Function at 0x1400f29a0
Capabilities:
Check if file exists
Copy file
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1390
call fcn.1401d4c90
sub rsp, rax
mov qword [rsp + 0x11b8], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0x1380], rax
cmp qword [rsp + 0x13a8], 1
je 0x1400f29f1
cmp qword [rsp + 0x13a8], 2
jne 0x1400f2a26
mov rax, qword [rsp + 0x13a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x13a0]
call qword [rax + 0x2d0]
mov edx, 2
mov rcx, qword [rsp + 0x13a0]
call fcn.140078478
mov eax, 1
jmp 0x1400f39e4
mov rax, qword [rsp + 0x13a8]
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x11c0], eax
cmp dword [rsp + 0x11c0], 0x8043
jg 0x1400f2add
cmp dword [rsp + 0x11c0], 0x8043
je 0x1400f2d65
cmp dword [rsp + 0x11c0], 0x800d
jg 0x1400f2ab6
cmp dword [rsp + 0x11c0], 0x800d
je 0x1400f2bd4
cmp dword [rsp + 0x11c0], 0x50d
je 0x1400f33ac
cmp dword [rsp + 0x11c0], 0x8003
je 0x1400f2d28
cmp dword [rsp + 0x11c0], 0x800c
je 0x1400f2b37
jmp 0x1400f39c7
cmp dword [rsp + 0x11c0], 0x8011
je 0x1400f3084
cmp dword [rsp + 0x11c0], 0x803f
je 0x1400f2e7b
jmp 0x1400f39c7
cmp dword [rsp + 0x11c0], 0x80a1
je 0x1400f2c8c
cmp dword [rsp + 0x11c0], 0x815c
je 0x1400f3455
cmp dword [rsp + 0x11c0], 0x815d
je 0x1400f34f3
cmp dword [rsp + 0x11c0], 0x8160
je 0x1400f3906
cmp dword [rsp + 0x11c0], 0xe146
je 0x1400f3218
jmp 0x1400f39c7
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
call fcn.14000f490
test rax, rax
je 0x1400f2bca
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800c
call fcn.14000ea40
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800d
call fcn.14000ea40
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x8030
call fcn.14000ea40
mov eax, 1
jmp 0x1400f39e4
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x75
call fcn.1400f0f30
cmp eax, 6
jne 0x1400f2c82
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
call fcn.14000f490
test rax, rax
je 0x1400f2c82
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800c
call fcn.14000ea40
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800d
call fcn.14000ea40
mov rcx, qword [rsp + 0x13a0]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x8030
call fcn.14000ea40
mov eax, 1
jmp 0x1400f39e4
lea rcx, [rsp + 0x1068]
call fcn.140001000
mov qword [rsp + 0x11c8], rax
mov rax, qword [rsp + 0x11c8]
mov qword [rsp + 0x11d0], rax
lea r8, [0x1402166ac]
mov rdx, qword [rsp + 0x11d0]
lea rcx, [rsp + 0x1070]
call fcn.1400010b0
mov qword [rsp + 0x11d8], rax
mov rcx, qword [rsp + 0x11d8]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1070]
call fcn.140001490
nop
lea rcx, [rsp + 0x1068]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
mov rdx, qword [rsp + 0x13a0]
add rdx, 0x4e8
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rax, qword [rsp + 0x13a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x13a0]
call qword [rax + 0x2b0]
mov eax, 1
jmp 0x1400f39e4
lea rcx, [rsp + 0x840]
call fcn.140002db0
nop
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x40]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, [0x140216ac0]
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.1400aec88
lea rcx, [rsp + 0x1078]
call fcn.14000edc0
lea r8, [0x140216ad0]
lea rdx, [rsp + 0x1080]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0x11e0], rax
mov rax, qword [rsp + 0x11e0]
mov qword [rsp + 0x11e8], rax
mov r9, qword [rsp + 0x11e8]
mov r9, qword [r9]
lea r8, [rsp + 0x40]
lea rdx, str._sLog__s.txt
lea rcx, [rsp + 0x840]
call fcn.140002c40
nop
lea rcx, [rsp + 0x1080]
call fcn.140001490
lea rcx, [rsp + 0x840]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x840]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
lea rcx, [rsp + 0x1050]
call fcn.140002db0
nop
xor eax, eax
mov word [rsp + 0x850], ax
lea rdi, [rsp + 0x852]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8d, 0x400
lea rdx, [rsp + 0x850]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x850]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea r8, str.Log
mov edx, 0x400
lea rcx, [rsp + 0x850]
call fcn.1400aec88
lea rcx, [rsp + 0x1088]
call fcn.14000edc0
lea r8, [0x140216b18]
lea rdx, [rsp + 0x1090]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0x11f0], rax
mov rax, qword [rsp + 0x11f0]
mov qword [rsp + 0x11f8], rax
mov r9, qword [rsp + 0x11f8]
mov r9, qword [r9]
lea r8, [rsp + 0x850]
lea rdx, str._sFatal__s.txt
lea rcx, [rsp + 0x1050]
call fcn.140002c40
nop
lea rcx, [rsp + 0x1090]
call fcn.140001490
lea rcx, [rsp + 0x1050]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400f2f9e
xor r8d, r8d
mov edx, 0x40
lea rcx, str.No_errors
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x1050]
call fcn.140001490
jmp 0x1400f39c7
lea rcx, [rsp + 0x1050]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x140216b78]
lea rcx, [rsp + 0x10a0]
call fcn.1400eeb90
mov qword [rsp + 0x1200], rax
lea rdx, [0x140216b68]
mov rcx, qword [rsp + 0x1200]
call fcn.140006d90
mov byte [rsp + 0x1098], al
lea rcx, [rsp + 0x10a0]
call fcn.140001490
movzx edx, byte [rsp + 0x1098]
test edx, edx
je 0x1400f302e
lea rcx, [rsp + 0x1050]
call fcn.140001490
jmp 0x1400f39c7
xor r8d, r8d
mov edx, 0x24
lea rcx, str.Do_you_want_to_see_how_to_fix_common_errors_
call fcn.1400ef1c0
cmp eax, 6
jne 0x1400f306d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__www.ccboot.com_wiki_how_to_view_server_error_log.htm
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1050]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
lea rdx, [0x140216c80]
lea rcx, [rsp + 0x10b0]
call fcn.1400eeb90
mov qword [rsp + 0x1208], rax
lea rdx, [0x140216c68]
mov rcx, qword [rsp + 0x1208]
call fcn.140006d90
mov byte [rsp + 0x10a8], al
lea rcx, [rsp + 0x10b0]
call fcn.140001490
movzx edx, byte [rsp + 0x10a8]
test edx, edx
je 0x1400f3132
lea rdx, [0x140216c98]
lea rcx, [rsp + 0x10b8]
call fcn.1400eeb90
mov qword [rsp + 0x1210], rax
mov rcx, qword [rsp + 0x1210]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10b8]
call fcn.140001490
xor eax, eax
jmp 0x1400f39e4
call fcn.140010180
mov rdx, rax
lea rcx, [rsp + 0x10c0]
call fcn.1400020d0
mov qword [rsp + 0x1218], rax
mov rax, qword [rsp + 0x1218]
mov qword [rsp + 0x1220], rax
mov r8, qword [rsp + 0x1220]
lea rdx, [0x140216cd0]
lea rcx, [rsp + 0x10c8]
call fcn.140006c90
mov qword [rsp + 0x1228], rax
mov rax, qword [rsp + 0x1228]
mov qword [rsp + 0x1230], rax
lea r8, [0x140216cb0]
mov rdx, qword [rsp + 0x1230]
lea rcx, [rsp + 0x10d0]
call fcn.1400010b0
mov qword [rsp + 0x1238], rax
mov rcx, qword [rsp + 0x1238]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x10c8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10c0]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
lea rdx, [0x140216d00]
lea rcx, [rsp + 0x10e0]
call fcn.1400eeb90
mov qword [rsp + 0x1240], rax
lea rdx, [0x140216ce8]
mov rcx, qword [rsp + 0x1240]
call fcn.140006d90
mov byte [rsp + 0x10d8], al
lea rcx, [rsp + 0x10e0]
call fcn.140001490
movzx edx, byte [rsp + 0x10d8]
test edx, edx
je 0x1400f32c6
lea rdx, [0x140216d18]
lea rcx, [rsp + 0x10e8]
call fcn.1400eeb90
mov qword [rsp + 0x1248], rax
mov rcx, qword [rsp + 0x1248]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x10e8]
call fcn.140001490
xor eax, eax
jmp 0x1400f39e4
call fcn.140010180
mov rdx, rax
lea rcx, [rsp + 0x10f0]
call fcn.1400020d0
mov qword [rsp + 0x1250], rax
mov rax, qword [rsp + 0x1250]
mov qword [rsp + 0x1258], rax
mov r8, qword [rsp + 0x1258]
lea rdx, str.http:__www.
lea rcx, [rsp + 0x10f8]
call fcn.140006c90
mov qword [rsp + 0x1260], rax
mov rax, qword [rsp + 0x1260]
mov qword [rsp + 0x1268], rax
lea r8, str..com__refprog
mov rdx, qword [rsp + 0x1268]
lea rcx, [rsp + 0x1100]
call fcn.1400010b0
mov qword [rsp + 0x1270], rax
mov rcx, qword [rsp + 0x1270]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1100]
call fcn.140001490
nop
lea rcx, [rsp + 0x10f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x10f0]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
lea rcx, [rsp + 0x1108]
call fcn.140185ba0
mov qword [rsp + 0x1278], rax
mov rax, qword [rsp + 0x1278]
mov qword [rsp + 0x1280], rax
call fcn.140010180
mov rdx, rax
lea rcx, [rsp + 0x1110]
call fcn.1400eeb90
mov qword [rsp + 0x1288], rax
mov rax, qword [rsp + 0x1288]
mov qword [rsp + 0x1290], rax
mov rcx, qword [rsp + 0x1280]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0x1290]
call fcn.140023510
lea r9, str.https:__update.youngzsoft.com_updatesystem_update.php
mov r8, rdi
mov rdx, rax
xor ecx, ecx
call fcn.1400dedf0
nop
lea rcx, [rsp + 0x1110]
call fcn.140001490
nop
lea rcx, [rsp + 0x1108]
call fcn.140001490
mov eax, 1
jmp 0x1400f39e4
lea rcx, [rsp + 0x1118]
call fcn.140001000
mov qword [rsp + 0x1298], rax
mov rax, qword [rsp + 0x1298]
mov qword [rsp + 0x12a0], rax
lea r8, [0x140216df0]
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rsp + 0x1120]
call fcn.1400010b0
mov qword [rsp + 0x12a8], rax
mov rcx, qword [rsp + 0x12a8]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x140216e10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x1120]
call fcn.140001490
nop
lea rcx, [rsp + 0x1118]
call fcn.140001490
xor eax, eax
jmp 0x1400f39e4
lea rcx, [rsp + 0x1128]
call fcn.140001000
mov qword [rsp + 0x12b0], rax
mov rax, qword [rsp + 0x12b0]
mov qword [rsp + 0x12b8], rax
lea r8, [0x140216d68]
mov rdx, qword [rsp + 0x12b8]
lea rcx, [rsp + 0x1130]
call fcn.1400010b0
mov qword [rsp + 0x12c0], rax
mov rax, qword [rsp + 0x12c0]
mov qword [rsp + 0x12c8], rax
mov rcx, qword [rsp + 0x12c8]
call fcn.140023510
mov rcx, rax
call fcn.140004bc0
nop
lea rcx, [rsp + 0x1130]
call fcn.140001490
nop
lea rcx, [rsp + 0x1128]
call fcn.140001490
lea rcx, [rsp + 0x1140]
call fcn.140001000
mov qword [rsp + 0x12d0], rax
mov rax, qword [rsp + 0x12d0]
mov qword [rsp + 0x12d8], rax
lea r8, [0x140216e20]
mov rdx, qword [rsp + 0x12d8]
lea rcx, [rsp + 0x1148]
call fcn.1400010b0
mov qword [rsp + 0x12e0], rax
mov rcx, qword [rsp + 0x12e0]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x1138], eax
lea rcx, [rsp + 0x1148]
call fcn.140001490
nop
lea rcx, [rsp + 0x1140]
call fcn.140001490
cmp dword [rsp + 0x1138], 0
je 0x1400f38ff
lea rcx, [rsp + 0x1150]
call fcn.140001000
mov qword [rsp + 0x12e8], rax
mov rax, qword [rsp + 0x12e8]
mov qword [rsp + 0x12f0], rax
lea r8, [0x140216e40]
mov rdx, qword [rsp + 0x12f0]
lea rcx, [rsp + 0x1158]
call fcn.1400010b0
mov qword [rsp + 0x12f8], rax
mov rax, qword [rsp + 0x12f8]
mov qword [rsp + 0x1300], rax
lea rcx, [rsp + 0x1160]
call fcn.140001000
mov qword [rsp + 0x1308], rax
mov rax, qword [rsp + 0x1308]
mov qword [rsp + 0x1310], rax
lea r8, str.RemoteMe.exe
mov rdx, qword [rsp + 0x1310]
lea rcx, [rsp + 0x1168]
call fcn.1400010b0
mov qword [rsp + 0x1318], rax
mov rcx, qword [rsp + 0x1300]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0x1318]
call fcn.140023510
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x1168]
call fcn.140001490
nop
lea rcx, [rsp + 0x1160]
call fcn.140001490
nop
lea rcx, [rsp + 0x1158]
call fcn.140001490
nop
lea rcx, [rsp + 0x1150]
call fcn.140001490
lea rcx, [rsp + 0x1178]
call fcn.140001000
mov qword [rsp + 0x1320], rax
mov rax, qword [rsp + 0x1320]
mov qword [rsp + 0x1328], rax
lea r8, str.RemoteMeRemoteMe.exe
mov rdx, qword [rsp + 0x1328]
lea rcx, [rsp + 0x1180]
call fcn.1400010b0
mov qword [rsp + 0x1330], rax
mov rcx, qword [rsp + 0x1330]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x1170], eax
lea rcx, [rsp + 0x1180]
call fcn.140001490
nop
lea rcx, [rsp + 0x1178]
call fcn.140001490
cmp dword [rsp + 0x1170], 0
je 0x1400f38ff
lea rcx, [rsp + 0x1058]
call fcn.140002db0
nop
lea rcx, [rsp + 0x1188]
call fcn.140002130
mov qword [rsp + 0x1338], rax
mov rax, qword [rsp + 0x1338]
mov qword [rsp + 0x1340], rax
lea rcx, [rsp + 0x1190]
call fcn.140001000
mov qword [rsp + 0x1348], rax
mov rax, qword [rsp + 0x1348]
mov qword [rsp + 0x1350], rax
call fcn.140010180
mov r9, rax
mov rax, qword [rsp + 0x1340]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x1350]
mov r8, qword [r8]
lea rdx, str._sRemoteMeRemoteMe.exe__product_s__version_s
lea rcx, [rsp + 0x1058]
call fcn.140002c40
nop
lea rcx, [rsp + 0x1190]
call fcn.140001490
nop
lea rcx, [rsp + 0x1188]
call fcn.140001490
lea rcx, [rsp + 0x1198]
call fcn.140001000
mov qword [rsp + 0x1358], rax
mov rax, qword [rsp + 0x1358]
mov qword [rsp + 0x1360], rax
lea r8, str.RemoteMe
mov rdx, qword [rsp + 0x1360]
lea rcx, [rsp + 0x11a0]
call fcn.1400010b0
mov qword [rsp + 0x1368], rax
mov rax, qword [rsp + 0x1368]
mov qword [rsp + 0x1370], rax
mov rcx, qword [rsp + 0x1370]
call fcn.140023510
mov rdi, rax
lea rcx, [rsp + 0x1058]
call fcn.140023510
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004900
nop
lea rcx, [rsp + 0x11a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x1198]
call fcn.140001490
nop
lea rcx, [rsp + 0x1058]
call fcn.140001490
xor eax, eax
jmp 0x1400f39e4
lea rdx, [0x140216f58]
lea rcx, [rsp + 0x11b0]
call fcn.1400eeb90
mov qword [rsp + 0x1378], rax
lea rdx, [0x140216f40]
mov rcx, qword [rsp + 0x1378]
call fcn.140006d90
mov byte [rsp + 0x11a8], al
lea rcx, [rsp + 0x11b0]
call fcn.140001490
movzx edx, byte [rsp + 0x11a8]
test edx, edx
je 0x1400f395d
xor eax, eax
jmp 0x1400f39e4
lea rcx, [rsp + 0x1060]
call fcn.140002db0
nop
call fcn.140010180
mov r8, rax
lea rdx, str.https:__user.youngzsoft.com_video.php_product_s
lea rcx, [rsp + 0x1060]
call fcn.140002c40
lea rcx, [rsp + 0x1060]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1060]
call fcn.140001490
xor eax, eax
jmp 0x1400f39e4
mov r8, qword [rsp + 0x13b0]
mov rdx, qword [rsp + 0x13a8]
mov rcx, qword [rsp + 0x13a0]
call fcn.14007e488
mov rcx, qword [rsp + 0x1380]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0x1390
pop rdi
ret