Function at 0x1401a3a10
Capabilities:
Check if file exists
Copy file
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xa30
mov qword [rsp + 0x7c0], 0xfffffffffffffffe
mov rax, qword [rsp + 0xa48]
mov qword [rsp + 0x7c8], rax
cmp qword [rsp + 0x7c8], 0x8089
ja 0x1401a3ac2
cmp qword [rsp + 0x7c8], 0x8089
je 0x1401a4058
cmp qword [rsp + 0x7c8], 0x10f
je 0x1401a4772
cmp qword [rsp + 0x7c8], 0x50b
je 0x1401a3b0f
cmp qword [rsp + 0x7c8], 0x8011
je 0x1401a4129
cmp qword [rsp + 0x7c8], 0x8012
je 0x1401a4615
cmp qword [rsp + 0x7c8], 0x8087
je 0x1401a3b67
jmp 0x1401a4d72
cmp qword [rsp + 0x7c8], 0x809c
je 0x1401a42e7
cmp qword [rsp + 0x7c8], 0x809e
je 0x1401a447e
cmp qword [rsp + 0x7c8], 0x80ea
je 0x1401a467e
cmp qword [rsp + 0x7c8], 0x80ec
je 0x1401a4740
jmp 0x1401a4d72
lea rdx, [0x14025f278]
lea rcx, [rsp + 0x5f8]
call fcn.1400f05c0
mov qword [rsp + 0x7d0], rax
mov rax, qword [rsp + 0x7d0]
mov qword [rsp + 0x7d8], rax
mov rcx, qword [rsp + 0x7d8]
call fcn.140050200
xor edx, edx
mov rcx, rax
call fcn.1400f1a30
nop
lea rcx, [rsp + 0x5f8]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
mov dword [rsp + 0x80], 0
mov edx, 0xa
lea rcx, [rsp + 0x40]
call fcn.14008ebb8
nop
lea rcx, [rsp + 0x600]
call fcn.140001000
mov qword [rsp + 0x7e0], rax
mov rax, qword [rsp + 0x7e0]
mov qword [rsp + 0x7e8], rax
lea r8, str.Log.txt
mov rdx, qword [rsp + 0x7e8]
lea rcx, [rsp + 0x608]
call fcn.1400010b0
mov qword [rsp + 0x7f0], rax
mov rax, qword [rsp + 0x7f0]
mov qword [rsp + 0x7f8], rax
mov rdx, qword [rsp + 0x7f8]
lea rcx, [rsp + 0x40]
call fcn.14008eda4
nop
lea rcx, [rsp + 0x608]
call fcn.140007060
nop
lea rcx, [rsp + 0x600]
call fcn.140007060
lea rcx, [rsp + 0x610]
call fcn.140001000
mov qword [rsp + 0x800], rax
mov rax, qword [rsp + 0x800]
mov qword [rsp + 0x808], rax
lea r8, str..ini
mov rdx, qword [rsp + 0x808]
lea rcx, [rsp + 0x618]
call fcn.1400010b0
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x810]
mov qword [rsp + 0x818], rax
mov rdx, qword [rsp + 0x818]
lea rcx, [rsp + 0x40]
call fcn.14008eda4
nop
lea rcx, [rsp + 0x618]
call fcn.140007060
nop
lea rcx, [rsp + 0x610]
call fcn.140007060
lea rcx, [rsp + 0x620]
call fcn.140001000
mov qword [rsp + 0x820], rax
mov rax, qword [rsp + 0x820]
mov qword [rsp + 0x828], rax
lea r8, str..xml
mov rdx, qword [rsp + 0x828]
lea rcx, [rsp + 0x628]
call fcn.1400010b0
mov qword [rsp + 0x830], rax
mov rax, qword [rsp + 0x830]
mov qword [rsp + 0x838], rax
mov rdx, qword [rsp + 0x838]
lea rcx, [rsp + 0x40]
call fcn.14008eda4
nop
lea rcx, [rsp + 0x628]
call fcn.140007060
nop
lea rcx, [rsp + 0x620]
call fcn.140007060
lea rcx, [rsp + 0x630]
call fcn.140001000
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x848], rax
lea r8, str.LogSubmit.zip
mov rdx, qword [rsp + 0x848]
lea rcx, [rsp + 0x78]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x630]
call fcn.140007060
lea rcx, [rsp + 0x638]
call fcn.140001000
mov qword [rsp + 0x850], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x858], rax
lea rcx, [rsp + 0x78]
call fcn.140050200
mov rbx, rax
mov rcx, qword [rsp + 0x858]
call fcn.140050200
lea r9, [rsp + 0x80]
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14018ec30
nop
lea rcx, [rsp + 0x638]
call fcn.140007060
lea rcx, [rsp + 0x88]
call fcn.140002d10
nop
lea rcx, [rsp + 0x640]
call fcn.1400020b0
mov qword [rsp + 0x860], rax
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x868], rax
mov r9, qword [rsp + 0x868]
mov r9, qword [r9]
lea r8, [0x14025f2e0]
lea rdx, str.http:__www.youngzsoft.net_submit.php_product_sversion3.0._srefprog
lea rcx, [rsp + 0x88]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x640]
call fcn.140007060
lea r11, [rsp + 0x648]
mov qword [rsp + 0x650], r11
lea rdx, str.bugreportsurl
mov rcx, qword [rsp + 0x650]
call fcn.140002050
mov qword [rsp + 0x870], rax
mov rdx, qword [rsp + 0x870]
lea rcx, [rsp + 0x90]
call fcn.1401a0700
nop
lea rcx, [rsp + 0x90]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401a3e9a
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x88]
call fcn.140002ce0
lea rcx, [rsp + 0x78]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401a3ff1
lea r8, [rsp + 0x78]
lea rdx, [0x14025f3a0]
lea rcx, [rsp + 0x658]
call fcn.140006d10
mov qword [rsp + 0x878], rax
mov rax, qword [rsp + 0x878]
mov qword [rsp + 0x880], rax
lea r8, [0x14025e97c]
mov rdx, qword [rsp + 0x880]
lea rcx, [rsp + 0x660]
call fcn.1400010b0
mov qword [rsp + 0x888], rax
mov rcx, qword [rsp + 0x888]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.explorer.exe
lea rdx, [0x14025f3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x660]
call fcn.140007060
nop
lea rcx, [rsp + 0x658]
call fcn.140007060
lea rcx, [rsp + 0x98]
call fcn.140002d10
nop
lea rdx, str.Please_attach_the__s_file_to_a_ticket_in_our_support_page_and_submit_for_troubleshooting._Thank_you_
lea rcx, [rsp + 0x668]
call fcn.1400f05c0
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x890]
mov qword [rsp + 0x898], rax
mov rcx, qword [rsp + 0x898]
call fcn.140050200
mov r8, qword [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x668]
call fcn.140007060
lea rcx, [rsp + 0x98]
call fcn.140050200
xor r8d, r8d
mov edx, 0x40
mov rcx, rax
call fcn.1400f0bf0
nop
lea rcx, [rsp + 0x98]
call fcn.140007060
lea rcx, [rsp + 0x88]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x90]
call fcn.140007060
nop
lea rcx, [rsp + 0x88]
call fcn.140007060
nop
lea rcx, [rsp + 0x78]
call fcn.140007060
nop
lea rcx, [rsp + 0x40]
call fcn.14008ed58
xor eax, eax
jmp 0x1401a4d77
lea rdx, str.https:__www.facebook.com_ccboot
lea rcx, [rsp + 0xa8]
call fcn.140002050
nop
lea rax, [rsp + 0x670]
mov qword [rsp + 0x678], rax
lea rdx, str.facebookurl
mov rcx, qword [rsp + 0x678]
call fcn.140002050
mov qword [rsp + 0x8a0], rax
mov rdx, qword [rsp + 0x8a0]
lea rcx, [rsp + 0xa0]
call fcn.1401a0700
nop
lea rcx, [rsp + 0xa0]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401a40d8
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.140002ce0
lea rcx, [rsp + 0xa8]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xa0]
call fcn.140007060
nop
lea rcx, [rsp + 0xa8]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
lea rdx, [0x14025f528]
lea rcx, [rsp + 0x688]
call fcn.1400f05c0
mov qword [rsp + 0x8a8], rax
lea rdx, [0x14025f518]
mov rcx, qword [rsp + 0x8a8]
call fcn.140006e10
mov byte [rsp + 0x680], al
lea rcx, [rsp + 0x688]
call fcn.140007060
movzx r11d, byte [rsp + 0x680]
test r11d, r11d
je 0x1401a4200
lea rdx, [0x14025f538]
lea rcx, [rsp + 0xc0]
call fcn.1400f05c0
lea rdx, str.HelpPageURL
lea rcx, [rsp + 0xc0]
call fcn.140006e10
movzx eax, al
test eax, eax
je 0x1401a41dc
lea rcx, [rsp + 0xc0]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x690], 0
lea rcx, [rsp + 0xc0]
call fcn.140007060
mov eax, dword [rsp + 0x690]
jmp 0x1401a4d77
lea rdx, str.http:__www.ccboot.com_wiki.htm_refprog
lea rcx, [rsp + 0xb8]
call fcn.140002050
nop
lea rax, [rsp + 0x698]
mov qword [rsp + 0x6a0], rax
lea rdx, str.helpurl
mov rcx, qword [rsp + 0x6a0]
call fcn.140002050
mov qword [rsp + 0x8b0], rax
mov rdx, qword [rsp + 0x8b0]
lea rcx, [rsp + 0xb0]
call fcn.1401a0700
nop
lea rcx, [rsp + 0xb0]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401a4280
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb8]
call fcn.140002ce0
lea rcx, [rsp + 0xb8]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x6a8], 0
lea rcx, [rsp + 0xb0]
call fcn.140007060
nop
lea rcx, [rsp + 0xb8]
call fcn.140007060
mov eax, dword [rsp + 0x6a8]
jmp 0x1401a4d77
lea rdx, [0x14025f600]
lea rcx, [rsp + 0x6b0]
call fcn.1400f05c0
mov qword [rsp + 0x8b8], rax
lea rdx, [0x14025f5e0]
mov rcx, qword [rsp + 0x8b8]
call fcn.140006e10
mov byte [rsp + 0x6ac], al
lea rcx, [rsp + 0x6b0]
call fcn.140007060
movzx r11d, byte [rsp + 0x6ac]
test r11d, r11d
je 0x1401a4397
lea rdx, str.UserForumURL
lea rcx, [rsp + 0x6b8]
call fcn.1400f05c0
mov qword [rsp + 0x8c0], rax
mov rcx, qword [rsp + 0x8c0]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x6b8]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
lea rdx, str.http:__forum.icafeman.com__refprog
lea rcx, [rsp + 0xd0]
call fcn.140002050
nop
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x6c8], rax
lea rdx, str.userforumurl
mov rcx, qword [rsp + 0x6c8]
call fcn.140002050
mov qword [rsp + 0x8c8], rax
mov rdx, qword [rsp + 0x8c8]
lea rcx, [rsp + 0xc8]
call fcn.1401a0700
nop
lea rcx, [rsp + 0xc8]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401a4417
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xd0]
call fcn.140002ce0
lea rcx, [rsp + 0xd0]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x6d0], 0
lea rcx, [rsp + 0xc8]
call fcn.140007060
nop
lea rcx, [rsp + 0xd0]
call fcn.140007060
mov eax, dword [rsp + 0x6d0]
jmp 0x1401a4d77
lea rdx, [0x14025f6a8]
lea rcx, [rsp + 0x6d8]
call fcn.1400f05c0
mov qword [rsp + 0x8d0], rax
lea rdx, [0x14025f568]
mov rcx, qword [rsp + 0x8d0]
call fcn.140006e10
mov byte [rsp + 0x6d4], al
lea rcx, [rsp + 0x6d8]
call fcn.140007060
movzx r11d, byte [rsp + 0x6d4]
test r11d, r11d
je 0x1401a452e
lea rdx, str.HomePageURL
lea rcx, [rsp + 0x6e0]
call fcn.1400f05c0
mov qword [rsp + 0x8d8], rax
mov rcx, qword [rsp + 0x8d8]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x6e0]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
lea rdx, str.http:__www.ccboot.com__refprog
lea rcx, [rsp + 0xe0]
call fcn.140002050
nop
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x6f0], rax
lea rdx, str.homepageurl
mov rcx, qword [rsp + 0x6f0]
call fcn.140002050
mov qword [rsp + 0x8e0], rax
mov rdx, qword [rsp + 0x8e0]
lea rcx, [rsp + 0xd8]
call fcn.1401a0700
nop
lea rcx, [rsp + 0xd8]
call fcn.140006ea0
movzx eax, al
test eax, eax
jne 0x1401a45ae
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xe0]
call fcn.140002ce0
lea rcx, [rsp + 0xe0]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x6f8], 0
lea rcx, [rsp + 0xd8]
call fcn.140007060
nop
lea rcx, [rsp + 0xe0]
call fcn.140007060
mov eax, dword [rsp + 0x6f8]
jmp 0x1401a4d77
lea rcx, [rsp + 0xf0]
call fcn.14019bbb0
nop
lea rcx, [rsp + 0xf0]
call fcn.1400830e4
cmp rax, 1
jne 0x1401a466a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xa40]
lea r8, [0x1401a2790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xf0]
call fcn.140005c10
xor eax, eax
jmp 0x1401a4d77
lea rcx, [rsp + 0x320]
call fcn.140002d10
nop
lea rcx, [rsp + 0x700]
call fcn.140001000
mov qword [rsp + 0x8e8], rax
mov rax, qword [rsp + 0x8e8]
mov qword [rsp + 0x8f0], rax
mov r8, qword [rsp + 0x8f0]
mov r8, qword [r8]
lea rdx, str._s_Manual.chm
lea rcx, [rsp + 0x320]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x700]
call fcn.140007060
lea rcx, [rsp + 0x320]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401a472c
lea rcx, [rsp + 0x320]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x14025f750]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x320]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
xor edx, edx
lea rcx, [rsp + 0x330]
call fcn.14014d260
nop
lea rcx, [rsp + 0x330]
call fcn.1400830e4
nop
lea rcx, [rsp + 0x330]
call fcn.14014d210
xor eax, eax
jmp 0x1401a4d77
lea rcx, [rsp + 0x708]
call fcn.140001000
mov qword [rsp + 0x8f8], rax
mov rax, qword [rsp + 0x8f8]
mov qword [rsp + 0x900], rax
lea r8, str.Web
mov rdx, qword [rsp + 0x900]
lea rcx, [rsp + 0x710]
call fcn.1400010b0
mov qword [rsp + 0x908], rax
mov rax, qword [rsp + 0x908]
mov qword [rsp + 0x910], rax
mov rcx, qword [rsp + 0x910]
call fcn.140050200
mov rcx, rax
call fcn.140004b40
nop
lea rcx, [rsp + 0x710]
call fcn.140007060
nop
lea rcx, [rsp + 0x708]
call fcn.140007060
lea rcx, [rsp + 0x720]
call fcn.140001000
mov qword [rsp + 0x918], rax
mov rax, qword [rsp + 0x918]
mov qword [rsp + 0x920], rax
lea r8, [0x14025f770]
mov rdx, qword [rsp + 0x920]
lea rcx, [rsp + 0x728]
call fcn.1400010b0
mov qword [rsp + 0x928], rax
mov rcx, qword [rsp + 0x928]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x718], eax
lea rcx, [rsp + 0x728]
call fcn.140007060
nop
lea rcx, [rsp + 0x720]
call fcn.140007060
cmp dword [rsp + 0x718], 0
je 0x1401a4d6e
lea rcx, [rsp + 0x730]
call fcn.140001000
mov qword [rsp + 0x930], rax
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0x938], rax
lea r8, [0x14025f788]
mov rdx, qword [rsp + 0x938]
lea rcx, [rsp + 0x738]
call fcn.1400010b0
mov qword [rsp + 0x940], rax
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0x740]
call fcn.140001000
mov qword [rsp + 0x950], rax
mov rax, qword [rsp + 0x950]
mov qword [rsp + 0x958], rax
lea r8, str.Web.exe
mov rdx, qword [rsp + 0x958]
lea rcx, [rsp + 0x748]
call fcn.1400010b0
mov qword [rsp + 0x960], rax
mov rcx, qword [rsp + 0x948]
call fcn.140050200
mov rbx, rax
mov rcx, qword [rsp + 0x960]
call fcn.140050200
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x748]
call fcn.140007060
nop
lea rcx, [rsp + 0x740]
call fcn.140007060
nop
lea rcx, [rsp + 0x738]
call fcn.140007060
nop
lea rcx, [rsp + 0x730]
call fcn.140007060
lea rcx, [rsp + 0x750]
call fcn.140001000
mov qword [rsp + 0x968], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x970], rax
lea r8, str.Webwke.dll
mov rdx, qword [rsp + 0x970]
lea rcx, [rsp + 0x758]
call fcn.1400010b0
mov qword [rsp + 0x978], rax
mov rax, qword [rsp + 0x978]
mov qword [rsp + 0x980], rax
lea rcx, [rsp + 0x760]
call fcn.140001000
mov qword [rsp + 0x988], rax
mov rax, qword [rsp + 0x988]
mov qword [rsp + 0x990], rax
lea r8, str.wke.dll
mov rdx, qword [rsp + 0x990]
lea rcx, [rsp + 0x768]
call fcn.1400010b0
mov qword [rsp + 0x998], rax
mov rcx, qword [rsp + 0x980]
call fcn.140050200
mov rbx, rax
mov rcx, qword [rsp + 0x998]
call fcn.140050200
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x768]
call fcn.140007060
nop
lea rcx, [rsp + 0x760]
call fcn.140007060
nop
lea rcx, [rsp + 0x758]
call fcn.140007060
nop
lea rcx, [rsp + 0x750]
call fcn.140007060
lea rcx, [rsp + 0x778]
call fcn.140001000
mov qword [rsp + 0x9a0], rax
mov rax, qword [rsp + 0x9a0]
mov qword [rsp + 0x9a8], rax
lea r8, str.WebWeb.exe
mov rdx, qword [rsp + 0x9a8]
lea rcx, [rsp + 0x780]
call fcn.1400010b0
mov qword [rsp + 0x9b0], rax
mov rcx, qword [rsp + 0x9b0]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x770], eax
lea rcx, [rsp + 0x780]
call fcn.140007060
nop
lea rcx, [rsp + 0x778]
call fcn.140007060
cmp dword [rsp + 0x770], 0
je 0x1401a4d6e
lea rdx, str.http:__www.youngzsoft.net_
lea rcx, [rsp + 0x5f0]
call fcn.140002050
nop
lea rcx, [rsp + 0x788]
call fcn.14018ffa0
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x9c0], rax
mov rcx, qword [rsp + 0x9c0]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x790]
call fcn.1400db040
mov qword [rsp + 0x9c8], rax
mov rax, qword [rsp + 0x9c8]
mov qword [rsp + 0x9d0], rax
lea rdx, [0x14025e994]
lea rcx, [rsp + 0x798]
call fcn.1400db040
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
lea rdx, [0x14025eb3c]
lea rcx, [rsp + 0x7a0]
call fcn.1400db040
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
lea rdx, [0x14025ebb4]
lea rcx, [rsp + 0x7a8]
call fcn.1400db040
mov qword [rsp + 0x9f8], rax
mov rax, qword [rsp + 0x9f8]
mov qword [rsp + 0xa00], rax
lea rcx, [rsp + 0x7b0]
call fcn.14018fe70
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
mov rcx, qword [rsp + 0xa10]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x7b8]
call fcn.1400db040
mov qword [rsp + 0xa18], rax
mov rax, qword [rsp + 0xa18]
mov qword [rsp + 0xa20], rax
mov rax, qword [rsp + 0x9d0]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x9e0]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x9f0]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xa00]
mov r9, qword [r9]
mov r8, qword [rsp + 0xa20]
mov r8, qword [r8]
lea rdx, str.http:__user.youngzsoft.com_call2.php_email_sfirstname_slastname_sphone_slicense_sproductccboot
lea rcx, [rsp + 0x5f0]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x7b8]
call fcn.140007060
nop
lea rcx, [rsp + 0x7b0]
call fcn.140007060
nop
lea rcx, [rsp + 0x7a8]
call fcn.140007060
nop
lea rcx, [rsp + 0x7a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x798]
call fcn.140007060
nop
lea rcx, [rsp + 0x790]
call fcn.140007060
nop
lea rcx, [rsp + 0x788]
call fcn.140007060
lea rcx, [rsp + 0x5f0]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x5f0]
call fcn.140007060
xor eax, eax
jmp 0x1401a4d77
mov eax, 1
add rsp, 0xa30
pop rbx
ret