Function at 0x140196780
Capabilities:
Check if file exists
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x7e0
mov qword [rsp + 0x6c0], 0xfffffffffffffffe
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x6c8], rax
cmp qword [rsp + 0x6c8], 0x8087
ja 0x14019681c
cmp qword [rsp + 0x6c8], 0x8087
je 0x1401968af
cmp qword [rsp + 0x6c8], 0x10f
je 0x14019724c
cmp qword [rsp + 0x6c8], 0x50b
je 0x140196857
cmp qword [rsp + 0x6c8], 0x8011
je 0x140196e5c
cmp qword [rsp + 0x6c8], 0x8012
je 0x1401971b1
jmp 0x14019731f
cmp qword [rsp + 0x6c8], 0x8089
je 0x140196d8b
cmp qword [rsp + 0x6c8], 0x809e
je 0x14019701a
cmp qword [rsp + 0x6c8], 0x80ec
je 0x14019721a
jmp 0x14019731f
lea rdx, [0x140247950]
lea rcx, [rsp + 0x5d0]
call fcn.1400eeb20
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x6d0]
mov qword [rsp + 0x6d8], rax
mov rcx, qword [rsp + 0x6d8]
call fcn.1400012c0
xor edx, edx
mov rcx, rax
call fcn.1400eff90
nop
lea rcx, [rsp + 0x5d0]
call fcn.140001470
xor eax, eax
jmp 0x140197324
mov dword [rsp + 0x70], 0
mov edx, 0xa
lea rcx, [rsp + 0x30]
call fcn.14008d720
nop
lea rcx, [rsp + 0x5d8]
call fcn.140001000
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x6e8], rax
lea r8, str.Log.txt
mov rdx, qword [rsp + 0x6e8]
lea rcx, [rsp + 0x5e0]
call fcn.1400010b0
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x6f8], rax
mov rdx, qword [rsp + 0x6f8]
lea rcx, [rsp + 0x30]
call fcn.14008d90c
nop
lea rcx, [rsp + 0x5e0]
call fcn.140001470
nop
lea rcx, [rsp + 0x5d8]
call fcn.140001470
lea rcx, [rsp + 0x5e8]
call fcn.140001000
mov qword [rsp + 0x700], rax
mov rax, qword [rsp + 0x700]
mov qword [rsp + 0x708], rax
lea r8, str..ini
mov rdx, qword [rsp + 0x708]
lea rcx, [rsp + 0x5f0]
call fcn.1400010b0
mov qword [rsp + 0x710], rax
mov rax, qword [rsp + 0x710]
mov qword [rsp + 0x718], rax
mov rdx, qword [rsp + 0x718]
lea rcx, [rsp + 0x30]
call fcn.14008d90c
nop
lea rcx, [rsp + 0x5f0]
call fcn.140001470
nop
lea rcx, [rsp + 0x5e8]
call fcn.140001470
lea rcx, [rsp + 0x5f8]
call fcn.140001000
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x720]
mov qword [rsp + 0x728], rax
lea r8, str..xml
mov rdx, qword [rsp + 0x728]
lea rcx, [rsp + 0x600]
call fcn.1400010b0
mov qword [rsp + 0x730], rax
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x738], rax
mov rdx, qword [rsp + 0x738]
lea rcx, [rsp + 0x30]
call fcn.14008d90c
nop
lea rcx, [rsp + 0x600]
call fcn.140001470
nop
lea rcx, [rsp + 0x5f8]
call fcn.140001470
lea rcx, [rsp + 0x608]
call fcn.140001000
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0x740]
mov qword [rsp + 0x748], rax
lea r8, str.LogSubmit.zip
mov rdx, qword [rsp + 0x748]
lea rcx, [rsp + 0x68]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x608]
call fcn.140001470
lea rcx, [rsp + 0x610]
call fcn.140001000
mov qword [rsp + 0x750], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x758], rax
lea rcx, [rsp + 0x68]
call fcn.1400012c0
mov rbx, rax
mov rcx, qword [rsp + 0x758]
call fcn.1400012c0
lea r9, [rsp + 0x70]
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401847c0
nop
lea rcx, [rsp + 0x610]
call fcn.140001470
lea rcx, [rsp + 0x78]
call fcn.140002d50
nop
lea rcx, [rsp + 0x618]
call fcn.1400020f0
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x768], rax
mov r9, qword [rsp + 0x768]
mov r9, qword [r9]
lea r8, [0x1402479b8]
lea rdx, str.http:__www.youngzsoft.net_submit.php_product_sversion3.0._srefprog
lea rcx, [rsp + 0x78]
call fcn.140002be0
nop
lea rcx, [rsp + 0x618]
call fcn.140001470
lea r11, [rsp + 0x620]
mov qword [rsp + 0x628], r11
lea rdx, str.bugreportsurl
mov rcx, qword [rsp + 0x628]
call fcn.140002090
mov qword [rsp + 0x770], rax
mov rdx, qword [rsp + 0x770]
lea rcx, [rsp + 0x80]
call fcn.140193d30
nop
lea rcx, [rsp + 0x80]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x140196bd3
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x78]
call fcn.140002d20
lea rcx, [rsp + 0x68]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140196d2a
lea r8, [rsp + 0x68]
lea rdx, [0x140247a80]
lea rcx, [rsp + 0x630]
call fcn.140006c30
mov qword [rsp + 0x778], rax
mov rax, qword [rsp + 0x778]
mov qword [rsp + 0x780], rax
lea r8, [0x14024576c]
mov rdx, qword [rsp + 0x780]
lea rcx, [rsp + 0x638]
call fcn.1400010b0
mov qword [rsp + 0x788], rax
mov rcx, qword [rsp + 0x788]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.explorer.exe
lea rdx, [0x140247ac0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x638]
call fcn.140001470
nop
lea rcx, [rsp + 0x630]
call fcn.140001470
lea rcx, [rsp + 0x88]
call fcn.140002d50
nop
lea rdx, str.Please_attach_the__s_file_to_a_ticket_in_our_support_page_and_submit_for_troubleshooting._Thank_you_
lea rcx, [rsp + 0x640]
call fcn.1400eeb20
mov qword [rsp + 0x790], rax
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x798], rax
mov rcx, qword [rsp + 0x798]
call fcn.1400012c0
mov r8, qword [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140002be0
nop
lea rcx, [rsp + 0x640]
call fcn.140001470
lea rcx, [rsp + 0x88]
call fcn.1400012c0
xor r8d, r8d
mov edx, 0x40
mov rcx, rax
call fcn.1400ef150
nop
lea rcx, [rsp + 0x88]
call fcn.140001470
lea rcx, [rsp + 0x78]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x80]
call fcn.140001470
nop
lea rcx, [rsp + 0x78]
call fcn.140001470
nop
lea rcx, [rsp + 0x68]
call fcn.140001470
nop
lea rcx, [rsp + 0x30]
call fcn.14008d8c0
xor eax, eax
jmp 0x140197324
lea rdx, str.https:__www.facebook.com_ccboot
lea rcx, [rsp + 0x98]
call fcn.140002090
nop
lea rax, [rsp + 0x648]
mov qword [rsp + 0x650], rax
lea rdx, str.facebookurl
mov rcx, qword [rsp + 0x650]
call fcn.140002090
mov qword [rsp + 0x7a0], rax
mov rdx, qword [rsp + 0x7a0]
lea rcx, [rsp + 0x90]
call fcn.140193d30
nop
lea rcx, [rsp + 0x90]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x140196e0b
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x98]
call fcn.140002d20
lea rcx, [rsp + 0x98]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x90]
call fcn.140001470
nop
lea rcx, [rsp + 0x98]
call fcn.140001470
xor eax, eax
jmp 0x140197324
lea rdx, [0x140247c08]
lea rcx, [rsp + 0x660]
call fcn.1400eeb20
mov qword [rsp + 0x7a8], rax
lea rdx, [0x140247bf8]
mov rcx, qword [rsp + 0x7a8]
call fcn.140006d30
mov byte [rsp + 0x658], al
lea rcx, [rsp + 0x660]
call fcn.140001470
movzx r11d, byte [rsp + 0x658]
test r11d, r11d
je 0x140196f33
lea rdx, [0x140247c18]
lea rcx, [rsp + 0xb0]
call fcn.1400eeb20
lea rdx, str.HelpPageURL
lea rcx, [rsp + 0xb0]
call fcn.140006d30
movzx eax, al
test eax, eax
je 0x140196f0f
lea rcx, [rsp + 0xb0]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x668], 0
lea rcx, [rsp + 0xb0]
call fcn.140001470
mov eax, dword [rsp + 0x668]
jmp 0x140197324
lea rdx, str.http:__www.ccboot.com_wiki.htm_refprog
lea rcx, [rsp + 0xa8]
call fcn.140002090
nop
lea rax, [rsp + 0x670]
mov qword [rsp + 0x678], rax
lea rdx, str.helpurl
mov rcx, qword [rsp + 0x678]
call fcn.140002090
mov qword [rsp + 0x7b0], rax
mov rdx, qword [rsp + 0x7b0]
lea rcx, [rsp + 0xa0]
call fcn.140193d30
nop
lea rcx, [rsp + 0xa0]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x140196fb3
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.140002d20
lea rcx, [rsp + 0xa8]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x680], 0
lea rcx, [rsp + 0xa0]
call fcn.140001470
nop
lea rcx, [rsp + 0xa8]
call fcn.140001470
mov eax, dword [rsp + 0x680]
jmp 0x140197324
lea rdx, [0x140247cc0]
lea rcx, [rsp + 0x688]
call fcn.1400eeb20
mov qword [rsp + 0x7b8], rax
lea rdx, [0x140247c48]
mov rcx, qword [rsp + 0x7b8]
call fcn.140006d30
mov byte [rsp + 0x684], al
lea rcx, [rsp + 0x688]
call fcn.140001470
movzx r11d, byte [rsp + 0x684]
test r11d, r11d
je 0x1401970ca
lea rdx, str.HomePageURL
lea rcx, [rsp + 0x690]
call fcn.1400eeb20
mov qword [rsp + 0x7c0], rax
mov rcx, qword [rsp + 0x7c0]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x690]
call fcn.140001470
xor eax, eax
jmp 0x140197324
lea rdx, str.http:__www.ccboot.com__refprog
lea rcx, [rsp + 0xc0]
call fcn.140002090
nop
lea rax, [rsp + 0x698]
mov qword [rsp + 0x6a0], rax
lea rdx, str.homepageurl
mov rcx, qword [rsp + 0x6a0]
call fcn.140002090
mov qword [rsp + 0x7c8], rax
mov rdx, qword [rsp + 0x7c8]
lea rcx, [rsp + 0xb8]
call fcn.140193d30
nop
lea rcx, [rsp + 0xb8]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x14019714a
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xc0]
call fcn.140002d20
lea rcx, [rsp + 0xc0]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x6a8], 0
lea rcx, [rsp + 0xb8]
call fcn.140001470
nop
lea rcx, [rsp + 0xc0]
call fcn.140001470
mov eax, dword [rsp + 0x6a8]
jmp 0x140197324
lea rcx, [rsp + 0xd0]
call fcn.14018f730
nop
lea rcx, [rsp + 0xd0]
call fcn.1400819f8
cmp rax, 1
jne 0x140197206
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x7f0]
lea r8, [0x140195500]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xd0]
call fcn.140005b00
xor eax, eax
jmp 0x140197324
xor edx, edx
lea rcx, [rsp + 0x300]
call fcn.140161ea0
nop
lea rcx, [rsp + 0x300]
call fcn.1400819f8
nop
lea rcx, [rsp + 0x300]
call fcn.140161e50
xor eax, eax
jmp 0x140197324
lea rdx, str.http:__help.youngzsoft.com_
lea rcx, [rsp + 0x5c8]
call fcn.140002090
nop
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x6b8], rax
lea rdx, str.supporturl
mov rcx, qword [rsp + 0x6b8]
call fcn.140002090
mov qword [rsp + 0x7d0], rax
mov rdx, qword [rsp + 0x7d0]
lea rcx, [rsp + 0x5c0]
call fcn.140193d30
nop
lea rcx, [rsp + 0x5c0]
call fcn.140007b70
movzx eax, al
test eax, eax
jne 0x1401972cc
lea rdx, [rsp + 0x5c0]
lea rcx, [rsp + 0x5c8]
call fcn.140002d20
lea rcx, [rsp + 0x5c8]
call fcn.1400012c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x5c0]
call fcn.140001470
nop
lea rcx, [rsp + 0x5c8]
call fcn.140001470
xor eax, eax
jmp 0x140197324
mov eax, 1
add rsp, 0x7e0
pop rbx
ret