Function at 0x14000b840
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x140210618], rax
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140210620], rax
call fcn.14000d42c
lea rsi, [0x14020b760]
mov qword [0x140210610], rsi
call fcn.140073190
call fcn.140071d60
call fcn.140071b30
call fcn.14006f470
call fcn.14006c958
call fcn.14006be10
call fcn.14006b688
call fcn.14006a66c
call fcn.14006a3e4
call fcn.140069e90
call fcn.140069810
call fcn.140064d30
call fcn.14006370c
call fcn.140062880
call fcn.140061b6c
call fcn.14005f15c
call fcn.14005d0d0
call fcn.14005cd28
call fcn.14005b490
call fcn.14005a0a0
call fcn.14003c220
call fcn.14003b994
lea rbp, [0x140210650]
mov rdx, rbp
lea rcx, [0x1402104c0]
call fcn.140072bf0
mov rdx, rbp
lea rcx, [0x1402104b8]
call fcn.140072bf0
call fcn.14000d410
mov byte [0x1402104d0], 1
call fcn.14003bb7c
mov qword [0x1402105e8], rax
call fcn.140065b84
mov dword [rsp + 0x20], 0x200
lea r9, [0x140210638]
lea r8, [0x140209020]
mov edx, 7
mov ecx, 0x40
call fcn.1400626c4
mov dword [rsp + 0x20], 0x200
lea r9, [0x140210630]
xor r8d, r8d
mov edx, reloc.WS2_32.dll_setsockopt
mov ecx, 8
call fcn.1400626c4
lea rcx, [0x140210500]
call sub.KERNEL32.dll_InitializeCriticalSection
lea rdx, str.__0_9___
mov rcx, 0xffffffffffffffff
call fcn.14003bcd0
mov qword [0x140210538], rax
call fcn.14003bb7c
mov qword [0x140210530], rax
call fcn.14003bb7c
mov qword [0x140210528], rax
call fcn.14003bb7c
mov qword [0x1402105f0], rax
mov dword [rsp + 0x20], 0x200
lea r9, [0x140210648]
lea r8, reloc.WS2_32.dll_ntohl
mov edx, 7
mov ecx, gethostname
call fcn.1400626c4
lea rbx, str.config_program_kitShutdown_enable
mov rcx, rbx
call fcn.1400041b0
test rax, rax
jne 0x14000bea8
mov dword [rsp + 0x20], 0x200
lea r9, [0x140210640]
lea r8, [0x1402090a0]
mov edx, 7
mov ecx, gethostbyname
call fcn.1400626c4
call fcn.14003bb7c
mov qword [0x1402105e0], rax
mov rcx, rbx
call fcn.1400041b0
test rax, rax
jne 0x14000bf00
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, 0x98
lea rbx, str.rooconfig.pbi
mov rdx, rbx
lea r12, [0x14020aa60]
mov rcx, r12
call fcn.140001fc0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.140059968
call fcn.140072d60
mov rdi, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rdi
call fcn.140064280
call fcn.140072d60
mov rcx, rax
call fcn.140064484
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, str.___WIN
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.140004bb0
call fcn.140072ca0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, 0x9c
mov rdx, rbx
call fcn.140001fc0
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, str.STRART
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.140059968
call fcn.140072ca0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, 0x9d
mov rdx, rbx
call fcn.140001fc0
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, str.___VER
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.140059968
call fcn.140072d60
mov rdi, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rdi
call fcn.1400053a0
call fcn.140072ca0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, 0x9e
mov rdx, rbx
call fcn.140001fc0
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, str.Hardware_ID
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
movsxd rcx, eax
call fcn.140072f30
call fcn.140072b60
lea rdi, [rsp + 0x80]
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
xor eax, eax
rep stosq qword [rdi], rax
xor eax, eax
mov word [rdi], ax
lea rcx, [rsp + 0x80]
call sub.ADVAPI32.dll_GetCurrentHwProfileW
call fcn.140072d90
lea rcx, [rsp + 0x84]
mov edx, 0x27
call fcn.140073020
call fcn.140072d60
call fcn.140072ca0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, SHCreateDirectory
mov rdx, rbx
call fcn.140001fc0
call fcn.140072cf0
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, SHCreateDirectory
mov rdx, rbx
mov rcx, r12
call fcn.140001fc0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.140059968
lea rcx, str.rooConfig.json
call fcn.140072ec0
call fcn.140072d60
mov rbx, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140064280
call fcn.140072ea0
call fcn.140072d60
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
call fcn.140072b60
lea rbx, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140072bf0
lea rcx, [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
call fcn.140072bf0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072ea0
mov rdi, qword [0x140210638]
call fcn.140072d60
mov rdx, rax
mov rcx, rdi
call fcn.14006233c
mov rdi, rax
call fcn.140072cf0
test rdi, rdi
je 0x14000bf58
lea r12, [rsp + 0x60]
lea rdi, [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
call fcn.140072e80
mov rcx, qword [rsp + 0x58]
call fcn.140072e80
call fcn.140072cf0
lea rcx, str.config_servers_ftp_
call fcn.140005f10
lea rcx, str.config_servers_email_
call fcn.140005f10
call fcn.14000d3ac
mov rsi, rax
call fcn.140072b60
mov qword [rsp + 0x78], 0
lea rdx, str.___a_zA_Z___d_a_zA_Z_
xor ecx, ecx
call fcn.14003bcd0
lea rdx, str.Sunday
mov qword [0x140210610], rdx
mov ebx, 1
nop dword [rax]
mov rcx, rdi
call fcn.140072f70
add qword [0x140210610], rax
call fcn.140072d90
mov rcx, qword [rsp + 0x78]
call fcn.140072ec0
call fcn.140072ca0
mov rdx, qword [rsi]
lea rcx, [rdx + rbx*8]
mov edx, eax
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x78]
call fcn.14006fd80
call fcn.140072ca0
mov edx, eax
mov rcx, rdi
call fcn.140072df0
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x78]
call fcn.140062308
mov qword [rax], rbx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov r8d, eax
mov edx, 3
mov rcx, qword [rsp + 0x78]
call fcn.14006fb10
call fcn.140072d20
mov rdx, rax
mov rcx, qword [rsi + 0x20]
call fcn.140062308
mov qword [rax], rbx
add rbx, 1
cmp rbx, 8
je 0x14000c738
mov rdx, qword [0x140210610]
jmp 0x14000bde8
call fcn.140072b60
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_CreateTimerQueue
mov rdx, rax
mov qword [0x1402105a8], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x493e0
mov qword [rsp + 0x20], 0x493e0
mov r9d, 1
lea r8, [0x140006810]
call sub.KERNEL32.dll_CreateTimerQueueTimer
jmp 0x14000ba07
call fcn.140072b60
mov qword [rsp + 0x48], 0
call sub.KERNEL32.dll_CreateTimerQueue
mov rdx, rax
mov qword [0x1402105a0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x493e0
mov qword [rsp + 0x20], 0x493e0
mov r9d, 1
lea r8, [0x140005ae0]
call sub.KERNEL32.dll_CreateTimerQueueTimer
jmp 0x14000ba49
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.140072c60
test eax, eax
je 0x14000c0a0
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.140072c60
test eax, eax
je 0x14000c1d0
xor edx, edx
xor ecx, ecx
call fcn.14005f270
mov rbx, rax
lea r12, [rsp + 0x60]
lea rdi, [rsp + 0x78]
test rbx, rbx
je 0x14000c3fe
mov rcx, qword [0x140210528]
mov rax, qword [0x1401e4910]
call qword [rax]
call fcn.140072d90
mov rcx, qword [rsp + 0x50]
call fcn.140072ec0
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov qword [rax + 0x10], 0
mov rcx, qword [0x140210528]
mov rax, qword [0x1401e4920]
call qword [rax]
call fcn.140072d90
mov rcx, qword [rsp + 0x58]
call fcn.140072ec0
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 8]
mov edx, eax
call fcn.140072df0
jmp 0x14000bd7c
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140003170
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
mov rcx, qword [rsp + 0x50]
call fcn.1400640c8
test rax, rax
js 0x14000c140
mov rcx, qword [0x140210638]
call fcn.14006254c
nop dword [rax]
mov rcx, qword [0x140210638]
call fcn.140062588
test rax, rax
je 0x14000bf6d
mov rax, qword [0x140210638]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.140072c60
test eax, eax
je 0x14000c0e8
mov rax, qword [0x140210638]
mov rax, qword [rax]
lea r12, [rsp + 0x60]
lea rdi, [rsp + 0x78]
cmp qword [rax + 0x20], 0
jne 0x14000bd7c
jmp 0x14000bf6d
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140063fb8
call fcn.140072d60
mov rcx, rax
call fcn.1400640c8
mov rdi, rax
call fcn.140072cf0
test rdi, rdi
js 0x14000c0d9
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140063fb8
call fcn.140072d60
mov rdi, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rdi
call fcn.140003170
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
jmp 0x14000c0d9
mov rcx, qword [rsp + 0x50]
call fcn.1400640c8
test rax, rax
jle 0x14000c2c4
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
call fcn.140072b60
lea r12, [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.140072bf0
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140072bf0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
call fcn.140072b60
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140072bf0
lea rdi, [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140072bf0
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call fcn.140064ad0
mov r13, rax
test rax, rax
jne 0x14000c32a
mov rcx, qword [rsp + 0x70]
call fcn.140072e80
mov rcx, qword [rsp + 0x78]
call fcn.140072e80
mov rcx, r13
call fcn.1400716d0
mov r8, rax
xor r9d, r9d
mov rdx, r13
xor ecx, ecx
call fcn.14005f2e4
mov rbx, rax
mov rcx, r13
call fcn.1400718e0
mov rcx, qword [rsp + 0x60]
call fcn.140072e80
mov rcx, qword [rsp + 0x68]
call fcn.140072e80
jmp 0x14000bf98
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140064280
call fcn.140072d60
mov rcx, rax
call fcn.1400640c8
mov rsi, rax
call fcn.140072cf0
cmp rsi, 0xfffffffffffffffe
je 0x14000c3a6
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.14005f3fc
test rax, rax
je 0x14000c3e9
lea r12, [rsp + 0x60]
lea rdi, [rsp + 0x78]
jmp 0x14000bfa1
mov rcx, rax
call fcn.140064bd0
mov r14, rax
mov rcx, rax
call fcn.1400716f0
mov rbx, rax
test rax, rax
jne 0x14000c355
mov rcx, r13
call fcn.140064c30
mov r13, rbx
jmp 0x14000c274
mov r8, r14
mov rdx, rax
mov rcx, r13
call fcn.140064d60
test rax, rax
je 0x14000c345
mov r8d, 4
mov rdx, rsi
mov rcx, rbx
call fcn.140071b50
test rax, rax
je 0x14000c345
lea rdx, [rbx + 4]
mov r9d, 1
lea r8, [r14 - 4]
mov rcx, qword [rsp + 0x78]
call fcn.140001010
mov rsi, rax
mov rcx, rbx
call fcn.1400718e0
mov rbx, rsi
jmp 0x14000c345
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140063fb8
call fcn.140072d60
mov rcx, rax
call fcn.14006441c
mov rsi, rax
call fcn.140072cf0
test rsi, rsi
je 0x14000c303
jmp 0x14000bf82
mov rdx, rbp
mov rcx, rbx
call fcn.140072f70
lea r12, [rsp + 0x60]
lea rdi, [rsp + 0x78]
call fcn.140072d90
mov rcx, qword [rsp + 0x50]
call fcn.140072ec0
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov qword [rax + 0x10], 0
call fcn.14005ea4c
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x20], ebx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.14005ea28
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 0x18]
mov edx, eax
call fcn.140072df0
call fcn.14005ea68
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x24], ebx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
lea rcx, [rax + 0x30]
lea rbx, str.init
mov rdx, rbx
call fcn.140072f70
call fcn.140072d90
call fcn.140072d90
lea rcx, str.JSON_ERROR
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rcx, qword [rax + 0x18]
call fcn.140072ec0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, str.json
mov r8d, 0x1a6
lea rsi, str.jsondata.pbi
mov rdx, rsi
call fcn.140001fc0
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, [0x14020b670]
call fcn.140072ec0
mov rcx, qword [rsp + 0x50]
call fcn.140072ec0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, str.json
mov r8d, 0x1a7
mov rdx, rsi
call fcn.140001fc0
call fcn.140072cf0
call fcn.140072d90
call fcn.140072d90
lea rcx, str.at_line
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
movsxd r13, dword [rax + 0x20]
call fcn.140072ca0
mov edx, eax
mov rcx, r13
call fcn.14006f9a0
call fcn.140072ca0
lea rcx, [0x14020b738]
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
movsxd r13, dword [rax + 0x24]
call fcn.140072ca0
mov edx, eax
mov rcx, r13
call fcn.14006f9a0
call fcn.140072ca0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, str.json
mov r8d, 0x1a8
mov rdx, rsi
call fcn.140001fc0
call fcn.140072cf0
jmp 0x14000bd7c
lea rdx, str.January
mov qword [0x140210610], rdx
mov ebx, 1
nop dword [rax + rax]
mov rcx, rdi
call fcn.140072f70
add qword [0x140210610], rax
call fcn.140072d90
mov rcx, qword [rsp + 0x78]
call fcn.140072ec0
call fcn.140072ca0
mov rdx, qword [rsi + 0x10]
lea rcx, [rdx + rbx*8]
mov edx, eax
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, qword [rsp + 0x78]
call fcn.14006fd80
call fcn.140072ca0
mov edx, eax
mov rcx, rdi
call fcn.140072df0
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsp + 0x78]
call fcn.140062308
mov qword [rax], rbx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov r8d, eax
mov edx, 3
mov rcx, qword [rsp + 0x78]
call fcn.14006fb10
call fcn.140072d20
mov rdx, rax
mov rcx, qword [rsi + 0x28]
call fcn.140062308
mov qword [rax], rbx
add rbx, 1
cmp rbx, 0xd
je 0x14000c810
mov rdx, qword [0x140210610]
jmp 0x14000c750
mov rcx, qword [rsp + 0x78]
call fcn.140072e80
call fcn.140072b60
call fcn.140006c90
mov rbx, rax
call fcn.1400650c8
sub rbx, rax
mov qword [0x1402104d8], rbx
call fcn.14005a214
call fcn.140061428
lea rax, [0x1402105f8]
mov qword [rsp + 0x20], rax
lea r9, [0x14020b910]
mov r8d, 8
mov edx, 1
mov ecx, 8
call fcn.14006984c
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
lea rcx, str.config_servers_email_server
call fcn.140004720
call fcn.140072ca0
mov edx, eax
lea rcx, [0x140210558]
call fcn.140072df0
lea rax, str.config_server_email_port
mov qword [rsp + 0x60], rax
call fcn.140072b60
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.140072bf0
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140003850
mov rbx, rax
test rax, rax
jne 0x14000cc80
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072ea0
mov rbx, qword [0x140210638]
call fcn.140072d60
mov rdx, rax
mov rcx, rbx
call fcn.14006233c
mov rbx, rax
call fcn.140072cf0
test rbx, rbx
jne 0x14000ccb0
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
call fcn.140072e80
mov qword [0x140210590], rbx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
lea rcx, str.config_servers_email_user
call fcn.140004720
call fcn.140072ca0
mov edx, eax
lea rcx, [0x140210540]
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
lea rcx, str.config_servers_email_ePassword
call fcn.140004720
call fcn.140072ca0
mov edx, eax
lea rbx, [0x140210580]
mov rcx, rbx
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
lea rcx, str.config_servers_email_from
call fcn.140004720
call fcn.140072ca0
mov edx, eax
lea rcx, [0x140210548]
call fcn.140072df0
mov rdx, qword [0x140210580]
mov rcx, rbp
call fcn.140072c60
test eax, eax
je 0x14000ce10
lea rax, str.config_servers_email_to
mov qword [rsp + 0x78], rax
call fcn.140072b60
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140072bf0
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.140003850
mov rbx, rax
test rax, rax
jne 0x14000cfe0
call fcn.14005ea4c
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x20], ebx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.14005ea28
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 0x18]
mov edx, eax
call fcn.140072df0
call fcn.14005ea68
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x24], ebx
call fcn.140072d90
mov rcx, qword [rsp + 0x78]
call fcn.140072ec0
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 0x28]
mov edx, eax
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
lea rcx, [rax + 0x30]
lea rdx, str.GetArrayString
call fcn.140072f70
mov rcx, qword [rsp + 0x78]
call fcn.140072e80
call sub.ICMP.DLL_IcmpCreateFile
mov qword [0x1402104c8], rax
lea rdx, str.Dnsapi.dll
mov rcx, 0xffffffffffffffff
call fcn.14005cf34
mov rbx, rax
test rax, rax
je 0x14000d070
lea rdx, str.DnsQuery_W
mov rcx, rax
call fcn.14005cfcc
mov qword [0x140210588], rax
lea rdx, str.DnsRecordListFree
mov rcx, rbx
call fcn.14005cfcc
mov qword [0x140210578], rax
cmp qword [0x140210588], 0
je 0x14000d068
test rax, rax
je 0x14000d068
mov qword [0x140210598], rbx
lea rdx, str.___a_zA_Z._______a_zA_Z_.___a_zA_Z.__
mov rcx, 0xffffffffffffffff
call fcn.14003bcd0
mov qword [0x140210570], rax
lea r8, str.roo.monitor
mov edx, 1
xor ecx, ecx
call sub.KERNEL32.dll_CreateMutexW
mov rcx, rax
mov qword [0x1402105b0], rax
test rax, rax
jne 0x14000d080
call sub.KERNEL32.dll_CloseHandle
mov qword [rsp + 0x20], rbp
lea r9, [0x140210650]
mov r8d, gethostname
lea rdx, [0x14020b190]
lea rcx, str.ERROR:_Program_already_running
call fcn.140001fc0
call fcn.140008ca0
mov rcx, qword [0x140210620]
call sub.KERNEL32.dll_HeapDestroy
movsxd rcx, dword [0x140210628]
call sub.KERNEL32.dll_ExitProcess
mov rcx, rax
call fcn.14005e944
cmp rax, 2
jne 0x14000c8ce
mov rdx, rbx
lea rcx, [0x140001520]
call fcn.14005d8a8
mov rbx, rax
jmp 0x14000c91a
call fcn.14005ea4c
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x20], ebx
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov ecx, eax
call fcn.14005ea28
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 0x18]
mov edx, eax
call fcn.140072df0
call fcn.14005ea68
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov dword [rax + 0x24], ebx
call fcn.140072d90
mov rcx, qword [rsp + 0x60]
call fcn.140072ec0
call fcn.140072ea0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
mov rbx, rax
call fcn.140072ca0
lea rcx, [rbx + 0x28]
mov edx, eax
call fcn.140072df0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072d20
mov rdx, rax
mov rcx, qword [0x140210638]
call fcn.140062308
lea rcx, [rax + 0x30]
lea rdx, str.GetInteger
call fcn.140072f70
jmp 0x14000c918
call fcn.140072d90
call fcn.140072d90
mov rsi, qword [0x140210580]
call fcn.140072ca0
mov qword [rsp + 0x68], rsi
movsxd rcx, eax
call fcn.140072f30
call fcn.140072b60
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140072bf0
mov qword [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call fcn.140072c60
test eax, eax
je 0x14000cea0
call fcn.140072d90
mov rcx, qword [rsp + 0x70]
call fcn.140072ec0
call fcn.140072d60
mov rcx, qword [rsp + 0x70]
call fcn.140072e80
mov rcx, qword [rsp + 0x68]
call fcn.140072e80
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
jmp 0x14000c9d5
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
call fcn.140072b60
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140072bf0
mov rcx, qword [rsp + 0x78]
call fcn.14006f950
mov edx, 0x40
cmp rax, rdx
mov rcx, rdx
cmovge rcx, rax
call fcn.1400716f0
mov rsi, rax
mov rcx, qword [rsp + 0x78]
call fcn.14006f950
mov rcx, rax
call fcn.1400716f0
mov r12, rax
mov rcx, qword [rsp + 0x78]
call fcn.14006f980
mov r8, rax
mov r9d, 0x118
mov rdx, qword [rsp + 0x78]
mov rcx, r12
call fcn.140071b90
mov r13, rax
mov rcx, rsi
call fcn.1400716d0
mov r9, rax
mov r8, rsi
mov rdx, r13
mov rcx, r12
call fcn.140066c80
mov rdx, rax
mov r8d, 1
mov rcx, rsi
call fcn.140071810
mov rsi, rax
mov rcx, r12
call fcn.1400718e0
mov rcx, qword [rsp + 0x78]
call fcn.140072e80
mov rcx, rsi
call fcn.1400716d0
mov r8, rax
mov r9d, 9
mov rdx, rsi
mov rcx, rbp
call fcn.140001010
mov r12, rax
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, r12
call fcn.140071860
call fcn.140072d60
mov r13, rax
call fcn.140072ca0
mov r8d, eax
lea rdx, [0x14020b188]
mov rcx, r13
call fcn.1400713b0
call fcn.140072ca0
lea rcx, [rsp + 0x70]
mov edx, eax
call fcn.140072df0
mov rcx, rsi
call fcn.1400052c0
mov rcx, r12
call fcn.1400052c0
jmp 0x14000ce61
mov rcx, rax
call fcn.14005e944
cmp rax, 4
jne 0x14000ca0b
mov rcx, rbx
call fcn.14005ea14
test rax, rax
je 0x14000d016
xor r8d, r8d
mov rdx, qword [0x1402105f8]
mov rcx, rbx
call fcn.14005f910
jmp 0x14000cb62
call fcn.140072d90
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
xor ecx, ecx
call fcn.14006f9a0
call fcn.140072ea0
mov rbx, qword [0x140210638]
call fcn.140072d60
mov rdx, rax
mov rcx, rbx
call fcn.14006233c
mov rbx, rax
call fcn.140072cf0
test rbx, rbx
je 0x14000cb62
jmp 0x14000ca0b
mov rcx, rbx
call fcn.14005d078
xor ebx, ebx
jmp 0x14000cbda
call sub.KERNEL32.dll_GetLastError
cmp rax, 0xb7
jne 0x14000d099
mov rcx, qword [0x1402105b0]
jmp 0x14000cc21
call fcn.140072b60
lea r15, [0x14020b364]
lea r14, str.__Monitor_thread_created
lea rdi, str.main
lea rsi, [0x14020b190]
lea r13, str.Monitor_thread_completed___
lea r12, str..htaccess_Monitor_thread_crashed_
lea rbp, [0x140210650]
mov dword [rsp + 0x20], 0x23
mov r9, rdi
mov r8, rsi
xor edx, edx
lea rcx, [0x140008d00]
call fcn.1400018a0
mov rbx, rax
call fcn.140072d90
call fcn.140072d90
mov rcx, r15
call fcn.140072ec0
call fcn.140072d90
call fcn.140072d90
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.1400051e0
call fcn.140072ca0
mov rcx, r14
call fcn.140072ec0
call fcn.140072d60
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9, rbp
mov r8d, 0x24
mov rdx, rsi
call fcn.140001fc0
call fcn.140072cf0
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.14003bac0
mov rcx, rbx
call fcn.14003bc90
mov qword [rsp + 0x20], rdi
mov r9, rbp
mov r8d, 0x27
mov rdx, rsi
mov rcx, r13
call fcn.140001fc0
mov r9d, 0x28
mov r8, rdi
mov rdx, rsi
mov ecx, 0x2c
call fcn.140001620
mov rbx, rax
lea rcx, [rax + 8]
mov rdx, r12
call fcn.140072f70
call fcn.140072d90
mov rcx, qword [rbx + 8]
call fcn.140072ec0
call fcn.140072ca0
mov edx, eax
mov rcx, rbx
call fcn.140072df0
mov dword [rsp + 0x20], 0x2c
mov r9, rdi
mov r8, rsi
mov rdx, rbx
lea rcx, [0x140006f30]
call fcn.1400018a0
mov rcx, rax
mov edx, 2
call fcn.14003bac0
jmp 0x14000d0cf