Function at 0x140196810
Capabilities:
Check if file exists
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x7e0
mov qword [rsp + 0x6c0], 0xfffffffffffffffe
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x6c8], rax
cmp qword [rsp + 0x6c8], 0x8087
ja 0x1401968ac
cmp qword [rsp + 0x6c8], 0x8087
je 0x14019693f
cmp qword [rsp + 0x6c8], 0x10f
je 0x1401972dc
cmp qword [rsp + 0x6c8], 0x50b
je 0x1401968e7
cmp qword [rsp + 0x6c8], 0x8011
je 0x140196eec
cmp qword [rsp + 0x6c8], 0x8012
je 0x140197241
jmp 0x1401973af
cmp qword [rsp + 0x6c8], 0x8089
je 0x140196e1b
cmp qword [rsp + 0x6c8], 0x809e
je 0x1401970aa
cmp qword [rsp + 0x6c8], 0x80ec
je 0x1401972aa
jmp 0x1401973af
lea rdx, [0x140246b90]
lea rcx, [rsp + 0x5d0]
call fcn.1400eeb90
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x6d0]
mov qword [rsp + 0x6d8], rax
mov rcx, qword [rsp + 0x6d8]
call fcn.140023510
xor edx, edx
mov rcx, rax
call fcn.1400f0000
nop
lea rcx, [rsp + 0x5d0]
call fcn.140001490
xor eax, eax
jmp 0x1401973b4
mov dword [rsp + 0x70], 0
mov edx, 0xa
lea rcx, [rsp + 0x30]
call fcn.14008d3d8
nop
lea rcx, [rsp + 0x5d8]
call fcn.140001000
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x6e8], rax
lea r8, str.Log.txt
mov rdx, qword [rsp + 0x6e8]
lea rcx, [rsp + 0x5e0]
call fcn.1400010b0
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x6f8], rax
mov rdx, qword [rsp + 0x6f8]
lea rcx, [rsp + 0x30]
call fcn.14008d5c4
nop
lea rcx, [rsp + 0x5e0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5d8]
call fcn.140001490
lea rcx, [rsp + 0x5e8]
call fcn.140001000
mov qword [rsp + 0x700], rax
mov rax, qword [rsp + 0x700]
mov qword [rsp + 0x708], rax
lea r8, str..ini
mov rdx, qword [rsp + 0x708]
lea rcx, [rsp + 0x5f0]
call fcn.1400010b0
mov qword [rsp + 0x710], rax
mov rax, qword [rsp + 0x710]
mov qword [rsp + 0x718], rax
mov rdx, qword [rsp + 0x718]
lea rcx, [rsp + 0x30]
call fcn.14008d5c4
nop
lea rcx, [rsp + 0x5f0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5e8]
call fcn.140001490
lea rcx, [rsp + 0x5f8]
call fcn.140001000
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x720]
mov qword [rsp + 0x728], rax
lea r8, str..xml
mov rdx, qword [rsp + 0x728]
lea rcx, [rsp + 0x600]
call fcn.1400010b0
mov qword [rsp + 0x730], rax
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x738], rax
mov rdx, qword [rsp + 0x738]
lea rcx, [rsp + 0x30]
call fcn.14008d5c4
nop
lea rcx, [rsp + 0x600]
call fcn.140001490
nop
lea rcx, [rsp + 0x5f8]
call fcn.140001490
lea rcx, [rsp + 0x608]
call fcn.140001000
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0x740]
mov qword [rsp + 0x748], rax
lea r8, str.LogSubmit.zip
mov rdx, qword [rsp + 0x748]
lea rcx, [rsp + 0x68]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x608]
call fcn.140001490
lea rcx, [rsp + 0x610]
call fcn.140001000
mov qword [rsp + 0x750], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x758], rax
lea rcx, [rsp + 0x68]
call fcn.140023510
mov rbx, rax
mov rcx, qword [rsp + 0x758]
call fcn.140023510
lea r9, [rsp + 0x70]
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140184890
nop
lea rcx, [rsp + 0x610]
call fcn.140001490
lea rcx, [rsp + 0x78]
call fcn.140002db0
nop
lea rcx, [rsp + 0x618]
call fcn.140002130
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x768], rax
mov r9, qword [rsp + 0x768]
mov r9, qword [r9]
lea r8, [0x140246bf8]
lea rdx, str.http:__www.youngzsoft.net_submit.php_product_sversion3.0._srefprog
lea rcx, [rsp + 0x78]
call fcn.140002c40
nop
lea rcx, [rsp + 0x618]
call fcn.140001490
lea r11, [rsp + 0x620]
mov qword [rsp + 0x628], r11
lea rdx, str.bugreportsurl
mov rcx, qword [rsp + 0x628]
call fcn.1400020d0
mov qword [rsp + 0x770], rax
mov rdx, qword [rsp + 0x770]
lea rcx, [rsp + 0x80]
call fcn.140193dc0
nop
lea rcx, [rsp + 0x80]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x140196c63
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x78]
call fcn.140002d80
lea rcx, [rsp + 0x68]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140196dba
lea r8, [rsp + 0x68]
lea rdx, [0x140246cc0]
lea rcx, [rsp + 0x630]
call fcn.140006c90
mov qword [rsp + 0x778], rax
mov rax, qword [rsp + 0x778]
mov qword [rsp + 0x780], rax
lea r8, [0x140244adc]
mov rdx, qword [rsp + 0x780]
lea rcx, [rsp + 0x638]
call fcn.1400010b0
mov qword [rsp + 0x788], rax
mov rcx, qword [rsp + 0x788]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.explorer.exe
lea rdx, [0x140246d00]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x638]
call fcn.140001490
nop
lea rcx, [rsp + 0x630]
call fcn.140001490
lea rcx, [rsp + 0x88]
call fcn.140002db0
nop
lea rdx, str.Please_attach_the__s_file_to_a_ticket_in_our_support_page_and_submit_for_troubleshooting._Thank_you_
lea rcx, [rsp + 0x640]
call fcn.1400eeb90
mov qword [rsp + 0x790], rax
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x798], rax
mov rcx, qword [rsp + 0x798]
call fcn.140023510
mov r8, qword [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140002c40
nop
lea rcx, [rsp + 0x640]
call fcn.140001490
lea rcx, [rsp + 0x88]
call fcn.140023510
xor r8d, r8d
mov edx, 0x40
mov rcx, rax
call fcn.1400ef1c0
nop
lea rcx, [rsp + 0x88]
call fcn.140001490
lea rcx, [rsp + 0x78]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x80]
call fcn.140001490
nop
lea rcx, [rsp + 0x78]
call fcn.140001490
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
lea rcx, [rsp + 0x30]
call fcn.14008d578
xor eax, eax
jmp 0x1401973b4
lea rdx, str.https:__www.facebook.com_ccboot
lea rcx, [rsp + 0x98]
call fcn.1400020d0
nop
lea rax, [rsp + 0x648]
mov qword [rsp + 0x650], rax
lea rdx, str.facebookurl
mov rcx, qword [rsp + 0x650]
call fcn.1400020d0
mov qword [rsp + 0x7a0], rax
mov rdx, qword [rsp + 0x7a0]
lea rcx, [rsp + 0x90]
call fcn.140193dc0
nop
lea rcx, [rsp + 0x90]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x140196e9b
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x98]
call fcn.140002d80
lea rcx, [rsp + 0x98]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x90]
call fcn.140001490
nop
lea rcx, [rsp + 0x98]
call fcn.140001490
xor eax, eax
jmp 0x1401973b4
lea rdx, [0x140246e48]
lea rcx, [rsp + 0x660]
call fcn.1400eeb90
mov qword [rsp + 0x7a8], rax
lea rdx, [0x140246e38]
mov rcx, qword [rsp + 0x7a8]
call fcn.140006d90
mov byte [rsp + 0x658], al
lea rcx, [rsp + 0x660]
call fcn.140001490
movzx r11d, byte [rsp + 0x658]
test r11d, r11d
je 0x140196fc3
lea rdx, [0x140246e58]
lea rcx, [rsp + 0xb0]
call fcn.1400eeb90
lea rdx, str.HelpPageURL
lea rcx, [rsp + 0xb0]
call fcn.140006d90
movzx eax, al
test eax, eax
je 0x140196f9f
lea rcx, [rsp + 0xb0]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x668], 0
lea rcx, [rsp + 0xb0]
call fcn.140001490
mov eax, dword [rsp + 0x668]
jmp 0x1401973b4
lea rdx, str.http:__www.ccboot.com_wiki.htm_refprog
lea rcx, [rsp + 0xa8]
call fcn.1400020d0
nop
lea rax, [rsp + 0x670]
mov qword [rsp + 0x678], rax
lea rdx, str.helpurl
mov rcx, qword [rsp + 0x678]
call fcn.1400020d0
mov qword [rsp + 0x7b0], rax
mov rdx, qword [rsp + 0x7b0]
lea rcx, [rsp + 0xa0]
call fcn.140193dc0
nop
lea rcx, [rsp + 0xa0]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x140197043
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.140002d80
lea rcx, [rsp + 0xa8]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x680], 0
lea rcx, [rsp + 0xa0]
call fcn.140001490
nop
lea rcx, [rsp + 0xa8]
call fcn.140001490
mov eax, dword [rsp + 0x680]
jmp 0x1401973b4
lea rdx, [0x140246f00]
lea rcx, [rsp + 0x688]
call fcn.1400eeb90
mov qword [rsp + 0x7b8], rax
lea rdx, [0x140246e88]
mov rcx, qword [rsp + 0x7b8]
call fcn.140006d90
mov byte [rsp + 0x684], al
lea rcx, [rsp + 0x688]
call fcn.140001490
movzx r11d, byte [rsp + 0x684]
test r11d, r11d
je 0x14019715a
lea rdx, str.HomePageURL
lea rcx, [rsp + 0x690]
call fcn.1400eeb90
mov qword [rsp + 0x7c0], rax
mov rcx, qword [rsp + 0x7c0]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x690]
call fcn.140001490
xor eax, eax
jmp 0x1401973b4
lea rdx, str.http:__www.ccboot.com__refprog
lea rcx, [rsp + 0xc0]
call fcn.1400020d0
nop
lea rax, [rsp + 0x698]
mov qword [rsp + 0x6a0], rax
lea rdx, str.homepageurl
mov rcx, qword [rsp + 0x6a0]
call fcn.1400020d0
mov qword [rsp + 0x7c8], rax
mov rdx, qword [rsp + 0x7c8]
lea rcx, [rsp + 0xb8]
call fcn.140193dc0
nop
lea rcx, [rsp + 0xb8]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x1401971da
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xc0]
call fcn.140002d80
lea rcx, [rsp + 0xc0]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x6a8], 0
lea rcx, [rsp + 0xb8]
call fcn.140001490
nop
lea rcx, [rsp + 0xc0]
call fcn.140001490
mov eax, dword [rsp + 0x6a8]
jmp 0x1401973b4
lea rcx, [rsp + 0xd0]
call fcn.14018f7c0
nop
lea rcx, [rsp + 0xd0]
call fcn.140081900
cmp rax, 1
jne 0x140197296
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x7f0]
lea r8, [0x140195590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xd0]
call fcn.140005b40
xor eax, eax
jmp 0x1401973b4
xor edx, edx
lea rcx, [rsp + 0x300]
call fcn.140161f70
nop
lea rcx, [rsp + 0x300]
call fcn.140081900
nop
lea rcx, [rsp + 0x300]
call fcn.140161f20
xor eax, eax
jmp 0x1401973b4
lea rdx, str.http:__help.youngzsoft.com_
lea rcx, [rsp + 0x5c8]
call fcn.1400020d0
nop
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x6b8], rax
lea rdx, str.supporturl
mov rcx, qword [rsp + 0x6b8]
call fcn.1400020d0
mov qword [rsp + 0x7d0], rax
mov rdx, qword [rsp + 0x7d0]
lea rcx, [rsp + 0x5c0]
call fcn.140193dc0
nop
lea rcx, [rsp + 0x5c0]
call fcn.140006e20
movzx eax, al
test eax, eax
jne 0x14019735c
lea rdx, [rsp + 0x5c0]
lea rcx, [rsp + 0x5c8]
call fcn.140002d80
lea rcx, [rsp + 0x5c8]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5c8]
call fcn.140001490
xor eax, eax
jmp 0x1401973b4
mov eax, 1
add rsp, 0x7e0
pop rbx
ret