Function at 0x1401c39b0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Get disk size
Get local ipv4 addresses
Get socket information
Manipulate boot configuration
Read .ini file
Read file on windows
Read pipe
Set registry value
Set socket configuration
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x165b8
call fcn.1401d4c90
sub rsp, rax
mov qword [rsp + 0x15d18], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0x165a0], rax
mov dword [rsp + 0x15d10], 0
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x65
jne 0x1401c3a17
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c1d10
mov eax, 1
jmp 0x1401cc0dd
mov rax, qword [rsp + 0x165d8]
cmp dword [rax + 0x28], 0x66
jne 0x1401c3a3c
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c11f0
mov eax, 1
jmp 0x1401cc0dd
lea rcx, [rsp + 0x7b0]
call fcn.14000f1c0
nop
mov dword [rsp + 0x948], 1
lea rcx, [rsp + 0x7b0]
call fcn.1401cfc20
mov dword [rsp + 0xaf0], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xaf0]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], 0x4010
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rdx, qword [rsp + 0x165d8]
mov eax, dword [rdx + 0x14]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x470]
call fcn.1401cc380
nop
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d1e00
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401cc052
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401cc052
mov byte [rsp + 0xb00], 0
lea rdi, [rsp + 0xb01]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
test eax, eax
jne 0x1401c3b6d
jmp 0x1401cc052
lea rcx, [0x14021d888]
call fcn.1400a9180
mov r8, rax
lea rdx, str.getservercmd
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c53bb
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010210
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15518], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15530]
call fcn.140017300
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x15518]
lea rdx, [rsp + 0x15520]
call fcn.140023420
mov rdx, rdi
mov rcx, rax
call fcn.14000cd00
movzx eax, al
test eax, eax
je 0x1401c3c41
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15540], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15540]
call fcn.140023260
mov rcx, rax
call fcn.140021310
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
lea rdx, [0x14021d8a8]
lea rcx, [rsp + 0x15548]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15544], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15544]
call fcn.140023260
lea rdx, [rsp + 0x15548]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x15548]
call fcn.140001490
lea rdx, [0x14021d8c8]
lea rcx, [rsp + 0x15558]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15550], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15550]
call fcn.140023260
lea rdx, [rsp + 0x15558]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x15558]
call fcn.140001490
lea rcx, [rsp + 0x15568]
call fcn.140001000
mov qword [rsp + 0x15d20], rax
mov rax, qword [rsp + 0x15d20]
mov qword [rsp + 0x15d28], rax
lea r8, [0x14021b9b4]
mov rdx, qword [rsp + 0x15d28]
lea rcx, [rsp + 0x15570]
call fcn.1400010b0
mov qword [rsp + 0x15d30], rax
mov rax, qword [rsp + 0x15d30]
mov qword [rsp + 0x15d38], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x15d38]
lea rcx, [rsp + 0x15578]
call fcn.1400010b0
mov qword [rsp + 0x15d40], rax
mov rax, qword [rsp + 0x15d40]
mov qword [rsp + 0x15d48], rax
lea r8, [0x14021d900]
mov rdx, qword [rsp + 0x15d48]
lea rcx, [rsp + 0x15580]
call fcn.1400010b0
mov qword [rsp + 0x15d50], rax
mov rcx, qword [rsp + 0x15d50]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021d910]
lea rcx, [0x14021d930]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x15560], eax
lea rcx, [rsp + 0x15580]
call fcn.140001490
nop
lea rcx, [rsp + 0x15578]
call fcn.140001490
nop
lea rcx, [rsp + 0x15570]
call fcn.140001490
nop
lea rcx, [rsp + 0x15568]
call fcn.140001490
cmp dword [rsp + 0x15560], 0
je 0x1401c3e8f
lea rdx, [0x14021d940]
lea rcx, [rsp + 0x15590]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15588], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15588]
call fcn.140023260
lea rdx, [rsp + 0x15590]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x15590]
call fcn.140001490
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
lea rcx, [rsp + 0x155a0]
call fcn.140001000
mov qword [rsp + 0x15d58], rax
mov rax, qword [rsp + 0x15d58]
mov qword [rsp + 0x15d60], rax
mov eax, dword [rsp + 0x15d10]
or eax, 1
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021bbcc]
mov rdx, qword [rsp + 0x15d60]
lea rcx, [rsp + 0x155a8]
call fcn.1400010b0
mov qword [rsp + 0x15d68], rax
mov rax, qword [rsp + 0x15d68]
mov qword [rsp + 0x15d70], rax
mov eax, dword [rsp + 0x15d10]
or eax, 2
mov dword [rsp + 0x15d10], eax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x15d70]
lea rcx, [rsp + 0x155b0]
call fcn.1400010b0
mov qword [rsp + 0x15d78], rax
mov rax, qword [rsp + 0x15d78]
mov qword [rsp + 0x15d80], rax
mov eax, dword [rsp + 0x15d10]
or eax, 4
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021d960]
mov rdx, qword [rsp + 0x15d80]
lea rcx, [rsp + 0x155b8]
call fcn.1400010b0
mov qword [rsp + 0x15d88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 8
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15d88]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021d970]
lea rcx, [0x14021d990]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c3fec
lea rcx, [rsp + 0x6d0]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c3fec
mov dword [rsp + 0x15d90], 1
jmp 0x1401c3ff7
mov dword [rsp + 0x15d90], 0
movzx eax, byte [rsp + 0x15d90]
mov byte [rsp + 0x15598], al
mov eax, dword [rsp + 0x15d10]
and eax, 8
test eax, eax
je 0x1401c402a
and dword [rsp + 0x15d10], 0xfffffff7
lea rcx, [rsp + 0x155b8]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 4
test eax, eax
je 0x1401c404e
and dword [rsp + 0x15d10], 0xfffffffb
lea rcx, [rsp + 0x155b0]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 2
test eax, eax
je 0x1401c4072
and dword [rsp + 0x15d10], 0xfffffffd
lea rcx, [rsp + 0x155a8]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 1
test eax, eax
je 0x1401c4095
and dword [rsp + 0x15d10], 0xfffffffe
lea rcx, [rsp + 0x155a0]
call fcn.140001490
movzx eax, byte [rsp + 0x15598]
test eax, eax
je 0x1401c40fe
lea rdx, [0x14021d9a0]
lea rcx, [rsp + 0x155c8]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155c0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155c0]
call fcn.140023260
lea rdx, [rsp + 0x155c8]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x155c8]
call fcn.140001490
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov rax, qword [rsp + 0x165d0]
cmp dword [rax + 0x220], 0
je 0x1401c53b6
mov rax, qword [rsp + 0x165d8]
cmp dword [rax], 2
jne 0x1401c53b6
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010210
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155d0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155e8]
call fcn.140017300
mov rdi, rax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea r8, [rsp + 0x155d0]
lea rdx, [rsp + 0x155d8]
call fcn.140023420
mov rdx, rdi
mov rcx, rax
call fcn.14000cc90
movzx eax, al
test eax, eax
je 0x1401c41ed
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401c411f
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155f8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155f8]
call fcn.140023260
mov rdx, rax
lea rcx, [rsp + 0x1b10]
call fcn.140023520
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x155fc], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x155fc]
call fcn.140023260
mov rcx, rax
call fcn.140021310
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
mov dword [rsp + 0x1b08], 0
mov dword [rsp + 0x1b40], 0
jmp 0x1401c42a4
mov eax, dword [rsp + 0x1b40]
add eax, 1
mov dword [rsp + 0x1b40], eax
movsxd rdi, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.14001db40
cmp rdi, rax
jae 0x1401c4de9
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
mov r8, rax
lea rdx, str.servercmd
lea rcx, [rsp + 0x15600]
call fcn.140006c90
mov qword [rsp + 0x15d98], rax
mov rax, qword [rsp + 0x15d98]
mov qword [rsp + 0x15da0], rax
lea r8, [0x14021d1c4]
mov rdx, qword [rsp + 0x15da0]
lea rcx, [rsp + 0x15608]
call fcn.1400010b0
mov qword [rsp + 0x15da8], rax
mov rax, qword [rsp + 0x15da8]
mov qword [rsp + 0x15db0], rax
mov rcx, qword [rsp + 0x15db0]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15610]
call fcn.1400d8960
mov qword [rsp + 0x15db8], rax
mov rax, qword [rsp + 0x15db8]
mov qword [rsp + 0x15dc0], rax
mov rcx, qword [rsp + 0x15dc0]
call fcn.140023510
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15610]
call fcn.140001490
nop
lea rcx, [rsp + 0x15608]
call fcn.140001490
nop
lea rcx, [rsp + 0x15600]
call fcn.140001490
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
test eax, eax
jne 0x1401c43fd
mov dword [rsp + 0x1b08], 1
jmp 0x1401c4de9
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, str.vnc_start
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c4470
lea rcx, [0x14021d9f0]
call fcn.1400a9180
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada80
mov dword [rsp + 0x1b44], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b44]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, str.vnc_monitor
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c44e3
lea rcx, str.vnc_ready
call fcn.1400a9180
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada80
mov dword [rsp + 0x1b48], eax
mov eax, dword [rsp + 0x608]
movsxd r9, dword [rsp + 0x1b48]
mov qword [rsp + 0x20], rax
mov r8d, 0x8040
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, [0x14021da28]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c45aa
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c45aa
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15618]
call fcn.1400dd060
mov qword [rsp + 0x15dc8], rax
mov rax, qword [rsp + 0x15dc8]
mov qword [rsp + 0x15dd0], rax
mov rcx, qword [rsp + 0x15dd0]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15618]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, [0x14021da48]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c4671
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c4671
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15620]
call fcn.1400dd060
mov qword [rsp + 0x15dd8], rax
mov rax, qword [rsp + 0x15dd8]
mov qword [rsp + 0x15de0], rax
mov rcx, qword [rsp + 0x15de0]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8058
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15620]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, str.getdiagnose_GetProcessInfo
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c4738
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c4738
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15628]
call fcn.1400dd060
mov qword [rsp + 0x15de8], rax
mov rax, qword [rsp + 0x15de8]
mov qword [rsp + 0x15df0], rax
mov rcx, qword [rsp + 0x15df0]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15628]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, str.processinfo
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c47ff
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c47ff
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15630]
call fcn.1400dd060
mov qword [rsp + 0x15df8], rax
mov rax, qword [rsp + 0x15df8]
mov qword [rsp + 0x15e00], rax
mov rcx, qword [rsp + 0x15e00]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8059
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15630]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, [0x14021dad0]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c4a47
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c4a47
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rcx, [0x14021daf0]
call fcn.1400a9180
lea rcx, [rsp + rax + 0xb00]
call fcn.1400ada80
mov dword [rsp + 0x1b60], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15638]
call fcn.140008ad0
lea rdi, [rsp + 0x15cf0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15648]
call fcn.14001e460
lea rdi, [rsp + 0x15ce0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x608]
lea r8, [rsp + 0x15cf0]
lea rdx, [rsp + 0x15ce0]
lea rcx, [rsp + 0x1b50]
call fcn.1400260a0
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010210
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea rdx, [rsp + 0x15658]
call fcn.140008ad0
mov rdx, rax
lea rcx, [rsp + 0x1b50]
call fcn.14000cd00
movzx eax, al
test eax, eax
je 0x1401c4994
lea rdi, [rsp + 0x15668]
lea rsi, [rsp + 0x1b50]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x15d00]
lea rsi, [rsp + 0x15668]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
lea r8, [rsp + 0x15d00]
lea rdx, [rsp + 0x15678]
call fcn.1400209e0
cmp dword [rsp + 0x1b60], 0
jne 0x1401c49ba
lea rdx, [rsp + 0x608]
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x2c0
call fcn.140006eb0
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15688]
call fcn.1400dd060
mov qword [rsp + 0x15e08], rax
mov rax, qword [rsp + 0x15e08]
mov qword [rsp + 0x15e10], rax
mov rcx, qword [rsp + 0x15e10]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15688]
call fcn.140001490
movsxd rdx, dword [rsp + 0x1b40]
lea rcx, [rsp + 0x1b10]
call fcn.140007d10
lea rdx, [0x14021db00]
mov rcx, rax
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c4de4
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
cmp rax, 2
jbe 0x1401c4b0e
lea rcx, [rsp + 0xb00]
call fcn.1400a9180
mov byte [rsp + rax + 0xafe], 0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x15690]
call fcn.1400dd060
mov qword [rsp + 0x15e18], rax
mov rax, qword [rsp + 0x15e18]
mov qword [rsp + 0x15e20], rax
mov rcx, qword [rsp + 0x15e20]
call fcn.140023510
mov r9d, dword [rsp + 0x608]
mov qword [rsp + 0x20], rax
mov r8d, 0x8045
mov edx, 0xffffffff
lea rcx, [0x1403ac8a0]
call fcn.1401baa70
nop
lea rcx, [rsp + 0x15690]
call fcn.140001490
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d1e00
lea rcx, [rsp + 0x7b0]
call fcn.1401cfc20
lea rcx, [rsp + 0x670]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c4de4
lea rcx, [rsp + 0x9f0]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
cmp eax, 1
jne 0x1401c4de4
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403aa660]
call fcn.1401332a0
mov qword [rsp + 0x1b70], rax
mov qword [rsp + 0x1b88], 0
mov qword [rsp + 0x1b78], 0
mov qword [rsp + 0x1b68], 0
lea rcx, [rsp + 0x1b90]
call fcn.140002db0
nop
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403aa660]
call fcn.1401348a0
mov dword [rsp + 0x1b80], eax
cmp dword [rsp + 0x1b80], 0
jne 0x1401c4bea
lea rcx, [rsp + 0x1b90]
call fcn.140001490
jmp 0x1401c4293
mov r8d, dword [rsp + 0x1b80]
lea rdx, [0x14021db20]
lea rcx, [rsp + 0x1b90]
call fcn.140002c40
lea rcx, [rsp + 0x1b90]
call fcn.140023510
lea r9, [rsp + 0x1b68]
lea r8, [rsp + 0x1b78]
lea rdx, [rsp + 0x1b88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1401c4c4a
lea rcx, [rsp + 0x1b90]
call fcn.140001490
jmp 0x1401c4293
mov rax, qword [rsp + 0x1b68]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jge 0x1401c4c68
addsd xmm0, qword [0x14025a290]
mulsd xmm0, qword [0x14025a2a0]
mov rax, qword [rsp + 0x1b78]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jge 0x1401c4c8e
addsd xmm1, qword [0x14025a290]
divsd xmm0, xmm1
comisd xmm0, xmmword [0x14025c2d0]
jbe 0x1401c4cae
lea rcx, [rsp + 0x1b90]
call fcn.140001490
jmp 0x1401c4293
xor edx, edx
lea rcx, [rsp + 0x1b90]
call fcn.140006dd0
movzx edx, ax
lea rcx, [0x1403aa660]
call fcn.140134700
cmp dword [rsp + 0x608], eax
jne 0x1401c4dd7
mov rax, qword [rsp + 0x1b68]
imul rax, rax, 0x64
xor edx, edx
div qword [rsp + 0x1b78]
mov rdi, rax
xor edx, edx
mov rax, qword [rsp + 0x1b70]
mov ecx, 0x400
div rcx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov eax, dword [rsp + 0x1b80]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x610]
lea rdx, str.Reboot__s___d_M__avoid_write_back_disk___c:__full__free__d___
xor ecx, ecx
call fcn.1400dc610
lea rdx, [0x14021dbb0]
lea rcx, [rsp + 0x15698]
call fcn.1400d8960
mov qword [rsp + 0x15e28], rax
mov rax, qword [rsp + 0x15e28]
mov qword [rsp + 0x15e30], rax
mov rcx, qword [rsp + 0x15e30]
call fcn.140023510
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15698]
call fcn.140001490
mov r9d, 0x1000
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
test eax, eax
jne 0x1401c4dd7
mov dword [rsp + 0x1b08], 1
lea rcx, [rsp + 0x1b90]
call fcn.140001490
jmp 0x1401c4de9
lea rcx, [rsp + 0x1b90]
call fcn.140001490
jmp 0x1401c4293
lea rcx, [rsp + 0x1b10]
call fcn.140021310
cmp dword [rsp + 0x1b08], 0
je 0x1401c4e12
lea rcx, [rsp + 0x1b10]
call fcn.140007c90
jmp 0x1401c53b6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b04]
cmp eax, 0x1e
jbe 0x1401c5101
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
call fcn.140010210
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a0]
call fcn.140023260
mov rcx, rax
call fcn.14001db40
cmp rax, 0xa
jae 0x1401c50b9
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x156a8]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156a4], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156a4]
call fcn.140023260
lea rdx, [rsp + 0x156a8]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x156a8]
call fcn.140001490
lea rdx, str.getdiagnose_GetHardwareInfo
lea rcx, [rsp + 0x156b8]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156b0], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156b0]
call fcn.140023260
lea rdx, [rsp + 0x156b8]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x156b8]
call fcn.140001490
lea rcx, [rsp + 0x156c8]
call fcn.140001000
mov qword [rsp + 0x15e38], rax
mov rax, qword [rsp + 0x15e38]
mov qword [rsp + 0x15e40], rax
lea r8, [0x14021bc24]
mov rdx, qword [rsp + 0x15e40]
lea rcx, [rsp + 0x156d0]
call fcn.1400010b0
mov qword [rsp + 0x15e48], rax
mov rax, qword [rsp + 0x15e48]
mov qword [rsp + 0x15e50], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x15e50]
lea rcx, [rsp + 0x156d8]
call fcn.1400010b0
mov qword [rsp + 0x15e58], rax
mov rax, qword [rsp + 0x15e58]
mov qword [rsp + 0x15e60], rax
lea r8, [0x14021dc40]
mov rdx, qword [rsp + 0x15e60]
lea rcx, [rsp + 0x156e0]
call fcn.1400010b0
mov qword [rsp + 0x15e68], rax
mov rcx, qword [rsp + 0x15e68]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021dc50]
lea rcx, [0x14021dc70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x156c0], eax
lea rcx, [rsp + 0x156e0]
call fcn.140001490
nop
lea rcx, [rsp + 0x156d8]
call fcn.140001490
nop
lea rcx, [rsp + 0x156d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x156c8]
call fcn.140001490
cmp dword [rsp + 0x156c0], 0
je 0x1401c50b9
lea rdx, str.gettemperature
lea rcx, [rsp + 0x156f0]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x156e8], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x156e8]
call fcn.140023260
lea rdx, [rsp + 0x156f0]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x156f0]
call fcn.140001490
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x230
mov rax, qword [rsp + 0x165d0]
mov rax, qword [rax + 0x230]
call qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b04], eax
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x470]
call fcn.1401d1e00
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
sub eax, dword [rsp + 0x1b00]
cmp eax, 0xe10
jbe 0x1401c5398
lea rcx, [rsp + 0x15700]
call fcn.140001000
mov qword [rsp + 0x15e70], rax
mov rax, qword [rsp + 0x15e70]
mov qword [rsp + 0x15e78], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x10
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021bc34]
mov rdx, qword [rsp + 0x15e78]
lea rcx, [rsp + 0x15708]
call fcn.1400010b0
mov qword [rsp + 0x15e80], rax
mov rax, qword [rsp + 0x15e80]
mov qword [rsp + 0x15e88], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x20
mov dword [rsp + 0x15d10], eax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x15e88]
lea rcx, [rsp + 0x15710]
call fcn.1400010b0
mov qword [rsp + 0x15e90], rax
mov rax, qword [rsp + 0x15e90]
mov qword [rsp + 0x15e98], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x40
mov dword [rsp + 0x15d10], eax
lea r8, [0x14021dca0]
mov rdx, qword [rsp + 0x15e98]
lea rcx, [rsp + 0x15718]
call fcn.1400010b0
mov qword [rsp + 0x15ea0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x80
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15ea0]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, str.CheckClientHDD
lea rcx, [0x14021dcd0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c526b
lea rcx, [rsp + 0x6d0]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c526b
mov dword [rsp + 0x15ea8], 1
jmp 0x1401c5276
mov dword [rsp + 0x15ea8], 0
movzx eax, byte [rsp + 0x15ea8]
mov byte [rsp + 0x156f8], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x80
test eax, eax
je 0x1401c52ae
and dword [rsp + 0x15d10], 0xffffff7f
lea rcx, [rsp + 0x15718]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x40
test eax, eax
je 0x1401c52d2
and dword [rsp + 0x15d10], 0xffffffbf
lea rcx, [rsp + 0x15710]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x20
test eax, eax
je 0x1401c52f6
and dword [rsp + 0x15d10], 0xffffffdf
lea rcx, [rsp + 0x15708]
call fcn.140001490
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x10
test eax, eax
je 0x1401c5319
and dword [rsp + 0x15d10], 0xffffffef
lea rcx, [rsp + 0x15700]
call fcn.140001490
movzx eax, byte [rsp + 0x156f8]
test eax, eax
je 0x1401c5382
lea rdx, str.checklocalhdd
lea rcx, [rsp + 0x15728]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x15720], eax
mov rcx, qword [rsp + 0x165d0]
add rcx, 0x268
lea rdx, [rsp + 0x15720]
call fcn.140023260
lea rdx, [rsp + 0x15728]
mov rcx, rax
call fcn.140012650
nop
lea rcx, [rsp + 0x15728]
call fcn.140001490
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x1b00], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x1b10]
call fcn.140007c90
jmp 0x1401c411f
jmp 0x1401cc052
mov r8d, 4
lea rdx, str.Sync
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c53fb
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c2de0
jmp 0x1401cc052
lea rcx, [0x14021dd08]
call fcn.1400a9180
mov r8, rax
lea rdx, str.setpnpid
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c583d
lea rcx, [rsp + 0x6c8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c54a6
lea rcx, [rsp + 0x670]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c54a6
lea rdx, [rsp + 0x15738]
lea rcx, [rsp + 0x470]
call fcn.1401ce3d0
mov qword [rsp + 0x15eb0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x100
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x15eb0]
call fcn.140001a40
test eax, eax
jne 0x1401c54a6
mov dword [rsp + 0x15eb8], 1
jmp 0x1401c54b1
mov dword [rsp + 0x15eb8], 0
movzx eax, byte [rsp + 0x15eb8]
mov byte [rsp + 0x15730], al
mov eax, dword [rsp + 0x15d10]
and eax, 0x100
test eax, eax
je 0x1401c54e8
and dword [rsp + 0x15d10], 0xfffffeff
lea rcx, [rsp + 0x15738]
call fcn.140001490
movzx eax, byte [rsp + 0x15730]
test eax, eax
je 0x1401c5519
lea r8, [0x14021dd28]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401cc052
lea r8, [0x14021dd40]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
mov byte [rsp + 0x1fd0], 0
lea rdi, [rsp + 0x1fd1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
test eax, eax
jne 0x1401c5582
jmp 0x1401cc052
mov byte [rsp + 0x1bb0], 0
lea rdi, [rsp + 0x1bb1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r9d, 0x400
lea r8, [rsp + 0x1bb0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
test eax, eax
jne 0x1401c55cb
jmp 0x1401cc052
lea rdx, [rsp + 0x1fd0]
lea rcx, [rsp + 0x15740]
call fcn.140010530
mov qword [rsp + 0x15ec0], rax
mov rax, qword [rsp + 0x15ec0]
mov qword [rsp + 0x15ec8], rax
mov rcx, qword [rsp + 0x15ec8]
call fcn.1400105c0
mov rdx, rax
lea rcx, [rsp + 0x1b98]
call fcn.1400020d0
nop
lea rcx, [rsp + 0x15740]
call fcn.140002e70
lea rdx, [rsp + 0x1bb0]
lea rcx, [rsp + 0x15748]
call fcn.140010530
mov qword [rsp + 0x15ed0], rax
mov rax, qword [rsp + 0x15ed0]
mov qword [rsp + 0x15ed8], rax
mov rcx, qword [rsp + 0x15ed8]
call fcn.1400105c0
mov rdx, rax
lea rcx, [rsp + 0x1fb0]
call fcn.1400020d0
nop
lea rcx, [rsp + 0x15748]
call fcn.140002e70
lea r8, [0x14021bc5c]
lea rdx, [0x14021dd48]
lea rcx, [rsp + 0x1b98]
call fcn.140006300
lea r8, [0x14021ced4]
lea rdx, [0x14021dd50]
lea rcx, [rsp + 0x1fb0]
call fcn.140006300
lea r8, [0x14021dd58]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
mov r9d, 0x400
lea r8, [rsp + 0x1fd0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d82f0
mov dword [rsp + 0x1fc0], 0
lea rdx, [rsp + 0x15750]
lea rcx, [rsp + 0x470]
call fcn.1401d09a0
mov qword [rsp + 0x15ee0], rax
mov rax, qword [rsp + 0x15ee0]
mov qword [rsp + 0x15ee8], rax
lea r9, [rsp + 0x1fc0]
lea r8, [0x14021cefc]
lea rdx, [rsp + 0x1fb8]
mov rcx, qword [rsp + 0x15ee8]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x15750]
call fcn.140001490
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x1fb8]
call fcn.1400068a0
mov dword [rsp + 0x1ba0], eax
cmp dword [rsp + 0x1ba0], 0
jge 0x1401c57b2
lea rcx, [rsp + 0x1fb8]
call fcn.140001490
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b98]
call fcn.140001490
jmp 0x1401cc052
mov r8d, dword [rsp + 0x1ba0]
add r8d, 1
lea rdx, [rsp + 0x15758]
lea rcx, [rsp + 0x1fb8]
call fcn.140006a00
mov qword [rsp + 0x15ef0], rax
mov rax, qword [rsp + 0x15ef0]
mov qword [rsp + 0x15ef8], rax
mov rdx, qword [rsp + 0x15ef8]
lea rcx, [rsp + 0x1fb8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15758]
call fcn.140001490
nop
lea rcx, [rsp + 0x1fb8]
call fcn.140001490
nop
lea rcx, [rsp + 0x1fb0]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b98]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x14021dd60]
call fcn.1400a9180
mov r8, rax
lea rdx, str.getcmd
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c722d
mov r8d, 0x800
lea rdx, [rsp + 0x3790]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x3790]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
lea rdx, [rsp + 0x3790]
lea rcx, [rsp + 0x3788]
call fcn.1400020d0
nop
lea rdx, [0x14021dd70]
lea rcx, [rsp + 0x3788]
call fcn.140006000
lea rcx, [rsp + 0x2f40]
call fcn.140002db0
nop
mov dword [rsp + 0x3780], 0
mov dword [rsp + 0x2f30], 0
lea rcx, [rsp + 0x6f8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c5949
lea rcx, [rsp + 0x670]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c5949
lea rcx, [rsp + 0x6c8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
jne 0x1401c5949
lea rcx, [rsp + 0x6d8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c596b
lea r8, str.setupdate_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c598b
lea r8, str.setupdate_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
lea rcx, [rsp + 0x6f8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c59c6
lea r8, str.setsuper_1_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c59e6
lea r8, str.setsuper_0_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
lea rcx, [rsp + 0x6a8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c5a8b
lea rcx, [rsp + 0x6b0]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15760]
call fcn.140002de0
mov qword [rsp + 0x15f00], rax
mov rax, qword [rsp + 0x15f00]
mov qword [rsp + 0x15f08], rax
mov rcx, qword [rsp + 0x15f08]
call fcn.140002e90
mov r8, rax
lea rdx, str.setdisplay__s_r_n
lea rcx, [rsp + 0x3fa0]
call fcn.1400acc74
nop
lea rcx, [rsp + 0x15760]
call fcn.140002e70
lea r8, [rsp + 0x3fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
lea rcx, [rsp + 0x2f38]
call fcn.140002db0
nop
lea rcx, [rsp + 0x3788]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, [0x14021ddd8]
lea rcx, [0x14021de00]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c5ad8
lea rdx, str.77.88.8.3_77.88.8.7_
lea rcx, [rsp + 0x2f38]
call fcn.1400020a0
lea rdx, [rsp + 0x998]
lea rcx, [rsp + 0x2bd8]
call fcn.140001430
nop
lea rcx, [rsp + 0x688]
call fcn.140001a40
test eax, eax
je 0x1401c5b14
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x2bd8]
call fcn.140002d80
lea rdx, [rsp + 0x9a0]
lea rcx, [rsp + 0x3f98]
call fcn.140001430
nop
lea rcx, [rsp + 0x690]
call fcn.140001a40
test eax, eax
je 0x1401c5b50
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x3f98]
call fcn.140002d80
lea rcx, [rsp + 0x2bd8]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x1401c5b80
mov r8, qword [rsp + 0x2bd8]
lea rdx, [0x14021de40]
lea rcx, [rsp + 0x2f38]
call fcn.14000efa0
lea rcx, [rsp + 0x3f98]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x1401c5bb0
mov r8, qword [rsp + 0x3f98]
lea rdx, [0x14021de48]
lea rcx, [rsp + 0x2f38]
call fcn.14000efa0
lea rcx, [rsp + 0x2f38]
call fcn.140001a40
test eax, eax
je 0x1401c5c50
lea rcx, [rsp + 0x2f38]
call fcn.140001a40
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x2f38]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x2c
jne 0x1401c5c50
lea rcx, [rsp + 0x2f38]
call fcn.140001a40
mov r8d, eax
sub r8d, 1
lea rdx, [rsp + 0x15768]
lea rcx, [rsp + 0x2f38]
call fcn.140006b20
mov qword [rsp + 0x15f10], rax
mov rax, qword [rsp + 0x15f10]
mov qword [rsp + 0x15f18], rax
mov rdx, qword [rsp + 0x15f18]
lea rcx, [rsp + 0x2f38]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15768]
call fcn.140001490
mov r8, qword [rsp + 0x2f38]
lea rdx, str.setdns__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15770]
call fcn.140002de0
mov qword [rsp + 0x15f20], rax
mov rax, qword [rsp + 0x15f20]
mov qword [rsp + 0x15f28], rax
mov rcx, qword [rsp + 0x15f28]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15770]
call fcn.140002e70
lea rcx, [rsp + 0x3788]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x2f80]
lea r8, [0x14021d00c]
lea rdx, [0x14021de68]
lea rcx, [0x14021de78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x2f80]
cmp eax, 0x47
jne 0x1401c5d38
lea rdx, str.setgmenu_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
jmp 0x1401c5d4c
lea rdx, str.setgmenu_0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15778]
call fcn.140002de0
mov qword [rsp + 0x15f30], rax
mov rax, qword [rsp + 0x15f30]
mov qword [rsp + 0x15f38], rax
mov rcx, qword [rsp + 0x15f38]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15778]
call fcn.140002e70
lea rcx, [rsp + 0x970]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call fcn.1400a9470
lea rcx, [rsp + 0x680]
call fcn.140001a40
test eax, eax
je 0x1401c5e04
lea rcx, [rsp + 0x680]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x23d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x23d0]
lea rdx, str.route_delete_0.0.0.0_r_nroute_add_0.0.0.0_mask_0.0.0.0__s_metric_1_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15780]
call fcn.140002de0
mov qword [rsp + 0x15f40], rax
mov rax, qword [rsp + 0x15f40]
mov qword [rsp + 0x15f48], rax
mov rcx, qword [rsp + 0x15f48]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15780]
call fcn.140002e70
lea rcx, [rsp + 0x700]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
test eax, eax
je 0x1401c6127
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x43a0]
call fcn.140001430
nop
mov dword [rsp + 0x43a8], 0
cmp dword [rsp + 0x43a8], 0xffffffff
je 0x1401c611a
lea r9, [rsp + 0x43a8]
lea r8, [0x14021d04c]
lea rdx, [rsp + 0x43b8]
lea rcx, [rsp + 0x43a0]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x43b8]
call fcn.140001a40
test eax, eax
jne 0x1401c5f20
lea rcx, [rsp + 0x43b8]
call fcn.140001490
jmp 0x1401c611a
mov dword [rsp + 0x43ac], 0x10
lea r8, [rsp + 0x43ac]
lea rdx, [rsp + 0x43c0]
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [rsp + 0x43c4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15788]
call fcn.140010530
mov qword [rsp + 0x15f50], rax
mov rax, qword [rsp + 0x15f50]
mov qword [rsp + 0x15f58], rax
mov rcx, qword [rsp + 0x15f58]
call fcn.1400105c0
mov rdx, rax
lea rcx, [rsp + 0x43b0]
call fcn.1400020d0
nop
lea rcx, [rsp + 0x15788]
call fcn.140002e70
lea rdx, [rsp + 0x43b0]
lea rcx, [rsp + 0x43b8]
call fcn.14001d8f0
movzx eax, al
test eax, eax
je 0x1401c60fa
lea rdx, str.net_start_MSiSCSI_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15790]
call fcn.140002de0
mov qword [rsp + 0x15f60], rax
mov rax, qword [rsp + 0x15f60]
mov qword [rsp + 0x15f68], rax
mov rcx, qword [rsp + 0x15f68]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15790]
call fcn.140002e70
lea r9, [0x14021df80]
mov r8, qword [rsp + 0x43b8]
lea rdx, str.iscsicli_AddTargetPortal__s_3260_r_niscsicli_LoginTarget__s:00_T______0x00000002__________0_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15798]
call fcn.140002de0
mov qword [rsp + 0x15f70], rax
mov rax, qword [rsp + 0x15f70]
mov qword [rsp + 0x15f78], rax
mov rcx, qword [rsp + 0x15f78]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15798]
call fcn.140002e70
nop
lea rcx, [rsp + 0x43b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x43b8]
call fcn.140001490
jmp 0x1401c611a
lea rcx, [rsp + 0x43b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x43b8]
call fcn.140001490
jmp 0x1401c5eca
lea rcx, [rsp + 0x43a0]
call fcn.140001490
lea rcx, [rsp + 0x9b8]
lea rdx, [0x14021d074]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c685a
lea r8, [rsp + 0x3790]
lea rdx, str._sCmdpublic.txt
lea rcx, [rsp + 0x3788]
call fcn.140002c40
lea rcx, [rsp + 0x3788]
call fcn.140023510
lea rdx, [0x14021d684]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c62e1
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dd0
test eax, eax
jne 0x1401c62b4
mov byte [rsp + 0x4730], 0
lea rdi, [rsp + 0x4731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x4730]
call fcn.1400aa4d8
lea rcx, [rsp + 0x4730]
call fcn.1400a9180
test rax, rax
jne 0x1401c61f1
jmp 0x1401c6195
mov r8d, 5
lea rdx, [0x14021e0cc]
lea rcx, [rsp + 0x4730]
call fcn.1400ccd88
test eax, eax
jne 0x1401c6262
lea rax, [rsp + 0x157a0]
mov qword [rsp + 0x157a8], rax
lea rdx, [rsp + 0x4735]
mov rcx, qword [rsp + 0x157a8]
call fcn.1400db960
mov qword [rsp + 0x15f80], rax
mov r8, qword [rsp + 0x15f80]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c0dc0
jmp 0x1401c6195
lea rcx, [0x14021e0d8]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x14021e0e8]
lea rcx, [rsp + 0x4730]
call fcn.1400ccd88
test eax, eax
jne 0x1401c628e
jmp 0x1401c6195
lea r8, [rsp + 0x4730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c6195
mov rcx, qword [rsp + 0x43e0]
call fcn.1400aa000
lea r8, [0x14021d74c]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
lea rcx, [rsp + 0x658]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0x43d0], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401cc310
nop
mov eax, dword [rsp + 0x43d0]
mov dword [rsp + 0x4588], eax
lea rcx, [rsp + 0x43f0]
call fcn.1401b7390
lea rdx, [rsp + 0x4590]
lea rcx, [rsp + 0x43d8]
call fcn.140001430
nop
cmp dword [rsp + 0x43d0], 0
jne 0x1401c635a
lea rdx, [0x14021e0f8]
lea rcx, [rsp + 0x43d8]
call fcn.1400020a0
cmp dword [rsp + 0x43d0], 0xffffffff
jne 0x1401c6378
lea rdx, str.Non_PXE
lea rcx, [rsp + 0x43d8]
call fcn.1400020a0
mov r9, qword [rsp + 0x43d8]
lea r8, [rsp + 0x3790]
lea rdx, [0x14021e118]
lea rcx, [rsp + 0x3788]
call fcn.140002c40
lea rcx, [rsp + 0x3788]
call fcn.140023510
lea rdx, [0x14021d75c]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c64f5
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dd0
test eax, eax
jne 0x1401c64c8
movzx eax, byte [0x1402112af]
mov byte [rsp + 0x5730], al
lea rdi, [rsp + 0x5731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x5730]
call fcn.1400aa4d8
lea rcx, [rsp + 0x5730]
call fcn.1400a9180
test rax, rax
jne 0x1401c6431
jmp 0x1401c63cf
mov r8d, 5
lea rdx, [0x14021e134]
lea rcx, [rsp + 0x5730]
call fcn.1400ccd88
test eax, eax
jne 0x1401c64a2
lea rax, [rsp + 0x157b0]
mov qword [rsp + 0x157b8], rax
lea rdx, [rsp + 0x5735]
mov rcx, qword [rsp + 0x157b8]
call fcn.1400db960
mov qword [rsp + 0x15f88], rax
mov r8, qword [rsp + 0x15f88]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c0dc0
jmp 0x1401c63cf
lea r8, [rsp + 0x5730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c63cf
mov rcx, qword [rsp + 0x43e0]
call fcn.1400aa000
lea r8, [0x14021d7e4]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x157c0]
call fcn.140010530
mov qword [rsp + 0x15f90], rax
mov rax, qword [rsp + 0x15f90]
mov qword [rsp + 0x15f98], rax
mov rcx, qword [rsp + 0x15f98]
call fcn.1400105c0
mov r9, rax
lea r8, [rsp + 0x3790]
lea rdx, [0x14021e140]
lea rcx, [rsp + 0x3788]
call fcn.140002c40
nop
lea rcx, [rsp + 0x157c0]
call fcn.140002e70
lea rcx, [rsp + 0x3788]
call fcn.140023510
lea rdx, [0x14021d7fc]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c66c1
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dd0
test eax, eax
jne 0x1401c6694
movzx eax, byte [0x1402112b3]
mov byte [rsp + 0x6730], al
lea rdi, [rsp + 0x6731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x6730]
call fcn.1400aa4d8
lea rcx, [rsp + 0x6730]
call fcn.1400a9180
test rax, rax
jne 0x1401c65fd
jmp 0x1401c659b
mov r8d, 5
lea rdx, [0x14021e15c]
lea rcx, [rsp + 0x6730]
call fcn.1400ccd88
test eax, eax
jne 0x1401c666e
lea rax, [rsp + 0x157c8]
mov qword [rsp + 0x157d0], rax
lea rdx, [rsp + 0x6735]
mov rcx, qword [rsp + 0x157d0]
call fcn.1400db960
mov qword [rsp + 0x15fa0], rax
mov r8, qword [rsp + 0x15fa0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c0dc0
jmp 0x1401c659b
lea r8, [rsp + 0x6730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c659b
mov rcx, qword [rsp + 0x43e0]
call fcn.1400aa000
lea r8, [0x14021d9bc]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
mov r9, qword [rsp + 0x610]
lea r8, [rsp + 0x3790]
lea rdx, str._sCmd_s.txt
lea rcx, [rsp + 0x3788]
call fcn.140002c40
lea rcx, [rsp + 0x3788]
call fcn.140023510
lea rdx, [0x14021d9ec]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x43e0], rax
cmp qword [rsp + 0x43e0], 0
je 0x1401c683f
mov rcx, qword [rsp + 0x43e0]
call fcn.1400a9dd0
test eax, eax
jne 0x1401c6811
movzx eax, byte [0x1402112b7]
mov byte [rsp + 0x7730], al
lea rdi, [rsp + 0x7731]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x43e0]
mov edx, 0x1000
lea rcx, [rsp + 0x7730]
call fcn.1400aa4d8
lea rcx, [rsp + 0x7730]
call fcn.1400a9180
test rax, rax
jne 0x1401c677a
jmp 0x1401c6718
mov r8d, 5
lea rdx, [0x14021e184]
lea rcx, [rsp + 0x7730]
call fcn.1400ccd88
test eax, eax
jne 0x1401c67eb
lea rax, [rsp + 0x157d8]
mov qword [rsp + 0x157e0], rax
lea rdx, [rsp + 0x7735]
mov rcx, qword [rsp + 0x157e0]
call fcn.1400db960
mov qword [rsp + 0x15fa8], rax
mov r8, qword [rsp + 0x15fa8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1401c0dc0
jmp 0x1401c6718
lea r8, [rsp + 0x7730]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c6718
mov rcx, qword [rsp + 0x43e0]
call fcn.1400aa000
lea r8, [0x14021daec]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x43d8]
call fcn.140001490
nop
lea rcx, [rsp + 0x43f0]
call fcn.140005db0
lea rcx, [rsp + 0x9f8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0x3f90], eax
lea rdx, [rsp + 0xa00]
lea rcx, [rsp + 0x2f28]
call fcn.140001430
nop
lea rcx, [rsp + 0x9f8]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401c6a76
lea rcx, [rsp + 0x9b8]
lea rdx, [0x14021dbac]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c6a76
lea rcx, [rsp + 0x157e8]
call fcn.140001000
mov qword [rsp + 0x15fb0], rax
mov rax, qword [rsp + 0x15fb0]
mov qword [rsp + 0x15fb8], rax
lea r8, [0x14021e190]
mov rdx, qword [rsp + 0x15fb8]
lea rcx, [rsp + 0x8738]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157e8]
call fcn.140001490
lea rcx, [rsp + 0x8738]
call fcn.140023510
lea rdx, [0x14021ddfc]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x8730], rax
cmp qword [rsp + 0x8730], 0
je 0x1401c6a1e
mov rcx, qword [rsp + 0x8730]
call fcn.1400a9dd0
test eax, eax
jne 0x1401c6a11
xor eax, eax
mov word [rsp + 0x8740], ax
lea rdi, [rsp + 0x8742]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x8730]
mov edx, 0x2000
lea rcx, [rsp + 0x8740]
call fcn.1400a9e40
lea rcx, [rsp + 0x8740]
call fcn.1400a8204
test rax, rax
jne 0x1401c69a3
jmp 0x1401c6945
lea rcx, [0x14021e1b0]
call fcn.1400a8204
mov r8, rax
lea rdx, [0x14021e1c8]
lea rcx, [rsp + 0x8740]
call fcn.1400a939c
test eax, eax
jne 0x1401c6a0c
mov dword [rsp + 0x3f90], 1
lea rcx, [0x14021e1e0]
call fcn.1400a8204
lea rdx, [rsp + rax*2 + 0x8740]
lea rcx, [rsp + 0x2f28]
call fcn.1400020a0
lea rdx, [0x14021e1f8]
lea rcx, [rsp + 0x2f28]
call fcn.1400069d0
jmp 0x1401c6a11
jmp 0x1401c6945
mov rcx, qword [rsp + 0x8730]
call fcn.1400aa000
lea rcx, [rsp + 0x9f8]
mov r8d, dword [rsp + 0x3f90]
lea rdx, [0x14021e200]
call fcn.140002c40
lea rcx, [rsp + 0xa00]
lea rdx, [rsp + 0x2f28]
call fcn.140002d80
lea rcx, [rsp + 0x7b0]
call fcn.1401b7780
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
nop
lea rcx, [rsp + 0x8738]
call fcn.140001490
cmp dword [rsp + 0x3f90], 0
je 0x1401c6b5c
lea r8, [rsp + 0x2f28]
lea rdx, [0x14021e210]
lea rcx, [rsp + 0x157f0]
call fcn.140006c90
mov qword [rsp + 0x15fc0], rax
mov rax, qword [rsp + 0x15fc0]
mov qword [rsp + 0x15fc8], rax
lea r8, [0x14021e208]
mov rdx, qword [rsp + 0x15fc8]
lea rcx, [rsp + 0xa740]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x157f0]
call fcn.140001490
lea rcx, [rsp + 0xa740]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x157f8]
call fcn.1400d8920
mov qword [rsp + 0x15fd0], rax
mov rax, qword [rsp + 0x15fd0]
mov qword [rsp + 0x15fd8], rax
mov rcx, qword [rsp + 0x15fd8]
call fcn.140023510
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x157f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xa740]
call fcn.140001490
lea r8, [rsp + 0x3790]
lea rdx, str._sCCBoot.ini
lea rcx, [rsp + 0x3788]
call fcn.140002c40
lea rcx, [rsp + 0x2bd0]
call fcn.140002db0
nop
lea rcx, [rsp + 0x2be0]
call fcn.14000eff0
nop
lea rcx, [rsp + 0x2f48]
call fcn.140007ac0
nop
lea rdx, [rsp + 0x2f48]
lea rcx, [rsp + 0x2be0]
call fcn.1401b7170
lea rdx, [0x14021e0a4]
lea rcx, [rsp + 0x2bd0]
call fcn.1400020a0
mov dword [rsp + 0xa748], 0
jmp 0x1401c6be9
mov eax, dword [rsp + 0xa748]
add eax, 1
mov dword [rsp + 0xa748], eax
movsxd rdi, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007b40
cmp rdi, rax
jae 0x1401c6e12
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1a8
lea rdx, [0x14021e248]
call fcn.1400060b0
test eax, eax
je 0x1401c6c38
jmp 0x1401c6bd8
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1c0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15800]
call fcn.140002270
mov qword [rsp + 0x15fe0], rax
mov rax, qword [rsp + 0x15fe0]
mov qword [rsp + 0x15fe8], rax
movsxd rdx, dword [rsp + 0xa748]
lea rcx, [rsp + 0x2f48]
call fcn.140007b70
mov rcx, rax
add rcx, 0x1a0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x15808]
call fcn.140002270
mov qword [rsp + 0x15ff0], rax
mov rax, qword [rsp + 0x15ff0]
mov qword [rsp + 0x15ff8], rax
mov r8, qword [rsp + 0x15ff8]
lea rdx, [rsp + 0x2bd0]
lea rcx, [rsp + 0x15810]
call fcn.140006bd0
mov qword [rsp + 0x16000], rax
mov rax, qword [rsp + 0x16000]
mov qword [rsp + 0x16008], rax
lea r8, [0x14021e0f4]
mov rdx, qword [rsp + 0x16008]
lea rcx, [rsp + 0x15818]
call fcn.1400010b0
mov qword [rsp + 0x16010], rax
mov rax, qword [rsp + 0x16010]
mov qword [rsp + 0x16018], rax
mov r8, qword [rsp + 0x15fe8]
mov rdx, qword [rsp + 0x16018]
lea rcx, [rsp + 0x15820]
call fcn.140006bd0
mov qword [rsp + 0x16020], rax
mov rax, qword [rsp + 0x16020]
mov qword [rsp + 0x16028], rax
lea r8, [0x14021e0e4]
mov rdx, qword [rsp + 0x16028]
lea rcx, [rsp + 0x15828]
call fcn.1400010b0
mov qword [rsp + 0x16030], rax
mov rax, qword [rsp + 0x16030]
mov qword [rsp + 0x16038], rax
mov rdx, qword [rsp + 0x16038]
lea rcx, [rsp + 0x2bd0]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15828]
call fcn.140001490
nop
lea rcx, [rsp + 0x15820]
call fcn.140001490
nop
lea rcx, [rsp + 0x15818]
call fcn.140001490
nop
lea rcx, [rsp + 0x15810]
call fcn.140001490
nop
lea rcx, [rsp + 0x15808]
call fcn.140001490
nop
lea rcx, [rsp + 0x15800]
call fcn.140001490
jmp 0x1401c6bd8
lea rcx, [rsp + 0x2f20]
call fcn.140002db0
nop
mov dword [rsp + 0x3780], 0
cmp dword [rsp + 0x3780], 0xffffffff
je 0x1401c6fbe
lea r9, [rsp + 0x3780]
lea r8, [0x14021e244]
lea rdx, [rsp + 0xaf60]
lea rcx, [rsp + 0x2bd0]
call fcn.1400065a0
nop
lea rcx, [rsp + 0xaf60]
call fcn.140001a40
test eax, eax
jne 0x1401c6e81
lea rcx, [rsp + 0xaf60]
call fcn.140001490
jmp 0x1401c6fbe
mov r8d, 1
lea rdx, [rsp + 0x15830]
lea rcx, [rsp + 0xaf60]
call fcn.140006b20
mov qword [rsp + 0x16040], rax
lea rcx, [rsp + 0x3788]
call fcn.140023510
mov rdi, rax
mov rcx, qword [rsp + 0x16040]
call fcn.140023510
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xa750]
lea r8, [0x14021e254]
mov rdx, rax
lea rcx, [0x14021e258]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15830]
call fcn.140001490
movzx eax, word [rsp + 0xa750]
test eax, eax
jne 0x1401c6f18
lea rcx, [rsp + 0xaf60]
call fcn.140001490
jmp 0x1401c6e2b
lea rdx, [rsp + 0xa750]
lea rcx, [rsp + 0x2f20]
call fcn.140006000
lea rdx, [0x14021e27c]
lea rcx, [rsp + 0x2f20]
call fcn.140006000
mov r8d, 1
lea rdx, [rsp + 0x15838]
lea rcx, [rsp + 0xaf60]
call fcn.140006a60
mov qword [rsp + 0x16048], rax
mov rax, qword [rsp + 0x16048]
mov qword [rsp + 0x16050], rax
mov rdx, qword [rsp + 0x16050]
lea rcx, [rsp + 0x2f20]
call fcn.140005fd0
nop
lea rcx, [rsp + 0x15838]
call fcn.140001490
lea rdx, [0x14021e280]
lea rcx, [rsp + 0x2f20]
call fcn.140006000
nop
lea rcx, [rsp + 0xaf60]
call fcn.140001490
jmp 0x1401c6e2b
lea rcx, [rsp + 0x2f20]
call fcn.140001a40
test eax, eax
je 0x1401c705b
mov r8, qword [rsp + 0x2f20]
lea rdx, [0x14021e288]
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15840]
call fcn.140002de0
mov qword [rsp + 0x16058], rax
mov rax, qword [rsp + 0x16058]
mov qword [rsp + 0x16060], rax
mov rcx, qword [rsp + 0x16060]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15840]
call fcn.140002e70
lea rcx, [rsp + 0x3788]
call fcn.140023510
mov r9, rax
mov r8d, 1
lea rdx, str.SetMkLink
lea rcx, [0x14021e2c8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c70a9
lea r8, str.setmklink__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
lea rcx, [rsp + 0x3788]
call fcn.140023510
mov r9, rax
xor r8d, r8d
lea rdx, str.USBWriteProtect
lea rcx, [0x14021e308]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1401c70e5
lea rax, [0x14021e284]
mov qword [rsp + 0x16068], rax
jmp 0x1401c70f4
lea rax, [0x14021e2c4]
mov qword [rsp + 0x16068], rax
mov r8, qword [rsp + 0x16068]
lea rdx, str.setusbwriteprotect__s_r_n
lea rcx, [rsp + 0x2f40]
call fcn.140002c40
lea rcx, [rsp + 0x2f40]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15848]
call fcn.140002de0
mov qword [rsp + 0x16070], rax
mov rax, qword [rsp + 0x16070]
mov qword [rsp + 0x16078], rax
mov rcx, qword [rsp + 0x16078]
call fcn.140002e90
mov r8, rax
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x15848]
call fcn.140002e70
lea r8, str._r_n:end_r_n_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x2f20]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f48]
call fcn.140007b10
nop
lea rcx, [rsp + 0x2be0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x2bd0]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f28]
call fcn.140001490
nop
lea rcx, [rsp + 0x3f98]
call fcn.140001490
nop
lea rcx, [rsp + 0x2bd8]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f38]
call fcn.140001490
nop
lea rcx, [rsp + 0x2f40]
call fcn.140001490
nop
lea rcx, [rsp + 0x3788]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x14021e358]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x14021e368]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c795b
lea rcx, str.superenable
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xb788]
call fcn.1400dd060
nop
lea rdx, [0x14021e388]
lea rcx, [rsp + 0xb788]
call fcn.1400069d0
mov dword [rsp + 0xaf68], 0
lea rcx, [rsp + 0xb788]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15850]
call fcn.1400db9e0
mov qword [rsp + 0x16080], rax
mov rcx, qword [rsp + 0x16080]
call fcn.140023510
lea rdx, [rsp + 0xaf68]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xaf70], rax
lea rcx, [rsp + 0x15850]
call fcn.140001490
cmp dword [rsp + 0xaf68], 1
jge 0x1401c733c
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [0x14021e390]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xb788]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [0x14021e3a8]
lea rcx, [rsp + 0xb780]
call fcn.1400020d0
nop
mov dword [rsp + 0xaf6c], 0
mov dword [rsp + 0xb790], 0
jmp 0x1401c737a
mov eax, dword [rsp + 0xb790]
add eax, 1
mov dword [rsp + 0xb790], eax
mov eax, dword [rsp + 0xaf68]
cmp dword [rsp + 0xb790], eax
jge 0x1401c7531
lea rcx, [0x14021e3c8]
call fcn.1400a8204
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._Pwd
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400a939c
test eax, eax
jne 0x1401c7462
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15858]
call fcn.1400db9a0
mov qword [rsp + 0x16088], rax
mov rax, qword [rsp + 0x16088]
mov qword [rsp + 0x16090], rax
mov r8d, 5
lea rdx, [rsp + 0x15860]
mov rcx, qword [rsp + 0x16090]
call fcn.140006a00
mov qword [rsp + 0x16098], rax
mov rax, qword [rsp + 0x16098]
mov qword [rsp + 0x160a0], rax
mov rdx, qword [rsp + 0x160a0]
lea rcx, [rsp + 0xb780]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15860]
call fcn.140001490
nop
lea rcx, [rsp + 0x15858]
call fcn.140001490
lea rcx, [0x14021e3e8]
call fcn.1400a8204
mov r8, rax
movsxd rax, dword [rsp + 0xb790]
lea rdx, str._SuperType
mov rcx, qword [rsp + 0xaf70]
mov rcx, qword [rcx + rax*8]
call fcn.1400a939c
test eax, eax
jne 0x1401c752c
movsxd rax, dword [rsp + 0xb790]
mov rdx, qword [rsp + 0xaf70]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x15868]
call fcn.1400db9a0
mov qword [rsp + 0x160a8], rax
mov rax, qword [rsp + 0x160a8]
mov qword [rsp + 0x160b0], rax
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [rsp + 0x15870]
mov rcx, qword [rsp + 0x160b0]
call fcn.140006a00
mov qword [rsp + 0x160b8], rax
mov rcx, qword [rsp + 0x160b8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xaf6c], eax
lea rcx, [rsp + 0x15870]
call fcn.140001490
nop
lea rcx, [rsp + 0x15868]
call fcn.140001490
jmp 0x1401c7369
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x14021e418]
lea rcx, [rsp + 0xb780]
call fcn.140006030
test eax, eax
jne 0x1401c7598
lea r8, [0x14021e438]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xb780]
call fcn.140001490
nop
lea rcx, [rsp + 0xb788]
call fcn.140001490
jmp 0x1401cc052
xor eax, eax
mov word [rsp + 0xaf80], ax
lea rdi, [rsp + 0xaf82]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15878]
call fcn.140001000
mov qword [rsp + 0x160c0], rax
mov rax, qword [rsp + 0x160c0]
mov qword [rsp + 0x160c8], rax
lea r8, [0x14021e364]
mov rdx, qword [rsp + 0x160c8]
lea rcx, [rsp + 0x15880]
call fcn.1400010b0
mov qword [rsp + 0x160d0], rax
mov rax, qword [rsp + 0x160d0]
mov qword [rsp + 0x160d8], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x160d8]
lea rcx, [rsp + 0x15888]
call fcn.1400010b0
mov qword [rsp + 0x160e0], rax
mov rax, qword [rsp + 0x160e0]
mov qword [rsp + 0x160e8], rax
lea r8, [0x14021e450]
mov rdx, qword [rsp + 0x160e8]
lea rcx, [rsp + 0x15890]
call fcn.1400010b0
mov qword [rsp + 0x160f0], rax
mov rcx, qword [rsp + 0x160f0]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xaf80]
lea r8, [0x14021e374]
lea rdx, [0x14021e460]
lea rcx, [0x14021e478]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15890]
call fcn.140001490
nop
lea rcx, [rsp + 0x15888]
call fcn.140001490
nop
lea rcx, [rsp + 0x15880]
call fcn.140001490
nop
lea rcx, [rsp + 0x15878]
call fcn.140001490
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158a0]
call fcn.140004e00
mov qword [rsp + 0x160f8], rax
mov rcx, qword [rsp + 0x160f8]
call fcn.140006e20
mov byte [rsp + 0x15898], al
lea rcx, [rsp + 0x158a0]
call fcn.140001490
movzx edx, byte [rsp + 0x15898]
test edx, edx
je 0x1401c7764
lea r8, [0x14021e488]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xb780]
call fcn.140001490
nop
lea rcx, [rsp + 0xb788]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [rsp + 0xaf80]
lea rcx, [rsp + 0x158b0]
call fcn.140004e00
mov qword [rsp + 0x16100], rax
mov rax, qword [rsp + 0x16100]
mov qword [rsp + 0x16108], rax
mov rcx, qword [rsp + 0x16108]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0xb780]
call fcn.140006030
mov dword [rsp + 0x158a8], eax
lea rcx, [rsp + 0x158b0]
call fcn.140001490
cmp dword [rsp + 0x158a8], 0
je 0x1401c780d
lea r8, [0x14021e4a8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xb780]
call fcn.140001490
nop
lea rcx, [rsp + 0xb788]
call fcn.140001490
jmp 0x1401cc052
mov r8d, dword [rsp + 0xaf6c]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403aa660]
call fcn.14013a0f0
mov dword [rsp + 0x16110], eax
cmp dword [rsp + 0x16110], 0xfffffffd
je 0x1401c786a
cmp dword [rsp + 0x16110], 0xfffffffe
je 0x1401c788f
cmp dword [rsp + 0x16110], 0xffffffff
je 0x1401c78b4
cmp dword [rsp + 0x16110], 0
je 0x1401c78d6
cmp dword [rsp + 0x16110], 1
je 0x1401c78f8
jmp 0x1401c791a
lea r8, str._ERR_DEVICEID_NOT_MATCH_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c793b
lea r8, str._ERR_ALREADY_SUPER_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c793b
lea r8, [0x14021e4f8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c793b
lea r8, [0x14021e518]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c793b
lea r8, [0x14021e530]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c793b
lea r8, [0x14021e538]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xb780]
call fcn.140001490
nop
lea rcx, [rsp + 0xb788]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x14021e558]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x14021e568]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c808b
lea rcx, str.superdisable
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xbfc0]
call fcn.1400dd060
nop
lea rdx, [0x14021e588]
lea rcx, [rsp + 0xbfc0]
call fcn.1400069d0
mov dword [rsp + 0xb794], 0
lea rcx, [rsp + 0xbfc0]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x158b8]
call fcn.1400db9e0
mov qword [rsp + 0x16118], rax
mov rcx, qword [rsp + 0x16118]
call fcn.140023510
lea rdx, [rsp + 0xb794]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xb7a0], rax
lea rcx, [rsp + 0x158b8]
call fcn.140001490
cmp dword [rsp + 0xb794], 3
jge 0x1401c7a6a
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, str._ERR_INVALID_CMD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [0x14021e5a8]
lea rcx, [rsp + 0xbfb0]
call fcn.1400020d0
nop
mov dword [rsp + 0xbfb8], 0
mov dword [rsp + 0xb798], 0
mov dword [rsp + 0xbfc8], 0
jmp 0x1401c7ab3
mov eax, dword [rsp + 0xbfc8]
add eax, 1
mov dword [rsp + 0xbfc8], eax
mov eax, dword [rsp + 0xb794]
cmp dword [rsp + 0xbfc8], eax
jge 0x1401c7cbe
movsxd rax, dword [rsp + 0xbfc8]
mov rdx, qword [rsp + 0xb7a0]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x158c0]
call fcn.1400db9a0
mov qword [rsp + 0x16120], rax
mov rax, qword [rsp + 0x16120]
mov qword [rsp + 0x16128], rax
mov rdx, qword [rsp + 0x16128]
lea rcx, [rsp + 0xbfc0]
call fcn.140002d80
nop
lea rcx, [rsp + 0x158c0]
call fcn.140001490
lea rcx, [0x14021e5c8]
call fcn.1400a8204
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021e5d8]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a939c
test eax, eax
jne 0x1401c7bb1
mov r8d, 5
lea rdx, [rsp + 0x158c8]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a00
mov qword [rsp + 0x16130], rax
mov rax, qword [rsp + 0x16130]
mov qword [rsp + 0x16138], rax
mov rdx, qword [rsp + 0x16138]
lea rcx, [rsp + 0xbfb0]
call fcn.140002d80
nop
lea rcx, [rsp + 0x158c8]
call fcn.140001490
jmp 0x1401c7aa2
lea rcx, [0x14021e5e8]
call fcn.1400a8204
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021e600]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a939c
test eax, eax
jne 0x1401c7c35
mov r8d, 8
lea rdx, [rsp + 0x158d0]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a00
mov qword [rsp + 0x16140], rax
mov rcx, qword [rsp + 0x16140]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xbfb8], eax
lea rcx, [rsp + 0x158d0]
call fcn.140001490
jmp 0x1401c7aa2
lea rcx, [0x14021e618]
call fcn.1400a8204
mov r8, rax
movsxd rax, dword [rsp + 0xbfc8]
lea rdx, [0x14021e630]
mov rcx, qword [rsp + 0xb7a0]
mov rcx, qword [rcx + rax*8]
call fcn.1400a939c
test eax, eax
jne 0x1401c7cb9
mov r8d, 0xa
lea rdx, [rsp + 0x158d8]
lea rcx, [rsp + 0xbfc0]
call fcn.140006a00
mov qword [rsp + 0x16148], rax
mov rcx, qword [rsp + 0x16148]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xb798], eax
lea rcx, [rsp + 0x158d8]
call fcn.140001490
jmp 0x1401c7aa2
jmp 0x1401c7aa2
mov rcx, qword [rsp + 0xb7a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.VERSION_ERROR
lea rcx, [rsp + 0xbfb0]
call fcn.140006030
test eax, eax
jne 0x1401c7d25
lea r8, [0x14021e668]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001490
jmp 0x1401cc052
xor eax, eax
mov word [rsp + 0xb7b0], ax
lea rdi, [rsp + 0xb7b2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x158e0]
call fcn.140001000
mov qword [rsp + 0x16150], rax
mov rax, qword [rsp + 0x16150]
mov qword [rsp + 0x16158], rax
lea r8, [0x14021e3c4]
mov rdx, qword [rsp + 0x16158]
lea rcx, [rsp + 0x158e8]
call fcn.1400010b0
mov qword [rsp + 0x16160], rax
mov rax, qword [rsp + 0x16160]
mov qword [rsp + 0x16168], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x16168]
lea rcx, [rsp + 0x158f0]
call fcn.1400010b0
mov qword [rsp + 0x16170], rax
mov rax, qword [rsp + 0x16170]
mov qword [rsp + 0x16178], rax
lea r8, [0x14021e680]
mov rdx, qword [rsp + 0x16178]
lea rcx, [rsp + 0x158f8]
call fcn.1400010b0
mov qword [rsp + 0x16180], rax
mov rcx, qword [rsp + 0x16180]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb7b0]
lea r8, [0x14021e3d4]
lea rdx, [0x14021e690]
lea rcx, [0x14021e6a8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x158f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x158f0]
call fcn.140001490
nop
lea rcx, [rsp + 0x158e8]
call fcn.140001490
nop
lea rcx, [rsp + 0x158e0]
call fcn.140001490
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15908]
call fcn.140004e00
mov qword [rsp + 0x16188], rax
mov rcx, qword [rsp + 0x16188]
call fcn.140006e20
mov byte [rsp + 0x15900], al
lea rcx, [rsp + 0x15908]
call fcn.140001490
movzx edx, byte [rsp + 0x15900]
test edx, edx
je 0x1401c7ef1
lea r8, [0x14021e6b8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [rsp + 0xb7b0]
lea rcx, [rsp + 0x15918]
call fcn.140004e00
mov qword [rsp + 0x16190], rax
mov rax, qword [rsp + 0x16190]
mov qword [rsp + 0x16198], rax
mov rcx, qword [rsp + 0x16198]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0xbfb0]
call fcn.140006030
mov dword [rsp + 0x15910], eax
lea rcx, [rsp + 0x15918]
call fcn.140001490
cmp dword [rsp + 0x15910], 0
je 0x1401c7f9a
lea r8, [0x14021e6d8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001490
jmp 0x1401cc052
mov r9d, dword [rsp + 0xb798]
mov r8d, dword [rsp + 0xbfb8]
mov edx, dword [rsp + 0x608]
lea rcx, [0x1403aa660]
call fcn.1401328e0
mov dword [rsp + 0x161a0], eax
cmp dword [rsp + 0x161a0], 0xffffffff
je 0x1401c7fe4
cmp dword [rsp + 0x161a0], 0
je 0x1401c8006
cmp dword [rsp + 0x161a0], 1
je 0x1401c8028
jmp 0x1401c804a
lea r8, str._ERR_GET_DEVICEID_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c806b
lea r8, str._ERR_INVALID_CLIENTID_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c806b
lea r8, str.OK_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401c806b
lea r8, str._ERR_OPERATION_FAILURE_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xbfc0]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x14021e750]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x14021e758]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c8da8
lea rcx, str.upload
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xc800]
call fcn.1400dd060
nop
lea rdx, [0x14021e768]
lea rcx, [rsp + 0xc800]
call fcn.1400069d0
mov dword [rsp + 0xc814], 0
lea r9, [rsp + 0xc814]
lea r8, [0x14021e3e4]
lea rdx, [rsp + 0x15920]
lea rcx, [rsp + 0xc800]
call fcn.1400065a0
mov qword [rsp + 0x161a8], rax
mov rcx, qword [rsp + 0x161a8]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xc810], eax
lea rcx, [rsp + 0x15920]
call fcn.140001490
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c8168
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea r9, [rsp + 0xc814]
lea r8, [0x14021e434]
lea rdx, [rsp + 0x15928]
lea rcx, [rsp + 0xc800]
call fcn.1400065a0
mov qword [rsp + 0x161b0], rax
mov rcx, qword [rsp + 0x161b0]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xc7f8], eax
lea rcx, [rsp + 0x15928]
call fcn.140001490
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c81d9
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xc808]
call fcn.140002db0
nop
mov edx, dword [rsp + 0xc814]
lea rcx, [rsp + 0xc800]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401c8275
mov eax, dword [rsp + 0xc814]
add eax, 1
mov dword [rsp + 0xc814], eax
lea r9, [rsp + 0xc814]
lea r8, [0x14021e5c4]
lea rdx, [rsp + 0x15930]
lea rcx, [rsp + 0xc800]
call fcn.1400065a0
mov qword [rsp + 0x161b8], rax
mov rax, qword [rsp + 0x161b8]
mov qword [rsp + 0x161c0], rax
mov rdx, qword [rsp + 0x161c0]
lea rcx, [rsp + 0xc808]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15930]
call fcn.140001490
jmp 0x1401c82d4
lea r9, [rsp + 0xc814]
lea r8, [0x14021e5d4]
lea rdx, [rsp + 0x15938]
lea rcx, [rsp + 0xc800]
call fcn.1400065a0
mov qword [rsp + 0x161c8], rax
mov rax, qword [rsp + 0x161c8]
mov qword [rsp + 0x161d0], rax
mov rdx, qword [rsp + 0x161d0]
lea rcx, [rsp + 0xc808]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15938]
call fcn.140001490
cmp dword [rsp + 0xc814], 0xffffffff
jne 0x1401c82ef
lea rax, [0x14021e5e4]
mov qword [rsp + 0x161d8], rax
jmp 0x1401c8353
lea r9, [rsp + 0xc814]
lea r8, [0x14021e664]
lea rdx, [rsp + 0x15940]
lea rcx, [rsp + 0xc800]
call fcn.1400065a0
mov qword [rsp + 0x161e0], rax
mov rax, qword [rsp + 0x161e0]
mov qword [rsp + 0x161e8], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x200
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x161e8]
call fcn.140023510
mov qword [rsp + 0x161d8], rax
mov rdx, qword [rsp + 0x161d8]
lea rcx, [rsp + 0xc7f0]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x200
test eax, eax
je 0x1401c8391
and dword [rsp + 0x15d10], 0xfffffdff
lea rcx, [rsp + 0x15940]
call fcn.140001490
xor eax, eax
mov word [rsp + 0xbfe0], ax
lea rdi, [rsp + 0xbfe2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15948]
call fcn.140001000
mov qword [rsp + 0x161f0], rax
mov rax, qword [rsp + 0x161f0]
mov qword [rsp + 0x161f8], rax
lea r8, [0x14021e77c]
mov rdx, qword [rsp + 0x161f8]
lea rcx, [rsp + 0x15950]
call fcn.1400010b0
mov qword [rsp + 0x16200], rax
mov rax, qword [rsp + 0x16200]
mov qword [rsp + 0x16208], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x16208]
lea rcx, [rsp + 0x15958]
call fcn.1400010b0
mov qword [rsp + 0x16210], rax
mov rax, qword [rsp + 0x16210]
mov qword [rsp + 0x16218], rax
lea r8, [0x14021e770]
mov rdx, qword [rsp + 0x16218]
lea rcx, [rsp + 0x15960]
call fcn.1400010b0
mov qword [rsp + 0x16220], rax
mov rcx, qword [rsp + 0x16220]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xbfe0]
lea r8, [0x14021e780]
lea rdx, [0x14021e788]
lea rcx, [0x14021e7a0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15960]
call fcn.140001490
nop
lea rcx, [rsp + 0x15958]
call fcn.140001490
nop
lea rcx, [rsp + 0x15950]
call fcn.140001490
nop
lea rcx, [rsp + 0x15948]
call fcn.140001490
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15970]
call fcn.140004e00
mov qword [rsp + 0x16228], rax
mov rcx, qword [rsp + 0x16228]
call fcn.140006e20
mov byte [rsp + 0x15968], al
lea rcx, [rsp + 0x15970]
call fcn.140001490
movzx edx, byte [rsp + 0x15968]
test edx, edx
je 0x1401c856b
lea r8, [0x14021e7b0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc808]
call fcn.140001490
nop
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [rsp + 0xbfe0]
lea rcx, [rsp + 0x15980]
call fcn.140004e00
mov qword [rsp + 0x16230], rax
mov rax, qword [rsp + 0x16230]
mov qword [rsp + 0x16238], rax
mov rcx, qword [rsp + 0x16238]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0xc7f0]
call fcn.140006030
mov dword [rsp + 0x15978], eax
lea rcx, [rsp + 0x15980]
call fcn.140001490
cmp dword [rsp + 0x15978], 0
je 0x1401c8622
lea r8, [0x14021e7d0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc808]
call fcn.140001490
nop
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xc7e8]
call fcn.140002270
nop
mov r8d, 1
lea rdx, [rsp + 0x15990]
lea rcx, [rsp + 0xc7e8]
call fcn.140006a60
mov qword [rsp + 0x16240], rax
lea rdx, [0x14021e7e8]
mov rcx, qword [rsp + 0x16240]
call fcn.140006d90
mov byte [rsp + 0x15988], al
lea rcx, [rsp + 0x15990]
call fcn.140001490
movzx edx, byte [rsp + 0x15988]
test edx, edx
je 0x1401c86ac
lea rdx, [0x14021e7ec]
lea rcx, [rsp + 0xc7e8]
call fcn.140006000
lea rcx, [rsp + 0xc808]
call fcn.140023510
lea rdx, [0x14021e7f0]
mov rcx, rax
call fcn.1400a9bbc
test rax, rax
jne 0x1401c8727
lea r8, [rsp + 0xc808]
lea rdx, [rsp + 0xc7e8]
lea rcx, [rsp + 0x15998]
call fcn.140006bd0
mov qword [rsp + 0x16248], rax
mov rax, qword [rsp + 0x16248]
mov qword [rsp + 0x16250], rax
mov rdx, qword [rsp + 0x16250]
lea rcx, [rsp + 0xc7e8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15998]
call fcn.140001490
jmp 0x1401c873c
lea rdx, [rsp + 0xc808]
lea rcx, [rsp + 0xc7e8]
call fcn.140002d80
lea rcx, [rsp + 0xc7e8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c87cc
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x14021e810]
mov ecx, 1
call fcn.1400dc610
lea r8, [0x14021e7f8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc808]
call fcn.140001490
nop
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
mov r8, qword [rsp + 0xc7e8]
lea rdx, [0x14021e870]
xor ecx, ecx
call fcn.1400dc610
lea rcx, [rsp + 0xc7e8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movsxd rdi, dword [rsp + 0xc7f8]
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
imul rdi, rdi, 0x400
lea rcx, [rsp + 0xc7e8]
call fcn.140023510
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1401009e0
mov dword [rsp + 0xc7e0], eax
cmp dword [rsp + 0xc7e0], 0
jne 0x1401c88d1
lea rcx, [rsp + 0xc7e8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rsp + 0xc7e8]
lea rdx, str._ERROR__Ceate_image__s_error
mov ecx, 1
call fcn.1400dc610
lea r8, str._ERR_CREATE_VMDK_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc808]
call fcn.140001490
nop
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xc820]
call fcn.14000e6a0
nop
lea rax, [rsp + 0x159a0]
mov qword [rsp + 0x159a8], rax
lea rdx, [rsp + 0xc7e8]
mov rcx, qword [rsp + 0x159a8]
call fcn.140001430
mov qword [rsp + 0x16258], rax
mov rdx, qword [rsp + 0x16258]
lea rcx, [rsp + 0xc820]
call fcn.1401cf620
test eax, eax
jne 0x1401c8996
lea rdx, [0x14021e898]
lea rcx, [rsp + 0x159b0]
call fcn.1400eeb90
mov qword [rsp + 0x16260], rax
mov rax, qword [rsp + 0x16260]
mov qword [rsp + 0x16268], rax
lea rcx, [rsp + 0xc9c0]
mov rdx, qword [rsp + 0x16268]
call fcn.140002d80
nop
lea rcx, [rsp + 0x159b0]
call fcn.140001490
lea rcx, [rsp + 0xc9c8]
lea rdx, [rsp + 0xc7e8]
call fcn.140002d80
lea rcx, [rsp + 0xc820]
call fcn.1401cef50
lea rcx, [rsp + 0xbfd8]
call fcn.140002db0
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140002db0
nop
lea rax, [rsp + 0x159b8]
mov qword [rsp + 0x159c0], rax
lea rdx, [0x14021e7f4]
mov rcx, qword [rsp + 0x159c0]
call fcn.1400020d0
mov qword [rsp + 0x16270], rax
mov rax, qword [rsp + 0x16270]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xbfd0]
lea rdx, [rsp + 0xbfd8]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140015e60
lea rcx, [rsp + 0xbfd0]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401c8a39
lea rdx, [0x14021e918]
lea rcx, [rsp + 0xbfd0]
call fcn.1400020a0
lea rcx, [rsp + 0xbfd8]
call fcn.140006910
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d1e00
test eax, eax
jne 0x1401c8c13
lea rax, [rsp + 0x159c8]
mov qword [rsp + 0x159d0], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159d0]
call fcn.140001430
mov qword [rsp + 0x16278], rax
mov rdx, qword [rsp + 0x16278]
lea rcx, [rsp + 0x470]
call fcn.1401d1c90
test eax, eax
jne 0x1401c8b8b
lea rax, [rsp + 0x159d8]
mov qword [rsp + 0x159e0], rax
lea rax, [rsp + 0x159e8]
mov qword [rsp + 0x159f0], rax
lea rdx, [rsp + 0xbfd0]
mov rcx, qword [rsp + 0x159e0]
call fcn.140001430
mov qword [rsp + 0x16280], rax
mov rax, qword [rsp + 0x16280]
mov qword [rsp + 0x16288], rax
lea rdx, [rsp + 0xbfd8]
mov rcx, qword [rsp + 0x159f0]
call fcn.140001430
mov qword [rsp + 0x16290], rax
mov rax, qword [rsp + 0x16288]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x16290]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d1f60
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e928]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c8b79
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e930]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
jmp 0x1401c8c11
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000e950
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002d80
lea rcx, [rsp + 0x6f0]
lea rdx, [0x14021e934]
call fcn.1400020a0
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e938]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c8c04
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e940]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
jmp 0x1401c8c8d
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xbfd8]
call fcn.140002d80
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xbfd0]
call fcn.140002d80
lea rcx, [rsp + 0x6f0]
lea rdx, [0x14021e944]
call fcn.1400020a0
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e948]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c8c80
lea rcx, [rsp + 0x658]
lea rdx, [0x14021e950]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
lea rcx, [rsp + 0x6f8]
lea rdx, [0x14021e954]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
lea rcx, [0x1403aa660]
call fcn.1400216d0
mov r8d, eax
lea rdx, str.OK__d_r_n
lea rcx, [rsp + 0xb00]
call fcn.1400acc74
lea r8, [rsp + 0xb00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xbfd0]
call fcn.140001490
nop
lea rcx, [rsp + 0xbfd8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc820]
call fcn.140005db0
nop
lea rcx, [rsp + 0xc7e8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc7f0]
call fcn.140001490
nop
lea rcx, [rsp + 0xc808]
call fcn.140001490
nop
lea rcx, [rsp + 0xc800]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x14021e968]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x14021e978]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401c9f21
lea rcx, str.disk2vhd
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xd5f0]
call fcn.1400dd060
nop
lea rdx, [0x14021e994]
lea rcx, [rsp + 0xd5f0]
call fcn.1400069d0
mov dword [rsp + 0xd604], 0
lea r9, [rsp + 0xd604]
lea r8, [0x14021e99c]
lea rdx, [rsp + 0x159f8]
lea rcx, [rsp + 0xd5f0]
call fcn.1400065a0
mov qword [rsp + 0x16298], rax
mov rcx, qword [rsp + 0x16298]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xd600], eax
lea rcx, [rsp + 0x159f8]
call fcn.140001490
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401c8ea6
lea r8, [0x14021e9a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xd5f8]
call fcn.140002db0
nop
mov edx, dword [rsp + 0xd604]
lea rcx, [rsp + 0xd5f0]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401c8f42
mov eax, dword [rsp + 0xd604]
add eax, 1
mov dword [rsp + 0xd604], eax
lea r9, [rsp + 0xd604]
lea r8, [0x14021e9b4]
lea rdx, [rsp + 0x15a00]
lea rcx, [rsp + 0xd5f0]
call fcn.1400065a0
mov qword [rsp + 0x162a0], rax
mov rax, qword [rsp + 0x162a0]
mov qword [rsp + 0x162a8], rax
mov rdx, qword [rsp + 0x162a8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15a00]
call fcn.140001490
jmp 0x1401c8fa1
lea r9, [rsp + 0xd604]
lea r8, [0x14021e9b8]
lea rdx, [rsp + 0x15a08]
lea rcx, [rsp + 0xd5f0]
call fcn.1400065a0
mov qword [rsp + 0x162b0], rax
mov rax, qword [rsp + 0x162b0]
mov qword [rsp + 0x162b8], rax
mov rdx, qword [rsp + 0x162b8]
lea rcx, [rsp + 0xd5f8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15a08]
call fcn.140001490
cmp dword [rsp + 0xd604], 0xffffffff
jne 0x1401c8fbc
lea rax, [0x14021e9bc]
mov qword [rsp + 0x162c0], rax
jmp 0x1401c9020
lea r9, [rsp + 0xd604]
lea r8, [0x14021e9c0]
lea rdx, [rsp + 0x15a10]
lea rcx, [rsp + 0xd5f0]
call fcn.1400065a0
mov qword [rsp + 0x162c8], rax
mov rax, qword [rsp + 0x162c8]
mov qword [rsp + 0x162d0], rax
mov eax, dword [rsp + 0x15d10]
or eax, 0x400
mov dword [rsp + 0x15d10], eax
mov rcx, qword [rsp + 0x162d0]
call fcn.140023510
mov qword [rsp + 0x162c0], rax
mov rdx, qword [rsp + 0x162c0]
lea rcx, [rsp + 0xd5c0]
call fcn.1400020d0
nop
mov eax, dword [rsp + 0x15d10]
and eax, 0x400
test eax, eax
je 0x1401c905e
and dword [rsp + 0x15d10], 0xfffffbff
lea rcx, [rsp + 0x15a10]
call fcn.140001490
xor eax, eax
mov word [rsp + 0xcdb0], ax
lea rdi, [rsp + 0xcdb2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15a18]
call fcn.140001000
mov qword [rsp + 0x162d8], rax
mov rax, qword [rsp + 0x162d8]
mov qword [rsp + 0x162e0], rax
lea r8, [0x14021e9c4]
mov rdx, qword [rsp + 0x162e0]
lea rcx, [rsp + 0x15a20]
call fcn.1400010b0
mov qword [rsp + 0x162e8], rax
mov rax, qword [rsp + 0x162e8]
mov qword [rsp + 0x162f0], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x162f0]
lea rcx, [rsp + 0x15a28]
call fcn.1400010b0
mov qword [rsp + 0x162f8], rax
mov rax, qword [rsp + 0x162f8]
mov qword [rsp + 0x16300], rax
lea r8, [0x14021e9c8]
mov rdx, qword [rsp + 0x16300]
lea rcx, [rsp + 0x15a30]
call fcn.1400010b0
mov qword [rsp + 0x16308], rax
mov rcx, qword [rsp + 0x16308]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xcdb0]
lea r8, [0x14021e9d4]
lea rdx, [0x14021e9d8]
lea rcx, [0x14021e9f0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15a30]
call fcn.140001490
nop
lea rcx, [rsp + 0x15a28]
call fcn.140001490
nop
lea rcx, [rsp + 0x15a20]
call fcn.140001490
nop
lea rcx, [rsp + 0x15a18]
call fcn.140001490
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a40]
call fcn.140004e00
mov qword [rsp + 0x16310], rax
mov rcx, qword [rsp + 0x16310]
call fcn.140006e20
mov byte [rsp + 0x15a38], al
lea rcx, [rsp + 0x15a40]
call fcn.140001490
movzx edx, byte [rsp + 0x15a38]
test edx, edx
je 0x1401c9238
lea r8, [0x14021ea00]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [rsp + 0xcdb0]
lea rcx, [rsp + 0x15a50]
call fcn.140004e00
mov qword [rsp + 0x16318], rax
mov rax, qword [rsp + 0x16318]
mov qword [rsp + 0x16320], rax
mov rcx, qword [rsp + 0x16320]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0xd5c0]
call fcn.140006030
mov dword [rsp + 0x15a48], eax
lea rcx, [rsp + 0x15a50]
call fcn.140001490
cmp dword [rsp + 0x15a48], 0
je 0x1401c92ef
lea r8, [0x14021ea20]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0x960]
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0xd5b8]
call fcn.140002270
nop
mov r8d, 1
lea rdx, [rsp + 0x15a60]
lea rcx, [rsp + 0xd5b8]
call fcn.140006a60
mov qword [rsp + 0x16328], rax
lea rdx, [0x14021ea38]
mov rcx, qword [rsp + 0x16328]
call fcn.140006d90
mov byte [rsp + 0x15a58], al
lea rcx, [rsp + 0x15a60]
call fcn.140001490
movzx edx, byte [rsp + 0x15a58]
test edx, edx
je 0x1401c9379
lea rdx, [0x14021ea3c]
lea rcx, [rsp + 0xd5b8]
call fcn.140006000
lea rcx, [rsp + 0xd5f8]
call fcn.140023510
lea rdx, [0x14021ea40]
mov rcx, rax
call fcn.1400a9bbc
test rax, rax
jne 0x1401c93f4
lea r8, [rsp + 0xd5f8]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0x15a68]
call fcn.140006bd0
mov qword [rsp + 0x16330], rax
mov rax, qword [rsp + 0x16330]
mov qword [rsp + 0x16338], rax
mov rdx, qword [rsp + 0x16338]
lea rcx, [rsp + 0xd5b8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15a68]
call fcn.140001490
jmp 0x1401c9409
lea rdx, [rsp + 0xd5f8]
lea rcx, [rsp + 0xd5b8]
call fcn.140002d80
lea rcx, [rsp + 0xd5b8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401c9499
mov r8, qword [rsp + 0xd5b8]
lea rdx, str._ERROR__Cannot_create_image___s_exists
mov ecx, 1
call fcn.1400dc610
lea r8, str._ERR_FILE_EXISTS_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
mov r8, qword [rsp + 0xd5b8]
lea rdx, str.Create_new_image__s
xor ecx, ecx
call fcn.1400dc610
lea rcx, [rsp + 0xd5b8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14021ea44]
lea rcx, [rsp + 0xcda0]
call fcn.1400020d0
nop
lea rdx, str._echo_off_r_n_t_t_t_t_t_t_t___REM_CCBootShare_Required_Services_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:rpc_endpoint_mapper_r_n_t_t_t_t_t_t_t___REM_RPC_Endpoint_Mapper_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_mapper_service_r_n_t_t_t_t_t_t_t___sc_config_nsi_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_nsi_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:dcom_server_process_launcher_r_n_t_t_t_t_t_t_t___REM_DCOM_Server_Process_Launcher_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_dcom_service_r_n_t_t_t_t_t_t_t___sc_config_DcomLaunch_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_DcomLaunch_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:remote_procedure_call_r_n_t_t_t_t_t_t_t___REM_Remote_Procedure_Call__RPC__r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_rpc_service_r_n_t_t_t_t_t_t_t___sc_config_RpcSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_RpcSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:security_accounts_manager_r_n_t_t_t_t_t_t_t___REM_Security_Accounts_Manager_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_security_service_r_n_t_t_t_t_t_t_t___sc_config_SamSs_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_SamSs_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:server_service_r_n_t_t_t_t_t_t_t___REM_Server_r_n_t_t_t_t_t_t_t___sc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_n_t_t_t_t_t_t_t___if_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:start_server_service_r_n_t_t_t_t_t_t_t___sc_config_LanmanServer_start_AUTO_r_n_t_t_t_t_t_t_t___net_start_LanmanServer_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:bat_exit_r_n_t_t_t_t_t_t_t___echo_12__get_sid_gust_variable_r_n_t_t_t_t_t_t_t___for__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_t_t_t_t_t_t_t___if_not____a__SID____r_n_t_t_t_t_t_t_t___set_sid_guest__a_r_n_t_t_t_t_t_t_t___goto_loop_end_r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t_____r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___:loop_end_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_13__create_script_for_regini_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_t_t_t_t_t_t_t____r_n_t_t_t_t_t_t_t___echo_14__add_permission_for_machine_security_r_n_t_t_t_t_t_t_t___net_user_guest__active:yes_r_n_t_t_t_t_t_t_t___regini_x_r_n_t_t_t_t_t_t_t___del_x_r_n_t_t_t_t_t_t_t____echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_t_t_t_t_t_t_t____echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_t_t_t_t_t_t_t____echo__hex_0_:42_00_00_00____y.reg_r_n_t_t_t_t_t_t_t___reg_import_y.reg_r_n_t_t_t_t_t_t_t___del_y.reg_r_n_t_t_t_t_t_t_t____echo_on_r_n
lea rcx, [rsp + 0xcda0]
call fcn.1400020a0
mov rdx, qword [rsp + 0x165d0]
add rdx, 0x228
lea r8, [0x140220298]
lea rcx, [rsp + 0xd5c8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0xd5d0]
call fcn.1400924e0
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140023510
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.140092c68
test eax, eax
je 0x1401c967c
lea rcx, [rsp + 0xd5d0]
call fcn.140026460
lea rcx, [rsp + 0xcda0]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15a70]
call fcn.1400d8920
mov qword [rsp + 0x16340], rax
mov rax, qword [rsp + 0x16340]
mov qword [rsp + 0x16348], rax
lea rcx, [rsp + 0xcda0]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15a78]
call fcn.1400d8920
mov qword [rsp + 0x16350], rax
mov rax, qword [rsp + 0x16350]
mov qword [rsp + 0x16358], rax
mov rcx, qword [rsp + 0x16348]
call fcn.140001a40
mov edi, eax
mov rcx, qword [rsp + 0x16358]
call fcn.140023510
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd5d0]
call fcn.140092160
nop
lea rcx, [rsp + 0x15a78]
call fcn.140001490
nop
lea rcx, [rsp + 0x15a70]
call fcn.140001490
lea rcx, [rsp + 0xd5d0]
call fcn.140092458
lea rcx, [rsp + 0xd5c8]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
lea rcx, [rsp + 0xd5c8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rdx, [rsp + 0xd5b8]
lea rcx, [rsp + 0xcb98]
call fcn.140001430
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0xcb98]
call fcn.140006200
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xcb98]
call fcn.1400068a0
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x15a80]
lea rcx, [rsp + 0xcb98]
call fcn.140002270
mov qword [rsp + 0x16360], rax
mov rax, qword [rsp + 0x16360]
mov qword [rsp + 0x16368], rax
mov rdx, qword [rsp + 0x16368]
lea rcx, [rsp + 0xcb98]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15a80]
call fcn.140001490
lea rcx, [rsp + 0xcb98]
call fcn.140001a40
cmp eax, 2
jne 0x1401c9792
mov edx, 1
lea rcx, [rsp + 0xcb98]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x3a
jne 0x1401c9792
lea r8, [0x140220294]
lea rdx, [rsp + 0xcb98]
lea rcx, [rsp + 0x15a88]
call fcn.1400010b0
mov qword [rsp + 0x16370], rax
mov rax, qword [rsp + 0x16370]
mov qword [rsp + 0x16378], rax
mov rdx, qword [rsp + 0x16378]
lea rcx, [rsp + 0xcb98]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15a88]
call fcn.140001490
mov r8, qword [rsp + 0xcb98]
lea rdx, str.SetAcl___s__start
xor ecx, ecx
call fcn.1400dc610
xor edx, edx
lea rcx, [rsp + 0xcbc0]
call fcn.140176e90
nop
lea rax, [rsp + 0x15a90]
mov qword [rsp + 0x15a98], rax
lea rax, [rsp + 0x15aa0]
mov qword [rsp + 0x15aa8], rax
lea rax, [rsp + 0x15ab0]
mov qword [rsp + 0x15ab8], rax
lea rdx, [0x1402202e8]
mov rcx, qword [rsp + 0x15a98]
call fcn.1400020d0
mov qword [rsp + 0x16380], rax
mov rax, qword [rsp + 0x16380]
mov qword [rsp + 0x16388], rax
lea rdx, [0x1402202f8]
mov rcx, qword [rsp + 0x15aa8]
call fcn.1400020d0
mov qword [rsp + 0x16390], rax
mov rax, qword [rsp + 0x16390]
mov qword [rsp + 0x16398], rax
lea rdx, [rsp + 0xcb98]
mov rcx, qword [rsp + 0x15ab8]
call fcn.140001430
mov qword [rsp + 0x163a0], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x16388]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x16398]
mov r8d, 1
mov rdx, qword [rsp + 0x163a0]
lea rcx, [rsp + 0xcbc0]
call fcn.1401822e0
mov dword [rsp + 0xd5b0], eax
mov r9, qword [rsp + 0xcb98]
mov r8d, dword [rsp + 0xd5b0]
lea rdx, str.SetAcl___d____s_
xor ecx, ecx
call fcn.1400dc610
xor r8d, r8d
lea rdx, [0x140220338]
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea rcx, [0x140220350]
call fcn.140008700
mov qword [rsp + 0xcb60], rax
mov dword [rsp + 0xcb68], 0
mov qword [rsp + 0xcb70], 0
mov dword [rsp + 0xcb78], 0x7f
mov dword [rsp + 0xcb7c], 0xffffffff
mov dword [rsp + 0xcb80], 0
lea rcx, [rsp + 0xcb98]
call fcn.1400231e0
mov rcx, rax
call fcn.140008700
mov qword [rsp + 0xcb88], rax
lea rcx, [0x140220368]
call fcn.140008700
mov qword [rsp + 0xcb90], rax
xor r9d, r9d
lea r8, [rsp + 0xcb60]
mov edx, 2
xor ecx, ecx
call sub.NETAPI32.dll_NetShareAdd
mov dword [rsp + 0xcba8], eax
cmp dword [rsp + 0xcba8], 0
je 0x1401c9a28
lea rdx, str._ERROR__Sharing_of_image_file_failed.
mov ecx, 1
call fcn.1400dc610
lea r8, str._ERR_SHARE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140176da0
nop
lea rcx, [rsp + 0xcb98]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5d0]
call fcn.14009272c
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xcda0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xd610]
call fcn.14000e6a0
nop
lea rax, [rsp + 0x15ac0]
mov qword [rsp + 0x15ac8], rax
lea rdx, [rsp + 0xd5b8]
mov rcx, qword [rsp + 0x15ac8]
call fcn.140001430
mov qword [rsp + 0x163a8], rax
mov rdx, qword [rsp + 0x163a8]
lea rcx, [rsp + 0xd610]
call fcn.1401cf620
test eax, eax
jne 0x1401c9aed
lea rdx, [0x1402203f0]
lea rcx, [rsp + 0x15ad0]
call fcn.1400eeb90
mov qword [rsp + 0x163b0], rax
mov rax, qword [rsp + 0x163b0]
mov qword [rsp + 0x163b8], rax
lea rcx, [rsp + 0xd7b0]
mov rdx, qword [rsp + 0x163b8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15ad0]
call fcn.140001490
lea rcx, [rsp + 0xd7b8]
lea rdx, [rsp + 0xd5b8]
call fcn.140002d80
lea rcx, [rsp + 0xd610]
call fcn.1401cef50
lea rcx, [rsp + 0xcbb0]
call fcn.140002db0
nop
lea rcx, [rsp + 0xcba0]
call fcn.140002db0
nop
lea rax, [rsp + 0x15ad8]
mov qword [rsp + 0x15ae0], rax
lea rdx, [0x1402202e4]
mov rcx, qword [rsp + 0x15ae0]
call fcn.1400020d0
mov qword [rsp + 0x163c0], rax
mov rax, qword [rsp + 0x163c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e8
lea r8, [rsp + 0xcba0]
lea rdx, [rsp + 0xcbb0]
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call fcn.140015e60
lea rcx, [rsp + 0xcba0]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401c9b90
lea rdx, str.Master
lea rcx, [rsp + 0xcba0]
call fcn.1400020a0
lea rcx, [rsp + 0xcbb0]
call fcn.140006910
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d1e00
test eax, eax
jne 0x1401c9d6a
lea rax, [rsp + 0x15ae8]
mov qword [rsp + 0x15af0], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15af0]
call fcn.140001430
mov qword [rsp + 0x163c8], rax
mov rdx, qword [rsp + 0x163c8]
lea rcx, [rsp + 0x470]
call fcn.1401d1c90
test eax, eax
jne 0x1401c9ce2
lea rax, [rsp + 0x15af8]
mov qword [rsp + 0x15b00], rax
lea rax, [rsp + 0x15b08]
mov qword [rsp + 0x15b10], rax
lea rdx, [rsp + 0xcba0]
mov rcx, qword [rsp + 0x15b00]
call fcn.140001430
mov qword [rsp + 0x163d0], rax
mov rax, qword [rsp + 0x163d0]
mov qword [rsp + 0x163d8], rax
lea rdx, [rsp + 0xcbb0]
mov rcx, qword [rsp + 0x15b10]
call fcn.140001430
mov qword [rsp + 0x163e0], rax
mov rax, qword [rsp + 0x163d8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x163e0]
mov rax, qword [rsp + 0x165d8]
mov edx, dword [rax + 0x14]
lea rcx, [rsp + 0x470]
call fcn.1401d1f60
lea rcx, [rsp + 0x658]
lea rdx, [0x140220418]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c9cd0
lea rcx, [rsp + 0x658]
lea rdx, [0x1402203ec]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
jmp 0x1401c9d68
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x628]
mov rdx, rax
call fcn.14000e950
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002d80
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140220420]
call fcn.1400020a0
lea rcx, [rsp + 0x658]
lea rdx, [0x140220424]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c9d5b
lea rcx, [rsp + 0x658]
lea rdx, [0x14022042c]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
jmp 0x1401c9de4
lea rcx, [rsp + 0x638]
lea rdx, [rsp + 0xcbb0]
call fcn.140002d80
lea rcx, [rsp + 0x610]
lea rdx, [rsp + 0xcba0]
call fcn.140002d80
lea rcx, [rsp + 0x6f0]
lea rdx, [0x140220430]
call fcn.1400020a0
lea rcx, [rsp + 0x658]
lea rdx, [0x140220434]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401c9dd7
lea rcx, [rsp + 0x658]
lea rdx, [0x14022043c]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
lea rcx, [rsp + 0x6f8]
lea rdx, [0x140220440]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
lea r8, [0x140220444]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xcba0]
call fcn.140001490
nop
lea rcx, [rsp + 0xcbb0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd610]
call fcn.140005db0
nop
lea rcx, [rsp + 0xcbc0]
call fcn.140176da0
nop
lea rcx, [rsp + 0xcb98]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5d0]
call fcn.14009272c
nop
lea rcx, [rsp + 0xd5c8]
call fcn.140001490
nop
lea rcx, [rsp + 0xcda0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5b8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f8]
call fcn.140001490
nop
lea rcx, [rsp + 0xd5f0]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x140220450]
call fcn.1400a9180
mov r8, rax
lea rdx, str.endupload
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401ca1c3
cmp dword [rsp + 0x608], 0
jbe 0x1401ca18d
lea rcx, [rsp + 0x6f8]
lea rdx, [0x14022046c]
call fcn.140006d50
movzx eax, al
test eax, eax
je 0x1401ca18d
lea rcx, [rsp + 0x6f8]
lea rdx, [0x140220470]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
lea rcx, [0x140220478]
call fcn.1400a9180
mov r8, rax
lea rdx, str.endupload_ok
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401ca13e
lea rcx, [rsp + 0xd950]
call fcn.14000e6a0
nop
lea rax, [rsp + 0x15b18]
mov qword [rsp + 0x15b20], rax
lea rdx, [0x140220498]
mov rcx, qword [rsp + 0x15b20]
call fcn.1400eeb90
mov qword [rsp + 0x163e8], rax
mov rdx, qword [rsp + 0x163e8]
lea rcx, [rsp + 0xd950]
call fcn.1401cf4c0
test eax, eax
je 0x1401ca131
lea rcx, [rsp + 0x15b28]
call fcn.14000edc0
lea r8, str._m_d_H_M
lea rdx, [rsp + 0x15b30]
mov rcx, rax
call fcn.14000e780
mov qword [rsp + 0x163f0], rax
mov rax, qword [rsp + 0x163f0]
mov qword [rsp + 0x163f8], rax
mov r8, qword [rsp + 0x163f8]
lea rdx, [0x1402204c8]
lea rcx, [rsp + 0x15b38]
call fcn.140006c90
mov qword [rsp + 0x16400], rax
mov rax, qword [rsp + 0x16400]
mov qword [rsp + 0x16408], rax
lea rcx, [rsp + 0xdaf0]
mov rdx, qword [rsp + 0x16408]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15b38]
call fcn.140001490
nop
lea rcx, [rsp + 0x15b30]
call fcn.140001490
lea rcx, [rsp + 0xd950]
call fcn.1401b7780
lea rcx, [rsp + 0x660]
mov r8d, dword [rsp + 0xdae8]
lea rdx, [0x1402204d0]
call fcn.140002c40
lea rcx, [rsp + 0x668]
lea rdx, [0x140220474]
call fcn.1400020a0
lea rcx, [rsp + 0x470]
call fcn.1401ceaa0
lea rcx, [rsp + 0x950]
mov r8d, dword [rsp + 0x608]
lea rdx, [0x1402204d8]
call fcn.140002c40
lea rcx, [rsp + 0x7b0]
call fcn.1401b7780
nop
lea rcx, [rsp + 0xd950]
call fcn.140005db0
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
mov edx, dword [rsp + 0x608]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x8039
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
xor r8d, r8d
lea rdx, str.Disk2VHD
xor ecx, ecx
call sub.NETAPI32.dll_NetShareDel
lea r8, [0x1402204f4]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401cc052
lea rcx, [0x140220500]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x140220510]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401ca8f6
lea rcx, str.multisyncto
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xe4a8]
call fcn.1400dd060
nop
lea rdx, [0x140220530]
lea rcx, [rsp + 0xe4a8]
call fcn.1400069d0
mov dword [rsp + 0xe4b0], 0
lea r9, [rsp + 0xe4b0]
lea r8, [0x140220538]
lea rdx, [rsp + 0x15b40]
lea rcx, [rsp + 0xe4a8]
call fcn.1400065a0
mov qword [rsp + 0x16410], rax
mov rcx, qword [rsp + 0x16410]
call fcn.140023510
mov rcx, rax
call fcn.1400a948c
mov dword [rsp + 0xdc98], eax
lea rcx, [rsp + 0x15b40]
call fcn.140001490
cmp dword [rsp + 0xe4b0], 0xffffffff
jne 0x1401ca2c1
lea r8, [0x140220540]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
lea r9, [rsp + 0xe4b0]
lea r8, [0x14022053c]
lea rdx, [rsp + 0xe4a0]
lea rcx, [rsp + 0xe4a8]
call fcn.1400065a0
nop
xor eax, eax
mov word [rsp + 0xdca0], ax
lea rdi, [rsp + 0xdca2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x15b48]
call fcn.140001000
mov qword [rsp + 0x16418], rax
mov rax, qword [rsp + 0x16418]
mov qword [rsp + 0x16420], rax
lea r8, [0x140220564]
mov rdx, qword [rsp + 0x16420]
lea rcx, [rsp + 0x15b50]
call fcn.1400010b0
mov qword [rsp + 0x16428], rax
mov rax, qword [rsp + 0x16428]
mov qword [rsp + 0x16430], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x16430]
lea rcx, [rsp + 0x15b58]
call fcn.1400010b0
mov qword [rsp + 0x16438], rax
mov rax, qword [rsp + 0x16438]
mov qword [rsp + 0x16440], rax
lea r8, [0x140220558]
mov rdx, qword [rsp + 0x16440]
lea rcx, [rsp + 0x15b60]
call fcn.1400010b0
mov qword [rsp + 0x16448], rax
mov rcx, qword [rsp + 0x16448]
call fcn.140023510
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xdca0]
lea r8, [0x140220568]
lea rdx, [0x140220570]
lea rcx, [0x140220588]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x15b60]
call fcn.140001490
nop
lea rcx, [rsp + 0x15b58]
call fcn.140001490
nop
lea rcx, [rsp + 0x15b50]
call fcn.140001490
nop
lea rcx, [rsp + 0x15b48]
call fcn.140001490
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b70]
call fcn.140004e00
mov qword [rsp + 0x16450], rax
mov rcx, qword [rsp + 0x16450]
call fcn.140006e20
mov byte [rsp + 0x15b68], al
lea rcx, [rsp + 0x15b70]
call fcn.140001490
movzx edx, byte [rsp + 0x15b68]
test edx, edx
je 0x1401ca4b2
lea r8, str._ERR_NEED_SET_ADMIN_PASSWORD_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
lea rdx, [rsp + 0xdca0]
lea rcx, [rsp + 0x15b80]
call fcn.140004e00
mov qword [rsp + 0x16458], rax
mov rax, qword [rsp + 0x16458]
mov qword [rsp + 0x16460], rax
mov rcx, qword [rsp + 0x16460]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0xe4a0]
call fcn.140006030
mov dword [rsp + 0x15b78], eax
lea rcx, [rsp + 0x15b80]
call fcn.140001490
cmp dword [rsp + 0x15b78], 0
je 0x1401ca55b
lea r8, str._ERR_NO_PERMISSION_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xdc90]
call fcn.140002db0
nop
cmp dword [rsp + 0xdc98], 0
jne 0x1401ca8a7
mov edx, dword [rsp + 0xe4b0]
lea rcx, [rsp + 0xe4a8]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401ca605
mov eax, dword [rsp + 0xe4b0]
add eax, 1
mov dword [rsp + 0xe4b0], eax
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402205d0]
lea rdx, [rsp + 0x15b88]
lea rcx, [rsp + 0xe4a8]
call fcn.1400065a0
mov qword [rsp + 0x16468], rax
mov rax, qword [rsp + 0x16468]
mov qword [rsp + 0x16470], rax
mov rdx, qword [rsp + 0x16470]
lea rcx, [rsp + 0xdc90]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15b88]
call fcn.140001490
jmp 0x1401ca664
lea r9, [rsp + 0xe4b0]
lea r8, [0x1402205d4]
lea rdx, [rsp + 0x15b90]
lea rcx, [rsp + 0xe4a8]
call fcn.1400065a0
mov qword [rsp + 0x16478], rax
mov rax, qword [rsp + 0x16478]
mov qword [rsp + 0x16480], rax
mov rdx, qword [rsp + 0x16480]
lea rcx, [rsp + 0xdc90]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15b90]
call fcn.140001490
lea rcx, [rsp + 0xe4c0]
call fcn.14000e6a0
nop
lea rax, [rsp + 0x15b98]
mov qword [rsp + 0x15ba0], rax
lea rdx, [rsp + 0xdc90]
mov rcx, qword [rsp + 0x15ba0]
call fcn.140001430
mov qword [rsp + 0x16488], rax
mov rdx, qword [rsp + 0x16488]
lea rcx, [rsp + 0xe4c0]
call fcn.1401cf4c0
test eax, eax
je 0x1401ca89a
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xeb40]
call fcn.14000e5e0
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007ac0
nop
lea rdx, [rsp + 0xeeb0]
lea rcx, [rsp + 0xeb40]
call fcn.1401b7170
lea rcx, [rsp + 0xeeb0]
call fcn.140007b40
test rax, rax
jbe 0x1401ca77f
lea r8, str._ERR_CHILD_IMAGE_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005db0
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
mov edx, dword [rsp + 0xe658]
lea rcx, [rsp + 0xe800]
call fcn.1401cc270
nop
lea rcx, [rsp + 0xee80]
call fcn.140007ac0
nop
lea rdx, [rsp + 0xee80]
lea rcx, [rsp + 0xe800]
call fcn.1401b7170
lea rcx, [rsp + 0xee80]
call fcn.140007b40
test rax, rax
jbe 0x1401ca862
lea r8, str._ERR_RECOVERY_POINT_CHECKED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xee80]
call fcn.140007b10
nop
lea rcx, [rsp + 0xe800]
call fcn.140005db0
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005db0
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xee80]
call fcn.140007b10
nop
lea rcx, [rsp + 0xe800]
call fcn.140005db0
nop
lea rcx, [rsp + 0xeeb0]
call fcn.140007b10
nop
lea rcx, [rsp + 0xeb40]
call fcn.140005db0
nop
lea rcx, [rsp + 0xe4c0]
call fcn.140005db0
lea r8, [0x140220618]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xdc90]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a0]
call fcn.140001490
nop
lea rcx, [rsp + 0xe4a8]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x140220620]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x140220630]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401cb6fa
lea rcx, str.robocopyready
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0xf288]
call fcn.1400dd060
nop
lea rdx, [0x140220650]
lea rcx, [rsp + 0xf288]
call fcn.1400069d0
mov dword [rsp + 0xf2a0], 0
lea rcx, [rsp + 0xf298]
call fcn.140002db0
nop
lea rcx, [rsp + 0xf258]
call fcn.140002db0
nop
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401caa0c
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x140220658]
lea rdx, [rsp + 0x15ba8]
lea rcx, [rsp + 0xf288]
call fcn.1400065a0
mov qword [rsp + 0x16490], rax
mov rax, qword [rsp + 0x16490]
mov qword [rsp + 0x16498], rax
mov rdx, qword [rsp + 0x16498]
lea rcx, [rsp + 0xf298]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15ba8]
call fcn.140001490
jmp 0x1401caa6b
lea r9, [rsp + 0xf2a0]
lea r8, [0x14022065c]
lea rdx, [rsp + 0x15bb0]
lea rcx, [rsp + 0xf288]
call fcn.1400065a0
mov qword [rsp + 0x164a0], rax
mov rax, qword [rsp + 0x164a0]
mov qword [rsp + 0x164a8], rax
mov rdx, qword [rsp + 0x164a8]
lea rcx, [rsp + 0xf298]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15bb0]
call fcn.140001490
cmp dword [rsp + 0xf2a0], 0xffffffff
jne 0x1401caac4
lea r8, [0x140220660]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xf258]
call fcn.140001490
nop
lea rcx, [rsp + 0xf298]
call fcn.140001490
nop
lea rcx, [rsp + 0xf288]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0xf298]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401cab27
lea r8, [0x140220678]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0xf258]
call fcn.140001490
nop
lea rcx, [rsp + 0xf298]
call fcn.140001490
nop
lea rcx, [rsp + 0xf288]
call fcn.140001490
jmp 0x1401cc052
mov edx, dword [rsp + 0xf2a0]
lea rcx, [rsp + 0xf288]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x22
jne 0x1401cabb5
mov eax, dword [rsp + 0xf2a0]
add eax, 1
mov dword [rsp + 0xf2a0], eax
lea r9, [rsp + 0xf2a0]
lea r8, [0x14022068c]
lea rdx, [rsp + 0x15bb8]
lea rcx, [rsp + 0xf288]
call fcn.1400065a0
mov qword [rsp + 0x164b0], rax
mov rax, qword [rsp + 0x164b0]
mov qword [rsp + 0x164b8], rax
mov rdx, qword [rsp + 0x164b8]
lea rcx, [rsp + 0xf258]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15bb8]
call fcn.140001490
jmp 0x1401cac14
lea r9, [rsp + 0xf2a0]
lea r8, [0x140220690]
lea rdx, [rsp + 0x15bc0]
lea rcx, [rsp + 0xf288]
call fcn.1400065a0
mov qword [rsp + 0x164c0], rax
mov rax, qword [rsp + 0x164c0]
mov qword [rsp + 0x164c8], rax
mov rdx, qword [rsp + 0x164c8]
lea rcx, [rsp + 0xf258]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15bc0]
call fcn.140001490
mov rax, qword [rsp + 0x165d8]
mov ecx, dword [rax + 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x15bc8]
call fcn.140010530
mov qword [rsp + 0x164d0], rax
mov rax, qword [rsp + 0x164d0]
mov qword [rsp + 0x164d8], rax
mov rcx, qword [rsp + 0x164d8]
call fcn.1400105c0
mov rdx, rax
lea rcx, [rsp + 0xef00]
call fcn.1400020d0
nop
lea rcx, [rsp + 0x15bc8]
call fcn.140002e70
lea r8, [rsp + 0xef00]
lea rdx, [0x1402206b4]
lea rcx, [rsp + 0x15bd0]
call fcn.140006c90
mov qword [rsp + 0x164e0], rax
mov rax, qword [rsp + 0x164e0]
mov qword [rsp + 0x164e8], rax
lea r8, [0x140220698]
mov rdx, qword [rsp + 0x164e8]
lea rcx, [rsp + 0xeef8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15bd0]
call fcn.140001490
lea r8, [rsp + 0xf298]
lea rdx, [0x1402206c0]
lea rcx, [rsp + 0xf278]
call fcn.140006c90
nop
lea rcx, [rsp + 0xef10]
call fcn.14000eff0
nop
lea rax, [rsp + 0x15bd8]
mov qword [rsp + 0x15be0], rax
lea rdx, [0x1402206c8]
mov rcx, qword [rsp + 0x15be0]
call fcn.1400020d0
mov qword [rsp + 0x164f0], rax
mov rdx, qword [rsp + 0x164f0]
lea rcx, [rsp + 0xef10]
call fcn.1401d1360
test eax, eax
je 0x1401cade4
lea rdx, [rsp + 0xf0b0]
lea r8, [0x140220694]
lea rcx, [rsp + 0x15be8]
call fcn.1400010b0
mov qword [rsp + 0x164f8], rax
mov rax, qword [rsp + 0x164f8]
mov qword [rsp + 0x16500], rax
lea r8, [rsp + 0xf298]
mov rdx, qword [rsp + 0x16500]
lea rcx, [rsp + 0x15bf0]
call fcn.140006bd0
mov qword [rsp + 0x16508], rax
mov rax, qword [rsp + 0x16508]
mov qword [rsp + 0x16510], rax
mov rdx, qword [rsp + 0x16510]
lea rcx, [rsp + 0xf278]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15bf0]
call fcn.140001490
nop
lea rcx, [rsp + 0x15be8]
call fcn.140001490
mov dword [rsp + 0xeee8], 1
lea rcx, [rsp + 0xf2b0]
call fcn.14000e6a0
nop
lea rax, [rsp + 0x15bf8]
mov qword [rsp + 0x15c00], rax
lea rdx, [rsp + 0xf258]
mov rcx, qword [rsp + 0x15c00]
call fcn.140001430
mov qword [rsp + 0x16518], rax
mov rdx, qword [rsp + 0x16518]
lea rcx, [rsp + 0xf2b0]
call fcn.1401cf4c0
test eax, eax
je 0x1401cae63
lea rdx, [rsp + 0xf458]
lea rcx, [rsp + 0xf278]
call fcn.140002d80
mov dword [rsp + 0xeee8], 0
call fcn.140185990
lea rdx, [0x1402206d8]
mov qword [rsp + 0x20], rdx
lea r9, [0x1402206f8]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x140220718]
lea rcx, [rsp + 0xf288]
call fcn.140002c40
lea rcx, [rsp + 0xf288]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
xor r8d, r8d
lea rdx, [0x1402206d4]
lea rcx, [rsp + 0xeef8]
call fcn.140006780
cmp eax, 0xffffffff
je 0x1401caf70
lea r8, [rsp + 0xeef8]
lea rdx, [0x140220754]
lea rcx, [rsp + 0x15c08]
call fcn.140006c90
mov qword [rsp + 0x16520], rax
mov rax, qword [rsp + 0x16520]
mov qword [rsp + 0x16528], rax
lea r8, [0x140220750]
mov rdx, qword [rsp + 0x16528]
lea rcx, [rsp + 0x15c10]
call fcn.1400010b0
mov qword [rsp + 0x16530], rax
mov rax, qword [rsp + 0x16530]
mov qword [rsp + 0x16538], rax
mov rdx, qword [rsp + 0x16538]
lea rcx, [rsp + 0xeef8]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15c10]
call fcn.140001490
nop
lea rcx, [rsp + 0x15c08]
call fcn.140001490
mov dx, VarDateFromDisp
lea rcx, [rsp + 0xf278]
call fcn.1400068a0
mov r9d, eax
add r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xf280]
lea rcx, [rsp + 0xf278]
call fcn.140002270
nop
xor r8d, r8d
lea rdx, [0x140220758]
lea rcx, [rsp + 0xf280]
call fcn.140006780
cmp eax, 0xffffffff
je 0x1401cb05a
lea r8, [rsp + 0xf280]
lea rdx, [0x140220760]
lea rcx, [rsp + 0x15c18]
call fcn.140006c90
mov qword [rsp + 0x16540], rax
mov rax, qword [rsp + 0x16540]
mov qword [rsp + 0x16548], rax
lea r8, [0x14022075c]
mov rdx, qword [rsp + 0x16548]
lea rcx, [rsp + 0x15c20]
call fcn.1400010b0
mov qword [rsp + 0x16550], rax
mov rax, qword [rsp + 0x16550]
mov qword [rsp + 0x16558], rax
mov rdx, qword [rsp + 0x16558]
lea rcx, [rsp + 0xf280]
call fcn.140002d80
nop
lea rcx, [rsp + 0x15c20]
call fcn.140001490
nop
lea rcx, [rsp + 0x15c18]
call fcn.140001490
mov rax, qword [rsp + 0xf298]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf280]
mov r8, qword [rsp + 0xeef8]
lea rdx, [0x140220768]
lea rcx, [rsp + 0xf288]
call fcn.140002c40
lea rcx, [rsp + 0xf288]
call fcn.140023510
mov rdx, rax
xor ecx, ecx
call fcn.1400dc610
mov qword [rsp + 0xeef0], 0
mov qword [rsp + 0xeee0], 0
mov dword [rsp + 0xf260], 0x18
mov qword [rsp + 0xf268], 0
mov dword [rsp + 0xf270], 1
xor r9d, r9d
lea r8, [rsp + 0xf260]
lea rdx, [rsp + 0xeee0]
lea rcx, [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1401cb112
lea rdx, str.Failed_to_create_pipe_
mov ecx, 1
call fcn.1400dc610
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0xf290], 0
mov dword [rsp + 0xf250], 0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x11610]
call fcn.1400a8080
mov dword [rsp + 0x11610], 0x68
lea rcx, [rsp + 0x11610]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdx, qword [rsp + 0xeee0]
mov qword [rsp + 0x11670], rdx
mov rax, qword [rsp + 0xeee0]
mov qword [rsp + 0x11668], rax
xor eax, eax
mov word [rsp + 0x11650], ax
lea rax, str.winsta0default
mov qword [rsp + 0x11620], rax
mov dword [rsp + 0x1164c], 0x101
xor eax, eax
mov word [rsp + 0xf5f0], ax
lea rdi, [rsp + 0xf5f2]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
lea rcx, [rsp + 0xf288]
call fcn.140023510
mov r8d, 0x1000
mov rdx, rax
lea rcx, [rsp + 0xf5f0]
call fcn.1400a9228
lea rdx, [rsp + 0x115f0]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x11610]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xf5f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0xf290], eax
cmp dword [rsp + 0xf290], 0
jne 0x1401cb2f3
lea rdx, str.Failed_to_CreateProcessAsUser_
mov ecx, 1
call fcn.1400dc610
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0xf280]
call fcn.140001490
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xef10]
call fcn.140005db0
nop
lea rcx, [rsp + 0xf278]
call fcn.140001490
nop
lea rcx, [rsp + 0xeef8]
call fcn.140001490
nop
lea rcx, [rsp + 0xef00]
call fcn.140001490
nop
lea rcx, [rsp + 0xf258]
call fcn.140001490
nop
lea rcx, [rsp + 0xf298]
call fcn.140001490
nop
lea rcx, [rsp + 0xf288]
call fcn.140001490
jmp 0x1401cc052
xor eax, eax
cmp eax, 1
je 0x1401cb564
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x11680], eax
cmp dword [rsp + 0x11680], 0
jne 0x1401cb324
jmp 0x1401cb564
mov byte [rsp + 0x116a0], 0
lea rdi, [rsp + 0x116a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x11694], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, 0xfff
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x11694], 1
jae 0x1401cb398
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401cb2f3
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x11694]
mov r8d, dword [rsp + 0x11694]
lea rdx, [rsp + 0x116a0]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x11690], eax
cmp dword [rsp + 0x11690], 0
je 0x1401cb3e2
cmp dword [rsp + 0x11694], 0
jne 0x1401cb403
lea rdx, str.Failed_to_ReadFile_in_piple_
mov ecx, 1
call fcn.1400dc610
mov dword [rsp + 0xf250], 1
jmp 0x1401cb564
lea rdx, [rsp + 0x116a0]
lea rcx, [rsp + 0x11688]
call fcn.1400db960
nop
lea rcx, [rsp + 0x11688]
call fcn.140012630
lea rcx, [rsp + 0x11688]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x1401cb546
lea rcx, [rsp + 0x11688]
call fcn.140001a40
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x11688]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x25
jne 0x1401cb546
mov dx, 0x25
lea rcx, [rsp + 0x11688]
call fcn.140023070
mov byte [rsp + 0x126a0], 0
lea rdi, [rsp + 0x126a1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x11688]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x15c28]
call fcn.1400d8920
mov qword [rsp + 0x16560], rax
mov r9, qword [rsp + 0x16560]
mov r9, qword [r9]
lea r8, str.__s_r_n
mov edx, 0x1000
lea rcx, [rsp + 0x126a0]
call fcn.1400acd10
lea rcx, [rsp + 0x15c28]
call fcn.140001490
lea r8, [rsp + 0x126a0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
test eax, eax
jne 0x1401cb546
lea rdx, str.terminate_robocopy_because_another_server_exit_sync
xor ecx, ecx
call fcn.1400dc610
xor edx, edx
mov rcx, qword [rsp + 0x115f0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0xf250], 1
lea rcx, [rsp + 0x11688]
call fcn.140001490
jmp 0x1401cb564
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x11688]
call fcn.140001490
jmp 0x1401cb2f3
mov rcx, qword [rsp + 0xeee0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.CCBootSyncTo
lea rdx, str.NET_SHARE__s__DELETE
lea rcx, [rsp + 0xf288]
call fcn.140002c40
lea rcx, [rsp + 0xf288]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
cmp dword [rsp + 0xf250], 0
je 0x1401cb5ea
lea r8, [0x140220928]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401cb678
cmp dword [rsp + 0xeee8], 0
je 0x1401cb637
lea rcx, [rsp + 0xf450]
lea rdx, [rsp + 0xf258]
call fcn.140002d80
lea rcx, [rsp + 0xf458]
lea rdx, [rsp + 0xf278]
call fcn.140002d80
lea rcx, [rsp + 0xf2b0]
call fcn.1401cef50
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
lea r8, [0x140220940]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x804c
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
nop
lea rcx, [rsp + 0xf280]
call fcn.140001490
nop
lea rcx, [rsp + 0xf2b0]
call fcn.140005db0
nop
lea rcx, [rsp + 0xef10]
call fcn.140005db0
nop
lea rcx, [rsp + 0xf278]
call fcn.140001490
nop
lea rcx, [rsp + 0xeef8]
call fcn.140001490
nop
lea rcx, [rsp + 0xef00]
call fcn.140001490
nop
lea rcx, [rsp + 0xf258]
call fcn.140001490
nop
lea rcx, [rsp + 0xf298]
call fcn.140001490
nop
lea rcx, [rsp + 0xf288]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [0x140220948]
call fcn.1400a9180
mov r8, rax
lea rdx, [0x140220960]
lea rcx, [rsp + 0xb00]
call fcn.1400ccd88
test eax, eax
jne 0x1401cc02b
lea rcx, str.multisynctofile
call fcn.1400a9180
lea rdx, [rsp + rax + 0xb00]
lea rcx, [rsp + 0x14e50]
call fcn.1400db960
nop
lea rdx, [0x14022098c]
lea rcx, [rsp + 0x14e50]
call fcn.1400069d0
mov dword [rsp + 0x14e60], 0
lea r9, [rsp + 0x14e60]
lea r8, [0x140220764]
lea rdx, [rsp + 0x15c30]
lea rcx, [rsp + 0x14e50]
call fcn.1400065a0
mov qword [rsp + 0x16568], rax
mov rcx, qword [rsp + 0x16568]
call fcn.140023510
mov rcx, rax
call fcn.1400a9498
mov qword [rsp + 0x13a00], rax
lea rcx, [rsp + 0x15c30]
call fcn.140001490
cmp dword [rsp + 0x14e60], 0xffffffff
jne 0x1401cb7f9
lea r8, str._ERR_PARAM_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0x15c38]
call fcn.140001000
mov qword [rsp + 0x16570], rax
mov rax, qword [rsp + 0x16570]
mov qword [rsp + 0x16578], rax
lea r8, str._syncdb.xml
mov rdx, qword [rsp + 0x16578]
lea rcx, [rsp + 0x139f8]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x15c38]
call fcn.140001490
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x139f8]
call fcn.1400068a0
mov dword [rsp + 0x139f0], eax
cmp dword [rsp + 0x139f0], 0xffffffff
je 0x1401cb8c2
mov r8d, dword [rsp + 0x139f0]
lea rdx, [rsp + 0x15c40]
lea rcx, [rsp + 0x139f8]
call fcn.140006b20
mov qword [rsp + 0x16580], rax
mov rax, qword [rsp + 0x16580]
mov qword [rsp + 0x16588], rax
mov rcx, qword [rsp + 0x16588]
call fcn.140023510
mov rcx, rax
call fcn.140004bc0
nop
lea rcx, [rsp + 0x15c40]
call fcn.140001490
lea rcx, [rsp + 0x139f8]
call fcn.140023510
lea rdx, [0x1402209c8]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x14e58], rax
cmp qword [rsp + 0x14e58], 0
jne 0x1401cb932
lea r8, [0x1402209d0]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001490
jmp 0x1401cc052
mov byte [rsp + 0x13d50], 0
lea rdi, [rsp + 0x13d51]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x14e64], 0
jmp 0x1401cb969
mov eax, dword [rsp + 0x14e64]
add eax, 1
mov dword [rsp + 0x14e64], eax
mov edi, dword [rsp + 0x14e64]
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
cmp rdi, rax
jae 0x1401cb9f2
mov qword [rsp + 0x14e68], 0x1000
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x14e68]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80c0
test eax, eax
jne 0x1401cb9ca
jmp 0x1401cb9f2
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x14e68]
lea rcx, [rsp + 0x13d50]
call fcn.1400ac454
jmp 0x1401cb958
xor edx, edx
mov rax, qword [rsp + 0x13a00]
mov ecx, 0x1000
div rcx
mov qword [rsp + 0x136a0], rdx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x136a0]
lea r8, [rsp + 0x13d50]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80c0
mov r9, qword [rsp + 0x14e58]
mov r8d, 1
mov rdx, qword [rsp + 0x136a0]
lea rcx, [rsp + 0x13d50]
call fcn.1400ac454
mov rcx, qword [rsp + 0x14e58]
call fcn.1400aa000
lea rcx, [rsp + 0x14d80]
call fcn.1400e7d10
nop
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov dword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rax
lea rdx, [rsp + 0x15c48]
lea rcx, [rsp + 0x14d80]
call fcn.1400eb0e0
mov rcx, rax
call fcn.1400e4e10
movzx eax, al
test eax, eax
jne 0x1401cbb3c
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401cbaed
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [0x1402209e8]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e65e0
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001490
jmp 0x1401cc052
xor r9d, r9d
lea r8, [0x140220a00]
lea rdx, [rsp + 0x14d50]
lea rcx, [rsp + 0x14d80]
call fcn.1400eba40
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e4170
test rax, rax
jne 0x1401cbbff
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401cbba2
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._ERR_COPY_FILE_FAILED_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e41c0
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e65e0
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001490
jmp 0x1401cc052
lea rcx, [rsp + 0x13a10]
call fcn.1401cc380
nop
lea rcx, [rsp + 0x13a10]
call fcn.1401b7590
mov dword [rsp + 0x14e70], 0
jmp 0x1401cbc38
mov eax, dword [rsp + 0x14e70]
add eax, 1
mov dword [rsp + 0x14e70], eax
mov edi, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4170
cmp rdi, rax
jae 0x1401cbd56
lea rcx, [rsp + 0x14e80]
call fcn.1401cc380
nop
mov dword [rsp + 0x15018], 0
lea rcx, [rsp + 0x14e80]
call fcn.1401d0fb0
mov dword [rsp + 0x151c0], 0
jmp 0x1401cbc99
mov eax, dword [rsp + 0x151c0]
add eax, 1
mov dword [rsp + 0x151c0], eax
mov eax, dword [rsp + 0x151b0]
cmp dword [rsp + 0x151c0], eax
jae 0x1401cbd36
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x14e88]
call fcn.140023510
mov rdi, rax
mov edx, dword [rsp + 0x14e70]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4140
lea rdx, [rsp + 0x15c60]
mov rcx, rax
call fcn.1400e73e0
mov r8, rdi
lea rdx, [rsp + 0x15c68]
mov rcx, rax
call fcn.1400e68f0
lea r8, [0x140220a58]
lea rdx, [rsp + 0x15c70]
mov rcx, rax
call fcn.1400e6840
mov rcx, rax
call fcn.1400e5170
mov rdx, rax
mov eax, dword [rsp + 0x151c0]
lea rcx, [rsp + rax*8 + 0x15020]
call fcn.1400020a0
jmp 0x1401cbc88
lea rcx, [rsp + 0x14e80]
call fcn.1401b7bb0
nop
lea rcx, [rsp + 0x14e80]
call fcn.140005db0
jmp 0x1401cbc27
lea rcx, [rsp + 0x136b0]
call fcn.1401cc310
nop
lea rcx, [rsp + 0x136b0]
call fcn.1401b7590
xor r9d, r9d
lea r8, [0x140220a68]
lea rdx, [rsp + 0x15c78]
lea rcx, [rsp + 0x14d80]
call fcn.1400eba40
mov qword [rsp + 0x16590], rax
mov rax, qword [rsp + 0x16590]
mov qword [rsp + 0x16598], rax
mov rdx, qword [rsp + 0x16598]
lea rcx, [rsp + 0x14d50]
call fcn.1400e5d90
nop
lea rcx, [rsp + 0x15c78]
call fcn.1400e41c0
mov dword [rsp + 0x151c4], 0
jmp 0x1401cbde9
mov eax, dword [rsp + 0x151c4]
add eax, 1
mov dword [rsp + 0x151c4], eax
mov edi, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4170
cmp rdi, rax
jae 0x1401cbf59
lea rcx, [rsp + 0x151d0]
call fcn.1401cc310
nop
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4140
lea rdx, [rsp + 0x15ca0]
mov rcx, rax
call fcn.1400e73e0
lea r8, [0x140220a94]
lea rdx, [rsp + 0x15ca8]
mov rcx, rax
call fcn.1400e68f0
lea r8, [0x140220aa0]
lea rdx, [rsp + 0x15cb0]
mov rcx, rax
call fcn.1400e6840
xor edx, edx
mov rcx, rax
call fcn.1400e7d50
mov dword [rsp + 0x15510], eax
mov dword [rsp + 0x15514], 0
jmp 0x1401cbe95
mov eax, dword [rsp + 0x15514]
add eax, 1
mov dword [rsp + 0x15514], eax
mov eax, dword [rsp + 0x15500]
cmp dword [rsp + 0x15514], eax
jae 0x1401cbf32
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x151d8]
call fcn.140023510
mov rdi, rax
mov edx, dword [rsp + 0x151c4]
lea rcx, [rsp + 0x14d50]
call fcn.1400e4140
lea rdx, [rsp + 0x15cb8]
mov rcx, rax
call fcn.1400e73e0
mov r8, rdi
lea rdx, [rsp + 0x15cc0]
mov rcx, rax
call fcn.1400e68f0
lea r8, [0x140220ab0]
lea rdx, [rsp + 0x15cc8]
mov rcx, rax
call fcn.1400e6840
mov rcx, rax
call fcn.1400e5170
mov rdx, rax
mov eax, dword [rsp + 0x15514]
lea rcx, [rsp + rax*8 + 0x15370]
call fcn.1400020a0
jmp 0x1401cbe84
mov edx, dword [rsp + 0x15510]
lea rcx, [rsp + 0x151d0]
call fcn.1401cdff0
nop
lea rcx, [rsp + 0x151d0]
call fcn.140005db0
jmp 0x1401cbdd8
mov edx, 1
xor ecx, ecx
call fcn.1401b7f70
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8056
xor edx, edx
lea rcx, [0x1403ac8a0]
call fcn.1401bad10
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401cbfb5
lea rcx, [rsp + 0x139f8]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str.OK__r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
nop
lea rcx, [rsp + 0x136b0]
call fcn.140005db0
nop
lea rcx, [rsp + 0x13a10]
call fcn.140005db0
nop
lea rcx, [rsp + 0x14d50]
call fcn.1400e41c0
nop
lea rcx, [rsp + 0x14d80]
call fcn.1400e65e0
nop
lea rcx, [rsp + 0x139f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x14e50]
call fcn.140001490
jmp 0x1401cc052
lea r8, str._ERR_VERSION_ERROR_r_n
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d8c10
jmp 0x1401cc052
mov edx, 1
mov rcx, qword [rsp + 0x165d8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_shutdown]
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x60], 0x400
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x165d8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x165d0]
call fcn.1400d80c0
mov dword [rsp + 0x15cd0], 0
lea rcx, [rsp + 0x470]
call fcn.140005db0
nop
lea rcx, [rsp + 0x7b0]
call fcn.140005db0
mov eax, dword [rsp + 0x15cd0]
mov rcx, qword [rsp + 0x165a0]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0x165b8
pop rdi
pop rsi
ret