694
nop
mov r14d, 0x80
mov dword [rsp + 0x48], r14d
mov r9d, ebx
lea r8, [rsp + 0x650]
mov rdx, r13
mov rcx, r10
call fcn.14006a440
mov rbx, rax
jmp 0x14005359a
mov rbx, r15
test r14b, r14b
jns 0x140053930
mov qword [rsp + 0x650], rdi
lea rcx, [rsp + 0x650]
jmp 0x14005392b
cmp eax, 0x1d
je 0x1400538c3
cmp eax, 0x1e
je 0x140053859
cmp eax, 0x1f
je 0x1400537e8
add eax, 0xffffffe0
test eax, 0xfffffffd
je 0x140053745
cmp edx, 0x23
je 0x1400536d4
lea eax, [rdx - 0x24]
cmp eax, r12d
ja 0x140053663
mov ecx, 0x148
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053640
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x3f0]
call fcn.1400ea694
nop
mov r14d, 0x1000
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x3f0]
mov rdx, r13
mov rcx, r9
call fcn.14005f958
mov rbx, rax
jmp 0x140053643
mov rbx, r15
bt r14d, 0xc
jae 0x140053930
mov qword [rsp + 0x3f0], rdi
lea rcx, [rsp + 0x3f0]
jmp 0x14005392b
mov ecx, reloc.SHELL32.dll_ILGetSize
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400536b1
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x590]
call fcn.1400ea694
nop
mov r14d, 0x4000
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x590]
mov rdx, r13
mov rcx, r9
call fcn.14008bf20
mov rbx, rax
jmp 0x1400536b4
mov rbx, r15
bt r14d, 0xe
jae 0x140053930
mov qword [rsp + 0x590], rdi
lea rcx, [rsp + 0x590]
jmp 0x14005392b
mov ecx, 0x90
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053722
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x410]
call fcn.1400ea694
nop
mov r14d, 0x2000
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x410]
mov rdx, r13
mov rcx, r9
call fcn.14004f030
mov rbx, rax
jmp 0x140053725
mov rbx, r15
bt r14d, 0xd
jae 0x140053930
mov qword [rsp + 0x410], rdi
lea rcx, [rsp + 0x410]
jmp 0x14005392b
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400537c5
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x6f0]
call fcn.1400ea694
nop
mov r14d, 0x800
mov dword [rsp + 0x48], r14d
mov qword [rbx + 8], r15
lea rax, vtable.mc::MyBasePanel.0
mov qword [rbx], rax
lea rcx, [rbx + 0x18]
mov qword [rcx + 8], r15
lea rax, vtable.micro::files::QPathStr.0
mov qword [rcx], rax
mov qword [rbx + 0x10], r13
mov byte [rbx + 0x28], r15b
lea rdx, [rsp + 0x6f0]
call fcn.1400e7b9c
nop
lea rax, vtable.mc::MyVideoPlayer.0
mov qword [rbx], rax
mov qword [rbx + 0x38], r15
mov qword [rbx + 0x30], r15
jmp 0x1400537c8
mov rbx, r15
bt r14d, 0xb
jae 0x140053930
mov qword [rsp + 0x6f0], rdi
lea rcx, [rsp + 0x6f0]
jmp 0x14005392b
mov ecx, 0x48
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053836
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x430]
call fcn.1400ea694
nop
mov r14d, 0x400
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x430]
mov rdx, r13
mov rcx, r9
call fcn.140061c44
mov rbx, rax
jmp 0x140053839
mov rbx, r15
bt r14d, 0xa
jae 0x140053930
mov qword [rsp + 0x430], rdi
lea rcx, [rsp + 0x430]
jmp 0x14005392b
mov ecx, QISearch
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400538a7
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x5b0]
call fcn.1400ea694
nop
mov r14d, 0x200
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x5b0]
mov rdx, r13
mov rcx, r9
call fcn.14005e31c
mov rbx, rax
jmp 0x1400538aa
mov rbx, r15
bt r14d, 9
jae 0x140053930
mov qword [rsp + 0x5b0], rdi
lea rcx, [rsp + 0x5b0]
jmp 0x14005392b
mov ecx, 0xa0
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053911
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x450]
call fcn.1400ea694
nop
mov r14d, 0x100
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x450]
mov rdx, r13
mov rcx, r9
call fcn.14004ec2c
mov rbx, rax
jmp 0x140053914
mov rbx, r15
bt r14d, 8
jae 0x140053930
mov qword [rsp + 0x450], rdi
lea rcx, [rsp + 0x450]
call fcn.1400e712c
lea r14, [0x14012da68]
or r8d, 0xffffffff
mov rdx, r14
lea rcx, [rsp + 0xcf0]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140053984
test rbx, rbx
je 0x140053984
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
nop
mov qword [rsp + 0x158], rdi
lea rcx, [rsp + 0x158]
call fcn.1400e712c
nop
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
jmp 0x14005544b
test rsi, rsi
je 0x1400539bb
mov rcx, rsi
call fcn.14003d660
jmp 0x14005706b
mov dword [rsp + 0x20], r15d
lea r9, [0x140177070]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x1400539f5
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14005706b
mov rax, qword [rcx]
call qword [rax + 0x40]
jmp 0x14005706b
mov r8d, 0x5912
jmp 0x140057059
test rsi, rsi
je 0x140053a12
mov rcx, rsi
call fcn.14003d560
jmp 0x14005706b
mov dword [rsp + 0x20], r15d
lea r9, [0x140177070]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140053a4c
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14005706b
mov rax, qword [rcx]
call qword [rax + 0x38]
jmp 0x14005706b
mov r8d, 0x5911
jmp 0x140057059
mov ecx, 0x100
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053aab
or r8d, 0xffffffff
lea rdx, str.http:__myco.yonan.ro_help_
lea rcx, [rsp + 0x670]
call fcn.1400e6fc8
nop
mov r14d, 4
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x670]
mov rdx, r13
mov rcx, rbx
call fcn.140090dec
mov rbx, rax
jmp 0x140053aae
mov rbx, r15
test r14b, 4
je 0x140053ad0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x670], rdi
lea rcx, [rsp + 0x670]
call fcn.1400e712c
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd10]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x14005706b
test rbx, rbx
je 0x14005706b
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
jmp 0x14005706b
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.1400526f0
movsxd rbx, eax
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053b63
xor r9d, r9d
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov r15, rax
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd30]
call fcn.1400e6fc8
lea rdx, [rbx + rbx*4]
jmp 0x1400548c5
mov r8d, 0x5925
sub ebx, r8d
je 0x140057059
sub ebx, 6
je 0x140053c26
dec ebx
je 0x140053bbe
sub ebx, 0x11
jne 0x14005706b
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.1400526f0
mov r8d, eax
jmp 0x1400548e7
mov r10, qword [rsp + 0x50]
mov rdx, r10
mov rcx, r13
call fcn.1400526f0
movsxd rcx, eax
lea r8, [rcx + rcx*4]
shl r8, 5
movsxd rax, dword [r8 + r13 + 0x870]
test eax, eax
jle 0x14005706b
mov rdx, r15
mov r9, rax
mov rcx, qword [r8 + r13 + 0x880]
mov rax, qword [rcx]
cmp r10, qword [rax + 0x18]
je 0x140053c14
add r15d, r12d
add rdx, r12
add rcx, 8
cmp rdx, r9
jl 0x140053bf7
jmp 0x14005706b
mov edx, r15d
lea rcx, [r13 + 0x7f0]
add rcx, r8
jmp 0x140054872
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.1400526f0
movsxd rsi, eax
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x20], r15d
lea r9, [0x140176b60]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140053d0b
mov edi, dword [rax + 0x50]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x90]
cmp rcx, rbx
je 0x140053ca7
test rcx, rcx
je 0x140053c8e
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x90], r15
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x90], rax
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053cd5
mov r9d, edi
lea r8, [rsp + 0x90]
mov rdx, r13
mov rcx, rax
call fcn.14003b694
mov r15, rax
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd90]
call fcn.1400e6fc8
lea rdx, [rsi + rsi*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, r15
call fcn.1400f2280
nop
lea rcx, [rsp + 0x90]
jmp 0x1400545bf
mov dword [rsp + 0x20], r15d
lea r9, [0x140177660]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140053d49
mov r8d, 0x5987
mov rcx, qword [rax + 8]
jmp 0x14005705d
test rsi, rsi
je 0x14005706b
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1400ee914
test al, al
jne 0x140053db8
xor r9d, r9d
lea r8, str.Message
lea rdx, str.Invalid_search_path_
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov qword [rsp + 0x80], rdi
lea rcx, [rsp + 0x80]
jmp 0x14005544b
mov rdx, r13
lea rcx, [rsp + 0x11c0]
call fcn.140073b48
nop
lea r14, [0x14012da68]
mov rdx, r14
cmp qword [rsp + 0x88], r15
cmovne rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1be0]
call fcn.1400e7be0
movzx eax, word [rsp + 0x11d8]
mov qword [rsp + 0x98], rax
mov rbx, qword [rsp + 0x11d0]
test rbx, rbx
je 0x140053e14
mov rbx, qword [rbx + 8]
jmp 0x140053e17
mov rbx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0x11c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, rbx
mov rdx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 0x429
jne 0x140053ec0
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], r15
lea rdx, [rsp + 0x1c88]
lea rcx, [rsp + 0xd8]
call fcn.1400e7b9c
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x140053e98
cmp dword [rax - 8], r15d
je 0x140053e98
lea rdx, [rsp + 0xd8]
mov rcx, rsi
call fcn.14003d2d8
nop
mov qword [rsp + 0xd8], rdi
lea rcx, [rsp + 0xd8]
call fcn.1400e712c
nop
lea rcx, [rsp + 0x11c0]
call fcn.140073e04
jmp 0x140053da3
cmp rax, 0x42a
jne 0x140053eae
mov ecx, UnRegisterTypeLib
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053ef2
lea rdx, [rsp + 0x1c98]
mov rcx, rax
call fcn.14004882c
mov rbx, rax
jmp 0x140053ef5
mov rbx, r15
test rbx, rbx
je 0x140053eae
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140053f22
mov r9, rbx
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov rsi, rax
jmp 0x140053f25
mov rsi, r15
test rsi, rsi
je 0x140053f75
or r8d, 0xffffffff
mov rdx, r14
lea rcx, [rsp + 0xe00]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rsi
call fcn.1400f2280
test al, al
jne 0x140053eae
mov rax, qword [rsi]
mov edx, r12d
mov rcx, rsi
call qword [rax]
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
jmp 0x140053eae
mov eax, 0x59ac
cmp ebx, eax
ja 0x140054258
je 0x14005412b
sub ebx, 0x5988
je 0x140054047
sub ebx, 5
je 0x14005401d
dec ebx
je 0x14005400f
dec ebx
je 0x140053fff
dec ebx
je 0x140053fef
sub ebx, 3
je 0x140053fde
cmp ebx, 5
jne 0x14005706b
xor r9d, r9d
lea edx, [rbx - 2]
mov r8d, 0xffff
mov rcx, qword [r13 + 8]
call qword [sym.imp.SHELL32.dll_SHFormatDrive]
jmp 0x14005706b
lea rcx, [r13 + 0x780]
call fcn.1400f3bb4
jmp 0x14005706b
test rsi, rsi
je 0x14005706b
mov edx, 3
jmp 0x140054028
test rsi, rsi
je 0x14005706b
mov edx, 2
jmp 0x140054028
test rsi, rsi
je 0x14005706b
mov edx, r12d
jmp 0x140054028
test rsi, rsi
je 0x14005706b
xor edx, edx
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + QISearch]
mov rcx, qword [rsi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x360]
jmp 0x14005706b
mov r8, r13
mov edx, 0x26b4
lea rcx, [rsp + 0xf90]
call fcn.140037888
lea rax, vtable.mc::MyOptionsDialog.0
mov qword [rsp + 0xf90], rax
mov qword [rsp + 0xff0], r15
mov byte [rsp + 0xff8], r15b
lea rax, vtable.micro::gui::QTreeControl.0
mov qword [rsp + 0xfe8], rax
mov qword [rsp + 0x1018], r15
mov qword [rsp + 0x1020], r15
mov qword [rsp + 0x1030], r15
mov qword [rsp + 0x1038], r15
mov qword [rsp + 0x1040], 8
mov qword [rsp + 0x1048], r15
lea rax, vtable.micro::utils::QObArray_class_mc::MyOpPage_.0
mov qword [rsp + 0x1028], rax
or dword [rsp + 0x1050], 0xffffffff
movzx ebx, word [rsp + 0xfa8]
mov rax, qword [rsp + 0xfa0]
test rax, rax
je 0x1400540ee
mov r15, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, r15
mov rdx, rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, [rsp + 0xf90]
call fcn.14006828c
jmp 0x14005706b
test rsi, rsi
je 0x140054238
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], r15
lea rdx, [rsp + 0x190]
mov rcx, rax
call fcn.1400ee914
mov rdx, r13
lea rcx, [rsp + 0x1060]
call fcn.140043904
nop
mov qword [rsp + 0x178], rdi
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x180], rax
test rax, rax
je 0x140054198
lock add dword [rax - 0xc], r12d
lea rax, [rsp + 0x178]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x10b8]
call fcn.1400e7b9c
nop
mov qword [rsp + 0x178], rdi
lea rcx, [rsp + 0x178]
call fcn.1400e712c
movzx ebx, word [rsp + 0x1078]
mov rax, qword [rsp + 0x1070]
test rax, rax
je 0x1400541e9
mov r15, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0x1060]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, r15
mov rdx, rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
lea rcx, [rsp + 0x1060]
call fcn.140043a14
nop
mov qword [rsp + 0x190], rdi
lea rcx, [rsp + 0x190]
jmp 0x14005544b
xor r9d, r9d
lea r8, str.Message
lea rdx, str.Invalid_path_
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14005706b
cmp ebx, 0x59ad
je 0x1400543b6
cmp ebx, 0x59ae
je 0x140054346
mov eax, 0x59af
cmp ebx, eax
je 0x1400542d6
jbe 0x14005706b
lea edx, [rax + 3]
cmp ebx, edx
jbe 0x1400542b0
cmp ebx, 0x59b6
je 0x1400548fb
cmp ebx, 0x59b7
jne 0x14005706b
mov edx, r12d
mov rcx, qword [r13 + 8]
call qword [sym.imp.MPR.dll_WNetConnectionDialog]
jmp 0x14005706b
mov eax, 0x300
cmp ebx, 0x59b1
jne 0x1400542c4
mov eax, 0x301
jmp 0x1400542ce
mov ecx, 0x302
cmp ebx, edx
cmove eax, ecx
movsxd r8, eax
jmp 0x140057059
or r8d, 0xffffffff
lea rdx, str.osk.exe
lea rcx, [rsp + 0x470]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2b8], r15
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x470]
call fcn.1400ed6b0
mov qword [rsp + 0x2b0], rdi
lea rcx, [rsp + 0x2b0]
call fcn.1400e712c
nop
mov qword [rsp + 0x470], rdi
lea rcx, [rsp + 0x470]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.regedit.exe
lea rcx, [rsp + 0x5d0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], r15
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x5d0]
call fcn.1400ed6b0
mov qword [rsp + 0x210], rdi
lea rcx, [rsp + 0x210]
call fcn.1400e712c
nop
mov qword [rsp + 0x5d0], rdi
lea rcx, [rsp + 0x5d0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.cmd.exe
lea rcx, [rsp + 0x490]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x318], r15
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x490]
call fcn.1400ed6b0
mov qword [rsp + 0x310], rdi
lea rcx, [rsp + 0x310]
call fcn.1400e712c
nop
mov qword [rsp + 0x490], rdi
lea rcx, [rsp + 0x490]
jmp 0x14005544b
mov edx, r12d
mov rcx, qword [r13 + 8]
call qword [sym.imp.MPR.dll_WNetDisconnectDialog]
jmp 0x14005706b
mov eax, 0x59f2
cmp ebx, eax
ja 0x140054981
je 0x140054911
mov eax, 0x59e2
cmp ebx, eax
ja 0x1400546ef
je 0x14005465a
mov eax, ebx
sub eax, 0x59bd
je 0x14005509e
sub eax, 8
je 0x1400545ea
sub eax, 0xe
je 0x1400545df
sub eax, 2
je 0x1400545d4
sub eax, 4
je 0x1400545c9
sub eax, 6
je 0x140054536
sub eax, 2
jne 0x14005706b
test rsi, rsi
je 0x14005453b
test rcx, rcx
je 0x14005453b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x188], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x150], rax
cmp dword [r13 + 0x930], r15d
je 0x140054507
xor r9d, r9d
lea rdx, [rsp + 0x188]
mov rcx, rbx
jmp 0x140054515
mov r9b, r12b
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.14003d274
nop
lea rcx, [rsp + 0x150]
call fcn.1400377d0
nop
lea rcx, [rsp + 0x188]
jmp 0x1400545bf
test rsi, rsi
jne 0x140054542
xor al, al
jmp 0x14005706e
test rcx, rcx
je 0x14005453b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x138], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x1a8], rax
mov r9b, r12b
lea rdx, [rsp + 0x1a8]
mov rcx, rsi
call fcn.14003d274
mov r9b, r12b
lea rdx, [rsp + 0x138]
mov rcx, rbx
call fcn.14003d274
nop
lea rcx, [rsp + 0x1a8]
call fcn.1400377d0
nop
lea rcx, [rsp + 0x138]
call fcn.1400377d0
jmp 0x14005706b
mov r8d, 0x59d9
jmp 0x140057059
mov r8d, 0x59d5
jmp 0x140057059
mov r8d, 0x59d3
jmp 0x140057059
or r8d, 0xffffffff
lea rdx, str.taskmgr.exe
lea rcx, [rsp + 0x6d0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x230], rdi
mov qword [rsp + 0x238], r15
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x6d0]
call fcn.1400ed6b0
mov qword [rsp + 0x230], rdi
lea rcx, [rsp + 0x230]
call fcn.1400e712c
nop
mov qword [rsp + 0x6d0], rdi
lea rcx, [rsp + 0x6d0]
jmp 0x14005544b
test rsi, rsi
je 0x14005453b
test rcx, rcx
je 0x14005453b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x98], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x1a0], rax
cmp dword [r13 + 0x930], r15d
jne 0x1400546c0
xor r9d, r9d
lea rdx, [rsp + 0x98]
mov rcx, rbx
jmp 0x1400546ce
mov r9b, r12b
lea rdx, [rsp + 0x1a0]
mov rcx, rsi
call fcn.14003d274
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400377d0
nop
lea rcx, [rsp + 0x98]
jmp 0x1400545bf
sub ebx, 0x59e4
je 0x1400548fb
sub ebx, 3
je 0x1400548e3
dec ebx
je 0x14005487c
dec ebx
je 0x140054849
sub ebx, 3
je 0x140054792
cmp ebx, 5
jne 0x14005706b
or r8d, 0xffffffff
lea rdx, str.calc.exe
lea rcx, [rsp + 0x4b0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1b8], r15
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x4b0]
call fcn.1400ed6b0
mov qword [rsp + 0x1b0], rdi
lea rcx, [rsp + 0x1b0]
call fcn.1400e712c
nop
mov qword [rsp + 0x4b0], rdi
lea rcx, [rsp + 0x4b0]
jmp 0x14005544b
mov ebx, r12d
mov qword [rsp + 0x68], r15
test rsi, rsi
je 0x1400547d7
mov ebx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
je 0x1400547d7
test rcx, rcx
je 0x1400547c4
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x68], r15
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x68], rax
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140054802
mov r9d, ebx
lea r8, [rsp + 0x68]
mov rdx, r13
mov rcx, rax
call fcn.14003b694
mov r15, rax
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xdf0]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, r15
call fcn.1400f2280
nop
lea rcx, [rsp + 0x68]
jmp 0x1400545bf
mov eax, dword [r13 + 0x930]
lea rdx, [rax + 0xd]
lea rdx, [rdx + rdx*4]
shl rdx, 5
lea rax, [rax + rax*4]
shl rax, 5
lea rcx, [r13 + 0x7f0]
add rcx, rax
mov edx, dword [rdx + r13]
call fcn.1400f21c8
jmp 0x14005706b
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400548a2
xor r9d, r9d
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov r15, rax
lea rcx, [rsp + 0xd80]
lea rdx, [0x14012da68]
or r8d, 0xffffffff
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, r15
call fcn.1400f2280
jmp 0x14005706b
or r8d, 0xffffffff
lea rdx, [0x14012da68]
mov rcx, r13
call fcn.140057a80
jmp 0x14005706b
test rsi, rsi
je 0x14005706b
mov rcx, rsi
call fcn.14003c748
jmp 0x14005706b
or r8d, 0xffffffff
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x5f0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r15
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x5f0]
call fcn.1400ed6b0
mov qword [rsp + 0x250], rdi
lea rcx, [rsp + 0x250]
call fcn.1400e712c
nop
mov qword [rsp + 0x5f0], rdi
lea rcx, [rsp + 0x5f0]
jmp 0x14005544b
mov r8d, 0x5a11
cmp ebx, r8d
ja 0x140054b38
je 0x140057059
sub ebx, 0x59f3
je 0x140054ac8
sub ebx, 6
je 0x140054a7c
dec ebx
je 0x140054a4b
sub ebx, 2
je 0x1400549f0
sub ebx, 5
je 0x1400549d5
cmp ebx, 3
jne 0x14005706b
xor r8d, r8d
lea edx, [rbx + 0xd]
mov rcx, qword [r13 + 8]
jmp 0x140057062
test rsi, rsi
je 0x14005706b
mov rcx, qword [rsi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x398]
jmp 0x14005706b
mov dword [rsp + 0x20], r15d
lea r9, [0x140177660]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140054a1d
mov r8d, 0x808d
jmp 0x140053d40
mov eax, r12d
sub eax, dword [r13 + 0x930]
mov ecx, eax
mov dword [r13 + 0x930], ecx
lea rcx, [rax + rax*4]
shl rcx, 5
mov rcx, qword [rcx + r13 + 0x7f8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x14005706b
mov eax, dword [r13 + 0x930]
lea rbx, [rax + rax*4]
shl rbx, 5
add rbx, r13
mov eax, dword [rbx + 0x870]
cmp eax, r12d
jle 0x14005706b
mov edx, dword [rbx + 0x820]
sub edx, r12d
jns 0x140054aa9
lea edx, [rax - 1]
jmp 0x140054aa9
mov eax, dword [r13 + 0x930]
lea rbx, [rax + rax*4]
shl rbx, 5
add rbx, r13
mov ecx, dword [rbx + 0x870]
cmp ecx, r12d
jle 0x14005706b
mov eax, dword [rbx + 0x820]
add eax, r12d
cdq
idiv ecx
lea rcx, [rbx + 0x7f0]
call fcn.1400f3700
mov rax, qword [rbx + 0x7f0]
lea rcx, [rbx + 0x7f0]
jmp 0x14005403c
or r8d, 0xffffffff
lea rdx, str.mspaint.exe
lea rcx, [rsp + 0x4d0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x350], rdi
mov qword [rsp + 0x358], r15
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x4d0]
call fcn.1400ed6b0
mov qword [rsp + 0x350], rdi
lea rcx, [rsp + 0x350]
call fcn.1400e712c
nop
mov qword [rsp + 0x4d0], rdi
lea rcx, [rsp + 0x4d0]
jmp 0x14005544b
sub ebx, 0x5a17
je 0x140054ce1
sub ebx, 3
je 0x140054c71
sub ebx, 5
je 0x140054c01
dec ebx
je 0x140054b91
dec ebx
je 0x140054b73
dec ebx
jne 0x14005706b
test rsi, rsi
je 0x14005706b
xor edx, edx
jmp 0x140054b7f
test rsi, rsi
je 0x14005706b
mov dl, r12b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0xe0]
jmp 0x140054035
or r8d, 0xffffffff
lea rdx, str.http:__myco.yonan.ro_help_
lea rcx, [rsp + 0x690]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], r15
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x690]
call fcn.1400ed6b0
mov qword [rsp + 0x270], rdi
lea rcx, [rsp + 0x270]
call fcn.1400e712c
nop
mov qword [rsp + 0x690], rdi
lea rcx, [rsp + 0x690]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, [0x14011b610]
lea rcx, [rsp + 0x4f0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2f0], rdi
mov qword [rsp + 0x2f8], r15
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x4f0]
call fcn.1400ed6b0
mov qword [rsp + 0x2f0], rdi
lea rcx, [rsp + 0x2f0]
call fcn.1400e712c
nop
mov qword [rsp + 0x4f0], rdi
lea rcx, [rsp + 0x4f0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.control.exe
lea rcx, [rsp + 0x610]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], r15
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x610]
call fcn.1400ed6b0
mov qword [rsp + 0x290], rdi
lea rcx, [rsp + 0x290]
call fcn.1400e712c
nop
mov qword [rsp + 0x610], rdi
lea rcx, [rsp + 0x610]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.dfrgui.exe
lea rcx, [rsp + 0x510]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], r15
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x510]
call fcn.1400ed6b0
mov qword [rsp + 0x1c0], rdi
lea rcx, [rsp + 0x1c0]
call fcn.1400e712c
nop
mov qword [rsp + 0x510], rdi
lea rcx, [rsp + 0x510]
jmp 0x14005544b
test rsi, rsi
je 0x14005706b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x118]
jmp 0x140054035
mov eax, 0x804f
cmp ebx, eax
ja 0x14005632d
je 0x1400558fa
mov eax, 0x8013
cmp ebx, eax
ja 0x14005557c
je 0x140055455
mov eax, 0x5a3d
cmp ebx, eax
ja 0x14005514d
je 0x140055141
cmp ebx, 0x5a27
je 0x140055123
cmp ebx, 0x5a28
je 0x140055116
cmp ebx, 0x5a2b
je 0x1400550a6
cmp ebx, 0x5a2c
jbe 0x14005706b
cmp ebx, 0x5a2e
jbe 0x14005509e
cmp ebx, 0x5a39
je 0x140054f03
cmp ebx, 0x5a3a
je 0x140054ebc
cmp ebx, 0x5a3c
jne 0x14005706b
mov ebx, r12d
mov qword [rsp + 0x50], r15
test rsi, rsi
je 0x140054e4a
mov ebx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x140054e4a
test rcx, rcx
je 0x140054e37
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x50], r15
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x50], rax
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140054e75
mov r9d, ebx
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, rax
call fcn.14003b694
mov r15, rax
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd50]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, r15
call fcn.1400f2280
nop
lea rcx, [rsp + 0x50]
jmp 0x1400545bf
mov rcx, qword [r13 + 0x58]
mov eax, r12d
sub eax, dword [rcx + 0x30]
mov dword [rcx + 0x30], eax
mov rax, qword [r13 + 0x58]
mov ecx, dword [rax + 0x30]
neg ecx
sbb rdx, rdx
neg rdx
add rdx, 0xfffffffffffffffe
mov dword [rsp + 0x30], reloc.SHELL32.dll_ILCloneFirst
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14005706b
mov r8, r13
mov edx, 0x7662
lea rcx, [rsp + 0xa50]
call fcn.140037888
nop
lea rax, vtable.mc::MyGetNameDialog.0
mov qword [rsp + 0xa50], rax
or r8d, 0xffffffff
lea r14, [0x14012da68]
mov rdx, r14
lea rcx, [rsp + 0xaa8]
call fcn.1400e6fc8
mov byte [rsp + 0xac8], r15b
lea rax, vtable.micro::gui::QEdit.0
mov qword [rsp + 0xab8], rax
mov qword [rsp + 0xac0], r15
movzx edi, word [rsp + 0xa68]
mov rbx, qword [rsp + 0xa60]
test rbx, rbx
je 0x140054f7d
mov rbx, qword [rbx + 8]
jmp 0x140054f80
mov rbx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0xa50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, r12
je 0x140054ff6
lea rax, vtable.micro::gui::QWindow.0
mov qword [rsp + 0xab8], rax
lea rcx, [rsp + 0xab8]
call fcn.1400ec690
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xaa8], rdi
lea rcx, [rsp + 0xaa8]
call fcn.1400e712c
nop
lea rcx, [rsp + 0xa50]
jmp 0x14005704c
cmp qword [rsp + 0xab0], r15
cmovne r14, qword [rsp + 0xab0]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelW]
test eax, eax
jne 0x140055058
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x710], rdi
mov qword [rsp + 0x718], r15
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x710]
call fcn.1400e7960
nop
lea rdx, [0x14016bc48]
lea rcx, [rsp + 0x710]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x140055060
lea rax, vtable.micro::gui::QWindow.0
mov qword [rsp + 0xab8], rax
lea rcx, [rsp + 0xab8]
call fcn.1400ec690
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xaa8], rdi
lea rcx, [rsp + 0xaa8]
call fcn.1400e712c
nop
jmp 0x140054fe9
mov r8, rbx
jmp 0x140057059
or r8d, 0xffffffff
lea rdx, str.mstsc.exe
lea rcx, [rsp + 0x530]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], r15
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x530]
call fcn.1400ed6b0
mov qword [rsp + 0x1e0], rdi
lea rcx, [rsp + 0x1e0]
call fcn.1400e712c
nop
mov qword [rsp + 0x530], rdi
lea rcx, [rsp + 0x530]
jmp 0x14005544b
test rsi, rsi
je 0x14005706b
xor edx, edx
jmp 0x14005512f
test rsi, rsi
je 0x14005706b
mov dl, r12b
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x120]
jmp 0x140054035
mov rcx, qword [r13 + 0x450]
jmp 0x140054a40
sub ebx, 0x5a40
je 0x140055345
sub ebx, 4
je 0x140055306
sub ebx, 0x19
je 0x1400552fb
sub ebx, 0x2f3
je 0x1400552d1
sub ebx, 0x70
je 0x1400551f8
cmp ebx, 0x224a
jne 0x14005706b
or r8d, 0xffffffff
lea rdx, str.rstrui.exe
lea rcx, [rsp + 0x630]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x208], r15
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x630]
call fcn.1400ed6b0
mov qword [rsp + 0x200], rdi
lea rcx, [rsp + 0x200]
call fcn.1400e712c
nop
mov qword [rsp + 0x630], rdi
lea rcx, [rsp + 0x630]
jmp 0x14005544b
xor r9d, r9d
or r8d, 0xffffffff
lea rdx, str.Apr__4_2015__23:08:28
lea rcx, [rsp + 0x550]
call fcn.1400e707c
nop
or r8d, 0xffffffff
lea rdx, [0x14011b6b0]
lea rcx, [rsp + 0xd70]
call fcn.1400e6fc8
lea r8, [0x14011b6a8]
mov rdx, rax
lea rcx, [rsp + 0xa10]
call fcn.140008a10
nop
lea r8, [rsp + 0x550]
mov rdx, rax
lea rcx, [rsp + 0x860]
call fcn.140011d2c
nop
mov rdx, rax
lea rcx, [rsp + 0xe20]
call fcn.140050e94
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x860], rdi
lea rcx, [rsp + 0x860]
call fcn.1400e712c
nop
mov qword [rsp + 0xa10], rdi
lea rcx, [rsp + 0xa10]
call fcn.1400e712c
lea rcx, [rsp + 0xe20]
call fcn.1400ef56c
nop
lea rcx, [rsp + 0xe20]
call fcn.1400ef0d0
nop
mov qword [rsp + 0x550], rdi
lea rcx, [rsp + 0x550]
jmp 0x14005544b
xor edx, edx
mov rcx, qword [r13 + 0x950]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [r13 + 0x948]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [r13 + 0x940], r12b
jmp 0x14005706b
mov r8d, 0x5a5d
jmp 0x140057059
mov rcx, qword [r13 + 0x58]
mov eax, r12d
sub eax, dword [rcx + 0x20]
mov dword [rcx + 0x20], eax
mov rax, qword [r13 + 0x58]
mov rcx, qword [r13 + 0x408]
cmp dword [rax + 0x20], r15d
je 0x14005532b
mov edx, 5
jmp 0x14005532d
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.140052434
jmp 0x14005706b
test rsi, rsi
je 0x14005706b
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], r15
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
call qword [rax + 0x50]
test al, al
je 0x14005543b
mov ecx, reloc.SHELL32.dll_ILGetSize
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400553cd
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x6b0]
call fcn.1400ea694
nop
mov r14d, r12d
mov dword [rsp + 0x48], r12d
lea r8, [rsp + 0x6b0]
mov rdx, r13
mov rcx, r9
call fcn.14008bf20
mov rbx, rax
jmp 0x1400553d0
mov rbx, r15
test r12b, r14b
je 0x1400553ea
mov qword [rsp + 0x6b0], rdi
lea rcx, [rsp + 0x6b0]
call fcn.1400e712c
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xe10]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x14005543b
test rbx, rbx
je 0x14005543b
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
nop
mov qword [rsp + 0xb0], rdi
lea rcx, [rsp + 0xb0]
call fcn.1400e712c
jmp 0x14005706b
test rsi, rsi
je 0x14005706b
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], r15
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa0]
call qword [rax + 0x50]
test al, al
je 0x140055567
mov ecx, 0x358
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r10, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400554e8
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x370]
call fcn.1400ea694
nop
mov r14d, 2
mov dword [rsp + 0x48], r14d
mov byte [rsp + 0x20], r12b
mov r9d, r12d
lea r8, [rsp + 0x370]
mov rdx, r13
mov rcx, r10
call fcn.14006e018
mov rbx, rax
jmp 0x1400554eb
mov rbx, r15
test r14b, 2
je 0x140055507
mov qword [rsp + 0x370], rdi
lea rcx, [rsp + 0x370]
call fcn.1400e712c
nop
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xce0]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140055558
test rbx, rbx
je 0x140055558
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
nop
jmp 0x140055567
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0xa0]
jmp 0x14005544b
mov eax, 0x8024
cmp ebx, eax
ja 0x140055795
je 0x140055747
sub ebx, 0x8019
je 0x1400556f9
dec ebx
je 0x1400556ab
dec ebx
je 0x14005565d
dec ebx
je 0x14005560f
sub ebx, 3
je 0x14005706b
cmp ebx, 4
jne 0x14005706b
lea rcx, [rsp + 0x930]
call fcn.140088618
nop
lea rcx, [rsp + 0x930]
call fcn.140088c14
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x940], rdi
lea rcx, [rsp + 0x940]
call fcn.1400e712c
nop
mov qword [rsp + 0x930], rdi
lea rcx, [rsp + 0x930]
jmp 0x14005544b
lea rcx, [rsp + 0x960]
call fcn.140088618
nop
lea rcx, [rsp + 0x960]
call fcn.14008880c
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x970], rdi
lea rcx, [rsp + 0x970]
call fcn.1400e712c
nop
mov qword [rsp + 0x960], rdi
lea rcx, [rsp + 0x960]
jmp 0x14005544b
lea rcx, [rsp + 0x990]
call fcn.140088618
nop
lea rcx, [rsp + 0x990]
call fcn.140088708
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x9a0], rdi
lea rcx, [rsp + 0x9a0]
call fcn.1400e712c
nop
mov qword [rsp + 0x990], rdi
lea rcx, [rsp + 0x990]
jmp 0x14005544b
lea rcx, [rsp + 0x9c0]
call fcn.140088618
nop
lea rcx, [rsp + 0x9c0]
call fcn.140088914
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x9d0], rdi
lea rcx, [rsp + 0x9d0]
call fcn.1400e712c
nop
mov qword [rsp + 0x9c0], rdi
lea rcx, [rsp + 0x9c0]
jmp 0x14005544b
lea rcx, [rsp + 0x9f0]
call fcn.140088618
nop
lea rcx, [rsp + 0x9f0]
call fcn.140088a10
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xa00], rdi
lea rcx, [rsp + 0xa00]
call fcn.1400e712c
nop
mov qword [rsp + 0x9f0], rdi
lea rcx, [rsp + 0x9f0]
jmp 0x14005544b
lea rcx, [rsp + 0xa20]
call fcn.140088618
nop
lea rcx, [rsp + 0xa20]
call fcn.140088b08
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xa30], rdi
lea rcx, [rsp + 0xa30]
call fcn.1400e712c
nop
mov qword [rsp + 0xa20], rdi
lea rcx, [rsp + 0xa20]
jmp 0x14005544b
cmp ebx, 0x8027
je 0x140055882
cmp ebx, 0x8031
je 0x14005586d
cmp ebx, 0x8032
jbe 0x14005706b
cmp ebx, 0x8034
jbe 0x14005586d
cmp ebx, 0x8036
je 0x1400557fd
cmp ebx, 0x8038
je 0x1400557e9
mov r8d, 0x804b
cmp ebx, r8d
jne 0x14005706b
jmp 0x140057059
cmp byte [r13 + 0x28], r15b
sete dl
mov rcx, r13
call fcn.1400f1de8
jmp 0x14005706b
or r8d, 0xffffffff
lea rdx, str.https:__www.facebook.com_myco.yonan.ro
lea rcx, [rsp + 0x3a0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x228], r15
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x3a0]
call fcn.1400ed6b0
mov qword [rsp + 0x220], rdi
lea rcx, [rsp + 0x220]
call fcn.1400e712c
nop
mov qword [rsp + 0x3a0], rdi
lea rcx, [rsp + 0x3a0]
jmp 0x14005544b
test rsi, rsi
je 0x14005706b
mov r8, rbx
mov rcx, qword [rsi + 8]
jmp 0x14005705d
or r8d, 0xffffffff
lea rdx, str.shwebsvc.dll__AddNetPlaceRunDll
lea rcx, [rsp + 0x3e0]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x3c0]
call fcn.1400e6fc8
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x3c0]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x3c0], rdi
lea rcx, [rsp + 0x3c0]
call fcn.1400e712c
nop
mov qword [rsp + 0x3e0], rdi
lea rcx, [rsp + 0x3e0]
jmp 0x14005544b
mov rdx, r13
lea rcx, [rsp + 0x730]
call fcn.140065274
nop
movzx edi, word [rsp + 0x748]
mov rax, qword [rsp + 0x740]
test rax, rax
je 0x140055926
mov rbx, qword [rax + 8]
jmp 0x140055929
mov rbx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, r12
jne 0x140055fbd
mov ebx, dword [rsp + 0x788]
cmp ebx, 0xa
jne 0x1400559d7
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xf0], r15
lea edx, [rbx - 3]
lea rcx, [rsp + 0xe8]
call fcn.1400e7ab4
lea rdx, [0x14012da68]
cmp qword [rsp + 0xf0], r15
cmovne rdx, qword [rsp + 0xf0]
xor r9d, r9d
lea r8, str.Message
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov qword [rsp + 0xe8], rdi
lea rcx, [rsp + 0xe8]
call fcn.1400e712c
jmp 0x140055fbd
test ebx, ebx
jne 0x140055afb
mov ecx, 0x3758
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x1400559fc
mov rcx, rax
call fcn.140079da0
mov rbx, rax
jmp 0x1400559ff
mov rbx, r15
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
nop
lea rcx, [rbx + 0x50]
mov rdx, rax
call fcn.1400e7b9c
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x880], rdi
lea rcx, [rsp + 0x880]
call fcn.1400e712c
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
nop
lea rcx, [rbx + 0x60]
mov rdx, rax
call fcn.1400e7b9c
nop
mov qword [rsp + 0x950], rdi
lea rcx, [rsp + 0x950]
call fcn.1400e712c
mov eax, dword [rsp + 0x7c0]
mov dword [rbx + 0x3748], eax
lea rdx, [rsp + 0xda0]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140055ad0
mov rax, qword [rbx]
mov rcx, rbx
mov edx, r12d
call qword [rax]
jmp 0x140055fbd
lea r9, [rbx + 0x30]
mov qword [r9 + 0x3720], rbx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
lea r8, [0x14007a764]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x140055fbd
cmp ebx, 2
jne 0x140055cc7
mov ecx, 0x108
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055b26
mov rcx, rax
call fcn.14005a6c0
mov rsi, rax
jmp 0x140055b29
mov rsi, r15
test rsi, rsi
je 0x140055fbd
or r8d, 0xffffffff
lea r14, [0x14012da68]
mov rdx, r14
lea rcx, [rsp + 0x400]
call fcn.1400e6fc8
nop
lea rdx, [rsp + 0x8c0]
lea rcx, [rsp + 0x730]
call fcn.1400510b4
mov rdi, rax
lea rdx, [rsp + 0x9e0]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
mov rbx, rax
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
nop
lea rcx, [rsp + 0x400]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x7c0]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.14005a99c
mov bl, al
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x8a0], rdi
lea rcx, [rsp + 0x8a0]
call fcn.1400e712c
nop
mov qword [rsp + 0x9e0], rdi
lea rcx, [rsp + 0x9e0]
call fcn.1400e712c
nop
mov qword [rsp + 0x8c0], rdi
lea rcx, [rsp + 0x8c0]
call fcn.1400e712c
nop
mov qword [rsp + 0x400], rdi
lea rcx, [rsp + 0x400]
call fcn.1400e712c
test bl, bl
jne 0x140055c47
xor r9d, r9d
lea r8, str.Message
lea rdx, str.Connection_error_
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, qword [rsi]
mov rcx, rsi
jmp 0x140055ac6
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055c6f
mov r9, rsi
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov rbx, rax
jmp 0x140055c72
mov rbx, r15
test rbx, rbx
je 0x140055c3c
lea rcx, [rsp + 0xd00]
or r8d, 0xffffffff
mov rdx, r14
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140055fbd
mov rax, qword [rbx]
mov edx, r12d
mov rcx, rbx
call qword [rax]
jmp 0x140055c3c
cmp ebx, 3
jne 0x140055e32
mov ecx, 0x6e8
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055cf2
mov rcx, rax
call fcn.1400768f4
mov rsi, rax
jmp 0x140055cf5
mov rsi, r15
test rsi, rsi
je 0x140055fbd
or r8d, 0xffffffff
lea r14, [0x14012da68]
mov rdx, r14
lea rcx, [rsp + 0x420]
call fcn.1400e6fc8
nop
lea rdx, [rsp + 0xa40]
lea rcx, [rsp + 0x730]
call fcn.1400510b4
mov rdi, rax
lea rdx, [rsp + 0x8e0]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
mov rbx, rax
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
nop
lea rcx, [rsp + 0x420]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x7c0]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140076ae4
mov bl, al
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x980], rdi
lea rcx, [rsp + 0x980]
call fcn.1400e712c
nop
mov qword [rsp + 0x8e0], rdi
lea rcx, [rsp + 0x8e0]
call fcn.1400e712c
nop
mov qword [rsp + 0xa40], rdi
lea rcx, [rsp + 0xa40]
call fcn.1400e712c
nop
mov qword [rsp + 0x420], rdi
lea rcx, [rsp + 0x420]
call fcn.1400e712c
test bl, bl
je 0x140055c21
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055e19
mov r9, rsi
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov rbx, rax
jmp 0x140055e1c
mov rbx, r15
test rbx, rbx
je 0x140055c3c
lea rcx, [rsp + 0xdc0]
jmp 0x140055c7f
cmp ebx, r12d
jne 0x140055f9d
mov ecx, 0x648
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055e5d
mov rcx, rax
call fcn.140070e6c
mov rsi, rax
jmp 0x140055e60
mov rsi, r15
test rsi, rsi
je 0x140055fbd
or r8d, 0xffffffff
lea r14, [0x14012da68]
mov rdx, r14
lea rcx, [rsp + 0x440]
call fcn.1400e6fc8
nop
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x730]
call fcn.1400510b4
mov rdi, rax
lea rdx, [rsp + 0x9b0]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
mov rbx, rax
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
nop
lea rcx, [rsp + 0x440]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x7c0]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.14007105c
mov bl, al
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x900], rdi
lea rcx, [rsp + 0x900]
call fcn.1400e712c
nop
mov qword [rsp + 0x9b0], rdi
lea rcx, [rsp + 0x9b0]
call fcn.1400e712c
nop
mov qword [rsp + 0x840], rdi
lea rcx, [rsp + 0x840]
call fcn.1400e712c
nop
mov qword [rsp + 0x440], rdi
lea rcx, [rsp + 0x440]
call fcn.1400e712c
test bl, bl
je 0x140055c21
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140055f84
mov r9, rsi
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov rbx, rax
jmp 0x140055f87
mov rbx, r15
test rbx, rbx
je 0x140055c3c
lea rcx, [rsp + 0xd20]
jmp 0x140055c7f
lea eax, [rbx - 4]
cmp eax, r12d
jbe 0x14005618e
lea eax, [rbx - 6]
cmp eax, r12d
jbe 0x14005603a
lea eax, [rbx - 8]
cmp eax, r12d
jbe 0x140055fcf
lea rcx, [rsp + 0x730]
call fcn.14006536c
jmp 0x14005706b
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], r15
mov edx, 7
lea rcx, [rsp + 0x108]
call fcn.1400e7ab4
lea rdx, [0x14012da68]
cmp qword [rsp + 0x110], r15
cmovne rdx, qword [rsp + 0x110]
xor r9d, r9d
lea r8, str.Message
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov qword [rsp + 0x108], rdi
lea rcx, [rsp + 0x108]
jmp 0x1400559cd
mov ecx, 0x2a8
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400560c8
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x730]
call fcn.1400510b4
mov rdi, rax
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
mov rbx, rax
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
nop
mov r14d, 0x38000
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x7c0]
mov r8, rax
mov rdx, r13
mov rcx, rsi
call fcn.14006a94c
mov rbx, rax
jmp 0x1400560cb
mov rbx, r15
lea rdi, vtable.micro::utils::QString.0
bt r14d, 0x11
jae 0x1400560f9
btr r14d, 0x11
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x850], rdi
lea rcx, [rsp + 0x850]
call fcn.1400e712c
nop
bt r14d, 0x10
jae 0x140056120
btr r14d, 0x10
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x870], rdi
lea rcx, [rsp + 0x870]
call fcn.1400e712c
nop
bt r14d, 0xf
jae 0x14005613c
mov qword [rsp + 0x890], rdi
lea rcx, [rsp + 0x890]
call fcn.1400e712c
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xde0]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rbx
call fcn.1400f2280
test al, al
jne 0x140055fbd
test rbx, rbx
je 0x140055fbd
jmp 0x140055ac0
mov ecx, 0x648
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400561b3
cmp ebx, 5
sete dl
mov rcx, rax
call fcn.140090964
jmp 0x1400561b6
mov rax, r15
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140055fbd
lea rdx, [rsp + 0x8f0]
lea rcx, [rsp + 0x730]
call fcn.1400510b4
mov r14, rax
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0x730]
call fcn.1400395cc
mov rsi, rax
lea rdx, [rsp + 0x8b0]
lea rcx, [rsp + 0x730]
call fcn.1400510d8
mov rdi, rax
mov ebx, dword [rsp + 0x7c0]
mov rcx, qword [rsp + 0x50]
add rcx, 0xb0
mov rdx, rax
call fcn.1400e7b9c
mov rcx, qword [rsp + 0x50]
add rcx, 0xe8
mov dword [rsp + 0x20], ebx
mov r9, r14
mov r8, rsi
mov rdx, rdi
call fcn.140090280
mov rbx, qword [rsp + 0x50]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x88]
mov dword [rbx + 0x80], r15d
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x8b0], rdi
lea rcx, [rsp + 0x8b0]
call fcn.1400e712c
nop
mov qword [rsp + 0x8d0], rdi
lea rcx, [rsp + 0x8d0]
call fcn.1400e712c
nop
mov qword [rsp + 0x8f0], rdi
lea rcx, [rsp + 0x8f0]
call fcn.1400e712c
mov ecx, 0x178
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400562cd
mov r9, rbx
mov rdx, r13
mov rcx, rax
call fcn.14003b850
mov rdi, rax
jmp 0x1400562d0
mov rdi, r15
test rdi, rdi
je 0x140055ac0
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd40]
call fcn.1400e6fc8
mov ecx, dword [r13 + 0x930]
lea rdx, [rcx + rcx*4]
shl rdx, 5
lea rcx, [r13 + 0x7f0]
add rcx, rdx
mov r8, rax
mov rdx, rdi
call fcn.1400f2280
test al, al
jne 0x140055fbd
mov rax, qword [rdi]
mov edx, r12d
mov rcx, rdi
call qword [rax]
jmp 0x140055ac0
mov eax, 0x8082
cmp ebx, eax
ja 0x140056a2a
je 0x1400569ba
mov eax, 0x8079
cmp ebx, eax
ja 0x1400566d0
je 0x140056660
lea r8d, [rax - 0x26]
sub ebx, r8d
je 0x140057059
sub ebx, 2
je 0x1400565da
sub ebx, 0x1f
je 0x140056562
dec ebx
je 0x1400564f2
dec ebx
je 0x14005647a
dec ebx
je 0x14005640a
dec ebx
jne 0x14005706b
or r8d, 0xffffffff
lea rdx, [0x14011b428]
lea rcx, [rsp + 0x480]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.taskschd.msc
lea rcx, [rsp + 0x460]
call fcn.1400e6fc8
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x460]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x460], rdi
lea rcx, [rsp + 0x460]
call fcn.1400e712c
nop
mov qword [rsp + 0x480], rdi
lea rcx, [rsp + 0x480]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.printmanagement.msc
lea rcx, [rsp + 0x4a0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], r15
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x4a0]
call fcn.1400ed6b0
mov qword [rsp + 0x240], rdi
lea rcx, [rsp + 0x240]
call fcn.1400e712c
nop
mov qword [rsp + 0x4a0], rdi
lea rcx, [rsp + 0x4a0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, [0x14011b428]
lea rcx, [rsp + 0x4e0]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.secpol.msc
lea rcx, [rsp + 0x4c0]
call fcn.1400e6fc8
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x4c0]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x4c0], rdi
lea rcx, [rsp + 0x4c0]
call fcn.1400e712c
nop
mov qword [rsp + 0x4e0], rdi
lea rcx, [rsp + 0x4e0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.WF.msc
lea rcx, [rsp + 0x500]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x260], rdi
mov qword [rsp + 0x268], r15
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x500]
call fcn.1400ed6b0
mov qword [rsp + 0x260], rdi
lea rcx, [rsp + 0x260]
call fcn.1400e712c
nop
mov qword [rsp + 0x500], rdi
lea rcx, [rsp + 0x500]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str._NoExit__ImportSystemModules
lea rcx, [rsp + 0x540]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.powershell.exe
lea rcx, [rsp + 0x520]
call fcn.1400e6fc8
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x520]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x520], rdi
lea rcx, [rsp + 0x520]
call fcn.1400e712c
nop
mov qword [rsp + 0x540], rdi
lea rcx, [rsp + 0x540]
jmp 0x14005544b
test rsi, rsi
je 0x14005706b
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], r15
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x14005664b
mov rax, qword [rcx]
lea rdx, [rsp + 0x118]
call qword [rax + 0x208]
mov qword [rsp + 0x910], rdi
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x918], rax
test rax, rax
je 0x140056636
lock add dword [rax - 0xc], r12d
lea rcx, [r13 + 0x448]
lea rdx, [rsp + 0x910]
call fcn.14003fad0
nop
mov qword [rsp + 0x118], rdi
lea rcx, [rsp + 0x118]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.services.msc
lea rcx, [rsp + 0x390]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x280], rdi
mov qword [rsp + 0x288], r15
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x390]
call fcn.1400ed6b0
mov qword [rsp + 0x280], rdi
lea rcx, [rsp + 0x280]
call fcn.1400e712c
nop
mov qword [rsp + 0x390], rdi
lea rcx, [rsp + 0x390]
jmp 0x14005544b
sub ebx, 0x807a
je 0x140056942
sub ebx, 2
je 0x1400568ca
sub ebx, 2
je 0x140056852
dec ebx
je 0x1400567e2
dec ebx
je 0x140056772
dec ebx
jne 0x14005706b
or r8d, 0xffffffff
lea rdx, str.odbcad32.exe
lea rcx, [rsp + 0x580]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2a0], rdi
mov qword [rsp + 0x2a8], r15
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x580]
call fcn.1400ed6b0
mov qword [rsp + 0x2a0], rdi
lea rcx, [rsp + 0x2a0]
call fcn.1400e712c
nop
mov qword [rsp + 0x580], rdi
lea rcx, [rsp + 0x580]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.comexp.msc
lea rcx, [rsp + 0x5a0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2c8], r15
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x5a0]
call fcn.1400ed6b0
mov qword [rsp + 0x2c0], rdi
lea rcx, [rsp + 0x2c0]
call fcn.1400e712c
nop
mov qword [rsp + 0x5a0], rdi
lea rcx, [rsp + 0x5a0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.MdSched.exe
lea rcx, [rsp + 0x5c0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x2e0], rdi
mov qword [rsp + 0x2e8], r15
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x5c0]
call fcn.1400ed6b0
mov qword [rsp + 0x2e0], rdi
lea rcx, [rsp + 0x2e0]
call fcn.1400e712c
nop
mov qword [rsp + 0x5c0], rdi
lea rcx, [rsp + 0x5c0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, [0x14011b428]
lea rcx, [rsp + 0x600]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.eventvwr.msc
lea rcx, [rsp + 0x5e0]
call fcn.1400e6fc8
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x5e0]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x5e0], rdi
lea rcx, [rsp + 0x5e0]
call fcn.1400e712c
nop
mov qword [rsp + 0x600], rdi
lea rcx, [rsp + 0x600]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str._res
lea rcx, [rsp + 0x640]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.perfmon.exe
lea rcx, [rsp + 0x620]
call fcn.1400e6fc8
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x620]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x620], rdi
lea rcx, [rsp + 0x620]
call fcn.1400e712c
nop
mov qword [rsp + 0x640], rdi
lea rcx, [rsp + 0x640]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, [0x14011b428]
lea rcx, [rsp + 0x680]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.perfmon.msc
lea rcx, [rsp + 0x660]
call fcn.1400e6fc8
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x660]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x660], rdi
lea rcx, [rsp + 0x660]
call fcn.1400e712c
nop
mov qword [rsp + 0x680], rdi
lea rcx, [rsp + 0x680]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.iscsicpl.exe
lea rcx, [rsp + 0x6a0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x300], rdi
mov qword [rsp + 0x308], r15
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x6a0]
call fcn.1400ed6b0
mov qword [rsp + 0x300], rdi
lea rcx, [rsp + 0x300]
call fcn.1400e712c
nop
mov qword [rsp + 0x6a0], rdi
lea rcx, [rsp + 0x6a0]
jmp 0x14005544b
mov r8d, 0x8093
cmp ebx, r8d
ja 0x140056d92
je 0x140057059
cmp ebx, 0x8083
je 0x140056d22
cmp ebx, 0x8084
je 0x140056cb2
cmp ebx, 0x8086
jbe 0x14005706b
cmp ebx, 0x8088
jbe 0x140056c93
cmp ebx, 0x808b
je 0x140056b57
cmp ebx, 0x808d
je 0x140056b2c
cmp ebx, 0x8091
jne 0x14005706b
mov r8, r13
mov edx, 0x26ad
lea rcx, [rsp + 0xc30]
call fcn.140037888
lea rax, vtable.mc::MyProcListDialog.0
mov qword [rsp + 0xc30], rax
mov qword [rsp + 0xc90], r15
mov byte [rsp + 0xc98], r15b
lea rax, vtable.micro::gui::QListCtrl.0
mov qword [rsp + 0xc88], rax
movzx ebx, word [rsp + 0xc48]
mov rax, qword [rsp + 0xc40]
test rax, rax
je 0x140056aef
mov r15, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0xc30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, r15
mov rdx, rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, [rsp + 0xc30]
call fcn.14006d324
jmp 0x14005706b
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x140056b4a
mov rdx, r13
mov rcx, rax
call fcn.140048580
mov r15, rax
lea rcx, [rsp + 0xdd0]
jmp 0x1400548aa
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.1400526f0
movsxd rsi, eax
mov dword [rsp + 0x20], r15d
lea r9, [0x140176b60]
lea r8, [0x140175f00]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll___RTDynamicCast
test rax, rax
je 0x140056c54
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x140056c11
mov qword [rax + 8], r15
mov qword [rax + 0x20], r15
lea rax, vtable.micro::files::QPathStr.0
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x10], r13
mov byte [rdi + 0x28], r15b
lea rax, vtable.mc::MyExplorerViewer.0
mov qword [rdi], rax
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x38], r15
mov rcx, qword [rdi + 0x30]
cmp rcx, rbx
je 0x140056c14
test rcx, rcx
je 0x140056bfe
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rdi + 0x30], r15
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rdi + 0x30], rax
jmp 0x140056c14
mov rdi, r15
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xd60]
call fcn.1400e6fc8
lea r8, [rsi + rsi*4]
shl r8, 5
lea rcx, [r13 + 0x7f0]
add rcx, r8
mov r8, rax
mov rdx, rdi
call fcn.1400f2280
nop
lea rcx, [rsp + 0x40]
jmp 0x1400545bf
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x140056c72
mov rdx, r13
mov rcx, rax
call fcn.140048580
mov r15, rax
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rsp + 0xcc0]
call fcn.1400e6fc8
lea rdx, [rsi + rsi*4]
jmp 0x1400548c5
test rsi, rsi
je 0x14005706b
cmp ebx, 0x8087
sete dl
mov rcx, rsi
call fcn.14003bda0
jmp 0x14005706b
or r8d, 0xffffffff
lea rdx, str.msconfig.exe
lea rcx, [rsp + 0x6c0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x320], rdi
mov qword [rsp + 0x328], r15
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x6c0]
call fcn.1400ed6b0
mov qword [rsp + 0x320], rdi
lea rcx, [rsp + 0x320]
call fcn.1400e712c
nop
mov qword [rsp + 0x6c0], rdi
lea rcx, [rsp + 0x6c0]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.compmgmt.msc
lea rcx, [rsp + 0x6e0]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x340], rdi
mov qword [rsp + 0x348], r15
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x6e0]
call fcn.1400ed6b0
mov qword [rsp + 0x340], rdi
lea rcx, [rsp + 0x340]
call fcn.1400e712c
nop
mov qword [rsp + 0x6e0], rdi
lea rcx, [rsp + 0x6e0]
jmp 0x14005544b
mov r8d, 0x8098
sub ebx, r8d
je 0x140057059
dec ebx
je 0x140057053
sub ebx, 0x1b
je 0x140056fd4
sub ebx, 2
je 0x140056eb1
sub ebx, 5
je 0x140056e39
cmp ebx, 0x2d
jne 0x14005706b
or r8d, 0xffffffff
lea rdx, str.msinfo32.exe
lea rcx, [rsp + 0x700]
call fcn.1400e6fc8
nop
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x360], rdi
mov qword [rsp + 0x368], r15
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x700]
call fcn.1400ed6b0
mov qword [rsp + 0x360], rdi
lea rcx, [rsp + 0x360]
call fcn.1400e712c
nop
mov qword [rsp + 0x700], rdi
lea rcx, [rsp + 0x700]
jmp 0x14005544b
or r8d, 0xffffffff
lea rdx, str.srchadmin.dll
lea rcx, [rsp + 0x3b0]
call fcn.1400e6fc8
nop
or r8d, 0xffffffff
lea rdx, str.control.exe
lea rcx, [rsp + 0x380]
call fcn.1400e6fc8
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x380]
call fcn.1400ed6b0
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x380], rdi
lea rcx, [rsp + 0x380]
call fcn.1400e712c
nop
mov qword [rsp + 0x3b0], rdi
lea rcx, [rsp + 0x3b0]
jmp 0x14005544b
test rsi, rsi
je 0x140054238
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov r8, r13
mov edx, 0x81bb
lea rcx, [rsp + 0xb60]
call fcn.140037888
mov qword [rsp + 0xbc0], r15
lea rax, vtable.mc::MyDirWatchDialog.1.0
mov qword [rsp + 0xb60], rax
lea rax, vtable.mc::MyDirWatchDialog.0
mov qword [rsp + 0xbb8], rax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0xbc8], rax
mov byte [rsp + 0xbe0], r15b
lea rax, vtable.micro::gui::QEdit.0
mov qword [rsp + 0xbd0], rax
mov qword [rsp + 0xbd8], r15
mov qword [rsp + 0xc08], r15
mov byte [rsp + 0xc10], r15b
lea rax, vtable.micro::gui::QListCtrl.0
mov qword [rsp + 0xc00], rax
lea rcx, [rsp + 0xc0]
call fcn.1400377d0
movzx ebx, word [rsp + 0xb78]
mov rax, qword [rsp + 0xb70]
test rax, rax
je 0x140056f97
mov r15, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0xb60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, r15
mov rdx, rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, [rsp + 0xb60]
call fcn.140042a74
jmp 0x14005706b
mov r8, r13
mov edx, 0x7dcc
lea rcx, [rsp + 0xb00]
call fcn.140037888
lea rdi, vtable.mc::MySyncDialog.0
mov qword [rsp + 0xb00], rdi
movzx ebx, word [rsp + 0xb18]
mov rax, qword [rsp + 0xb10]
test rax, rax
je 0x140057011
mov r15, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rax, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ecad8]
mov r8, r15
mov rdx, rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [rsp + 0xb00], rdi
lea rcx, [rsp + 0xb00]
call fcn.140037948
jmp 0x14005706b
mov r8d, 0x8099
mov rcx, qword [rdi + 8]
mov edx, 0x111
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, r12b
mov rcx, qword [rsp + 0x1d40]
xor rcx, rsp
call fcn.140001010
add rsp, 0x1d50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret