Function at 0x140001ca0
Capabilities:
Create directory
Create process on windows
Create thread
Delete file
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.140006f10
call fcn.140006ef0
call fcn.140006ed0
mov ecx, 0x104
call fcn.140006fa0
mov rsi, rax
mov dword [rbp + 0x60], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rbp + 0x60]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov ecx, dword [rbp + 0x60]
inc ecx
call fcn.140006fa0
mov r8d, dword [rbp + 0x60]
mov rdx, rsi
inc r8d
mov qword [0x14000e8b0], rax
mov rcx, rax
call sub.ntdll.dll_memcpy
mov rcx, qword [0x14000e8b0]
mov edx, 0x5c
call sub.ntdll.dll_strrchr
mov rbx, rax
sub rbx, qword [0x14000e8b0]
lea rcx, [rax + 1]
mov qword [0x14000e8a0], rcx
lea rcx, [rbx + 1]
call fcn.140006fa0
mov rdx, qword [0x14000e8b0]
mov r8, rbx
mov rcx, rax
mov qword [0x14000e8a8], rax
call sub.ntdll.dll_memcpy
mov rcx, qword [0x14000e8a8]
mov edx, 0x104
mov byte [rcx + rbx], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, 0x5c
mov rcx, rsi
call sub.ntdll.dll_strrchr
movabs rcx, 0x656e757470654e
mov rdi, 0xffffffffffffffff
mov qword [rax + 1], rcx
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140001db0
inc rcx
call fcn.140006fa0
mov qword [0x14000e8b8], rax
mov rdx, rsi
nop dword [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001dd0
mov rcx, qword [0x14000e8b8]
call fcn.140006840
test al, al
jne 0x140001e00
mov rcx, qword [0x14000e8b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [0x14000e8b8]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
mov rcx, rsi
call fcn.140007150
mov ecx, 0x104
call fcn.140006fa0
mov rdx, qword [0x14000e8a8]
mov rbx, rax
mov r8, rax
nop dword [rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140001e30
lea rcx, [rax - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001e46
mov eax, dword [str.TEST]
mov dword [rcx], eax
movzx eax, word [0x1400092b4]
mov word [rcx + 4], ax
mov rcx, rbx
call fcn.140006840
mov rcx, rbx
mov byte [0x14000e8c0], al
call fcn.140007150
call fcn.140006e90
mov r15d, 1
lea r9, [rbp + 0x68]
xor esi, esi
mov dword [0x14000e8c4], r15d
xor r8d, r8d
mov dword [rbp + 0x68], esi
lea rdx, [rbp + 0x70]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
je 0x140001f05
mov eax, dword [rbp + 0x68]
cmp eax, 7
jb 0x140001f05
mov ecx, eax
add rcx, rcx
call fcn.140006fa0
lea r9, [rbp + 0x68]
mov r8, rax
lea rdx, [rbp + 0x70]
mov ecx, 8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
je 0x140001ef8
mov r8d, 3
lea rdx, [0x1400092b8]
mov rcx, rbx
call sub.ntdll.dll_wcsncmp
test eax, eax
jne 0x140001ef8
mov dword [0x14000e8c4], esi
test rbx, rbx
je 0x140001f05
mov rcx, rbx
call fcn.140007150
movzx r9d, r15b
lea rdx, [rsp + 0x60]
mov r8d, setsockopt
lea rcx, str.old_version_process
call fcn.140006980
test al, al
je 0x140001f7d
mov rcx, qword [rsp + 0x68]
call fcn.140006d30
test al, al
je 0x140001f7d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rsp + 0x60]
mov rbx, rax
call fcn.1400071e0
test al, al
je 0x140001f7d
nop dword [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0x1388
ja 0x140002a79
mov ecx, dword [rsp + 0x60]
call fcn.1400071e0
test al, al
jne 0x140001f50
mov ecx, 0x104
call fcn.140006fa0
xor r9d, r9d
lea rcx, str.old_version_path
mov r8d, 0x104
mov rdx, rax
mov rbx, rax
call fcn.140006980
test al, al
je 0x140001fbb
mov rcx, rbx
call fcn.140006840
test al, al
je 0x140001fbb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.140007150
movzx r9d, r15b
lea rdx, [rsp + 0x50]
mov r8d, setsockopt
lea rcx, str.mute_process
call fcn.140006980
test al, al
je 0x140002001
mov rcx, qword [rsp + 0x58]
call fcn.140006d30
test al, al
je 0x140002001
mov ecx, dword [rsp + 0x50]
call fcn.1400071e0
test al, al
jne 0x140002a52
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x70], eax
call fcn.140006c60
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, str.mute_process
mov r8d, setsockopt
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140006a40
lea rcx, [0x14000e8c8]
mov byte [0x14000e8c1], r15b
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001ba0]
mov qword [0x14000e8d0], rax
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001bf0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x14000e8d8]
mov qword [rsp + 0x28], rsi
lea r8, [0x140001bc0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
nop
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14000e8d8], rsi
jne 0x1400020f2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0xbb8
jb 0x1400020c0
cmp qword [0x14000e8d8], rsi
je 0x140002aa0
call fcn.140002f10
test al, al
jne 0x140002104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp dword [0x14000e8c4], esi
lea rax, [0x140009468]
lea rcx, str.Checking_for_software_updates...
cmove rcx, rax
call fcn.140001c10
cmp byte [0x14000e8c0], sil
jne 0x14000225c
call fcn.1400038e0
test al, al
je 0x14000225c
mov ecx, 0x104
call fcn.140006fa0
mov rcx, rax
mov rbx, rax
call fcn.140003670
test al, al
jne 0x14000217a
cmp dword [0x14000e8c4], esi
lea rax, [0x1400094a8]
lea rcx, str.Error:_A_new_version_was_detected__but_downloading_the_new_version_failed
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rdx, qword [0x14000e8b0]
cmp byte [rdx + rdi + 1], sil
lea rdi, [rdi + 1]
jne 0x140002181
lea r8d, [rdi + 1]
lea rcx, str.old_version_path
call fcn.140006a40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x70], eax
call fcn.140006c60
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, str.old_version_process
mov r8d, setsockopt
movdqa xmmword [rsp + 0x60], xmm0
call fcn.140006a40
xorps xmm0, xmm0
mov dword [rbp - 0x40], 0x68
xor eax, eax
xor r9d, r9d
mov dword [rbp + 0x24], eax
xor r8d, r8d
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002ac7
cmp dword [0x14000e8c4], esi
lea rax, [0x140009520]
lea rcx, str.Error:_The_new_version_was_downloaded__but_start_the_new_version_process_failed
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp dword [0x14000e8c4], esi
lea rax, [0x1400095a0]
lea rcx, str.Retrieving_font_file...
cmove rcx, rax
call fcn.140001c10
mov ecx, 0x104
call fcn.140006fa0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, reloc.WS2_32.dll_sendto
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rbx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1400022a2
movsd xmm0, qword [str.msyh.ttc]
movsd qword [rcx], xmm0
movzx eax, word [0x1400095d8]
mov word [rcx + 8], ax
mov rcx, rbx
mov qword [rsp + 0x178], r14
call fcn.140006840
test al, al
jne 0x1400023c5
mov edx, 0x5c
mov rcx, rbx
call sub.ntdll.dll_strrchr
lea rcx, [rbx - 1]
mov byte [rax], sil
nop
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1400022f0
movsd xmm0, qword [str.msyh.ttf]
movsd qword [rcx], xmm0
movzx eax, word [0x1400095e8]
mov word [rcx + 8], ax
mov rcx, rbx
call fcn.140006840
test al, al
jne 0x1400023c5
mov rcx, qword [0x14000e8b8]
mov rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002330
lea rcx, [rbx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140002345
movsd xmm0, qword [str.msyh.ttc]
mov r14d, r15d
movsd qword [rcx], xmm0
movzx eax, word [0x1400095d8]
mov word [rcx + 8], ax
nop dword [rax]
lea rdx, str.bb95c4b76ddb381d41ba7d86c9c4d58e
mov rcx, rbx
call fcn.140006700
test al, al
jne 0x1400023c5
mov rdx, rbx
lea rcx, str._T2X7fYG8.bmp
call fcn.1400033f0
test al, al
je 0x14000239f
inc r14d
cmp r14d, 3
jle 0x140002370
cmp dword [0x14000e8c4], esi
lea rax, [0x140009628]
lea rcx, str.Error:_Failed_to_obtain_the_font_file__please_download_and_install_the_Microsoft_YaHei_font
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
lea r8, [0x14000e8e8]
mov rcx, rbx
lea rdx, [0x14000e8e0]
call fcn.140006fc0
test al, al
jne 0x140002405
cmp dword [0x14000e8c4], esi
lea rax, [0x1400096c0]
lea rcx, str.Error:_Failed_to_read_font_file
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rcx, rbx
call fcn.140007150
cmp dword [0x14000e8c4], esi
lea rax, [0x1400096f8]
lea rcx, str.Retrieving_resource_files...
cmove rcx, rax
call fcn.140001c10
mov ecx, 0x104
call fcn.140006fa0
mov rbx, rax
mov rax, qword [0x14000e8b8]
mov rdx, rbx
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002441
lea rcx, [rbx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140002456
movsd xmm0, qword [0x140009730]
mov r14d, r15d
movsd qword [rcx], xmm0
mov eax, dword [0x140009738]
mov dword [rcx + 8], eax
nop dword [rax + rax]
lea rdx, str.f7a94af3b5f2f815866f97e8e0e393de
mov rcx, rbx
call fcn.140006700
mov rdx, rbx
test al, al
jne 0x1400024d8
lea rcx, str._F9pwaRRf.bmp
call fcn.1400033f0
test al, al
je 0x1400024af
inc r14d
cmp r14d, 3
jle 0x140002480
cmp dword [0x14000e8c4], esi
lea rax, [0x140009778]
lea rcx, str.Error:_Failed_to_obtain_FTD3XX.dll__please_download_and_put_it_into__s
mov rdx, rbx
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rcx, qword [0x14000e8b8]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400024e0
lea rcx, [rbx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1400024f5
movsd xmm0, qword [0x1400097e8]
mov r14d, r15d
movsd qword [rcx], xmm0
mov eax, dword [0x1400097f0]
mov dword [rcx + 8], eax
movzx eax, word [0x1400097f4]
mov word [rcx + 0xc], ax
movzx eax, byte [0x1400097f6]
mov byte [rcx + 0xe], al
nop dword [rax]
lea rdx, str.e67ce2e6c08328e30362605d8d52f8b5
mov rcx, rbx
call fcn.140006700
mov rdx, rbx
test al, al
jne 0x140002588
lea rcx, str._l8ySmcR1.bmp
call fcn.1400033f0
test al, al
je 0x14000255f
inc r14d
cmp r14d, 3
jle 0x140002530
cmp dword [0x14000e8c4], esi
lea rax, [0x140009830]
lea rcx, str.Error:_Failed_to_obtain_leechcore.dll__please_download_and_put_it_into__s
mov rdx, rbx
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rcx, qword [0x14000e8b8]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002590
lea rcx, [rbx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1400025a5
movsd xmm0, qword [str._vmm.dll]
movsd qword [rcx], xmm0
movzx eax, byte [0x1400098b8]
mov byte [rcx + 8], al
nop word [rax + rax]
lea rdx, str.ce011614fe966b4a89e5c5482ee62dc8
mov rcx, rbx
call fcn.140006700
test al, al
jne 0x140002628
mov rdx, rbx
lea rcx, str._vZnrKw94.bmp
call fcn.1400033f0
test al, al
je 0x1400025ff
inc r15d
cmp r15d, 3
jle 0x1400025d0
cmp dword [0x14000e8c4], esi
lea rax, [0x1400098f8]
lea rcx, str.Error:_Failed_to_obtain_vmm.dll__please_download_and_put_it_into__s
mov rdx, rbx
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rcx, rbx
call fcn.140007150
cmp dword [0x14000e8c4], esi
lea rax, [0x140009968]
lea rcx, str.Initializing_dma...
cmove rcx, rax
call fcn.140001c10
call fcn.140007de0
test al, al
jne 0x14000267c
cmp dword [0x14000e8c4], esi
lea rax, [0x140009998]
lea rcx, str.Error:_dma_runtime_library_load_failed
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
lea rax, [0x1400099d7]
mov ecx, 4
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x80]
lea rax, str._device
mov qword [rbp - 0x78], rax
lea rax, str.fpga
mov qword [rbp - 0x70], rax
lea rax, str._norefresh
mov qword [rbp - 0x68], rax
call qword [0x14000ead0]
mov qword [0x14000e918], rax
test rax, rax
jne 0x1400026e9
cmp dword [0x14000e8c4], esi
lea rax, [0x1400099f8]
lea rcx, str.Error:_VMMDLL_Initialize_failed
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.140008a30
test al, al
jne 0x140002718
cmp dword [0x14000e8c4], esi
lea rax, [0x140009a38]
lea rcx, str.ERROR:_dma_host_kernel_context_parsing_failed
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp dword [0x14000e8c4], esi
lea rax, [0x140009a88]
lea rcx, str.Initializing_KmboxNet...
cmove rcx, rax
call fcn.140001c10
mov r9b, 1
lea rdx, [0x14000e8f0]
mov r8d, 0x21
lea rcx, str.kmboxnet_data
call fcn.140006980
test al, al
je 0x1400028f7
cmp byte [0x14000e8f0], sil
je 0x1400028f7
lea r8, [0x14000e908]
lea rdx, [0x14000e902]
lea rcx, [0x14000e8f2]
call fcn.140001000
test eax, eax
jne 0x1400028f7
cmp byte [0x14000e8f0], sil
je 0x1400027c3
mov r8d, 0x21
lea rdx, [0x14000e8f0]
lea rcx, str.kmboxnet_data
call fcn.140006a40
nop word [rax + rax]
mov ecx, esi
call fcn.1400013a0
inc rsi
cmp rsi, 0xff
jb 0x1400027b0
cmp dword [0x14000e8c4], 0
lea rax, [0x140009b10]
lea rcx, str.All_initializations_completed__entering_the_login_window...
cmove rcx, rax
call fcn.140001c10
xor r9d, r9d
lea rdx, [0x14000e921]
mov r8d, 0x40
lea rcx, [0x140009b74]
call fcn.140006980
test al, al
jne 0x140002807
mov byte [0x14000e921], al
mov rcx, qword [0x14000e8d8]
xor r9d, r9d
xor r8d, r8d
mov byte [0x14000e920], 0
mov edx, 0x405
call qword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x14000e920], 0
jne 0x140002844
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14000e920], 0
je 0x140002830
mov rcx, qword [0x14000e8d8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x406
call qword [sym.imp.USER32.dll_SendMessageA]
movsx r8d, byte [0x14000e961]
lea rdx, [0x14000e921]
inc r8d
lea rcx, [0x140009b74]
call fcn.140006a40
cmp dword [0x14000e8c4], 0
lea rax, [0x140009b78]
lea rcx, str.Key_verification_in_progress...
cmove rcx, rax
call fcn.140001c10
lea rbx, [0x14000e962]
xor r9d, r9d
mov rdx, rbx
lea rcx, str.machine_code
mov r8d, 0x40
call fcn.140006980
test al, al
jne 0x1400029e0
call fcn.1400071c0
mov r8d, eax
lea rdx, str._08X
mov rcx, rbx
call fcn.140006070
movsx r8d, al
lea rcx, str.machine_code
inc r8d
mov byte [0x14000e9a2], al
mov rdx, rbx
call fcn.140006a40
jmp 0x1400029f0
mov rcx, qword [0x14000e8d8]
xor r9d, r9d
xor r8d, r8d
mov byte [0x14000e8f1], sil
mov edx, 0x403
call qword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x14000e8f1], sil
jne 0x140002934
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14000e8f1], sil
je 0x140002920
mov rcx, qword [0x14000e8d8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x404
call qword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x14000e8f1], 1
jne 0x14000295e
mov byte [0x14000e8f0], sil
jmp 0x140002981
lea r8, [0x14000e908]
lea rdx, [0x14000e902]
lea rcx, [0x14000e8f2]
call fcn.140001000
test eax, eax
sete byte [0x14000e8f0]
mov r8d, 0x21
lea rdx, [0x14000e8f0]
lea rcx, str.kmboxnet_data
call fcn.140006a40
cmp byte [0x14000e8f0], sil
jne 0x140002791
cmp byte [0x14000e8f1], 2
jne 0x1400027c3
cmp dword [0x14000e8c4], esi
lea rax, [0x140009ad0]
lea rcx, str.Error:Failed_to_initialize_KmboxNet
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400029e0
mov byte [0x14000e9a2], dil
call fcn.140003b60
test al, al
jne 0x140002a27
cmp dword [0x14000e8c4], 0
lea rax, [0x140009bc8]
mov rdx, qword [0x14000e9a8]
lea rcx, str.Error:_Verification_failed:_s
cmove rcx, rax
call fcn.140001c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp dword [0x14000e8c4], 0
lea rax, [0x140009c00]
lea rcx, str.Login_successful__waiting_for_the_target_game_process_to_start...
cmove rcx, rax
call fcn.140001c10
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002a45
cmp dword [0x14000e8c4], esi
lea rax, [0x1400093a0]
mov edx, dword [rsp + 0x50]
lea rcx, str.Another_identical_process_exists._Please_terminate_the_process_manually._Process_id:__d
cmove rcx, rax
call fcn.140006860
call fcn.140001c60
int3
cmp dword [0x14000e8c4], esi
lea rax, [0x1400092d8]
mov edx, dword [rsp + 0x60]
lea rcx, str.Waiting_for_the_old_version_process_to_exit_timed_out__please_manually_end_the_process__process_id:__d
cmove rcx, rax
call fcn.140006860
call fcn.140001c60
int3
cmp dword [0x14000e8c4], esi
lea rax, [0x140009428]
mov edx, dword [rsp + 0x50]
lea rcx, str.Failed_to_launch_the_init_dialog
cmove rcx, rax
call fcn.140006860
call fcn.140001c60
int3
mov rcx, rbx
call fcn.140007150
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001c60
int3