Function at 0x140005990
Capabilities:
Accept command line arguments
Clear file content
Copy file
Enumerate disk volumes
Enumerate files on windows
Enumerate files recursively
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get geographical location
Get session user name
Get thread local storage value
Identify system language via api
Manipulate console buffer
Move file
Query environment variable
Read file on windows
Resume thread
Set console window title
Set environment variable
Set thread local storage value
Suspend thread
Terminate thread
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc68
mov edx, 0x2c
mov ecx, 0xbf
call fcn.140005670
lea rcx, [rsp + 0x500]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x570]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.COMDLG32.dll_ChooseColorW]
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x118]
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [rsp + 0x7c], eax
lea r9, [rsp + 0x500]
mov r8d, 0xd8
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0xa0]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc88], rax
lea r9, [rsp + 0x3b0]
mov r8d, 0x8e
mov edx, 0xdf
mov rcx, qword [rsp + 0xc0]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0xc0], rax
lea r9, [rsp + 0x570]
mov r8d, 0xe2
mov edx, 0x41
mov rcx, qword [rsp + 0xa0]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov rcx, qword [rsp + 0xa0]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0x98], eax
lea r9, [rsp + 0xa0]
mov r8d, 0xd7
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x110]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0xd0]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc78], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
lea rdx, [rsp + 0x670]
mov rcx, qword [rsp + 0x328]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x78], eax
lea rdx, [rsp + 0x750]
mov rcx, qword [rsp + 0x1e8]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0x108]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc70], rax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc78], rax
lea rcx, [rsp + 0x670]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x88], eax
mov edx, 0xe9
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x98], eax
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x148], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc80], rax
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x148], eax
mov r9d, 0x46
mov r8d, 0xd0
mov edx, 0x85
mov rcx, qword [rsp + 0x108]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov r8d, 1
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x4c], 0xf041ad2
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov dword [rsp + 0x4c], 0x50e0e00d
mov dword [rsp + 0x4c], 0x62ffd2c9
lea r8, [rsp + 0x78]
lea rdx, [fcn.140005670]
mov rcx, qword [rsp + 0x1e8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
mov rax, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc78]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
ja 0x140005dec
mov dword [rsp + 0x4c], 0x401072c6
mov dword [rsp + 0x4c], 0x6b0232ad
mov r9, qword [rsp + 0xc88]
mov r8, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc88]
mov rcx, qword [rsp + 0xc70]
call fcn.140005990
mov r8d, 0x9f
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov r9d, 5
lea r8, [rsp + 0x4c]
lea rdx, [fcn.140005990]
mov rcx, qword [rsp + 0x178]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x4c], 0x6194f400
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
lea rcx, [rsp + 0x610]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x50], eax
mov r8d, 0x37
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc80]
mov rcx, qword [rsp + 0xc80]
call fcn.140005990
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xb4]
mov r8d, dword [rsp + 0x1b0]
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0x1e0]
mov ecx, 0xf9
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x64], eax
mov edx, 0xf3
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x1a0], eax
cmp dword [rsp + 0x1a0], 0x5a0bf4be
je 0x140005f14
cmp dword [rsp + 0x1a0], 0x78efbfa0
je 0x140005f3b
jmp 0x140006031
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov ecx, 0x94
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov dword [rsp + 0x148], eax
jmp 0x140006031
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0x2d0], rax
movabs rax, 0x7bad91b54e9267
cmp qword [rsp + 0x2d0], rax
je 0x140006006
movabs rax, 0x7e4c11496be3d3
cmp qword [rsp + 0x2d0], rax
je 0x140005f7c
jmp 0x140006031
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x670]
mov r8d, 0x74
lea rdx, [rsp + 0x750]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
mov dword [rsp + 0x7c], eax
lea rdx, [rsp + 0x3b0]
mov cl, 0xc9
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov r9, qword [rsp + 0x270]
mov r8, qword [rsp + 0xc8]
mov edx, 0x3c
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc88], rax
jmp 0x140006031
lea r9, [rsp + 0x610]
mov r8d, 0x55
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x64], eax
mov r9, qword [rsp + 0xc70]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc80]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
mov eax, dword [rsp + 0x50]
shl eax, 4
cmp eax, dword [rsp + 0x4c]
jg 0x140006099
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
mov dword [rsp + 0x78], eax
lea rdx, [rsp + 0x158]
mov cl, 0xb3
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov dword [rsp + 0x84], eax
jmp 0x140006141
mov rax, qword [rsp + 0xc88]
movzx ecx, al
mov rax, qword [rsp + 0xc80]
shr rax, cl
mov rcx, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc78]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1400060f3
mov r9, qword [rsp + 0x160]
mov r8, qword [rsp + 0xc8]
mov edx, 0x47
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [rsp + 0x6c], eax
jmp 0x140006141
mov eax, dword [rsp + 0x50]
xor eax, 0x4002b2b9
cmp eax, dword [rsp + 0x4c]
jg 0x140006141
mov edx, 0x95
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x84], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x44], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
mov edx, 0x2a
mov ecx, dword [rsp + 0x50]
call fcn.140005670
mov eax, 0x3af
mov word [rsp + 0x44], ax
mov eax, 0xfd6
mov word [rsp + 0x44], ax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc70], rax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc70]
call fcn.140005990
mov edx, 0xcc
mov ecx, dword [rsp + 0x50]
call fcn.140005670
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc78], rax
mov rax, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc80]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc78]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x140006232
mov r8d, 0x16
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov dword [rsp + 0x94], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
jmp 0x14000627e
mov eax, dword [rsp + 0x50]
sub eax, 0x4dcfad99
cmp eax, dword [rsp + 0x4c]
jl 0x14000627e
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x58], eax
mov eax, 0x7fe
mov word [rsp + 0x44], ax
lea r9, [rsp + 0x98]
mov r8d, 0xd8
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], eax
cmp dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x23a1c35d
je 0x140006320
cmp dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x2c7c9eef
je 0x1400062d7
jmp 0x140006349
mov eax, 0x33e
mov word [rsp + 0x44], ax
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x20], 0xa0
mov r9d, 0xe5
mov r8d, 0xcd
mov edx, 0x40
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x7c], eax
jmp 0x140006349
mov dx, 0x70
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc70], rax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x198], eax
cmp dword [rsp + 0x198], 0x1b546e22
je 0x1400063d2
cmp dword [rsp + 0x198], 0x5fb31679
je 0x140006385
jmp 0x14000648c
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov dword [rsp + 0x94], eax
mov r8d, 0x51
mov edx, 0x1e
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0xf4], eax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [rsp + 0x40], ax
jmp 0x14000648c
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0xf4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x120]
mov r8d, 0xdf
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc88], rax
mov eax, dword [rsp + 0x54]
movzx ecx, al
mov eax, dword [rsp + 0x4c]
shl eax, cl
cmp eax, dword [rsp + 0x50]
jne 0x14000648c
movzx eax, word [rsp + 0x44]
sar eax, 0x12
movzx ecx, word [rsp + 0x40]
cmp eax, ecx
jge 0x140006473
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov r8d, 0x66
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov qword [rsp + 0x150], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
xor edx, edx
mov ecx, 0x38
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc78], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
xor edx, edx
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
mov r9, qword [rsp + 0x1e0]
mov r8d, 0x50
mov edx, 0x29
mov ecx, 0x52
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov dword [rsp + 0xf4], eax
movzx eax, word [rsp + 0x44]
mov dword [rsp + 0x188], eax
cmp dword [rsp + 0x188], 0x808
je 0x1400065f2
cmp dword [rsp + 0x188], 0xa72
je 0x140006516
jmp 0x1400066fe
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x12c]
mov r8d, dword [rsp + 0xe8]
lea rdx, [rsp + 0x610]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov dword [rsp + 0x84], eax
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x21c], eax
cmp dword [rsp + 0x21c], 0xbe4
je 0x14000656b
jmp 0x1400065ac
mov r9, qword [rsp + 0xc70]
mov r8, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc80]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
mov edx, 0xe3
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x80], eax
jmp 0x1400065ed
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0x88], eax
jmp 0x1400066fe
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0x90], eax
mov edx, 0x98
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x84], eax
mov ecx, 0x2d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x570]
mov r8d, 0x4e
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_BackupRead]
mov dword [rsp + 0x94], eax
movzx eax, word [rsp + 0x40]
or eax, 0x7c8
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jle 0x1400066a9
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rsp + 0xf0], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x178], rax
jmp 0x1400066fe
movzx eax, word [rsp + 0x44]
add eax, 0xf76
movzx ecx, word [rsp + 0x40]
cmp eax, ecx
jne 0x1400066c8
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
jmp 0x1400066fe
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x6c]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x1400066fe
mov rdx, qword [rsp + 0xd0]
mov ecx, 0x49
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x670]
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov qword [rsp + 0x1f8], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc70], rax
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x6c], eax
mov r8d, 0x52
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x6c]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsp + 0x70]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x140006821
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x88], eax
lea rdx, [rsp + 0xd8]
mov ecx, 0xba
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [rsp + 0xf0], eax
lea r8, [rsp + 0x3b0]
mov edx, 1
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x1c8], eax
mov edx, 0x47
mov ecx, 0x49
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [rsp + 0xf4], eax
jmp 0x1400068f0
mov eax, dword [rsp + 0x64]
movzx ecx, al
mov eax, dword [rsp + 0x58]
shl eax, cl
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x6c]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x1400068f0
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0x2d8], rax
movabs rax, 0x77bdb44d8141d8
cmp qword [rsp + 0x2d8], rax
je 0x140006895
movabs rax, 0x78133470108a4d
cmp qword [rsp + 0x2d8], rax
je 0x14000687c
jmp 0x1400068e8
mov edx, 0x41
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x64], eax
jmp 0x1400068e8
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
mov dword [rsp + 0x1a4], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov qword [rsp + 0x2f8], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x168], rax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
mov dword [rsp + 0xec], eax
movzx eax, word [rsp + 0x44]
add eax, 0x527
movzx ecx, word [rsp + 0x40]
cmp eax, ecx
je 0x1400069cb
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc78], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x49
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x220], eax
cmp dword [rsp + 0x220], 0x15c5b360
je 0x140006a07
jmp 0x140006a4d
lea r8, [rsp + 0xe8]
xor edx, edx
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc80], rax
jmp 0x140006a64
mov rdx, qword [rsp + 0x170]
mov ecx, 0x6a
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x120]
mov ecx, 0x15
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x28], 0x47
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x388]
mov r8, qword [rsp + 0x150]
mov edx, 0x45
mov ecx, 0xa8
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0xe0]
mov ecx, 0xdd
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x54]
jle 0x140006b8e
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x28], 0x9e
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x44]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0xb0], eax
jmp 0x140006bdf
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6c]
mov edx, dword [rsp + 0x64]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140006bdf
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x68], eax
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x470]
mov r8, qword [rsp + 0x278]
mov edx, 0xaf
mov ecx, 0xc9
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [rsp + 0x4c], eax
lea r8, [rsp + 0x50]
mov edx, 0x5e
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x74]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x64]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x140006cb0
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 0x6a
lea r8, [rsp + 0xc8]
mov edx, 0x9b
mov ecx, 0x30
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
mov dword [rsp + 0x148], eax
xor edx, edx
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [rsp + 0x1a4], eax
jmp 0x140006d23
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x120]
mov r8d, 0xd2
lea rdx, [rsp + 0x3b0]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc70], rax
mov edx, 0x86
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0x5c], eax
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x1d0], eax
cmp dword [rsp + 0x1d0], 0xa32
je 0x140006dc8
cmp dword [rsp + 0x1d0], 0xb27
je 0x140006d91
jmp 0x140006dd0
lea r8, [fcn.140005670]
mov edx, 0xd1
mov ecx, 0xb9
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
mov dword [rsp + 0x90], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [rsp + 0x1a4], eax
jmp 0x140006dd0
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x6c], eax
mov edx, 0x3a
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [rsp + 0xec], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc88], rax
mov r9d, 0x13
mov r8, qword [rsp + 0x278]
mov edx, 0x31
mov ecx, 0xdb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x4c], eax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc80]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 0xd0
lea r8, [rsp + 0x1f8]
mov edx, 0x9e
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x224], eax
cmp dword [rsp + 0x224], 0x281
je 0x140006eae
jmp 0x140006ff2
mov r8d, 0xe0
mov edx, 0xed
lea rcx, [fcn.140005670]
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
mov dword [rsp + 0x94], eax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x88
mov r8d, 0xb4
mov edx, 0xbe
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0xec], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140006f3b
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov dword [rsp + 0x74], eax
jmp 0x140006fed
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsp + 0x74]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140006f73
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc70], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
jmp 0x140006fed
mov rax, qword [rsp + 0xc80]
movzx ecx, al
mov rax, qword [rsp + 0xc78]
shr rax, cl
mov rcx, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc70]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jbe 0x140006fce
mov r9, qword [rsp + 0xd8]
mov r8d, 0x14
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [rsp + 0x64], eax
jmp 0x140006fed
movzx eax, word [rsp + 0x40]
movzx ecx, word [rsp + 0x48]
sub eax, ecx
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jne 0x140006fed
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
jmp 0x140007098
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x22c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140007074
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
lea r9, [rsp + 0x270]
mov r8d, 0x3f
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x7c], eax
jmp 0x140007098
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140007098
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x5c], eax
mov r8, qword [rsp + 0x1e0]
mov edx, 0xcb
mov ecx, 0xa4
call qword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x228], eax
cmp dword [rsp + 0x228], 0x27fbf021
je 0x1400070d4
jmp 0x1400071f6
mov edx, 0x79
mov ecx, dword [rsp + 0x5c]
call fcn.140005670
movzx eax, word [rsp + 0x40]
movzx ecx, word [rsp + 0x48]
sar eax, cl
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jg 0x140007173
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x470]
mov r8d, 0x9f
lea rdx, [rsp + 0x3b0]
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x22c], eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x388]
lea r8, [rsp + 0xa0]
mov edx, 0xe4
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov dword [rsp + 0x64], eax
jmp 0x1400071f1
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x54]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x5c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x14000719b
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
jmp 0x1400071f1
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x74]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x6c]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x1400071e1
mov edx, reloc.COMCTL32.dll_DrawInsert
mov ecx, dword [rsp + 0x60]
call fcn.140005670
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x78], eax
jmp 0x1400071f1
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc70], rax
jmp 0x14000727b
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x1a8], eax
cmp dword [rsp + 0x1a8], 0x167b
je 0x14000721d
cmp dword [rsp + 0x1a8], 0x9225
je 0x14000726e
jmp 0x14000727b
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x570]
mov r8d, 0xe3
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x238], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x60], eax
jmp 0x14000727b
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0x84], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x48], ax
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0xf8], eax
lea rdx, [rsp + 0x610]
mov ecx, 0x9e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rsp + 0x1c8], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x64], eax
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0xb0], eax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
mov dword [rsp + 0x94], eax
mov ecx, 0x6f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x338], rax
mov r8d, 0x80
mov edx, 0xe3
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x1bc], eax
mov rax, qword [rsp + 0xc80]
movzx ecx, al
mov rax, qword [rsp + 0xc70]
shl rax, cl
mov rcx, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc88]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x14000749b
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xe8]
mov r8d, 0x1b
lea rdx, [rsp + 0xb4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov dword [rsp + 0xf0], eax
mov edx, dword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [rsp + 0x128], eax
mov r9d, 0x29
mov r8, qword [rsp + 0x290]
mov edx, 0x2c
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x60], eax
movzx eax, word [rsp + 0x44]
mov dword [rsp + 0x230], eax
cmp dword [rsp + 0x230], 0x1f
je 0x140007411
jmp 0x140007473
mov edx, 0x15
lea rcx, [rsp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc78], rax
mov dword [rsp + 0x20], 0x48
mov r9d, 0xbd
mov r8d, 0x6e
mov edx, 0xea
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x90], eax
jmp 0x140007496
mov r8d, 1
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x128], eax
jmp 0x14000754a
movzx eax, word [rsp + 0x48]
movzx ecx, word [rsp + 0x40]
sub eax, ecx
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jle 0x14000754a
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x1ac], eax
cmp dword [rsp + 0x1ac], 0x30e51cca
je 0x14000752a
cmp dword [rsp + 0x1ac], 0x649581d0
je 0x1400074db
jmp 0x14000754a
lea r9, [rsp + 0x4c]
mov r8d, LBItemFromPt
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [rsp + 0x84], eax
lea rdx, [rsp + 0x7c0]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x54], eax
jmp 0x14000754a
xor r8d, r8d
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x338]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x280]
mov r8d, 0x30
lea rdx, [rsp + 0x500]
mov rcx, qword [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
mov dword [rsp + 0x78], eax
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x60], eax
mov edx, 0xf4
mov ecx, dword [rsp + 0x4c]
call fcn.140005670
mov dword [rsp + 0x20], 0x67
mov r9d, 0x1e
mov r8d, 0xa7
mov edx, 0xea
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x254], eax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x1b0]
mov r8d, 0x7f
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x234], eax
mov eax, dword [rsp + 0x234]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x8c]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsp + 0x64]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x1400076f2
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc88]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
mov r9, qword [rsp + 0x288]
mov r8d, 0x23
mov edx, 0x55
mov ecx, 0x1d
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov dword [rsp + 0x184], eax
lea r8, [rsp + 0x158]
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov dword [rsp + 0x80], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov dword [rsp + 0x28], 0x38
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, 0x59
lea r8, [rsp + 0x3b0]
mov edx, 0xed
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rsp + 0x118], rax
movzx eax, word [rsp + 0x40]
movzx ecx, word [rsp + 0x48]
add eax, ecx
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jle 0x1400077b5
mov edx, 0x7a
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [rsp + 0xb0], eax
jmp 0x1400078dc
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x58]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x74]
mov edx, dword [rsp + 0x8c]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x14000780e
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc70], rax
mov ecx, 0x9d
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov dword [rsp + 0x128], eax
mov ecx, 0xe5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x1f8], rax
jmp 0x1400078dc
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x40]
sar eax, cl
movzx ecx, word [rsp + 0x48]
cmp eax, ecx
jg 0x140007863
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc78], rax
jmp 0x1400078dc
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x84], eax
mov edx, 0x56
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
mov r8d, 0xdb
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov qword [rsp + 0x200], rax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0x268], eax
xor r8d, r8d
mov edx, 0xac
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov dword [rsp + 0x58], eax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
lea rcx, [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x70], eax
movzx eax, word [rsp + 0x40]
movzx ecx, word [rsp + 0x48]
sub eax, ecx
movzx ecx, word [rsp + 0x44]
cmp eax, ecx
jge 0x1400079d7
mov r9, qword [rsp + 0xc88]
mov r8, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
lea rdx, [rsp + 0x4c]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x180], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x44], ax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x1b4], eax
cmp dword [rsp + 0x1b4], 0x1866475c
je 0x140007a1f
cmp dword [rsp + 0x1b4], 0x7ae8f6ba
je 0x140007acf
jmp 0x140007b57
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc78], rax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x60], eax
mov edx, 0x74
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov dword [rsp + 0x68], eax
mov edx, 0xa2
mov rcx, qword [rsp + 0x358]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [rsp + 0x84], eax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc88]
mov rcx, qword [rsp + 0xc70]
call fcn.140005990
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rsp + 0x238], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
jmp 0x140007b57
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc70], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x48], ax
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xe8
xor r9d, r9d
mov r8d, 0xa2
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov dword [rsp + 0x9c], eax
mov r8d, 0x62
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov qword [rsp + 0x170], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rsp + 0xec], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0x49f0978c
je 0x140007bb2
jmp 0x140007bc4
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
jmp 0x140007bf1
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
mov dword [rsp + 0x130], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x134]
mov r8d, dword [rsp + 0xe8]
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov dword [rsp + 0x9c], eax
mov edx, 0xac
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [rsp + 0x130], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x23c], eax
cmp dword [rsp + 0x23c], 0x68380dfe
je 0x140007c8f
jmp 0x140007dd9
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc80]
call fcn.140005990
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc70], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov r9d, 0x17
mov r8, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov dword [rsp + 0x94], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xda
mov r9d, 0x41
mov r8d, 0x24
mov edx, 0x43
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
mov dword [rsp + 0x64], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x48], ax
mov dword [rsp + 0x20], 0xf8
mov r9, qword [rsp + 0x2a8]
mov r8d, 0xad
mov rdx, qword [rsp + 0x4a0]
mov ecx, 0x91
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x38], 0xaf
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x388]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x670]
mov r8d, 0xfb
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x9c], eax
jmp 0x140007e3f
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x4b0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xb0], eax
mov ecx, 0xc4
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [rsp + 0x1d4], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x240], eax
cmp dword [rsp + 0x240], 0x69d0
je 0x140007e59
jmp 0x140007ebe
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x1d4], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x31c], eax
jmp 0x140007f45
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rsp + 0xf0], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0x340], rax
movabs rax, 0x76010e9f68534a
cmp qword [rsp + 0x340], rax
je 0x140007f09
jmp 0x140007f1b
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
jmp 0x140007f45
mov r8d, 0x65
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x378]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [rsp + 0x70], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x44], ax
lea r9, [rsp + 0x118]
lea r8, [rsp + 0x500]
mov edx, 0x3e
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
mov r8d, 0x2c
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x138], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x80], eax
mov ecx, 0x8a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0x2f0], rax
movabs rax, 0x793075d2fa2868
cmp qword [rsp + 0x2f0], rax
je 0x140008067
movabs rax, 0x7d261bc1c5574e
cmp qword [rsp + 0x2f0], rax
je 0x140008030
jmp 0x1400080f0
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov r9d, 0x4e
lea r8, [rsp + 0xd0]
mov edx, 0xad
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [rsp + 0x1cc], eax
jmp 0x1400080f0
lea r9, [rsp + 0x388]
mov r8d, 0x66
lea rdx, [rsp + 0x160]
mov ecx, 0xfe
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x68], eax
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x298]
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0x4b0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [rsp + 0x260], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc80], rax
mov edx, 1
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [rsp + 0x84], eax
mov r9, qword [rsp + 0xc80]
mov r8, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x1b8], eax
cmp dword [rsp + 0x1b8], 0xbf61
je 0x140008242
cmp dword [rsp + 0x1b8], 0xfbb1
je 0x14000816f
jmp 0x14000829c
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x134]
mov r8d, 0x46
mov dx, 0x4f
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov dword [rsp + 0x184], eax
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov dword [rsp + 0x1bc], eax
mov edx, 0x28
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [rsp + 0x320], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x44], ax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x244], eax
mov eax, dword [rsp + 0x244]
mov dword [rsp + 0x12c], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x48], ax
mov edx, 0xc9
mov rcx, qword [rsp + 0x400]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x64], eax
jmp 0x14000829c
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x1bc], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc70], rax
mov r8d, 0x66
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [rsp + 0x128], eax
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rdx, [rsp + 0x12c]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x180], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x44]
mov dword [rsp + 0x1c0], eax
cmp dword [rsp + 0x1c0], 0x609
je 0x1400083de
cmp dword [rsp + 0x1c0], 0xbb9
je 0x140008300
jmp 0x140008453
mov r9, qword [rsp + 0xc88]
mov r8, qword [rsp + 0xc70]
mov rdx, qword [rsp + 0xc88]
mov rcx, qword [rsp + 0xc80]
call fcn.140005990
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc70], rax
lea rax, [rsp + 0x7c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x58], eax
mov ecx, 0xb9
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x318], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x248], eax
cmp dword [rsp + 0x248], 0x22adb2be
je 0x1400083a0
jmp 0x1400083d2
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
lea rcx, [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x44], ax
jmp 0x1400083dc
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x44], ax
jmp 0x140008453
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x20], 0x1a
lea r9, [rsp + 0x6e0]
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov dword [rsp + 0x250], eax
mov r8d, 0x41
lea rdx, [rsp + 0x388]
lea rcx, [rsp + 0x358]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov dword [rsp + 0x7c], eax
mov edx, LBItemFromPt
mov ecx, dword [rsp + 0x50]
call fcn.140005670
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x58], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov r8d, 0xfc
mov rdx, qword [rsp + 0x408]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14000858e
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x68], eax
mov edx, 0xed
mov ecx, 0xc6
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
lea r8, [rsp + 0x570]
mov edx, 1
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc78], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x410]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x68], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x20], rax
mov r9d, 0xb0
mov r8, qword [rsp + 0x360]
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov dword [rsp + 0x8c], eax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x130], eax
jmp 0x140008682
mov rax, qword [rsp + 0xc70]
movzx ecx, al
mov rax, qword [rsp + 0xc80]
shr rax, cl
mov rcx, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc78]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140008682
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc78], rax
movzx eax, word [rsp + 0x44]
mov dword [rsp + 0x1c4], eax
cmp dword [rsp + 0x1c4], 0x8b
je 0x1400085fe
cmp dword [rsp + 0x1c4], 0x553
je 0x140008672
jmp 0x140008682
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0xb4]
mov rcx, qword [rsp + 0x418]
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x9c], eax
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rsp + 0x1cc], eax
mov r9, qword [rsp + 0xc88]
mov r8, qword [rsp + 0xc80]
mov rdx, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc88]
call fcn.140005990
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
jmp 0x140008682
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
lea rax, [rsp + 0x388]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x24c]
mov r8d, 0xb3
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov dword [rsp + 0x7c], eax
lea r9, [rsp + 0x388]
mov r8d, 0x15
mov edx, 0x44
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov dword [rsp + 0xec], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x24c]
lea rcx, [fcn.140005670]
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov dword [rsp + 0x250], eax
mov ecx, 0x6e
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x138], eax
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x8c]
add edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140008792
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0xb8], eax
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc78]
call fcn.140005990
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x5c], eax
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [rsp + 0xf0], eax
mov edx, 0x8e
mov rcx, qword [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x254], eax
mov dword [rsp + 0x20], 0x74
mov r9d, 0xfc
mov r8d, 0x29
mov edx, 0x4d
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x1c8], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0xb8], eax
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov dword [rsp + 0x60], eax
mov r9, qword [rsp + 0xc78]
mov r8, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc70]
call fcn.140005990
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x60], eax
mov r8d, 0xdf
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov qword [rsp + 0x110], rax
mov edx, dword [rsp + 0x134]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [rsp + 0x314], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc70], rax
mov dword [rsp + 0x28], 0xc8
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x208]
lea r8, [rsp + 0xb4]
mov edx, 0xd8
mov ecx, 0x99
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0x130], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x2b8], rax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x48]
mov dword [rsp + 0x258], eax
cmp dword [rsp + 0x258], 0x4b3
je 0x140008931
jmp 0x140008960
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x50], eax
mov ecx, 0x30
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
jmp 0x1400089dc
mov ecx, 0xb3
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc80], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb5
mov r8, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov dword [rsp + 0x210], eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x28], 0x6a
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x36
mov r8, qword [rsp + 0x438]
mov edx, 0x57
mov ecx, 0xf0
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30c]
mov r8d, 0x22
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov dword [rsp + 0x1d4], eax
lea r9, [rsp + 0x168]
mov r8d, 0x76
lea rdx, [rsp + 0x470]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc80]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc88]
mov rdx, qword [rsp + 0xc70]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x140008acd
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x44], ax
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x25c], eax
mov eax, dword [rsp + 0x25c]
mov dword [rsp + 0xb4], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xb8]
mov edx, dword [rsp + 0x4c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x140008b34
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x64], eax
lea rdx, [rsp + 0x3b0]
mov ecx, 0x46
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rsp + 0x308], eax
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [rsp + 0x180], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc70], rax
mov rax, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc80]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc88]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x140008b94
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x5c], eax
jmp 0x140008bb8
mov rdx, qword [rsp + 0x440]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [rsp + 0x4c], eax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
mov edx, 0xdb
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0xf8], eax
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x138]
lea r8, [rsp + 0xb4]
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0x448]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xc70]
mov qword [rsp + 0xc88], rax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0xb8]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x50]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140008cfb
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x44], ax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x500]
mov r8d, 0x4e
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [rsp + 0x260], eax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
mov r9d, 0x19
lea r8, [rsp + 0x44]
mov edx, 0xf1
mov ecx, 0x8e
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
mov dword [rsp + 0x184], eax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x264], eax
cmp dword [rsp + 0x264], 0x693a4252
je 0x140008cd7
jmp 0x140008ce9
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc88], rax
jmp 0x140008cfb
lea rcx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0x9c], eax
lea r9, [rsp + 0x470]
lea r8, [rsp + 0x134]
lea rdx, [fcn.140005990]
mov rcx, qword [rsp + 0x178]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x310], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [rsp + 0xf4], eax
mov dword [rsp + 0x28], 0x1b
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2f8]
lea r8, [rsp + 0x2b8]
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x378]
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [rsp + 0x268], eax
mov eax, dword [rsp + 0x4c]
movzx ecx, al
mov eax, dword [rsp + 0x5c]
sar eax, cl
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x50]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140008e87
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0x300], rax
movabs rax, 0x77faff7f9cd414
cmp qword [rsp + 0x300], rax
je 0x140008dfd
movabs rax, 0x7cd114d5b40025
cmp qword [rsp + 0x300], rax
je 0x140008e75
jmp 0x140008e82
mov rax, qword [rsp + 0xc88]
mov rcx, qword [rsp + 0xc70]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc78]
mov rdx, qword [rsp + 0xc80]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x140008e73
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x74], eax
lea r9, [rsp + 0x120]
mov r8d, 0x41
mov edx, 0xcb
mov rcx, qword [rsp + 0xe0]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x2c0], rax
mov rcx, qword [rsp + 0x458]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x210], eax
jmp 0x140008e82
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [rsp + 0x138], eax
jmp 0x140008f34
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x8c]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x58]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x140008f0c
mov rax, qword [rsp + 0xc80]
mov qword [rsp + 0xc70], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x214], eax
cmp dword [rsp + 0x214], 0xafea
je 0x140008edd
jmp 0x140008ef1
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x40], ax
jmp 0x140008f0a
mov edx, 1
lea rcx, [fcn.140005990]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [rsp + 0xf8], eax
jmp 0x140008f34
lea rdx, [rsp + 0xa10]
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x460], rax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x40], ax
mov eax, 0x12
add rsp, 0xc68
ret