Function at 0x1400ab970
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x428
xorpd xmm0, xmm0
mov rbx, rcx
mov rsi, rdx
lea rcx, [rax - 0x170]
xor edx, edx
mov r8d, 0xe8
movsd qword [rax - 0x178], xmm0
mov edi, 1
call fcn.1400b93b0
lea r15, [0x1400f2c58]
mov r14d, 6
lea rcx, [rsp + 0x210]
xor ebp, ebp
mov rdx, rbx
lea r12d, [r14 + 0x1a]
lea r13d, [r14 + 3]
mov byte [rsp + 0x140], bpl
call fcn.140058920
mov r11, qword [rsp + 0x210]
mov qword [rsp + 0x80], r11
add r11, 0xc
mov qword [rsp + 0x70], r11
jmp 0x1400aba19
cmp r13w, ax
ja 0x1400aba0f
cmp ax, 0xd
jbe 0x1400aba2a
cmp r12w, ax
je 0x1400aba2a
add r11, 2
mov qword [rsp + 0xb0], r11
movzx eax, word [r11]
cmp ax, bp
jne 0x1400aba03
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x168], r11
call fcn.140044ef4
mov rax, qword [rsp + 0x70]
mov ecx, 0x2a
cmp cx, word [rax]
lea rcx, [rsp + 0x480]
sete r13b
call fcn.14004b91c
mov rdx, qword [rsp + 0x168]
lea rcx, str.__free
mov r8d, r14d
call fcn.140045f78
mov rcx, r15
cmp al, bpl
jne 0x1400ade6c
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x1400f2cf0], edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x480]
xor edx, edx
call fcn.14001622c
lea rcx, [rsp + 0x480]
call fcn.14001621c
mov ecx, ebp
mov dword [rsp + 0x150], ebp
cmp eax, ebp
mov dword [rsp + 0x188], ebp
sete cl
cmp dword [0x1400ef7c8], ebp
mov dword [rsp + 0x130], ecx
jge 0x1400abba5
mov rax, qword [0x1400f1e28]
mov ecx, ebp
mov rdx, rbp
mov r8, rbp
mov qword [rsp + 0x220], rbp
mov dword [0x1400ef7c8], ecx
mov qword [rsp + 0x1e0], rdx
cmp rax, rbp
je 0x1400abb7c
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1e0]
call rax
mov r8, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x1e0]
cmp r8, rbp
jbe 0x1400abb76
cmp rdx, 0x202
jb 0x1400abb42
mov eax, 0x38
mov ecx, eax
mov dword [0x1400ef7c8], eax
jmp 0x1400abb7c
cmp rdx, 0x184
jb 0x1400abb52
mov ecx, 8
jmp 0x1400abb60
cmp rdx, 0x160
jb 0x1400abb68
mov ecx, 2
mov dword [0x1400ef7c8], ecx
jmp 0x1400abb7c
mov ecx, dword [0x1400ef7c8]
cmp rdx, rbp
cmova ecx, edi
jmp 0x1400abb60
mov ecx, dword [0x1400ef7c8]
mov rax, qword [0x1400f1e28]
mov r9d, r8d
mov r8d, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [0x1400f1e30]
lea rdx, str.DBG:_IMD:_0x_X_0x_X_0x_X__0x_p_r_n
call fcn.140012fac
mov rdx, qword [rsp + 0x168]
lea rcx, [0x1400de9cc]
mov r8d, 3
call fcn.140045f78
mov ebx, ebp
lea rdx, [rsp + 0x168]
cmp al, bpl
mov eax, 0xfff00000
lea rcx, str.__ins
cmovne ebx, eax
mov r8d, 5
mov dword [rsp + 0x90], ebx
call fcn.14004e558
cmp al, bpl
je 0x1400abbf7
mov r12b, 5
jmp 0x1400abc19
lea rdx, [rsp + 0x168]
lea rcx, str.__fins
mov r8d, r14d
call fcn.14004e558
movzx r12d, bpl
cmp al, bpl
cmovne r12d, r14d
lea rcx, [rsp + 0x100]
mov edx, 0x3e8
call fcn.14004bedc
lea rcx, [rsp + 0xa8]
call fcn.14004be6c
lea rcx, [rsp + 0x170]
call fcn.14004be6c
lea rcx, [rsp + 0x78]
call fcn.14004be6c
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0xc8], rbp
call fcn.14004be6c
lea rcx, [rsp + 0xd0]
call fcn.14004be6c
lea rcx, [rsp + 0x88]
call fcn.14004be6c
lea rcx, [rsp + 0xd8]
call fcn.14004be6c
lea rcx, [rsp + 0x118]
call fcn.14004be6c
lea rcx, [rsp + 0x98]
call fcn.14004be6c
lea rcx, [rsp + 0x108]
call fcn.14004be6c
lea rcx, [rsp + 0xa0]
call fcn.14004be6c
or qword [rsp + 0x1a8], 0xffffffffffffffff
or qword [rsp + 0x1b8], 0xffffffffffffffff
lea rax, [0x1400d63f4]
lea rcx, [rsp + 0xf0]
mov edx, 0xc8
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x148], rbp
mov r14, rbp
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x250], rbp
mov r15d, ebp
call fcn.14004bedc
mov rax, qword [rsp + 0xb0]
movzx ebx, word [rax]
mov rdi, qword [rsp + 0x168]
mov qword [rsp + 0x268], rax
mov word [rsp + 0x488], bx
mov qword [rsp + 0xc0], rax
cmp r13b, bpl
je 0x1400abefc
add qword [rsp + 0x70], 2
mov word [rax], bp
mov rax, qword [rsp + 0x70]
movzx ecx, word [rax]
mov rdx, rax
cmp cx, bp
je 0x1400abd82
mov r8d, 0x2a
cmp cx, r8w
je 0x1400abd82
add rax, 2
mov qword [rsp + 0x70], rax
mov cx, word [rax]
cmp cx, bp
jne 0x1400abd6b
sub rax, rdx
lea rcx, [rsp + 0xa8]
sar rax, 1
mov r8d, eax
call fcn.14004c0cc
mov r11, qword [rsp + 0xa8]
cmp word [r11], bp
je 0x1400abdb8
lea rcx, [rsp + 0x100]
mov edx, 0x3e8
call fcn.14004bf70
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
cmp bx, bp
je 0x1400abdd9
add rax, 2
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0xc0]
call fcn.140044ef4
mov ebx, 1
lea rdi, [0x1400d63f4]
mov esi, 0xfff00000
lea rdx, [rsp + 0xc0]
lea rcx, str._mem
mov r8d, 4
call fcn.14004e5bc
cmp al, bpl
jne 0x1400abe35
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400d9174]
mov r8d, 2
call fcn.14004e5bc
cmp al, bpl
je 0x1400abe3f
mov qword [rsp + 0x1b0], rdi
jmp 0x1400abdf7
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400df3f0]
mov r8d, 3
call fcn.14004e5bc
cmp al, bpl
je 0x1400abe6f
lea rax, [0x1400e22a8]
mov qword [rsp + 0x1b0], rax
jmp 0x1400abdf7
lea rdx, [rsp + 0xc0]
lea rcx, str._map
mov r8d, 4
call fcn.14004e5bc
cmp al, bpl
je 0x1400abe96
mov r14, rbx
jmp 0x1400abdf7
lea rdx, [rsp + 0xc0]
lea rcx, str._exe
mov r8d, 4
call fcn.14004e5bc
cmp al, bpl
je 0x1400abec1
mov dword [rsp + 0x90], ebx
jmp 0x1400abdf7
lea rdx, [rsp + 0xc0]
lea rcx, str._nexe
mov r8d, 5
call fcn.14004e5bc
cmp al, bpl
je 0x1400abeec
mov dword [rsp + 0x90], esi
jmp 0x1400abdf7
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x478]
lea r8, [0x1400e2280]
lea rdx, str.ERRORLEVEL
mov rcx, rsi
call fcn.14004b578
mov r11, qword [rsp + 0xa8]
or r9d, 0xffffffff
or r8d, r9d
lea rcx, [rsp + 0xc8]
cmp word [r11], bp
je 0x1400abf66
lea rdx, [0x1400e227c]
call fcn.14004c024
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xc8]
call fcn.14004bfa8
lea rdx, str.Imdisk
lea rcx, [rsp + 0xc8]
call fcn.14004bfa8
jmp 0x1400abf72
lea rdx, str._Imdisk
call fcn.14004c024
lea rcx, str.__version
mov r8d, 9
mov rdx, rdi
call fcn.140045f78
lea rcx, [0x1400e2244]
mov r8d, 2
mov rdx, rdi
mov bl, al
call fcn.140045f78
lea rcx, [0x1400e2240]
mov r8d, 2
mov rdx, rdi
mov sil, al
call fcn.140045f78
lea rcx, [0x1400de9cc]
mov r8d, 3
mov rdx, rdi
mov bpl, al
call fcn.140045f78
xor ecx, ecx
cmp bl, cl
jne 0x1400abfe9
cmp sil, cl
jne 0x1400abfe9
cmp bpl, cl
jne 0x1400abfe9
xor ebp, ebp
cmp al, bpl
jne 0x1400abfeb
mov cl, 1
jmp 0x1400abfee
xor ebp, ebp
mov cl, bpl
mov esi, dword [rsp + 0x130]
cmp esi, ebp
jne 0x1400ac008
mov eax, dword [0x1400ef7c8]
cmp eax, ebp
jle 0x1400ac008
cmp eax, 2
jge 0x1400ac012
cmp cl, bpl
jne 0x1400ac01c
cmp r12b, bpl
jne 0x1400ac01c
cmp r12b, 6
jl 0x1400ac27d
lea rbx, [0x1400e2238]
cmp esi, ebp
jne 0x1400ac093
lea rcx, [rsp + 0x1e8]
call fcn.14004be6c
lea rax, [0x1400e2230]
lea r8, [rsp + 0x1e8]
lea rdx, [rsp + 0x270]
mov ecx, 2
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], rax
call fcn.140030814
mov r11, qword [rsp + 0x1e8]
cmp word [r11], bp
je 0x1400ac086
cmp word [r11 + 2], bp
lea rax, [0x1400e2228]
cmove rax, rbx
mov rbx, rax
lea rcx, [rsp + 0x1e8]
call fcn.140044f24
lea rdi, [0x1400f2c58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x1400f2cf0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rsp + 0x478]
mov r11d, dword [0x1400f2cf0]
cmp r11d, ebp
jle 0x1400ac0fa
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.140013908
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1400ac0c3
lea rcx, [rsp + 0x480]
or edx, 0xffffffff
call fcn.14001622c
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx r11d, r12b
mov eax, 0x20
add r11w, 0x30
lea rcx, [rsp + 0x480]
or edx, 0xffffffff
mov word [rsp + 0x19e], ax
mov word [rsp + 0x1a0], bp
mov word [rsp + 0x19c], r11w
call fcn.14001622c
lea rdx, str.28:INDATA
lea rcx, [rsp + 0x128]
call fcn.140058920
lea rax, [0x1400e2228]
lea rdx, [0x1400e2238]
cmp esi, ebp
lea rcx, [rsp + 0x128]
cmovne rdx, rax
call fcn.14004bfa8
lea rcx, [rsp + 0x128]
mov rdx, rbx
call fcn.14004bfa8
lea rdx, [rsp + 0x19c]
lea rcx, [rsp + 0x128]
call fcn.14004bfa8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x128]
call fcn.14004bfa8
mov r8, qword [rsp + 0x128]
lea rdx, str.Install_IMD__s__r_n
lea rcx, [0x1400f1e30]
call fcn.140012fac
mov rdx, qword [rsp + 0x128]
mov rcx, rdi
call fcn.140039598
lea rbx, [0x1400f2c58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12d, 1
mov rcx, rbx
add dword [0x1400f2cf0], r12d
mov dword [0x1400ef7c8], 0xffffffc0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x480]
xor edx, edx
call fcn.14001622c
lea rcx, [rsp + 0x480]
call fcn.14001621c
mov esi, ebp
mov rcx, rbx
cmp eax, ebp
sete sil
mov dword [rsp + 0x130], esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x1400ef7c8]
lea eax, [r12 + 0x37]
cmp esi, ebp
mov rcx, rbx
cmove r11d, eax
mov dword [0x1400ef7c8], r11d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x128]
call fcn.140044f24
jmp 0x1400ac283
mov r12d, 1
cmp r13b, bpl
je 0x1400acf34
mov rax, qword [rsp + 0xc0]
mov r13d, 2
mov qword [rsp + 0x160], rax
cmp word [rax], bp
je 0x1400ac331
lea rdx, [rsp + 0x160]
lea rcx, [0x1400d9174]
mov r8d, r13d
call fcn.14004e558
cmp al, bpl
jne 0x1400ac321
mov rcx, qword [rsp + 0x160]
movzx eax, word [rcx]
cmp ax, bp
je 0x1400ac304
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400ac2ec
cmp ax, 0xd
jbe 0x1400ac304
cmp dx, ax
je 0x1400ac304
add rcx, r13
mov qword [rsp + 0x160], rcx
mov ax, word [rcx]
cmp ax, bp
jne 0x1400ac2e0
lea rcx, [rsp + 0x160]
call fcn.140044ef4
mov r11, qword [rsp + 0x160]
cmp word [r11], bp
jne 0x1400ac2ab
jmp 0x1400ac331
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x70]
mov edi, 0x2a
cmp di, word [rax]
jne 0x1400acf14
add rax, r13
mov qword [rsp + 0x208], rbp
mov qword [rsp + 0x1c8], rbp
mov qword [rsp + 0x70], rax
cmp word [rax], 0x40
mov bl, bpl
jne 0x1400ac370
add rax, r13
mov bl, r12b
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x70]
call fcn.140051edc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac395
add r11, r13
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x70]
call fcn.140051edc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac3ba
add r11, r13
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x70]
call fcn.140051edc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac3df
add r11, r13
mov qword [rsp + 0x70], r11
mov r12b, byte [rsp + 0x148]
lea rcx, [rsp + 0x70]
mov esi, 1
mov edx, edi
and r12b, sil
call fcn.1400588ac
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0xa0]
sub r8, r11
mov rdx, r11
sar r8, 1
call fcn.14004c0cc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac429
add r11, r13
mov qword [rsp + 0x70], r11
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1400588ac
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x98]
sub r8, r11
mov rdx, r11
sar r8, 1
call fcn.14004c0cc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac463
add r11, r13
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x70]
call fcn.140051edc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac488
add r11, r13
mov qword [rsp + 0x70], r11
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1400588ac
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x108]
sub r8, r11
mov rdx, r11
sar r8, 1
call fcn.14004c0cc
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x70]
call fcn.140051edc
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ac4d4
add r11, r13
mov qword [rsp + 0x70], r11
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x218], rcx
cmp bl, bpl
je 0x1400ac50c
add rcx, rax
mov qword [rsp + 0x238], rbp
mov qword [rsp + 0x218], rcx
cmp qword [rsp + 0x208], rbp
jle 0x1400ac52d
mov rax, qword [rsp + 0x1c8]
cmp rax, rbp
cmovle rax, rsi
mov qword [rsp + 0x1c8], rax
lea rcx, [rsp + 0x190]
mov edx, 0x318
call fcn.14004bedc
mov rcx, qword [rsp + 0x190]
lea rdi, [rcx + 0x6a]
mov qword [rsp + 0x1f8], rcx
lea rax, [rdi + 0x6a]
mov qword [rsp + 0x228], rdi
lea rbx, [rax + 0x6a]
mov qword [rsp + 0x258], rax
mov word [rbx], bp
mov word [rax], bp
mov rax, qword [rsp + 0x1a8]
cqo
lea r14, [rbx + 0x6a]
and edx, 0x1ff
add rax, rdx
sar rax, 9
mov rdx, rax
mov qword [rsp + 0x1a8], rax
call fcn.1400a9350
mov rax, qword [rsp + 0x1b8]
mov rcx, rdi
cqo
and edx, 0x1ff
add rax, rdx
sar rax, 9
mov rdx, rax
mov qword [rsp + 0x1b8], rax
call fcn.1400a9350
mov word [rbx], bp
mov rdx, qword [rsp + 0x208]
cmp rdx, rbp
jle 0x1400ac5de
mov rcx, rbx
call fcn.1400a9350
mov rax, qword [rsp + 0xb0]
cmp word [rsp + 0x488], bp
mov rcx, rbp
setne cl
lea rcx, [rax + rcx*2]
mov qword [rsp + 0xb8], rcx
lea rcx, [rsp + 0xb8]
call fcn.140044ef4
mov rdx, qword [rsp + 0xb8]
lea rcx, str.__w:
mov r8d, 4
mov dword [rsp + 0x198], ebp
call fcn.140045fc8
cmp al, bpl
je 0x1400ac651
add qword [rsp + 0xb8], 8
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xb8]
call fcn.14004fc04
lea rdx, [rsp + 0xb8]
lea rcx, [0x1400e21d8]
or r8d, 0xffffffff
call fcn.14004e558
mov r11d, dword [0x1400ef7c8]
cmp r11d, esi
jl 0x1400ac68d
mov eax, dword [rsp + 0x90]
mov ecx, 0xfff00000
cmp eax, ebp
cmove eax, ecx
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xb8]
lea r8, [0x1400d63f4]
xor edx, edx
mov qword [rsp + 0x138], rax
mov sil, bpl
mov dil, bpl
mov qword [rsp + 0x1d8], r8
mov ebx, edx
mov rbp, r8
cmp word [rax], dx
je 0x1400ac7ab
lea ebp, [rdx + 1]
lea rdx, [rsp + 0x138]
lea rcx, [0x1400df6a8]
mov r8d, r13d
call fcn.14004e558
xor edx, edx
cmp al, dl
je 0x1400ac6e9
mov ebx, ebp
jmp 0x1400ac784
cmp ebx, edx
je 0x1400ac734
lea rdx, [rsp + 0x138]
lea rcx, [0x1400e21d4]
mov r8d, r13d
call fcn.14004e558
xor edx, edx
cmp al, dl
je 0x1400ac70f
mov sil, bpl
jmp 0x1400ac784
lea rdx, [rsp + 0x138]
lea rcx, [0x1400e21d0]
mov r8d, 3
call fcn.14004e558
xor edx, edx
cmp al, dl
je 0x1400ac734
mov dil, bpl
jmp 0x1400ac784
mov rcx, qword [rsp + 0x138]
movzx eax, word [rcx]
cmp ax, dx
je 0x1400ac773
mov r8d, 0x20
lea r9d, [r8 - 0x17]
cmp r9w, ax
ja 0x1400ac75a
cmp ax, 0xd
jbe 0x1400ac773
cmp r8w, ax
je 0x1400ac773
add rcx, r13
mov qword [rsp + 0x138], rcx
mov ax, word [rcx]
cmp ax, dx
jne 0x1400ac74e
lea rcx, [rsp + 0x138]
call fcn.140044ef4
xor edx, edx
mov ebx, edx
mov rax, qword [rsp + 0x138]
cmp word [rax], dx
jne 0x1400ac6c5
mov rbp, qword [rsp + 0x1d8]
mov r11d, dword [0x1400ef7c8]
lea r8, [0x1400d63f4]
test r11b, 0x10
je 0x1400ac7ca
lea rax, str._o_par
cmp dil, dl
cmovne rax, rbp
mov rbp, rax
mov qword [rsp + 0x1d8], rax
mov ecx, r11d
lea r13, str._o_shared
mov al, 1
and ecx, 0x20
movzx eax, al
cmove r13, r8
cmp ecx, edx
cmovne eax, edx
bt qword [rsp + 0x148], 9
jb 0x1400ac80f
cmp ecx, edx
jne 0x1400ac80f
mov ebx, 1
cmp r12b, dl
je 0x1400ac816
bt qword [rsp + 0x148], 8
jae 0x1400ac816
mov al, bl
jmp 0x1400ac816
mov al, dl
mov ebx, 1
cmp r11d, 8
jl 0x1400ac9f7
cmp r12b, dl
je 0x1400ac82d
cmp al, dl
jne 0x1400ac9f7
cmp r12b, dl
mov rdi, r8
mov r12d, 1
jne 0x1400ac849
cmp sil, dl
jne 0x1400ac860
lea rdi, str._o_ro
jmp 0x1400ac860
mov eax, dword [rsp + 0x140]
cmp ecx, edx
movzx eax, al
cmove eax, r12d
mov dword [rsp + 0x140], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xb0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x78]
lea edx, [rax + rbx + 0x800]
call fcn.14004bf70
mov r11, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x228]
mov r9, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
lea rdx, str.imdisk__a___s__s__s___b__sb__s__sb__f__s
mov r9, rbp
mov r8, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0xe0], rdx
cmp word [rdx], bp
je 0x1400ac9db
lea rdx, [rsp + 0xe0]
lea rcx, [0x1400e15ec]
mov r8d, 2
call fcn.14004e5bc
cmp al, bpl
jne 0x1400ac96c
lea rdx, [rsp + 0xe0]
lea rcx, [0x1400d9408]
mov r8d, 2
call fcn.14004e5bc
cmp al, bpl
jne 0x1400ac96c
mov rcx, qword [rsp + 0xe0]
movzx eax, word [rcx]
cmp ax, bp
je 0x1400ac9b5
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400ac951
cmp ax, 0xd
jbe 0x1400ac9b5
cmp dx, ax
je 0x1400ac9b5
add rcx, 2
mov qword [rsp + 0xe0], rcx
mov ax, word [rcx]
cmp ax, bp
jne 0x1400ac945
jmp 0x1400ac9b5
mov rax, qword [rsp + 0xe0]
movzx ecx, word [rax]
cmp cx, bp
je 0x1400ac9b5
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x1400ac991
cmp cx, 0xd
jbe 0x1400ac9b5
cmp dx, cx
je 0x1400ac9b5
mov word [rax], dx
mov rax, qword [rsp + 0xe0]
add rax, 2
mov qword [rsp + 0xe0], rax
mov cx, word [rax]
cmp cx, bp
jne 0x1400ac985
lea rcx, [rsp + 0xe0]
call fcn.140044ef4
mov rax, qword [rsp + 0xe0]
cmp word [rax], bp
jne 0x1400ac8ee
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov r11, qword [rsp + 0x78]
mov qword [rsp + 0x80], r11
jmp 0x1400acef1
xor ebp, ebp
cmp r12b, bpl
je 0x1400aca47
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 7]
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0xa0000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400ad8eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x1400d63f4]
mov rdx, qword [rsp + 0x1c8]
xor ebx, ebx
lea rbp, [0x1400e2138]
cmp r12b, bl
cmovne rbp, r8
cmp rdx, rbx
jle 0x1400aca71
mov rcx, qword [rsp + 0x258]
call fcn.1400a9350
mov rcx, qword [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdi, rax
cmp rax, rbx
jne 0x1400aca97
mov rdi, qword [rsp + 0xa0]
jmp 0x1400aca9b
add rdi, 2
mov rcx, qword [rsp + 0x98]
cmp word [rcx], bx
jne 0x1400acafd
lea rcx, [rsp + 0x98]
mov edx, 0x800
call fcn.14004bf70
mov rbx, qword [rsp + 0x98]
call fcn.1400475f0
mov r9, qword [rsp + 0x1f8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x228]
lea rdx, str._s_s_s__u
mov r8, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x98]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, 0x400
cmp esi, eax
jle 0x1400acb1f
mov esi, eax
mov rax, qword [rsp + 0x98]
mov word [rax + 0x800], bx
lea rdx, str.Global_
lea rcx, [rsp + 0xf0]
call fcn.140058a38
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0xf0]
call fcn.14004bfa8
lea rdx, str._devio_Ack
lea rcx, [rsp + 0xf0]
call fcn.14004bfa8
mov word [r14], bx
mov rax, qword [rsp + 0x148]
mov ecx, 0x30
mov word [rsp + 0x2a8], bx
test cl, al
jne 0x1400acb8a
cmp r12b, bl
je 0x1400acc72
test al, 0x40
jne 0x1400acc72
lea rdx, str.__kill:
mov r8d, 0x10
mov rcx, r14
call fcn.1400177f8
mov edi, 0x104
lea rdx, [r14 + 0x27e]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [r14 + 0xe]
lea rcx, [r14 + 0x27e]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, qword [rsp + 0x248]
mov r9d, 0x22
movzx ecx, word [r8]
xor edx, edx
mov rdi, r8
cmp r9w, cx
jne 0x1400acc0a
add r8, 2
jmp 0x1400acc00
cmp r9w, cx
je 0x1400acc37
add rdi, 2
movzx ecx, word [rdi]
cmp cx, dx
jne 0x1400acbf6
jmp 0x1400acc37
cmp cx, dx
je 0x1400acc37
mov r9d, 0x20
lea r10d, [r9 - 0x17]
cmp r10w, cx
ja 0x1400acc25
cmp cx, 0xd
jbe 0x1400acc37
cmp r9w, cx
je 0x1400acc37
add rdi, 2
mov cx, word [rdi]
cmp cx, dx
jne 0x1400acc19
movzx ebx, word [rdi]
mov word [rdi], dx
mov ecx, 0x20
test byte [rsp + 0x148], cl
lea rcx, str._LOAD_25_poweroff
cdqe
lea rdx, str._RAMD_ImdiskV__D__m__s_
cmovne rdx, rcx
lea rcx, [r14 + rax*2]
call qword [sym.imp.USER32.dll_wsprintfW]
mov word [rdi], bx
mov rax, qword [rsp + 0x148]
sar rax, 1
and eax, 3
je 0x1400acc92
lea rdx, str._nrc:_d
lea rcx, [rsp + 0x2a8]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x238]
mov rdi, qword [rsp + 0x1f8]
mov ebx, 0x1ff
cqo
mov rcx, rdi
and rdx, rbx
add rdx, rax
sar rdx, 9
call fcn.1400a9350
mov rax, qword [rsp + 0x218]
lea r12, [rdi + 0x6a]
cqo
mov rcx, r12
and rdx, rbx
add rdx, rax
sar rdx, 9
call fcn.1400a9350
mov rcx, qword [rsp + 0x478]
lea r8, [0x1400d9b58]
lea rdx, str.__ImdMapPid
call fcn.14004b578
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xa0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x180]
add eax, ebx
lea edx, [rax + rsi + 0x940]
call fcn.14004bedc
lea rdx, str.Global_
lea rcx, [rsp + 0x1d0]
call fcn.140058920
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x1d0]
call fcn.14004bfa8
mov r8, qword [rsp + 0x1d0]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x1400ad939
lea rcx, [rsp + 0x1d0]
call fcn.140044f24
mov r8, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
lea rax, [r12 + 0x6a]
lea rdx, str.EXEC___pid:__ImdMapPid____exe:_s10INDATA___nfb___MyName0____s__w:60000__s__s__s_shm:_s___s__s__s__s__s
mov r9, r14
lea r11, [rax + 0x6a]
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea edx, [rsi + 0x800]
lea rcx, [rsp + 0x78]
call fcn.14004bf70
mov r9, qword [rsp + 0x1d8]
xor ebp, ebp
mov word [rdi], bp
mov word [r12], bp
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r8, [0x1400d63f4]
lea rdx, str.imdisk__a__t_proxy__s__s__s__o_shm__f__s
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov r11, qword [rsp + 0x78]
mov r9, qword [rsp + 0xf0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x80], r11
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, qword [rsp + 0x478]
mov rdx, qword [rsp + 0x180]
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x20], rbp
call fcn.1400367d4
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, ebp
jne 0x1400ad914
lea ebx, [rbp + 0x31]
lea r12d, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, r12d
jns 0x1400acec1
mov edx, dword [rsp + 0x198]
cmp edx, ebp
jle 0x1400acee4
xor r8d, r8d
mov rcx, r13
call fcn.140013908
lea rcx, [rsp + 0x180]
call fcn.140044f24
mov rax, qword [rsp + 0xb8]
lea rcx, [rsp + 0x190]
mov r14, r12
mov qword [rsp + 0xb0], rax
mov word [rax], bp
call fcn.140044f24
mov rax, qword [rsp + 0x268]
mov cx, word [rsp + 0x488]
or rsi, 0xffffffffffffffff
mov word [rax], cx
lea r13d, [rsi + 0x21]
jmp 0x1400ad526
mov esi, 4
lea rdx, [rsp + 0xb0]
lea rcx, str._exe
mov r8d, esi
call fcn.14004e558
mov ebx, dword [rsp + 0x90]
lea r8d, [rsi + 1]
cmp al, bpl
lea rdx, [rsp + 0xb0]
lea rcx, str._nexe
cmovne ebx, r12d
call fcn.14004e558
mov edi, 0xfff00000
cmp al, bpl
lea rdx, [rsp + 0xb0]
lea rcx, str._nexe1
cmovne ebx, edi
mov dword [rsp + 0x90], ebx
lea ebx, [rsi + 2]
mov r8d, ebx
call fcn.14004e558
cmp al, bpl
je 0x1400acfb6
mov dword [rsp + 0x90], edi
mov dword [rsp + 0x188], r12d
mov edi, 0x2c
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x80]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0xe8]
mov word [rax], bp
mov rax, qword [rsp + 0x80]
cmp word [rax], bp
je 0x1400ad119
add rax, 2
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], rax
call fcn.14004f5d4
mov r11, qword [rsp + 0x80]
cmp word [r11], bp
je 0x1400ad119
add r11, 2
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], r11
call fcn.14004f5d4
mov r11, qword [rsp + 0x80]
cmp word [r11], bp
je 0x1400ad119
add r11, 2
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], r11
call fcn.14004f5d4
mov r11, qword [rsp + 0x80]
cmp word [r11], bp
je 0x1400ad119
add r11, 2
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], r11
call fcn.14004f5d4
mov r11, qword [rsp + 0x80]
cmp word [r11], bp
je 0x1400ad119
add r11, 2
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], r11
call fcn.14004f5d4
mov r11, qword [rsp + 0x80]
cmp word [r11], bp
je 0x1400ad119
add r11, 2
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x80]
mov r8d, edi
mov qword [rsp + 0x80], r11
call fcn.14004f8a8
lea rcx, [rsp + 0x88]
mov edx, ebx
mov dil, bpl
call fcn.14004bf70
mov rax, qword [rsp + 0x88]
mov r11d, 0x3a
mov word [rax + 2], r11w
mov rax, qword [rsp + 0x88]
mov word [rax + 4], bp
mov rcx, qword [rsp + 0x88]
cmp word [rcx], bp
je 0x1400ad1ed
call fcn.1400b8a34
cmp eax, ebp
je 0x1400ad1e0
lea rax, str.imdisk
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x280], rax
lea rax, [0x1400e2230]
mov qword [rsp + 0x288], rax
lea rax, [0x1400e1f00]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x298], rax
call fcn.14004be6c
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x280]
mov ecx, esi
call fcn.140030814
lea rcx, [rsp + 0x230]
cmp eax, ebp
sete dil
call fcn.140044f24
mov rax, qword [rsp + 0x88]
cmp word [rax], bp
jne 0x1400ad213
lea rdx, [0x1400da8e8]
lea rcx, [rsp + 0x88]
call fcn.1400589a0
mov r11, qword [rsp + 0x88]
cmp word [r11], bp
je 0x1400add78
lea rcx, [rsp + 0x178]
mov edx, 0x3c
call fcn.14004bedc
mov rax, qword [rsp + 0xe8]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0xf8], rax
mov rbx, rsi
cmp word [rax], bp
je 0x1400adc93
lea r13d, [rsi + 0x21]
lea rcx, [rsp + 0xf8]
call fcn.140044ef4
mov r11, qword [rsp + 0xf8]
mov ecx, 0x70
movzx eax, word [r11]
or ax, r13w
cmp cx, ax
jne 0x1400ad292
lea rdx, [rsp + 0x1f0]
jmp 0x1400ad2b8
mov ecx, 0x6c
cmp cx, ax
jne 0x1400ad2a6
lea rdx, [rsp + 0x200]
jmp 0x1400ad2b8
mov ecx, 0x68
cmp cx, ax
jne 0x1400ad2de
lea rdx, [rsp + 0x240]
add r11, 2
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0xf8], r11
call fcn.14004fbd8
mov rax, qword [rsp + 0xf8]
cmp word [rax], bp
jne 0x1400ad261
cmp qword [rsp + 0x1f0], rbp
jle 0x1400ad31f
mov ecx, r12d
call fcn.140017ec0
mov r11, rax
movabs rax, 0xa3d70a3d70a3d70b
imul r11, qword [rsp + 0x1f0]
imul r11
lea rbx, [r11 + rdx]
sar rbx, 6
mov rax, rbx
shr rax, 0x3f
add rbx, rax
sar rbx, 0x14
cmp rbx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x240]
cmovl rbx, qword [rsp + 0x200]
cmp rax, rbp
jle 0x1400ad34b
cmp rbx, rax
cmovg rbx, rax
cmp rbx, rbp
cmovle rbx, rax
cmp rbx, rbp
jl 0x1400adc93
mov rax, qword [rsp + 0x88]
cmp word [rax], bp
je 0x1400adc93
mov rcx, qword [rsp + 0x178]
cmp rbx, rbp
cmovle rbx, r12
mov rdx, rbx
call fcn.1400a935c
lea rdx, [0x1400e1ef8]
lea rcx, [rsp + 0x178]
call fcn.14004bfa8
lea rax, str.imdisk___e
lea rdx, str.imdisk___a
cmp dil, bpl
lea rcx, [rsp + 0x78]
cmovne rdx, rax
call fcn.1400589a0
test byte [rsp + 0x250], r12b
je 0x1400ad3ca
lea rdx, str.__o_awe
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rax, qword [rsp + 0x178]
cmp word [rax], bp
je 0x1400ad3fa
lea rdx, str.___s
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x178]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rax, qword [rsp + 0x88]
cmp word [rax], bp
je 0x1400ad42a
lea rdx, str.___m
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rax, qword [rsp + 0xd0]
cmp word [rax], bp
jne 0x1400ad448
mov rax, qword [rsp + 0xd8]
cmp word [rax], bp
je 0x1400ad50c
lea rdx, str.___p__
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov r11, qword [rsp + 0xd0]
cmp word [r11], bp
je 0x1400ad48a
lea rdx, str.__FS:
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rax, qword [rsp + 0xd8]
cmp word [rax], bp
je 0x1400ad4ba
lea rdx, str.__V:
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rdx, qword [rsp + 0xd0]
lea rcx, str.NTFS
call fcn.140045ff4
cmp al, bpl
je 0x1400ad4fb
mov rax, qword [rsp + 0x118]
cmp word [rax], bp
je 0x1400ad4fb
mov ecx, 0x30
cmp cx, word [rax]
je 0x1400ad4fb
lea rdx, [0x1400deff8]
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
lea rdx, str.___Q__Y__X__
lea rcx, [rsp + 0x78]
call fcn.14004bfa8
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x80], rax
call fcn.140044f24
lea rcx, [rsp + 0xb0]
call fcn.140044ef4
mov rdx, qword [rsp + 0xb0]
lea rcx, str._gui
mov r8d, 4
call fcn.140045f78
cmp al, bpl
jne 0x1400adb95
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [rsp + 0x80]
mov edi, 9
lea r12d, [rax - 0xc8]
movzx ecx, word [rdx]
cmp cx, bp
je 0x1400ad58f
cmp di, cx
ja 0x1400ad583
cmp cx, 0xd
jbe 0x1400ad58f
cmp r13w, cx
je 0x1400ad58f
add rdx, 2
jmp 0x1400ad570
lea rcx, [rsp + 0x110]
call fcn.140058a38
mov rbp, qword [rsp + 0x110]
xor ebx, ebx
mov qword [rsp + 0x158], rbp
cmp word [rbp], bx
je 0x1400ad65c
lea esi, [rbx + 6]
lea rdx, [rsp + 0x158]
lea rcx, str.__nbrd
mov r8d, esi
call fcn.14004e5bc
cmp al, bl
jne 0x1400ad64b
lea rdx, [rsp + 0x158]
lea rcx, [0x1400d6b24]
mov r8d, esi
call fcn.14004e5bc
cmp al, bl
jne 0x1400ad64b
lea rdx, [rsp + 0x158]
lea rcx, [0x1400d9168]
mov r8d, 2
call fcn.14004e5bc
cmp al, bl
jne 0x1400ad64b
mov rcx, qword [rsp + 0x158]
jmp 0x1400ad636
cmp di, ax
ja 0x1400ad624
cmp ax, 0xd
jbe 0x1400ad63e
cmp r13w, ax
je 0x1400ad63e
add rcx, 2
mov qword [rsp + 0x158], rcx
movzx eax, word [rcx]
cmp ax, bx
jne 0x1400ad619
lea rcx, [rsp + 0x158]
call fcn.140044ef4
mov rax, qword [rsp + 0x158]
cmp word [rax], bx
jne 0x1400ad5bb
movsxd rdi, dword [rsp + 0x130]
movsxd rsi, dword [rsp + 0x90]
movsxd rbx, dword [rsp + 0x188]
mov r13, qword [rsp + 0x478]
xor eax, eax
cmp rdi, rax
jne 0x1400ad818
cmp rsi, rax
jg 0x1400ad818
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x2f0]
xor r8d, r8d
call fcn.14005c144
mov eax, 1
cmp dword [rsp + 0x350], eax
jle 0x1400ada47
mov rax, qword [rsp + 0x358]
lea rcx, str.imdisk
lea r8, [rsp + 0x100]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x358]
mov ecx, dword [rsp + 0x350]
call fcn.140030814
mov r15d, eax
xor eax, eax
cmp byte [rsp + 0x140], al
mov dword [rsp + 0x150], eax
jle 0x1400ad8af
cmp r15d, 3
jne 0x1400ad8af
cmp rbx, rax
jne 0x1400ad8af
lea rcx, [rsp + 0xf0]
lea edi, [rax + 1]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea r15, [0x1400f2c58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x1400f2cf0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x210]
call fcn.140044f24
mov rsi, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x470]
jmp 0x1400ab9c0
cmp rbx, rax
jne 0x1400ad8af
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x1c0]
call fcn.140058920
lea rcx, [rsp + 0x1c0]
mov rdx, rbp
call fcn.14004bfa8
mov rax, qword [rsp + 0xa8]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x150], 1
mov r8, r13
mov dword [rsp + 0x20], ecx
cmp word [rax], cx
je 0x1400ad87d
mov r9, qword [rsp + 0x1c0]
xor edx, edx
jmp 0x1400ad895
mov rdx, qword [rsp + 0x1c0]
mov word [rsp + 0x120], cx
lea r9, [rsp + 0x120]
mov rcx, r13
call fcn.14000a168
lea rcx, [rsp + 0x1c0]
mov r15d, eax
call fcn.140044f24
xor eax, eax
cmp r14, rax
je 0x1400ada4d
cmp r15d, 3
jne 0x1400ada4d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, 0x1388
jae 0x1400ada4d
xor r8d, r8d
mov edx, 0xc8
mov rcx, r13
call fcn.140013908
jmp 0x1400ad67c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x190]
mov r15d, eax
cmp eax, ebp
cmove r15d, ebx
call fcn.140044f24
mov r13, qword [rsp + 0x478]
jmp 0x1400ada4f
lea rcx, [rsp + 0x180]
mov r15d, 1
call fcn.140044f24
lea rcx, [rsp + 0x190]
call fcn.140044f24
jmp 0x1400ada4f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1d0]
call fcn.140044f24
lea rcx, [rsp + 0x180]
call fcn.140044f24
lea rcx, [rsp + 0x190]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x1400f2cf0]
mov r15d, 0xb7
jmp 0x1400ade91
mov r15d, 0x80070057
xor ebp, ebp
mov rax, qword [rsp + 0x360]
cmp rax, rbp
je 0x1400ada79
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x360], rbp
call fcn.140044f24
mov rdx, qword [rsp + 0xa8]
cmp word [rdx], bp
je 0x1400adabd
cmp dword [rsp + 0x150], ebp
jne 0x1400adabd
mov rax, qword [rsp + 0x100]
mov ecx, 0x2a
mov word [rsp + 0x3e0], bp
lea r8, [rsp + 0x3e0]
cmp word [rax], cx
jne 0x1400adab5
lea r8, [rax + 2]
mov rcx, r13
call fcn.14004b578
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x1400f2cf0]
jmp 0x1400ade91
mov rcx, qword [rsp + 0x478]
lea r9, [0x1400d63f4]
lea rdx, str.imdisk.cpl_
xor r8d, r8d
mov dword [rsp + 0x20], 0xffffff9c
call fcn.14006b27c
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x1400f2cf0], esi
jmp 0x1400ade8e
lea rcx, [rsp + 0x178]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x1400f2cf0], esi
jmp 0x1400ade4b
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x118]
call fcn.140044f24
lea rcx, [rsp + 0xd8]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x1400f2cf0]
mov r15d, 0x80070057
jmp 0x1400ade91
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.140013908
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x1400f2cf0]
cmp r11d, ebp
jg 0x1400ade53
lea rcx, [rsp + 0x480]
or edx, 0xffffffff
call fcn.14001622c
mov r15d, ebp
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x210]
call fcn.140044f24
mov eax, r15d
add rsp, 0x428
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret