Function at 0x140012640
Capabilities:
Allocate or change rwx memory
Delete file
Enumerate process modules
Execute command
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x5c28
call fcn.14020de60
sub rsp, rax
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x2500]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x2500]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x2500]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.CeleryIn.bin
lea rcx, [rsp + 0x2500]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, [rsp + 0x1940]
lea rdx, [rsp + 0x2500]
lea rcx, [rsp + 0x300]
call fcn.14001a630
nop
lea rcx, [rsp + 0x300]
call fcn.140011b30
movzx eax, al
test eax, eax
je 0x140012703
lea rcx, [0x140250700]
call fcn.14000a170
mov byte [rsp + 0x66], 0
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x66]
jmp 0x140017cb0
mov qword [rsp + 0x3f8], 0
lea rdx, str.naMupJWdMv5zM2WyoaElYaS5rD
lea rcx, [rsp + 0x1068]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x1068]
lea rcx, [rsp + 0x1410]
call fcn.140005ba0
mov qword [rsp + 0xbb0], rax
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0xbb8], rax
mov rdx, qword [rsp + 0xbb8]
lea rcx, [rsp + 0x13f0]
call fcn.140005130
mov qword [rsp + 0xbc0], rax
mov rax, qword [rsp + 0xbc0]
mov qword [rsp + 0xbc8], rax
mov rdx, qword [rsp + 0xbc8]
lea rcx, [rsp + 0x628]
call fcn.140005ba0
nop
lea rcx, [rsp + 0x13f0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1410]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1068]
call fcn.140004ac0
lea rdx, [0x14024e4c4]
lea rcx, [rsp + 0x570]
call fcn.140007ba0
nop
lea rax, [rsp + 0x628]
mov qword [rsp + 0x4f8], rax
mov rcx, qword [rsp + 0x4f8]
call fcn.140008fe0
mov qword [rsp + 0x220], rax
mov rcx, qword [rsp + 0x4f8]
call fcn.140010e90
mov qword [rsp + 0xbd0], rax
jmp 0x140012821
mov rax, qword [rsp + 0x220]
inc rax
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0xbd0]
cmp qword [rsp + 0x220], rax
je 0x14001285a
mov rax, qword [rsp + 0x220]
movzx eax, byte [rax]
mov byte [rsp + 0x67], al
movsx ax, byte [rsp + 0x67]
movzx edx, ax
lea rcx, [rsp + 0x570]
call fcn.14000f0f0
jmp 0x14001280e
lea r9, [rsp + 0x3ec]
mov r8d, 0x2000
lea rdx, [rsp + 0x3c20]
mov rcx, qword [0x14031f410]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140012984
mov dword [rsp + 0x6c], 0
jmp 0x140012898
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x3ec]
xor edx, edx
mov ecx, 8
div rcx
mov ecx, dword [rsp + 0x6c]
cmp rcx, rax
jae 0x140012984
mov eax, dword [rsp + 0x6c]
mov r9d, 0x208
lea r8, [rsp + 0x2b30]
mov rdx, qword [rsp + rax*8 + 0x3c20]
mov rcx, qword [0x14031f410]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x14001297f
lea rdx, [rsp + 0x2b30]
lea rcx, [rsp + 0x1430]
call fcn.140007ba0
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
xor r8d, r8d
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0xbe0]
call fcn.140011e00
cmp rax, 0xffffffffffffffff
je 0x14001293c
mov dword [rsp + 0x1b8], 1
jmp 0x140012947
mov dword [rsp + 0x1b8], 0
movzx eax, byte [rsp + 0x1b8]
mov byte [rsp + 0x68], al
lea rcx, [rsp + 0x1430]
call fcn.14000e8b0
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x14001297f
mov eax, dword [rsp + 0x6c]
mov rax, qword [rsp + rax*8 + 0x3c20]
mov qword [rsp + 0x3f8], rax
jmp 0x140012984
jmp 0x14001288e
cmp qword [rsp + 0x3f8], 0
jne 0x1400129d3
lea rcx, str.Could_not_locate_module_n
call fcn.14000a170
mov byte [rsp + 0x69], 0
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x69]
jmp 0x140017cb0
lea rdx, str.DJqVMaWyD2WzM1clMzMhqUV
lea rcx, [rsp + 0x10a8]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x10a8]
lea rcx, [rsp + 0x14f0]
call fcn.140005ba0
mov qword [rsp + 0xc48], rax
mov rax, qword [rsp + 0xc48]
mov qword [rsp + 0xc50], rax
mov rdx, qword [rsp + 0xc50]
lea rcx, [rsp + 0x14d0]
call fcn.140005130
mov qword [rsp + 0xc58], rax
mov rax, qword [rsp + 0xc58]
mov qword [rsp + 0xc60], rax
mov rdx, qword [rsp + 0xc60]
lea rcx, [rsp + 0x14b0]
call fcn.140005ba0
mov qword [rsp + 0xc68], rax
mov rax, qword [rsp + 0xc68]
mov qword [rsp + 0xc70], rax
mov rcx, qword [rsp + 0xc70]
call fcn.140008fe0
mov qword [rsp + 0x650], rax
lea rdx, str.naMuZmWbYaS5rD
lea rcx, [rsp + 0x1088]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x1088]
lea rcx, [rsp + 0x1490]
call fcn.140005ba0
mov qword [rsp + 0xc78], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov rdx, qword [rsp + 0xc80]
lea rcx, [rsp + 0x1470]
call fcn.140005130
mov qword [rsp + 0xcc8], rax
mov rax, qword [rsp + 0xcc8]
mov qword [rsp + 0xcd0], rax
mov rdx, qword [rsp + 0xcd0]
lea rcx, [rsp + 0x1450]
call fcn.140005ba0
mov qword [rsp + 0x648], rax
mov rcx, qword [rsp + 0x648]
call fcn.140008fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x658], rax
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x658]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x1450]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1470]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1490]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1088]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x14b0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x14d0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x14f0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x10a8]
call fcn.140004ac0
mov rax, qword [rsp + 0x3f8]
add rax, 0x280000
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
sub rax, 0x1000
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x140]
add rax, 0x800
mov qword [rsp + 0x560], rax
mov rax, qword [rsp + 0x140]
add rax, 0xc00
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x560]
add rax, 0x800
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
add rax, 0x200
mov qword [rsp + 0xe20], rax
mov rax, qword [rsp + 0x228]
add rax, 0x400
mov qword [rsp + 0xe28], rax
mov rax, qword [rsp + 0x228]
add rax, 0x800
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0x228]
add rax, 0x810
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x660]
add rax, 0x800
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
add rax, 0x100
mov qword [rsp + 0xe30], rax
mov rax, qword [rsp + 0x500]
add rax, 0xc00
mov qword [rsp + 0xe38], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x300]
call fcn.1400116e0
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x238]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
add rax, 4
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x230]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x230]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x230]
mov eax, dword [rax + 0x50]
add eax, 0x2000
mov eax, eax
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x6e0], rax
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x538]
call fcn.14000d090
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x138]
call fcn.14020dd78
mov qword [rsp + 0x668], rax
mov rax, qword [rsp + 0x668]
mov qword [rsp + 0x340], rax
mov rdi, qword [rsp + 0x340]
xor eax, eax
mov rcx, qword [rsp + 0x138]
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x138]
mov r8, qword [rsp + 0x340]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x670], rax
mov rcx, qword [rsp + 0x670]
call fcn.14020daf4
mov rax, qword [rsp + 0x5c40]
mov rax, qword [rax]
mov qword [rsp + 0x698], rax
mov rax, qword [rsp + 0x5c40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x568], rax
mov rax, qword [rsp + 0x5c40]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x6a0], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x238]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140012f25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1402507c0]
call fcn.14000a170
mov byte [rsp + 0x6a], 0
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x6a]
jmp 0x140017cb0
mov dword [rsp + 0x12c], 0
jmp 0x140012f56
mov eax, dword [rsp + 0x12c]
inc eax
mov dword [rsp + 0x12c], eax
mov rax, qword [rsp + 0x180]
add rax, 0x28
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x678]
movzx eax, word [rax + 2]
cmp dword [rsp + 0x12c], eax
je 0x140013054
mov rax, qword [rsp + 0x180]
cmp dword [rax + 0x10], 0
je 0x14001304f
mov rax, qword [rsp + 0x180]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x3f0], eax
mov rax, qword [rsp + 0x180]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x238]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x680], rax
mov rax, qword [rsp + 0x180]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x508]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x688], rax
mov eax, dword [rsp + 0x3f0]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rsp + 0x680]
mov rdx, qword [rsp + 0x688]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14001304f
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x50]
jmp 0x140017cb0
jmp 0x140012f32
lea rcx, [rsp + 0xe80]
call fcn.14000e210
nop
xor edx, edx
lea rcx, [rsp + 0x300]
call fcn.14000ede0
lea r8, [rsp + 0xe80]
mov rdx, rax
mov rcx, qword [rsp + 0xb8]
call fcn.140019d80
nop
lea rcx, [rsp + 0xe80]
call fcn.14000ea60
lea rdx, [0x1402507e0]
lea rcx, [rsp + 0x10c8]
call fcn.1400047d0
nop
xor edx, edx
lea rcx, [rsp + 0x300]
call fcn.14000ede0
lea r8, [rsp + 0x10c8]
mov rdx, rax
mov rcx, qword [rsp + 0xb8]
call fcn.140011fa0
mov qword [rsp + 0x510], rax
lea rcx, [rsp + 0x10c8]
call fcn.140004ac0
cmp qword [rsp + 0x510], 0
jne 0x140013145
lea rcx, str.No_entry_point_n
call fcn.14000a170
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x51]
jmp 0x140017cb0
lea rdx, [rsp + 0x510]
mov rcx, qword [rsp + 0x408]
call fcn.14000d3e0
mov qword [rsp + 0x6d0], 0
mov dword [rsp + 0xba8], 0
mov rax, qword [rsp + 0xb8]
sub rax, 0x340
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb8]
sub rax, 0x260
mov qword [rsp + 0xe40], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x800
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x690]
add rax, 0x40
mov qword [rsp + 0xe48], rax
mov rax, qword [rsp + 0xb0]
add rax, 0xc00
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
add rax, 0x180
mov qword [rsp + 0xe50], rax
mov rax, qword [rsp + 0x1a8]
add rax, 0x188
mov qword [rsp + 0xe58], rax
mov rax, qword [rsp + 0x1a8]
add rax, 0x190
mov qword [rsp + 0xe60], rax
mov rax, qword [rsp + 0x1a8]
add rax, 0x178
mov qword [rsp + 0xe68], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x1000
mov qword [rsp + 0xe70], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x1400
mov qword [rsp + 0x518], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x17c0
mov qword [rsp + 0x710], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x1800
mov qword [rsp + 0xe78], rax
mov rax, qword [rsp + 0x5c40]
add rax, 0x5b4
mov rdx, rax
lea rcx, [rsp + 0x10e8]
call fcn.140007ba0
nop
lea rdx, [rsp + 0x10e8]
mov rcx, qword [rsp + 0x518]
call fcn.1401be1a0
nop
lea rcx, [rsp + 0x10e8]
call fcn.14000e8b0
lea rdx, [rsp + 0x698]
mov rcx, qword [rsp + 0x30]
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 8
lea rdx, [rsp + 0x568]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x10
lea rdx, [rsp + 0x6a0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x18
lea rdx, [rsp + 0x518]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x20
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
mov edx, dword [rax + 0xb8]
lea rcx, [rsp + 0xe98]
call fcn.140011bd0
nop
lea rax, [rsp + 0xe98]
mov qword [rsp + 0x558], rax
mov rcx, qword [rsp + 0x558]
call fcn.1400068b0
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x558]
call fcn.140008cd0
mov qword [rsp + 0x6a8], rax
jmp 0x1400133d9
mov rax, qword [rsp + 0x240]
add rax, 4
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x6a8]
cmp qword [rsp + 0x240], rax
je 0x140013429
mov rax, qword [rsp + 0x240]
mov eax, dword [rax]
mov dword [rsp + 0x400], eax
mov rax, qword [rsp + 0x5c40]
add rax, 0x390
mov qword [rsp + 0x6b0], rax
lea rdx, [rsp + 0x400]
mov rcx, qword [rsp + 0x6b0]
call fcn.14001a400
jmp 0x1400133c5
lea rcx, [rsp + 0xe98]
call fcn.14000ea20
lea rcx, [rsp + 0x590]
call fcn.14000e210
nop
mov rax, qword [rsp + 0x5c40]
add rax, 0x390
mov rcx, rax
call fcn.14001b3c0
shl rax, 2
mov rdx, rax
lea rcx, [rsp + 0x590]
call fcn.14001b090
mov rax, qword [rsp + 0x5c40]
add rax, 0x390
mov rcx, rax
call fcn.14001b3c0
shl rax, 2
mov qword [rsp + 0x6c0], rax
mov rcx, qword [rsp + 0x5c40]
add rcx, 0x390
call fcn.1400116e0
mov qword [rsp + 0x6b8], rax
xor edx, edx
lea rcx, [rsp + 0x590]
call fcn.14000ede0
mov rdi, rax
mov rax, qword [rsp + 0x6b8]
mov rsi, rax
mov rax, qword [rsp + 0x6c0]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x590]
mov rcx, qword [rsp + 0xb0]
call fcn.14000d2f0
mov rax, qword [rsp + 0x5c40]
add rax, 0x390
mov rcx, rax
call fcn.14001b3c0
mov qword [rsp + 0x6c8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x28
lea rdx, [rsp + 0x6c8]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
add rax, 0x98
mov rcx, qword [rsp + 0x30]
add rcx, 0x30
mov rdx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
add rax, 0xa8
mov rcx, qword [rsp + 0x30]
add rcx, 0x38
mov rdx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x40
lea rdx, [rsp + 0x560]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x568]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x48
lea rdx, [rsp + 0x6d8]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x50
lea rdx, [rsp + 0x6e0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x58
lea rdx, [rsp + 0x138]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
add rax, 0x88
mov rcx, qword [rsp + 0x30]
add rcx, 0x60
mov rdx, rax
call fcn.14000d3e0
mov dword [rsp + 0x338], 0
mov rax, qword [rsp + 0x30]
add rax, 0x68
lea rdx, [rsp + 0x338]
mov rcx, rax
call fcn.14000d380
mov dword [rsp + 0x33c], 0
mov rax, qword [rsp + 0x30]
add rax, 0x70
lea rdx, [rsp + 0x33c]
mov rcx, rax
call fcn.14000d380
mov rax, qword [rsp + 0x5c40]
add rax, 0x5b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x404], eax
mov rax, qword [rsp + 0x30]
add rax, 0x78
lea rdx, [rsp + 0x404]
mov rcx, rax
call fcn.14000d380
mov qword [rsp + 0x6e8], 1
mov rax, qword [rsp + 0x30]
add rax, 0x80
lea rdx, [rsp + 0x6e8]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
add rax, 0x48
mov rcx, qword [rsp + 0x30]
add rcx, 0x88
mov rdx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
mov eax, dword [rax + 0x90]
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x30]
add rax, 0xa0
lea rdx, [rsp + 0x6f0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0xa8
lea rdx, [0x14031e5d0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
movsxd rax, dword [rax + 0x388]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x30]
add rax, 0xb0
lea rdx, [rsp + 0x6f8]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x5c40]
add rax, 0x320
mov rcx, qword [rsp + 0x30]
add rcx, 0xb8
mov rdx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0xc0
lea rdx, [rsp + 0x1a8]
mov rcx, rax
call fcn.14000d3e0
mov qword [rsp + 0x700], 0
mov rax, qword [rsp + 0x30]
add rax, 0xc8
lea rdx, [rsp + 0x700]
mov rcx, rax
call fcn.14000d3e0
mov qword [rsp + 0x708], 0
mov rax, qword [rsp + 0x30]
add rax, 0xd0
lea rdx, [rsp + 0x708]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0xd8
lea rdx, [rsp + 0x710]
mov rcx, rax
call fcn.14000d3e0
mov qword [rsp + 0x718], 0
mov rax, qword [rsp + 0x30]
add rax, 0xe0
lea rdx, [rsp + 0x718]
mov rcx, rax
call fcn.14000d3e0
mov qword [rsp + 0x720], 0
mov rax, qword [rsp + 0x30]
add rax, 0xe8
lea rdx, [rsp + 0x720]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x30]
add rax, 0x80
mov qword [rsp + 0xfd8], rax
lea rdx, str.PvNtVPNtVPNtrz52LGbXVPNtVPNtVPNtVPNtL2uzqFOyZGHXVPNtVPNtVPNtVPNtrzWcVTHkAFjtMJMwPvNtVPNtVPNtVPNtVP8iMzuiVTIzLljtZQNjZQNjBGO1PvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rzcvMKRtL2qyJ2IzL10fVTg6rwNXVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6nzWypFOwM2IoMJMwVPftZGO1KFjtn3c6ZDbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOeracdLzIkVTAaMIgyMzZtXlNlZUIqYPOerablPvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rzcvMKRtL2qyJ2IzLlNeVQZjqI0fVTg6rwZXVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6nzWypFOwM2IoMJMwVPftAQO1KFjtn3c6ANbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOeracdLzIkVTAaMIgyMzZtXlN1ZUIqYPOerab1PvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rzcvMKRtL2qyJ2IzLlNeVQLjqI0fVTg6rwLXVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6nzWypFOwM2IoMJMwVPftAmO1KFjtn3c6AjbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOeracdLzIkVTAaMIgyMzZtXlN4ZUIqYPOerab4PvNtVPNtVPNtVPNtVTAbMaImMNbtVPNtVPNtVPNtVPOwnTM1VTIhnjbtVPNtVPNtVPNtVPOwnTM1VTIjnjbtVPNtVPNtVPNtVPOwnTM1VTIknjbtVPNtVPNtVPNtVPOwnTM1VTIinjbtVPNtVPNtVPNtVPOwnTM1VTIzLjbtVPNtVPNtVPNtVPOwnTM1VTIiLjbtVPNtVPNtVPNtVPOwnTM1VTIzqtbtVPNtVPNtVPNtVPOwnTM1VTIkqtbtVPNtVPNtVPNtVPOwnTM1VTH4PvNtVPNtVPNtVPNtVTAbMaHtMGxXVPNtVPNtVPNtVPNtL2uzqFOyZGNXVPNtVPNtVPNtVPNtL2uzqFOyZGRXVPNtVPNtVPNtVPNtL2uzqFOyZGVXVPNtVPNtVPNtVPNtL2uzqFOyZGZXVPNtVPNtVPNtVPNtL2uzqFOyZGDXVPNtVPNtVPNtVPNtMzuiVTIzLljtZQNjZQRjZQO1PvNtVPNtVPNtVPNtVUcvnFOypTffVPHjZGM5rHg1PvNtVPNtVPNtVPNtVUOhrKxtJlHjZGM5rHg1KDbtVPNtVPNtVPNtVPOhpKRtMJMwYPNjZQNjZGNjZUHXVPNtVPNtVPNtVPNtL2WwVTHkANbtVPNtVPNtVPNtVPOwLzZtMGRmPvNtVPNtVPNtVPNtVTAvLlOyZGVXVPNtVPNtVPNtVPNtL2WwVTHkZDbtVPNtVPNtVPNtVPOwLzZtMGRjPvNtVPNtVPNtVPNtVTAvLlOyBDbtVPNtVPNtVPNtVPOwLzZtMGtXVPNtVPNtVPNtVPNtL2WwVTIkqtbtVPNtVPNtVPNtVPOwLzZtMJM2PvNtVPNtVPNtVPNtVTAvLlOyo2ZXVPNtVPNtVPNtVPNtL2WwVTIzLjbtVPNtVPNtVPNtVPOwLzZtMJ9ePvNtVPNtVPNtVPNtVTAvLlOypJfXVPNtVPNtVPNtVPNtL2WwVTIjnjbtVPNtVPNtVPNtVPOwLzZtMJ5ePvNtVPNtVPNtVPNtVTAvL3AxPvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rwNfVTg6rzcvMKRtL2qyJ2IzL10XVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6ZFjtn3c6nzWypFOwM2IoMJMwVPftZGO1KDbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOerablYPOeracdLzIkVTAaMIgyMzZtXlNlZUIqPvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rwZfVTg6rzcvMKRtL2qyJ2IzLlNeVQZjqI0XVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6APjtn3c6nzWypFOwM2IoMJMwVPftAQO1KDbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOerab1YPOeracdLzIkVTAaMIgyMzZtXlN1ZUIqPvNtVPNtVPNtVPNtVP8irzWcozAzVTg6rwLfVTg6rzcvMKRtL2qyJ2IzLlNeVQLjqI0XVPNtVPNtVPNtVPNtYl96LzyhL2Ltn3c6Aljtn3c6nzWypFOwM2IoMJMwVPftAmO1KDbtVPNtVPNtVPNtVPNiY3cvnJ5wMvOerab4YPOeracdLzIkVTAaMIgyMzZtXlN4ZUIqPvNtVPNtVPNtVPNtVP8ioaSkVTIzLljtZQNjZQNjBGO1PvNtVPNtVPNtVPNtVUcvnFOyMzZfVTHkADbtVPNtVPNtVPNtVPOwLzZtMGR1PvNtVPNtVPNtVPNtVTIlM2RXPFNtVPN
lea rcx, [rsp + 0x1108]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x1108]
lea rcx, [rsp + 0x1550]
call fcn.140005ba0
mov qword [rsp + 0x728], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x730], rax
mov rdx, qword [rsp + 0x730]
lea rcx, [rsp + 0x1530]
call fcn.140005130
mov qword [rsp + 0x738], rax
mov rax, qword [rsp + 0x738]
mov qword [rsp + 0x740], rax
mov rdx, qword [rsp + 0x740]
lea rcx, [rsp + 0x1510]
call fcn.140005ba0
mov qword [rsp + 0x748], rax
mov rcx, qword [rsp + 0x748]
call fcn.140008fe0
mov r9, qword [rsp + 0x408]
mov r8, qword [rsp + 0xb8]
mov rdx, rax
lea rcx, [rsp + 0x2d40]
call fcn.14000d440
lea rcx, [rsp + 0x1510]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1530]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1550]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1108]
call fcn.140004ac0
nop
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x750], rax
lea rdx, [rsp + 0x2d40]
lea rcx, [rsp + 0x1128]
call fcn.1400047d0
mov qword [rsp + 0xfb8], rax
mov r9, qword [rsp + 0x750]
lea r8, [rsp + 0x1128]
lea rdx, [rsp + 0x1148]
lea rcx, [0x14031e8e0]
call fcn.1400fdcd0
mov qword [rsp + 0xfc0], rax
lea rcx, [rsp + 0x1128]
call fcn.140004ac0
lea rdx, [rsp + 0x1148]
mov rcx, qword [rsp + 0x348]
call fcn.14000d2f0
nop
lea rcx, [rsp + 0x1148]
call fcn.14000eb40
nop
jmp 0x1400139c8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x120
mov r8d, 0x3ff
mov rdx, qword [rsp + 0x418]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xc30]
call fcn.14000d090
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rcx, [rsp + 0x134]
call fcn.140004440
mov qword [rsp + 0x758], rax
mov byte [rsp + 0x52], 0
mov r9, qword [rsp + 0x758]
lea r8, [rsp + 0x52]
mov edx, 8
lea rcx, [rsp + 0x2e8]
call fcn.14000e260
nop
xor edx, edx
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
mov rcx, qword [rsp + 0x348]
mov qword [rax], rcx
lea rcx, [rsp + 0x128]
call fcn.140004440
mov qword [rsp + 0x760], rax
mov byte [rsp + 0xc0], 0xf
mov byte [rsp + 0xc1], 5
mov byte [rsp + 0xc2], 0xff
mov byte [rsp + 0xc3], 0x25
mov byte [rsp + 0xc4], 0
mov byte [rsp + 0xc5], 0
mov byte [rsp + 0xc6], 0
mov byte [rsp + 0xc7], 0
xor edx, edx
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xc8], al
mov edx, 1
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xc9], al
mov edx, 2
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xca], al
mov edx, 3
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xcb], al
mov edx, 4
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xcc], al
mov edx, 5
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xcd], al
mov edx, 6
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xce], al
mov edx, 7
lea rcx, [rsp + 0x2e8]
call fcn.14000ede0
movzx eax, byte [rax]
mov byte [rsp + 0xcf], al
lea rax, [rsp + 0xd0]
mov r8, rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x1910]
call fcn.14000df80
lea rcx, [rsp + 0xf90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xdd0]
lea rcx, [rsp + 0xf90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x760]
lea rdx, [rsp + 0xdd0]
lea rcx, [rsp + 0xeb0]
call fcn.14000e180
nop
mov rax, qword [rsp + 0x78]
add rax, 8
lea rdx, [rsp + 0xeb0]
mov rcx, rax
call fcn.14000d2f0
nop
lea rcx, [rsp + 0xeb0]
call fcn.14000ea00
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [0x14031e808]
mov qword [rsp + 0x4c8], rax
mov rcx, qword [rsp + 0x4c8]
call fcn.1400068b0
mov qword [rsp + 0x248], rax
mov rcx, qword [rsp + 0x4c8]
call fcn.140008cd0
mov qword [rsp + 0x768], rax
jmp 0x140013cc7
mov rax, qword [rsp + 0x248]
add rax, 8
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x768]
cmp qword [rsp + 0x248], rax
je 0x140013cfc
mov rax, qword [rsp + 0x248]
mov rax, qword [rax]
mov qword [rsp + 0x770], rax
mov rcx, qword [rsp + 0x770]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140013cb3
lea rcx, str.Resumed_threads_n
call fcn.14000a170
mov rax, qword [0x14031e5d0]
add rax, 0x168
mov rcx, rax
call fcn.14000d240
test rax, rax
jne 0x140013d2f
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140013d08
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov byte [rsp + 0x53], 0xc3
mov rax, qword [rsp + 0x78]
add rax, 0xa
lea rdx, [rsp + 0x53]
mov rcx, rax
call fcn.14000d290
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdx, [rsp + 0xc30]
mov rcx, qword [rsp + 0x78]
call fcn.14000d2f0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
mov r8d, 0x100
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [0x14031e5d0]
add rax, 0x180
mov rcx, rax
call fcn.14000d240
test rax, rax
jne 0x140013e2c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140013e05
mov rax, qword [0x14031e5d0]
add rax, 0x168
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x778], rax
mov rdx, qword [rsp + 0x778]
lea rcx, str.GOT_LUA_STATE:__p_n
call fcn.14000a170
lea rdx, [rsp + 0x538]
mov rcx, qword [rsp + 0x140]
call fcn.14000d2f0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8d, 0x3ff
mov rdx, qword [rsp + 0x418]
mov rcx, qword [0x14031f410]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0xfc8], 0
mov qword [rsp + 0x458], 0
mov qword [rsp + 0x450], 0
mov qword [rsp + 0xfd0], 0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x14031e808]
mov qword [rsp + 0x420], rax
mov rcx, qword [rsp + 0x420]
call fcn.1400068b0
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x420]
call fcn.140008cd0
mov qword [rsp + 0x780], rax
jmp 0x140013f54
mov rax, qword [rsp + 0x250]
add rax, 8
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x780]
cmp qword [rsp + 0x250], rax
je 0x140013f89
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov qword [rsp + 0x788], rax
mov rcx, qword [rsp + 0x788]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x140013f40
lea rcx, [0x1402511d0]
call fcn.14000a170
mov qword [rsp + 0x1f8], 0
mov rax, qword [rsp + 0x5c40]
add rax, 0x308
mov qword [rsp + 0x790], rax
lea rdx, str.StringValue
lea rcx, [rsp + 0x1168]
call fcn.1400047d0
nop
xor r9d, r9d
lea r8, [rsp + 0x1168]
lea rdx, [rsp + 0x7a0]
mov rcx, qword [rsp + 0x790]
call fcn.14001d090
mov qword [rsp + 0x798], rax
mov rax, qword [rsp + 0x798]
mov rax, qword [rax]
mov qword [rsp + 0x1f8], rax
lea rcx, [rsp + 0x7a0]
call fcn.140004490
nop
lea rcx, [rsp + 0x1168]
call fcn.140004ac0
lea rax, [0x14031e808]
mov qword [rsp + 0x428], rax
mov rcx, qword [rsp + 0x428]
call fcn.1400068b0
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x428]
call fcn.140008cd0
mov qword [rsp + 0x7a8], rax
jmp 0x140014071
mov rax, qword [rsp + 0x258]
add rax, 8
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x7a8]
cmp qword [rsp + 0x258], rax
je 0x1400140b4
mov rax, qword [rsp + 0x258]
mov rax, qword [rax]
mov qword [rsp + 0x430], rax
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001405d
lea rcx, [0x14031e808]
call fcn.1400111d0
lea rcx, str.Resumed_and_cleared_threads_n
call fcn.14000a170
cmp qword [rsp + 0x1f8], 0
jne 0x1400140f3
lea rcx, str.Failed_to_establish_a_connection_to_the_UI..._n
call fcn.14000a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140017c45
lea rcx, str.READY_n
call fcn.14000a170
lea rcx, [rsp + 0x520]
call fcn.14000e210
nop
lea rcx, [rsp + 0x90]
call fcn.14000e210
nop
lea rcx, [rsp + 0x1c8]
call fcn.14000e210
nop
mov rdx, qword [rsp + 0x1f8]
lea rcx, [rsp + 0x160]
call fcn.14000dfe0
nop
lea rdx, [0x14024e524]
lea rcx, [rsp + 0x1188]
call fcn.1400047d0
nop
xor r9d, r9d
lea r8, [rsp + 0x1188]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x160]
call fcn.14001cfe0
nop
lea rcx, [rsp + 0x1188]
call fcn.140004ac0
lea rdx, str.objout
lea rcx, [rsp + 0x11a8]
call fcn.1400047d0
nop
xor r9d, r9d
lea r8, [rsp + 0x11a8]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x160]
call fcn.14001cfe0
nop
lea rcx, [rsp + 0x11a8]
call fcn.140004ac0
lea rdx, [rsp + 0xc18]
lea rcx, [rsp + 0x160]
call fcn.14001d270
nop
mov dword [rsp + 0x80], 1
jmp 0x1400141f8
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0xa
jg 0x1400143a3
lea rax, [rsp + 0xc18]
mov qword [rsp + 0x438], rax
mov rcx, qword [rsp + 0x438]
call fcn.1400068b0
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x438]
call fcn.140008cd0
mov qword [rsp + 0x7b0], rax
jmp 0x140014256
mov rax, qword [rsp + 0x260]
add rax, 8
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x7b0]
cmp qword [rsp + 0x260], rax
je 0x14001439e
mov rax, qword [rsp + 0x260]
mov rax, qword [rax]
mov qword [rsp + 0x268], rax
mov edx, dword [rsp + 0x80]
lea rcx, [rsp + 0x15b0]
call fcn.140009fc0
mov qword [rsp + 0x7b8], rax
mov rax, qword [rsp + 0x7b8]
mov qword [rsp + 0x7c0], rax
mov r8, qword [rsp + 0x7c0]
lea rdx, [0x14025069c]
lea rcx, [rsp + 0x1590]
call fcn.1400063f0
mov qword [rsp + 0x7c8], rax
mov rax, qword [rsp + 0x7c8]
mov qword [rsp + 0x7d0], rax
mov rax, qword [rsp + 0x7d0]
mov qword [rsp + 0x7e0], rax
lea rdx, [rsp + 0x1570]
lea rcx, [rsp + 0x268]
call fcn.14001d400
mov qword [rsp + 0x7d8], rax
mov rax, qword [rsp + 0x7d8]
mov qword [rsp + 0x7e8], rax
mov rdx, qword [rsp + 0x7e0]
mov rcx, qword [rsp + 0x7e8]
call fcn.14000a300
mov byte [rsp + 0x54], al
lea rcx, [rsp + 0x1570]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1590]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x15b0]
call fcn.140004ac0
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x14001438c
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x520]
call fcn.14001a430
nop
lea rcx, [rsp + 0x268]
call fcn.140004490
jmp 0x14001439e
lea rcx, [rsp + 0x268]
call fcn.140004490
jmp 0x140014242
jmp 0x1400141e8
lea rcx, [rsp + 0x520]
call fcn.14001b3f0
cmp rax, 0xa
je 0x1400144a3
lea rcx, [0x140251248]
call fcn.14000a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0xc18]
call fcn.14000eb20
nop
lea rcx, [rsp + 0x1b0]
call fcn.140004490
nop
lea rcx, [rsp + 0xa8]
call fcn.140004490
nop
lea rcx, [rsp + 0x160]
call fcn.140004490
nop
lea rcx, [rsp + 0x1c8]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x90]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x520]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x2e8]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xc30]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x590]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x55]
jmp 0x140017cb0
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0xa8]
call fcn.14001d270
nop
mov dword [rsp + 0x84], 1
jmp 0x1400144d6
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0xa
jg 0x140014681
lea rax, [rsp + 0xc00]
mov qword [rsp + 0x440], rax
mov rcx, qword [rsp + 0x440]
call fcn.1400068b0
mov qword [rsp + 0x270], rax
mov rcx, qword [rsp + 0x440]
call fcn.140008cd0
mov qword [rsp + 0x7f0], rax
jmp 0x140014534
mov rax, qword [rsp + 0x270]
add rax, 8
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x7f0]
cmp qword [rsp + 0x270], rax
je 0x14001467c
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov qword [rsp + 0x278], rax
mov edx, dword [rsp + 0x84]
lea rcx, [rsp + 0x1610]
call fcn.140009fc0
mov qword [rsp + 0x7f8], rax
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x800], rax
mov r8, qword [rsp + 0x800]
lea rdx, [0x1402506c4]
lea rcx, [rsp + 0x15f0]
call fcn.1400063f0
mov qword [rsp + 0x808], rax
mov rax, qword [rsp + 0x808]
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x810]
mov qword [rsp + 0x820], rax
lea rdx, [rsp + 0x15d0]
lea rcx, [rsp + 0x278]
call fcn.14001d400
mov qword [rsp + 0x818], rax
mov rax, qword [rsp + 0x818]
mov qword [rsp + 0x828], rax
mov rdx, qword [rsp + 0x820]
mov rcx, qword [rsp + 0x828]
call fcn.14000a300
mov byte [rsp + 0x56], al
lea rcx, [rsp + 0x15d0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x15f0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1610]
call fcn.140004ac0
movzx eax, byte [rsp + 0x56]
test eax, eax
je 0x14001466a
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x1c8]
call fcn.14001a430
nop
lea rcx, [rsp + 0x278]
call fcn.140004490
jmp 0x14001467c
lea rcx, [rsp + 0x278]
call fcn.140004490
jmp 0x140014520
jmp 0x1400144c6
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp rax, 0xa
je 0x14001478f
lea rcx, [0x140251278]
call fcn.14000a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0xc00]
call fcn.14000eb20
nop
lea rcx, [rsp + 0xc18]
call fcn.14000eb20
nop
lea rcx, [rsp + 0x1b0]
call fcn.140004490
nop
lea rcx, [rsp + 0xa8]
call fcn.140004490
nop
lea rcx, [rsp + 0x160]
call fcn.140004490
nop
lea rcx, [rsp + 0x1c8]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x90]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x520]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x2e8]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xc30]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x590]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x57]
jmp 0x140017cb0
mov dword [rsp + 0x88], 1
jmp 0x1400147ac
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x32
jg 0x140014957
lea rax, [rsp + 0xc00]
mov qword [rsp + 0x448], rax
mov rcx, qword [rsp + 0x448]
call fcn.1400068b0
mov qword [rsp + 0x280], rax
mov rcx, qword [rsp + 0x448]
call fcn.140008cd0
mov qword [rsp + 0x830], rax
jmp 0x14001480a
mov rax, qword [rsp + 0x280]
add rax, 8
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x830]
cmp qword [rsp + 0x280], rax
je 0x140014952
mov rax, qword [rsp + 0x280]
mov rax, qword [rax]
mov qword [rsp + 0x288], rax
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x1670]
call fcn.140009fc0
mov qword [rsp + 0x838], rax
mov rax, qword [rsp + 0x838]
mov qword [rsp + 0x840], rax
mov r8, qword [rsp + 0x840]
lea rdx, str.sout
lea rcx, [rsp + 0x1650]
call fcn.1400063f0
mov qword [rsp + 0x848], rax
mov rax, qword [rsp + 0x848]
mov qword [rsp + 0x850], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x860], rax
lea rdx, [rsp + 0x1630]
lea rcx, [rsp + 0x288]
call fcn.14001d400
mov qword [rsp + 0x858], rax
mov rax, qword [rsp + 0x858]
mov qword [rsp + 0x868], rax
mov rdx, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x868]
call fcn.14000a300
mov byte [rsp + 0x58], al
lea rcx, [rsp + 0x1630]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1650]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1670]
call fcn.140004ac0
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x140014940
lea rdx, [rsp + 0x288]
lea rcx, [rsp + 0x90]
call fcn.14001a430
nop
lea rcx, [rsp + 0x288]
call fcn.140004490
jmp 0x140014952
lea rcx, [rsp + 0x288]
call fcn.140004490
jmp 0x1400147f6
jmp 0x14001479c
lea rcx, [rsp + 0x90]
call fcn.14001b3f0
cmp rax, 0x32
je 0x140014a65
lea rcx, str.Failed_to_establish_a_script_connection..._n
call fcn.14000a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x59], 0
lea rcx, [rsp + 0xc00]
call fcn.14000eb20
nop
lea rcx, [rsp + 0xc18]
call fcn.14000eb20
nop
lea rcx, [rsp + 0x1b0]
call fcn.140004490
nop
lea rcx, [rsp + 0xa8]
call fcn.140004490
nop
lea rcx, [rsp + 0x160]
call fcn.140004490
nop
lea rcx, [rsp + 0x1c8]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x90]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x520]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x2e8]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xc30]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x590]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x59]
jmp 0x140017cb0
mov dword [rsp + 0x130], 0
mov rax, qword [rsp + 0x5c40]
add rax, 0x5b4
mov r8d, 0x100
mov rdx, rax
lea rcx, [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, str.myfile.txt
lea rcx, [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, 1
lea rcx, [rsp + 0x1fe0]
call fcn.14000dd70
nop
mov r9d, 0x40
mov r8d, 0x12
lea rdx, [rsp + 0x2300]
lea rcx, [rsp + 0x1fe0]
call fcn.140019a10
lea rcx, [rsp + 0x1fe0]
call fcn.1400113c0
lea rdx, [0x1402512f8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140017bc8
cmp qword [rsp + 0x450], 0
je 0x140014b4c
movsx rax, word [0x140305044]
mov rcx, qword [rsp + 0x450]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x458], 0
jne 0x140014b4c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014aeb
mov qword [rsp + 0x290], 0
jmp 0x140014b6d
mov rax, qword [rsp + 0x290]
inc rax
mov qword [rsp + 0x290], rax
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp qword [rsp + 0x290], rax
jae 0x140014d62
lea rcx, [rsp + 0x12a]
call fcn.140004440
mov qword [rsp + 0x870], rax
mov byte [rsp + 0xd8], 0
mov byte [rsp + 0xd9], 0
mov byte [rsp + 0xda], 0
mov byte [rsp + 0xdb], 0
mov byte [rsp + 0xdc], 0
mov byte [rsp + 0xdd], 0
mov byte [rsp + 0xde], 0
mov byte [rsp + 0xdf], 0
mov byte [rsp + 0xe0], 0
mov byte [rsp + 0xe1], 0
mov byte [rsp + 0xe2], 0
mov byte [rsp + 0xe3], 0
mov byte [rsp + 0xe4], 0
mov byte [rsp + 0xe5], 0
mov byte [rsp + 0xe6], 0
mov byte [rsp + 0xe7], 0
mov byte [rsp + 0xe8], 0
mov byte [rsp + 0xe9], 0
mov byte [rsp + 0xea], 0
mov byte [rsp + 0xeb], 0
mov byte [rsp + 0xec], 0
mov byte [rsp + 0xed], 0
mov byte [rsp + 0xee], 0
mov byte [rsp + 0xef], 0
mov byte [rsp + 0xf0], 0xf
mov byte [rsp + 0xf1], 0
mov byte [rsp + 0xf2], 0
mov byte [rsp + 0xf3], 0
mov byte [rsp + 0xf4], 0
mov byte [rsp + 0xf5], 0
mov byte [rsp + 0xf6], 0
mov byte [rsp + 0xf7], 0
lea rax, [rsp + 0xf8]
mov r8, rax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x1920]
call fcn.14000df80
lea rcx, [rsp + 0xf70]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xf80]
lea rcx, [rsp + 0xf70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x870]
lea rdx, [rsp + 0xf80]
lea rcx, [rsp + 0xec8]
call fcn.14000e180
nop
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x878], rax
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x1c8]
call fcn.14000ee10
mov rcx, qword [rsp + 0x878]
add rcx, qword [rax]
mov rax, rcx
lea rdx, [rsp + 0xec8]
mov rcx, rax
call fcn.14000d2f0
nop
lea rcx, [rsp + 0xec8]
call fcn.14000ea00
jmp 0x140014b5a
movsxd rax, dword [0x140305004]
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + rax + 0x10]
mov rcx, rax
call fcn.14000d240
test rax, rax
jbe 0x14001734a
movsxd rax, dword [0x140305004]
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0xca8]
call fcn.1401bde80
nop
lea rdx, [0x1402506fc]
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x140015787
lea rcx, [rsp + 0xcf0]
call fcn.14000e210
nop
mov qword [rsp + 0x148], 0
jmp 0x140014dfb
mov rax, qword [rsp + 0x148]
inc rax
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0x90]
call fcn.14001b3f0
cmp qword [rsp + 0x148], rax
jae 0x14001507a
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x880], rax
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x880]
lea rax, [rax + rcx + 0x10]
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x350], rax
cmp qword [rsp + 0x350], 0
jne 0x140014e6a
jmp 0x14001507a
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x888], rax
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x888]
lea rax, [rax + rcx + 0x10]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
jbe 0x140014f99
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x890], rax
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x890]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov r8, qword [rsp + 0x350]
mov rdx, rax
lea rcx, [rsp + 0xee0]
call fcn.14000d090
nop
lea rax, [rsp + 0xee0]
mov qword [rsp + 0x460], rax
mov rcx, qword [rsp + 0x460]
call fcn.1400068b0
mov qword [rsp + 0x298], rax
mov rcx, qword [rsp + 0x460]
call fcn.140008cd0
mov qword [rsp + 0x898], rax
jmp 0x140014f52
mov rax, qword [rsp + 0x298]
inc rax
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x898]
cmp qword [rsp + 0x298], rax
je 0x140014f87
mov rax, qword [rsp + 0x298]
movzx eax, byte [rax]
mov byte [rsp + 0x5a], al
lea rdx, [rsp + 0x5a]
lea rcx, [rsp + 0xcf0]
call fcn.14001a3d0
jmp 0x140014f3f
lea rcx, [rsp + 0xee0]
call fcn.14000ea00
jmp 0x140015075
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x8a0], rax
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x8a0]
add rcx, qword [rax]
mov rax, rcx
mov r8, qword [rsp + 0x350]
mov rdx, rax
lea rcx, [rsp + 0xef8]
call fcn.14000d090
nop
lea rax, [rsp + 0xef8]
mov qword [rsp + 0x468], rax
mov rcx, qword [rsp + 0x468]
call fcn.1400068b0
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x468]
call fcn.140008cd0
mov qword [rsp + 0x8a8], rax
jmp 0x140015033
mov rax, qword [rsp + 0x2a0]
inc rax
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x8a8]
cmp qword [rsp + 0x2a0], rax
je 0x140015068
mov rax, qword [rsp + 0x2a0]
movzx eax, byte [rax]
mov byte [rsp + 0x5b], al
lea rdx, [rsp + 0x5b]
lea rcx, [rsp + 0xcf0]
call fcn.14001a3d0
jmp 0x140015020
lea rcx, [rsp + 0xef8]
call fcn.14000ea00
jmp 0x140014de8
lea rdx, [0x14024e36b]
lea rcx, [rsp + 0x200]
call fcn.1400047d0
nop
lea rax, [rsp + 0xcf0]
mov qword [rsp + 0x470], rax
mov rcx, qword [rsp + 0x470]
call fcn.1400068b0
mov qword [rsp + 0x2a8], rax
mov rcx, qword [rsp + 0x470]
call fcn.140008cd0
mov qword [rsp + 0x8b0], rax
jmp 0x1400150de
mov rax, qword [rsp + 0x2a8]
inc rax
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x8b0]
cmp qword [rsp + 0x2a8], rax
je 0x140015113
mov rax, qword [rsp + 0x2a8]
movzx eax, byte [rax]
mov byte [rsp + 0x60], al
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x200]
call fcn.140004c10
jmp 0x1400150cb
lea rdx, [0x140251308]
lea rcx, [rsp + 0x11e8]
call fcn.1400047d0
nop
lea rdx, [0x140251310]
lea rcx, [rsp + 0x11c8]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1ac8]
mov qword [rsp + 0x8b8], rax
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x8b8]
call fcn.1400073d0
mov qword [rsp + 0x8c0], rax
lea r9, [rsp + 0x11e8]
lea r8, [rsp + 0x11c8]
mov rdx, qword [rsp + 0x8c0]
lea rcx, [rsp + 0x1690]
call fcn.14001afd0
mov qword [rsp + 0x8c8], rax
mov rdx, qword [rsp + 0x8c8]
lea rcx, [rsp + 0x200]
call fcn.1400080b0
lea rcx, [rsp + 0x1690]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x11c8]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x11e8]
call fcn.140004ac0
lea rdx, [0x140251320]
lea rcx, [rsp + 0x1228]
call fcn.1400047d0
nop
lea rdx, [0x140251328]
lea rcx, [rsp + 0x1208]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1ae8]
mov qword [rsp + 0x8d0], rax
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x8d0]
call fcn.1400073d0
mov qword [rsp + 0x8d8], rax
lea r9, [rsp + 0x1228]
lea r8, [rsp + 0x1208]
mov rdx, qword [rsp + 0x8d8]
lea rcx, [rsp + 0x16b0]
call fcn.14001afd0
mov qword [rsp + 0x8e0], rax
mov rdx, qword [rsp + 0x8e0]
lea rcx, [rsp + 0x200]
call fcn.1400080b0
lea rcx, [rsp + 0x16b0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1208]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1228]
call fcn.140004ac0
lea rdx, [0x140251338]
lea rcx, [rsp + 0x1268]
call fcn.1400047d0
nop
lea rdx, [0x140251340]
lea rcx, [rsp + 0x1248]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1b08]
mov qword [rsp + 0x8e8], rax
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x8e8]
call fcn.1400073d0
mov qword [rsp + 0x8f0], rax
lea r9, [rsp + 0x1268]
lea r8, [rsp + 0x1248]
mov rdx, qword [rsp + 0x8f0]
lea rcx, [rsp + 0x16d0]
call fcn.14001afd0
mov qword [rsp + 0x8f8], rax
mov rdx, qword [rsp + 0x8f8]
lea rcx, [rsp + 0x200]
call fcn.1400080b0
lea rcx, [rsp + 0x16d0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1248]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1268]
call fcn.140004ac0
lea rdx, [0x140251350]
lea rcx, [rsp + 0x12a8]
call fcn.1400047d0
nop
lea rdx, [0x140251358]
lea rcx, [rsp + 0x1288]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1a28]
mov qword [rsp + 0x900], rax
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x900]
call fcn.1400073d0
mov qword [rsp + 0x908], rax
lea r9, [rsp + 0x12a8]
lea r8, [rsp + 0x1288]
mov rdx, qword [rsp + 0x908]
lea rcx, [rsp + 0x16f0]
call fcn.14001afd0
mov qword [rsp + 0x910], rax
mov rdx, qword [rsp + 0x910]
lea rcx, [rsp + 0x200]
call fcn.1400080b0
lea rcx, [rsp + 0x16f0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1288]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x12a8]
call fcn.140004ac0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov dword [rsp + 0xd80], 0
mov dword [rsp + 0xd84], 0
mov dword [rsp + 0xd88], 0
mov dword [rsp + 0xd8c], 0
mov qword [rsp + 0xd90], 0
mov qword [rsp + 0xd98], 0
mov qword [rsp + 0xda0], 0
mov qword [rsp + 0xda8], 0
mov qword [rsp + 0xdb0], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xd80]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x1710]
call fcn.140061920
mov qword [rsp + 0x918], rax
mov rdx, qword [rsp + 0x918]
lea rcx, [rsp + 0x200]
call fcn.1400080b0
lea rcx, [rsp + 0x1710]
call fcn.140004ac0
xor edx, edx
lea rcx, [rsp + 0x200]
call fcn.140004b70
movsx eax, byte [rax]
test eax, eax
jle 0x14001550f
xor edx, edx
lea rcx, [rsp + 0x200]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0xa
jl 0x140015530
lea rcx, [rsp + 0x200]
call fcn.140008fe0
mov rdx, rax
lea rcx, [0x140251368]
call fcn.14000a170
jmp 0x140015767
lea rcx, [rsp + 0x200]
call fcn.1400057c0
mov qword [rsp + 0x920], rax
mov rax, qword [0x14031f410]
mov qword [rsp + 0x928], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rsp + 0x920]
xor edx, edx
mov rcx, qword [rsp + 0x928]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x478], rax
lea rcx, [rsp + 0x200]
call fcn.1400057c0
mov qword [rsp + 0x930], rax
lea rcx, [rsp + 0x200]
call fcn.140008fe0
mov qword [rsp + 0x938], rax
mov r8, qword [rsp + 0x930]
mov rdx, qword [rsp + 0x938]
mov rcx, qword [rsp + 0x478]
call fcn.140019900
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x368], rax
mov qword [rsp + 0x1000], 0
lea rcx, [rsp + 0x200]
call fcn.1400057c0
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x2b0], 0
jmp 0x140015631
mov rax, qword [rsp + 0x2b0]
inc rax
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x188]
sub rax, 0x30000
mov qword [rsp + 0x188], rax
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp qword [rsp + 0x2b0], rax
jae 0x140015767
cmp qword [rsp + 0x188], 0
jbe 0x140015767
cmp qword [rsp + 0x188], 0x7fffffff
jae 0x140015767
cmp qword [rsp + 0x188], 0x30000
jbe 0x140015689
mov qword [rsp + 0x480], 0x30000
jmp 0x140015699
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x360], rax
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x940], rax
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x1c8]
call fcn.14000ee10
mov rcx, qword [rsp + 0x940]
add rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x358], rax
lea rdx, [rsp + 0x368]
mov rcx, qword [rsp + 0x358]
call fcn.14000d3e0
mov rax, qword [rsp + 0x358]
add rax, 0x10
lea rdx, [rsp + 0x360]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x360]
or rax, 0x1f
mov qword [rsp + 0x948], rax
mov rax, qword [rsp + 0x358]
add rax, 0x18
lea rdx, [rsp + 0x948]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x368]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x368], rax
jmp 0x140015608
lea rcx, [rsp + 0x200]
call fcn.140004ac0
nop
lea rcx, [rsp + 0xcf0]
call fcn.14000ea00
jmp 0x140017184
lea rdx, [0x140250724]
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x140015c52
movsxd rax, dword [0x140305004]
mov rcx, qword [rsp + 0x1b0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x950], rax
mov rax, qword [rsp + 0x950]
add rax, 8
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x2b8], rax
cmp qword [rsp + 0x2b8], 0
je 0x140015c4d
mov rdx, qword [rsp + 0x2b8]
lea rcx, [rsp + 0x1c40]
call fcn.1401bde30
lea rcx, [rsp + 0x1958]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x197c], 4
jne 0x140015c4d
mov rdx, qword [rsp + 0x2b8]
lea rcx, [rsp + 0x998]
call fcn.14000dfe0
nop
mov rax, qword [rsp + 0x2b8]
add rax, 0x1b8
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x140015c40
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x1c70]
call fcn.1401bde30
lea rcx, [rsp + 0x1988]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x19ac], 4
jne 0x140015c40
mov rax, qword [rsp + 0x150]
add rax, 0x10
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
add rax, 0x18
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0xfe0], rax
mov rax, qword [rsp + 0x150]
add rax, 0x10
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x488], rax
cmp qword [rsp + 0x488], 0
jbe 0x140015c40
mov rcx, qword [rsp + 0x150]
call fcn.14000d240
mov qword [rsp + 0x958], rax
mov r8, qword [rsp + 0x488]
mov rdx, qword [rsp + 0x958]
lea rcx, [rsp + 0xf10]
call fcn.14000d090
nop
lea rcx, [rsp + 0xde0]
call fcn.140004830
nop
lea rax, [rsp + 0xf10]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.1400068b0
mov qword [rsp + 0x2c0], rax
mov rcx, qword [rsp + 0x490]
call fcn.140008cd0
mov qword [rsp + 0x960], rax
jmp 0x140015994
mov rax, qword [rsp + 0x2c0]
inc rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x960]
cmp qword [rsp + 0x2c0], rax
je 0x1400159c9
mov rax, qword [rsp + 0x2c0]
movzx eax, byte [rax]
mov byte [rsp + 0x5c], al
movzx edx, byte [rsp + 0x5c]
lea rcx, [rsp + 0xde0]
call fcn.140004c10
jmp 0x140015981
lea rdx, [rsp + 0xde0]
lea rcx, [rsp + 0xbe8]
call fcn.1400118b0
nop
lea rcx, [rsp + 0xbe8]
call fcn.14001b390
mov qword [rsp + 0x968], rax
mov rax, qword [0x14031f410]
mov qword [rsp + 0x970], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, qword [rsp + 0x968]
xor edx, edx
mov rcx, qword [rsp + 0x970]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x498], rax
lea rcx, [rsp + 0xbe8]
call fcn.14001b390
mov qword [rsp + 0x978], rax
lea rcx, [rsp + 0xbe8]
call fcn.1400116e0
mov qword [rsp + 0x980], rax
mov r8, qword [rsp + 0x978]
mov rdx, qword [rsp + 0x980]
mov rcx, qword [rsp + 0x498]
call fcn.140019900
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x380], rax
mov qword [rsp + 0xfe8], 0
lea rcx, [rsp + 0xbe8]
call fcn.14001b390
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x2c8], 0
jmp 0x140015ae0
mov rax, qword [rsp + 0x2c8]
inc rax
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x190]
sub rax, 0x30000
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp qword [rsp + 0x2c8], rax
jae 0x140015c16
cmp qword [rsp + 0x190], 0
jbe 0x140015c16
cmp qword [rsp + 0x190], 0x7fffffff
jae 0x140015c16
cmp qword [rsp + 0x190], 0x30000
jbe 0x140015b38
mov qword [rsp + 0x4a0], 0x30000
jmp 0x140015b48
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x378], rax
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x988], rax
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x1c8]
call fcn.14000ee10
mov rcx, qword [rsp + 0x988]
add rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x370], rax
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x370]
call fcn.14000d3e0
mov rax, qword [rsp + 0x370]
add rax, 0x10
lea rdx, [rsp + 0x378]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x378]
or rax, 0x1f
mov qword [rsp + 0x990], rax
mov rax, qword [rsp + 0x370]
add rax, 0x18
lea rdx, [rsp + 0x990]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x380]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x380], rax
jmp 0x140015ab7
lea rcx, [rsp + 0xbe8]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xde0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0xf10]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x998]
call fcn.140004490
jmp 0x140017184
lea rdx, [0x140250764]
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x14001636c
lea rcx, [rsp + 0xcd8]
call fcn.14000e210
nop
lea rcx, [rsp + 0x5a8]
call fcn.140004830
nop
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9a0], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9a0]
lea rax, [rax + rcx + 0x18]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
je 0x140015d39
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9a8], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x9a8]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov rdx, rax
lea rcx, [rsp + 0x1730]
call fcn.1401bde80
mov qword [rsp + 0x9b0], rax
mov rdx, qword [rsp + 0x9b0]
lea rcx, [rsp + 0x5a8]
call fcn.1400080b0
lea rcx, [rsp + 0x1730]
call fcn.140004ac0
jmp 0x140015d9f
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9b8], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x9b8]
add rcx, qword [rax]
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x1750]
call fcn.1401bde80
mov qword [rsp + 0x9c0], rax
mov rdx, qword [rsp + 0x9c0]
lea rcx, [rsp + 0x5a8]
call fcn.1400080b0
lea rcx, [rsp + 0x1750]
call fcn.140004ac0
mov qword [rsp + 0x158], 1
jmp 0x140015dc0
mov rax, qword [rsp + 0x158]
inc rax
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x90]
call fcn.14001b3f0
cmp qword [rsp + 0x158], rax
jae 0x14001603f
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9c8], rax
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c8]
lea rax, [rax + rcx + 0x10]
mov rcx, rax
call fcn.14000d240
mov qword [rsp + 0x388], rax
cmp qword [rsp + 0x388], 0
jne 0x140015e2f
jmp 0x14001603f
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9d0], rax
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9d0]
lea rax, [rax + rcx + 0x18]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
je 0x140015f5e
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9d8], rax
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x9d8]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov r8, qword [rsp + 0x388]
mov rdx, rax
lea rcx, [rsp + 0xf28]
call fcn.14000d090
nop
lea rax, [rsp + 0xf28]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.1400068b0
mov qword [rsp + 0x2d0], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140008cd0
mov qword [rsp + 0x9e0], rax
jmp 0x140015f17
mov rax, qword [rsp + 0x2d0]
inc rax
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x9e0]
cmp qword [rsp + 0x2d0], rax
je 0x140015f4c
mov rax, qword [rsp + 0x2d0]
movzx eax, byte [rax]
mov byte [rsp + 0x5d], al
lea rdx, [rsp + 0x5d]
lea rcx, [rsp + 0xcd8]
call fcn.14001a3d0
jmp 0x140015f04
lea rcx, [rsp + 0xf28]
call fcn.14000ea00
jmp 0x14001603a
movsxd rax, dword [0x140305004]
mov qword [rsp + 0x9e8], rax
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0x9e8]
add rcx, qword [rax]
mov rax, rcx
mov r8, qword [rsp + 0x388]
mov rdx, rax
lea rcx, [rsp + 0xf40]
call fcn.14000d090
nop
lea rax, [rsp + 0xf40]
mov qword [rsp + 0x4b0], rax
mov rcx, qword [rsp + 0x4b0]
call fcn.1400068b0
mov qword [rsp + 0x2d8], rax
mov rcx, qword [rsp + 0x4b0]
call fcn.140008cd0
mov qword [rsp + 0x9f0], rax
jmp 0x140015ff8
mov rax, qword [rsp + 0x2d8]
inc rax
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x9f0]
cmp qword [rsp + 0x2d8], rax
je 0x14001602d
mov rax, qword [rsp + 0x2d8]
movzx eax, byte [rax]
mov byte [rsp + 0x5e], al
lea rdx, [rsp + 0x5e]
lea rcx, [rsp + 0xcd8]
call fcn.14001a3d0
jmp 0x140015fe5
lea rcx, [rsp + 0xf40]
call fcn.14000ea00
jmp 0x140015dad
lea rdx, [0x14024e37b]
lea rcx, [rsp + 0xe00]
call fcn.1400047d0
nop
lea rax, [rsp + 0xcd8]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4b8]
call fcn.1400068b0
mov qword [rsp + 0x2e0], rax
mov rcx, qword [rsp + 0x4b8]
call fcn.140008cd0
mov qword [rsp + 0x9f8], rax
jmp 0x1400160a3
mov rax, qword [rsp + 0x2e0]
inc rax
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x9f8]
cmp qword [rsp + 0x2e0], rax
je 0x1400160d8
mov rax, qword [rsp + 0x2e0]
movzx eax, byte [rax]
mov byte [rsp + 0x5f], al
movzx edx, byte [rsp + 0x5f]
lea rcx, [rsp + 0xe00]
call fcn.140004c10
jmp 0x140016090
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rdx, rax
lea rcx, [rsp + 0x2710]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x4c], 0
jmp 0x14001610b
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x5a8]
call fcn.1400057c0
movsxd rcx, dword [rsp + 0x4c]
cmp rcx, rax
jae 0x1400161ea
movsxd rax, dword [rsp + 0x4c]
mov rdx, rax
lea rcx, [rsp + 0x5a8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x3a
jne 0x14001614a
jmp 0x1400161ea
lea rcx, [rsp + 0x5a8]
call fcn.1400057c0
mov ecx, dword [rsp + 0x4c]
inc ecx
movsxd rcx, ecx
cmp rcx, rax
jae 0x1400161a4
movsxd rax, dword [rsp + 0x4c]
mov rdx, rax
lea rcx, [rsp + 0x5a8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x1400161a4
mov eax, dword [rsp + 0x4c]
inc eax
cdqe
mov rdx, rax
lea rcx, [rsp + 0x5a8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x1400161a4
jmp 0x1400161ea
movsxd rax, dword [rsp + 0x4c]
mov rdx, rax
lea rcx, [rsp + 0x5a8]
call fcn.140004b70
movsx ax, byte [rax]
mov word [rsp + 0x1bc], ax
xor eax, eax
mov word [rsp + 0x1be], ax
lea rdx, [rsp + 0x1bc]
lea rcx, [rsp + 0x2710]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140016101
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x3e8], eax
lea rcx, [rsp + 0x2710]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x3e8]
cmp eax, ecx
jle 0x14001633e
mov byte [rsp + 0x3c], 1
lea rdx, [rsp + 0x2710]
lea rcx, [rsp + 0x12c8]
call fcn.140007ba0
nop
lea rcx, [rsp + 0x12c8]
call fcn.140011ca0
movzx eax, al
test eax, eax
jne 0x140016261
mov dword [rsp + 0x1c0], 1
jmp 0x14001626c
mov dword [rsp + 0x1c0], 0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x65], al
lea rcx, [rsp + 0x12c8]
call fcn.14000e8b0
movzx eax, byte [rsp + 0x65]
test eax, eax
je 0x1400162bc
mov eax, dword [rsp + 0x130]
inc eax
mov dword [rsp + 0x130], eax
cmp dword [rsp + 0x130], 0x1f4
jle 0x1400162bc
mov byte [rsp + 0x3c], 0
lea rcx, str.Maximum_number_of_files_created_for_this_session._n
call fcn.14000a170
movzx eax, byte [rsp + 0x3c]
test eax, eax
je 0x14001633e
mov edx, 1
lea rcx, [rsp + 0x1b30]
call fcn.14000dd70
nop
mov r9d, 0x40
mov r8d, 0x32
lea rdx, [rsp + 0x2710]
lea rcx, [rsp + 0x1b30]
call fcn.140019a10
lea rcx, [rsp + 0x1b30]
call fcn.140017d30
movzx eax, al
test eax, eax
je 0x140016330
lea rdx, [rsp + 0xe00]
lea rcx, [rsp + 0x1b30]
call fcn.140005df0
lea rcx, [rsp + 0x1b30]
call fcn.1400113c0
nop
lea rcx, [rsp + 0x1b30]
call fcn.14000f1a0
nop
lea rcx, [rsp + 0xe00]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x5a8]
call fcn.140004ac0
nop
lea rcx, [rsp + 0xcd8]
call fcn.14000ea00
jmp 0x140017184
lea rdx, [0x14025078c]
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x1400169b9
lea rcx, [rsp + 0x13d8]
call fcn.14000e210
nop
lea rcx, [rsp + 0x5e8]
call fcn.140004830
nop
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa00], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa00]
lea rax, [rax + rcx + 0x18]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
je 0x140016453
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa08], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa08]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov rdx, rax
lea rcx, [rsp + 0x1770]
call fcn.1401bde80
mov qword [rsp + 0xa10], rax
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x5e8]
call fcn.1400080b0
lea rcx, [rsp + 0x1770]
call fcn.140004ac0
jmp 0x1400164b9
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa18], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa18]
add rcx, qword [rax]
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x1790]
call fcn.1401bde80
mov qword [rsp + 0xa20], rax
mov rdx, qword [rsp + 0xa20]
lea rcx, [rsp + 0x5e8]
call fcn.1400080b0
lea rcx, [rsp + 0x1790]
call fcn.140004ac0
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rdx, rax
lea rcx, [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x44], 0
jmp 0x1400164ec
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x5e8]
call fcn.1400057c0
movsxd rcx, dword [rsp + 0x44]
cmp rcx, rax
jae 0x1400165cb
movsxd rax, dword [rsp + 0x44]
mov rdx, rax
lea rcx, [rsp + 0x5e8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x3a
jne 0x14001652b
jmp 0x1400165cb
lea rcx, [rsp + 0x5e8]
call fcn.1400057c0
mov ecx, dword [rsp + 0x44]
inc ecx
movsxd rcx, ecx
cmp rcx, rax
jae 0x140016585
movsxd rax, dword [rsp + 0x44]
mov rdx, rax
lea rcx, [rsp + 0x5e8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x140016585
mov eax, dword [rsp + 0x44]
inc eax
cdqe
mov rdx, rax
lea rcx, [rsp + 0x5e8]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x140016585
jmp 0x1400165cb
movsxd rax, dword [rsp + 0x44]
mov rdx, rax
lea rcx, [rsp + 0x5e8]
call fcn.140004b70
movsx ax, byte [rax]
mov word [rsp + 0x198], ax
xor eax, eax
mov word [rsp + 0x19a], ax
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1400164e2
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x3e4], eax
lea rcx, [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x3e4]
cmp eax, ecx
jle 0x140016999
lea rdx, [0x14024e37f]
lea rcx, [rsp + 0x5c8]
call fcn.1400047d0
nop
xor edx, edx
lea rcx, [rsp + 0x20f0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
jne 0x14001666a
lea rdx, [rsp + 0x19f0]
lea rcx, [rsp + 0x20f0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
movzx eax, word [rsp + 0x19f6]
and eax, 0x4000
test eax, eax
je 0x14001666a
lea rdx, [0x1402513b8]
lea rcx, [rsp + 0x5c8]
call fcn.1400081d0
lea rdx, str._ISFOLDER_
lea rcx, [rsp + 0x5c8]
call fcn.14000a330
movzx eax, al
test eax, eax
je 0x140016754
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [rsp + 0x20f0]
lea rcx, [rsp + 0x1ca0]
call fcn.14000daf0
nop
lea rcx, [rsp + 0x1ca0]
call fcn.140017d10
movzx eax, al
test eax, eax
je 0x140016732
lea rdx, [rsp + 0x61]
lea rcx, [rsp + 0x1ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rsp + 0x4c0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x140016723
movzx edx, byte [rsp + 0x61]
lea rcx, [rsp + 0x5c8]
call fcn.1400056f0
jmp 0x1400166c7
lea rcx, [rsp + 0x1ca0]
call fcn.140011360
jmp 0x140016747
lea rdx, str._NOFILE_
lea rcx, [rsp + 0x5c8]
call fcn.1400081d0
nop
lea rcx, [rsp + 0x1ca0]
call fcn.14000f160
lea rcx, [rsp + 0x5c8]
call fcn.1400057c0
mov qword [rsp + 0xa28], rax
mov rax, qword [0x14031f410]
mov qword [rsp + 0xa30], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, qword [rsp + 0xa28]
xor edx, edx
mov rcx, qword [rsp + 0xa30]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x550], rax
lea rcx, [rsp + 0x5c8]
call fcn.1400057c0
mov qword [rsp + 0xa38], rax
lea rcx, [rsp + 0x5c8]
call fcn.140008fe0
mov qword [rsp + 0xa40], rax
mov r8, qword [rsp + 0xa38]
mov rdx, qword [rsp + 0xa40]
mov rcx, qword [rsp + 0x550]
call fcn.140019900
mov rax, qword [rsp + 0x550]
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0xff0], 0
lea rcx, [rsp + 0x5c8]
call fcn.1400057c0
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x1e0], 0
jmp 0x140016855
mov rax, qword [rsp + 0x1e0]
inc rax
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x168]
sub rax, 0x30000
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp qword [rsp + 0x1e0], rax
jae 0x14001698b
cmp qword [rsp + 0x168], 0
jbe 0x14001698b
cmp qword [rsp + 0x168], 0x7fffffff
jae 0x14001698b
cmp qword [rsp + 0x168], 0x30000
jbe 0x1400168ad
mov qword [rsp + 0x4d0], 0x30000
jmp 0x1400168bd
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x398], rax
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa48], rax
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x1c8]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa48]
add rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x390], rax
lea rdx, [rsp + 0x3a0]
mov rcx, qword [rsp + 0x390]
call fcn.14000d3e0
mov rax, qword [rsp + 0x390]
add rax, 0x10
lea rdx, [rsp + 0x398]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x398]
or rax, 0x1f
mov qword [rsp + 0xa50], rax
mov rax, qword [rsp + 0x390]
add rax, 0x18
lea rdx, [rsp + 0xa50]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x3a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3a0], rax
jmp 0x14001682c
lea rcx, [rsp + 0x5c8]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x5e8]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x13d8]
call fcn.14000ea00
jmp 0x140017184
lea rdx, str.fdel
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x140016c7e
lea rcx, [rsp + 0x13c0]
call fcn.14000e210
nop
lea rcx, [rsp + 0x608]
call fcn.140004830
nop
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa58], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa58]
lea rax, [rax + rcx + 0x18]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
je 0x140016aa0
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa60], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa60]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov rdx, rax
lea rcx, [rsp + 0x17b0]
call fcn.1401bde80
mov qword [rsp + 0xa68], rax
mov rdx, qword [rsp + 0xa68]
lea rcx, [rsp + 0x608]
call fcn.1400080b0
lea rcx, [rsp + 0x17b0]
call fcn.140004ac0
jmp 0x140016b06
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa70], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa70]
add rcx, qword [rax]
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x17d0]
call fcn.1401bde80
mov qword [rsp + 0xa78], rax
mov rdx, qword [rsp + 0xa78]
lea rcx, [rsp + 0x608]
call fcn.1400080b0
lea rcx, [rsp + 0x17d0]
call fcn.140004ac0
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rdx, rax
lea rcx, [rsp + 0x2920]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x48], 0
jmp 0x140016b39
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x608]
call fcn.1400057c0
movsxd rcx, dword [rsp + 0x48]
cmp rcx, rax
jae 0x140016c18
movsxd rax, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x3a
jne 0x140016b78
jmp 0x140016c18
lea rcx, [rsp + 0x608]
call fcn.1400057c0
mov ecx, dword [rsp + 0x48]
inc ecx
movsxd rcx, ecx
cmp rcx, rax
jae 0x140016bd2
movsxd rax, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x140016bd2
mov eax, dword [rsp + 0x48]
inc eax
cdqe
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x140016bd2
jmp 0x140016c18
movsxd rax, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140004b70
movsx ax, byte [rax]
mov word [rsp + 0x19c], ax
xor eax, eax
mov word [rsp + 0x19e], ax
lea rdx, [rsp + 0x19c]
lea rcx, [rsp + 0x2920]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140016b2f
mov rax, qword [rsp + 0x5c40]
add rax, 0x3ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x3e0], eax
lea rcx, [rsp + 0x2920]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x3e0]
cmp eax, ecx
jle 0x140016c5e
lea rcx, [rsp + 0x2920]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x608]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x13c0]
call fcn.14000ea00
jmp 0x140017184
lea rdx, [0x1402513f0]
lea rcx, [rsp + 0xca8]
call fcn.140006250
movzx eax, al
test eax, eax
je 0x140017184
lea rcx, [rsp + 0x13a8]
call fcn.14000e210
nop
lea rcx, [rsp + 0xc88]
call fcn.140004830
nop
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa80], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa80]
lea rax, [rax + rcx + 0x18]
mov rcx, rax
call fcn.14000d240
cmp rax, 0xf
je 0x140016d65
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa88], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa88]
add rcx, qword [rax]
mov rax, rcx
mov rcx, rax
call fcn.14000d240
mov rdx, rax
lea rcx, [rsp + 0x17f0]
call fcn.1401bde80
mov qword [rsp + 0xa90], rax
mov rdx, qword [rsp + 0xa90]
lea rcx, [rsp + 0xc88]
call fcn.1400080b0
lea rcx, [rsp + 0x17f0]
call fcn.140004ac0
jmp 0x140016dcb
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xa98], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14000ee10
mov rcx, qword [rsp + 0xa98]
add rcx, qword [rax]
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x1810]
call fcn.1401bde80
mov qword [rsp + 0xaa0], rax
mov rdx, qword [rsp + 0xaa0]
lea rcx, [rsp + 0xc88]
call fcn.1400080b0
lea rcx, [rsp + 0x1810]
call fcn.140004ac0
lea rcx, [rsp + 0xc88]
call fcn.1400057c0
cmp rax, 0xa
jbe 0x140017169
mov r9d, 7
xor r8d, r8d
lea rdx, [rsp + 0x1850]
lea rcx, [rsp + 0xc88]
call fcn.140009f50
mov qword [rsp + 0xaa8], rax
mov rax, qword [rsp + 0xaa8]
mov qword [rsp + 0xab0], rax
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rdx, str.http:__
mov rcx, qword [rsp + 0xab0]
call fcn.140006250
movzx eax, al
test eax, eax
jne 0x140016ea7
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x1830]
lea rcx, [rsp + 0xc88]
call fcn.140009f50
mov qword [rsp + 0xab8], rax
mov rax, qword [rsp + 0xab8]
mov qword [rsp + 0xac0], rax
mov eax, dword [rsp + 0x40]
or eax, 2
mov dword [rsp + 0x40], eax
lea rdx, str.https:__
mov rcx, qword [rsp + 0xac0]
call fcn.140006250
movzx eax, al
test eax, eax
jne 0x140016ea7
mov dword [rsp + 0x1a0], 0
jmp 0x140016eb2
mov dword [rsp + 0x1a0], 1
movzx eax, byte [rsp + 0x1a0]
mov byte [rsp + 0x62], al
mov eax, dword [rsp + 0x40]
and eax, 2
test eax, eax
je 0x140016edc
and dword [rsp + 0x40], 0xfffffffd
lea rcx, [rsp + 0x1830]
call fcn.140004ac0
nop
mov eax, dword [rsp + 0x40]
and eax, 1
test eax, eax
je 0x140016ef9
and dword [rsp + 0x40], 0xfffffffe
lea rcx, [rsp + 0x1850]
call fcn.140004ac0
movzx eax, byte [rsp + 0x62]
test eax, eax
je 0x140017169
lea rcx, [rsp + 0xc88]
call fcn.140008fe0
mov rdx, rax
lea rcx, [rsp + 0xd28]
call fcn.140012230
nop
lea rcx, [rsp + 0xd28]
call fcn.1400057c0
mov qword [rsp + 0xac8], rax
mov rax, qword [0x14031f410]
mov qword [rsp + 0xad0], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, qword [rsp + 0xac8]
xor edx, edx
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x4d8], rax
lea rcx, [rsp + 0xd28]
call fcn.1400057c0
mov qword [rsp + 0xad8], rax
lea rcx, [rsp + 0xd28]
call fcn.140008fe0
mov qword [rsp + 0xae0], rax
mov r8, qword [rsp + 0xad8]
mov rdx, qword [rsp + 0xae0]
mov rcx, qword [rsp + 0x4d8]
call fcn.140019900
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x3b8], rax
mov qword [rsp + 0xff8], 0
lea rcx, [rsp + 0xd28]
call fcn.1400057c0
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x1e8], 0
jmp 0x140017025
mov rax, qword [rsp + 0x1e8]
inc rax
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x170]
sub rax, 0x30000
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x1c8]
call fcn.14001b3f0
cmp qword [rsp + 0x1e8], rax
jae 0x14001715b
cmp qword [rsp + 0x170], 0
jbe 0x14001715b
cmp qword [rsp + 0x170], 0x7fffffff
jae 0x14001715b
cmp qword [rsp + 0x170], 0x30000
jbe 0x14001707d
mov qword [rsp + 0x4e0], 0x30000
jmp 0x14001708d
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x3b0], rax
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xae8], rax
mov rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0x1c8]
call fcn.14000ee10
mov rcx, qword [rsp + 0xae8]
add rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x3a8], rax
lea rdx, [rsp + 0x3b8]
mov rcx, qword [rsp + 0x3a8]
call fcn.14000d3e0
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
lea rdx, [rsp + 0x3b0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x3b0]
or rax, 0x1f
mov qword [rsp + 0xaf0], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x18
lea rdx, [rsp + 0xaf0]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3b8], rax
jmp 0x140016ffc
lea rcx, [rsp + 0xd28]
call fcn.140004ac0
nop
lea rcx, [rsp + 0xc88]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x13a8]
call fcn.14000ea00
lea rcx, [rsp + 0x129]
call fcn.140004440
mov qword [rsp + 0xaf8], rax
mov byte [rsp + 0x100], 0
mov byte [rsp + 0x101], 0
mov byte [rsp + 0x102], 0
mov byte [rsp + 0x103], 0
mov byte [rsp + 0x104], 0
mov byte [rsp + 0x105], 0
mov byte [rsp + 0x106], 0
mov byte [rsp + 0x107], 0
mov byte [rsp + 0x108], 0
mov byte [rsp + 0x109], 0
mov byte [rsp + 0x10a], 0
mov byte [rsp + 0x10b], 0
mov byte [rsp + 0x10c], 0
mov byte [rsp + 0x10d], 0
mov byte [rsp + 0x10e], 0
mov byte [rsp + 0x10f], 0
mov byte [rsp + 0x110], 0
mov byte [rsp + 0x111], 0
mov byte [rsp + 0x112], 0
mov byte [rsp + 0x113], 0
mov byte [rsp + 0x114], 0
mov byte [rsp + 0x115], 0
mov byte [rsp + 0x116], 0
mov byte [rsp + 0x117], 0
mov byte [rsp + 0x118], 0xf
mov byte [rsp + 0x119], 0
mov byte [rsp + 0x11a], 0
mov byte [rsp + 0x11b], 0
mov byte [rsp + 0x11c], 0
mov byte [rsp + 0x11d], 0
mov byte [rsp + 0x11e], 0
mov byte [rsp + 0x11f], 0
lea rax, [rsp + 0x120]
mov r8, rax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1930]
call fcn.14000df80
lea rcx, [rsp + 0xfa8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xdc0]
lea rcx, [rsp + 0xfa8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0xaf8]
lea rdx, [rsp + 0xdc0]
lea rcx, [rsp + 0xf58]
call fcn.14000e180
nop
movsxd rax, dword [0x140305004]
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov rax, rcx
lea rdx, [rsp + 0xf58]
mov rcx, rax
call fcn.14000d2f0
nop
lea rcx, [rsp + 0xf58]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xca8]
call fcn.140004ac0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 3
lea rdx, [rsp + 0x2300]
lea rcx, [rsp + 0x1db0]
call fcn.14000d9a0
nop
lea rcx, [rsp + 0x1db0]
call fcn.140017cf0
movzx eax, al
test eax, eax
je 0x140017b9d
lea rdx, [0x14024e3aa]
lea rcx, [rsp + 0x318]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x63]
lea rcx, [rsp + 0x1db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x4e8]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rsp + 0x4e8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x1400173fd
movzx edx, byte [rsp + 0x63]
lea rcx, [rsp + 0x318]
call fcn.140004c10
jmp 0x1400173a1
lea rcx, [rsp + 0x1db0]
call fcn.140011300
lea rcx, [rsp + 0x318]
call fcn.140011b00
movzx eax, al
test eax, eax
jne 0x140017b90
lea rdx, [0x140251410]
lea rcx, [rsp + 0x1308]
call fcn.1400047d0
nop
lea rdx, str.game:HttpGet
lea rcx, [rsp + 0x12e8]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1a48]
mov qword [rsp + 0xb00], rax
lea rdx, [rsp + 0x318]
mov rcx, qword [rsp + 0xb00]
call fcn.1400073d0
mov qword [rsp + 0xb08], rax
lea r9, [rsp + 0x1308]
lea r8, [rsp + 0x12e8]
mov rdx, qword [rsp + 0xb08]
lea rcx, [rsp + 0x1870]
call fcn.14001afd0
mov qword [rsp + 0xb10], rax
mov rdx, qword [rsp + 0xb10]
lea rcx, [rsp + 0x318]
call fcn.1400080b0
lea rcx, [rsp + 0x1870]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x12e8]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1308]
call fcn.140004ac0
lea rdx, [0x140251428]
lea rcx, [rsp + 0x1348]
call fcn.1400047d0
nop
lea rdx, str.Game:HttpGet
lea rcx, [rsp + 0x1328]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1a68]
mov qword [rsp + 0xb18], rax
lea rdx, [rsp + 0x318]
mov rcx, qword [rsp + 0xb18]
call fcn.1400073d0
mov qword [rsp + 0xb20], rax
lea r9, [rsp + 0x1348]
lea r8, [rsp + 0x1328]
mov rdx, qword [rsp + 0xb20]
lea rcx, [rsp + 0x1890]
call fcn.14001afd0
mov qword [rsp + 0xb28], rax
mov rdx, qword [rsp + 0xb28]
lea rcx, [rsp + 0x318]
call fcn.1400080b0
lea rcx, [rsp + 0x1890]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1328]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1348]
call fcn.140004ac0
lea rdx, [0x140251440]
lea rcx, [rsp + 0x1388]
call fcn.1400047d0
nop
lea rdx, str.game.HttpGet
lea rcx, [rsp + 0x1368]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1a88]
mov qword [rsp + 0xb30], rax
lea rdx, [rsp + 0x318]
mov rcx, qword [rsp + 0xb30]
call fcn.1400073d0
mov qword [rsp + 0xb38], rax
lea r9, [rsp + 0x1388]
lea r8, [rsp + 0x1368]
mov rdx, qword [rsp + 0xb38]
lea rcx, [rsp + 0x18b0]
call fcn.14001afd0
mov qword [rsp + 0xb40], rax
mov rdx, qword [rsp + 0xb40]
lea rcx, [rsp + 0x318]
call fcn.1400080b0
lea rcx, [rsp + 0x18b0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1368]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1388]
call fcn.140004ac0
lea rdx, str.httpget
lea rcx, [rsp + 0x1028]
call fcn.1400047d0
nop
lea rdx, str.Game.HttpGet
lea rcx, [rsp + 0x1008]
call fcn.1400047d0
nop
lea rax, [rsp + 0x1aa8]
mov qword [rsp + 0xb48], rax
lea rdx, [rsp + 0x318]
mov rcx, qword [rsp + 0xb48]
call fcn.1400073d0
mov qword [rsp + 0xb50], rax
lea r9, [rsp + 0x1028]
lea r8, [rsp + 0x1008]
mov rdx, qword [rsp + 0xb50]
lea rcx, [rsp + 0x18d0]
call fcn.14001afd0
mov qword [rsp + 0xb58], rax
mov rdx, qword [rsp + 0xb58]
lea rcx, [rsp + 0x318]
call fcn.1400080b0
lea rcx, [rsp + 0x18d0]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1008]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x1028]
call fcn.140004ac0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0
mov dword [rsp + 0xd48], 0
mov dword [rsp + 0xd4c], 0
mov dword [rsp + 0xd50], 0
mov dword [rsp + 0xd54], 0
mov qword [rsp + 0xd58], 0
mov qword [rsp + 0xd60], 0
mov qword [rsp + 0xd68], 0
mov qword [rsp + 0xd70], 0
mov qword [rsp + 0xd78], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x72]
lea r8, [rsp + 0xd48]
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x18f0]
call fcn.140061920
mov qword [rsp + 0xb60], rax
mov rdx, qword [rsp + 0xb60]
lea rcx, [rsp + 0x318]
call fcn.1400080b0
lea rcx, [rsp + 0x18f0]
call fcn.140004ac0
xor edx, edx
lea rcx, [rsp + 0x318]
call fcn.140004b70
movsx eax, byte [rax]
test eax, eax
jle 0x14001781e
xor edx, edx
lea rcx, [rsp + 0x318]
call fcn.140004b70
movsx eax, byte [rax]
cmp eax, 0xa
jl 0x14001783f
lea rcx, [rsp + 0x318]
call fcn.140008fe0
mov rdx, rax
lea rcx, str.Script_error:__s_n
call fcn.14000a170
jmp 0x140017b40
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0xd08]
call fcn.1400073d0
nop
lea rcx, [rsp + 0xd08]
call fcn.1400057c0
mov qword [rsp + 0xb68], rax
mov rax, qword [0x14031f410]
mov qword [rsp + 0xb70], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rsp + 0xb68]
xor edx, edx
mov rcx, qword [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x4f0], rax
lea rcx, [rsp + 0xd08]
call fcn.1400057c0
mov qword [rsp + 0xb78], rax
lea rcx, [rsp + 0xd08]
call fcn.140008fe0
mov qword [rsp + 0xb80], rax
mov r8, qword [rsp + 0xb78]
mov rdx, qword [rsp + 0xb80]
mov rcx, qword [rsp + 0x4f0]
call fcn.140019900
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0xfa0], 0
lea rcx, [rsp + 0xd08]
call fcn.1400057c0
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x1f0], 0
jmp 0x140017956
mov rax, qword [rsp + 0x1f0]
inc rax
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x178]
sub rax, 0x30000
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x520]
call fcn.14001b3f0
cmp qword [rsp + 0x1f0], rax
jae 0x140017a8d
cmp qword [rsp + 0x178], 0
jbe 0x140017a8d
mov eax, 0xffffffff
cmp qword [rsp + 0x178], rax
jae 0x140017a8d
cmp qword [rsp + 0x178], 0x30000
jbe 0x1400179af
mov qword [rsp + 0x410], 0x30000
jmp 0x1400179bf
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x3c8], rax
movsxd rax, dword [0x140305004]
mov qword [rsp + 0xb88], rax
mov rdx, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x520]
call fcn.14000ee10
mov rcx, qword [rsp + 0xb88]
add rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x3c0], rax
lea rdx, [rsp + 0x3d0]
mov rcx, qword [rsp + 0x3c0]
call fcn.14000d3e0
mov rax, qword [rsp + 0x3c0]
add rax, 0x10
lea rdx, [rsp + 0x3c8]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x3c8]
or rax, 0x1f
mov qword [rsp + 0xb90], rax
mov rax, qword [rsp + 0x3c0]
add rax, 0x18
lea rdx, [rsp + 0xb90]
mov rcx, rax
call fcn.14000d3e0
mov rax, qword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x3d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3d0], rax
jmp 0x14001792d
movsxd rax, dword [0x140305004]
mov rcx, qword [rsp + 0x1f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3d8], rax
lea rdx, str.inject
lea rcx, [rsp + 0x1048]
call fcn.1400047d0
nop
lea rdx, [rsp + 0x1048]
mov rcx, qword [rsp + 0x3d8]
call fcn.1401be130
nop
lea rcx, [rsp + 0x1048]
call fcn.140004ac0
mov qword [rsp + 0xb98], 6
mov rax, qword [rsp + 0x3d8]
add rax, 0x10
lea rdx, [rsp + 0xb98]
mov rcx, rax
call fcn.14000d3e0
mov qword [rsp + 0xba0], 0xf
mov rax, qword [rsp + 0x3d8]
add rax, 0x18
lea rdx, [rsp + 0xba0]
mov rcx, rax
call fcn.14000d3e0
nop
lea rcx, [rsp + 0xd08]
call fcn.140004ac0
mov edx, 1
lea rcx, [rsp + 0x1ed0]
call fcn.14000dd70
nop
mov r9d, 0x40
mov r8d, 0x12
lea rdx, [rsp + 0x2300]
lea rcx, [rsp + 0x1ed0]
call fcn.140019a10
lea rcx, [rsp + 0x1ed0]
call fcn.1400113c0
nop
lea rcx, [rsp + 0x1ed0]
call fcn.14000f1a0
nop
lea rcx, [rsp + 0x318]
call fcn.140004ac0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14025076c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x1db0]
call fcn.14000f120
jmp 0x140014aeb
lea rcx, [rsp + 0x1fe0]
call fcn.14000f1a0
nop
lea rcx, [rsp + 0xc00]
call fcn.14000eb20
nop
lea rcx, [rsp + 0xc18]
call fcn.14000eb20
nop
lea rcx, [rsp + 0x1b0]
call fcn.140004490
nop
lea rcx, [rsp + 0xa8]
call fcn.140004490
nop
lea rcx, [rsp + 0x160]
call fcn.140004490
nop
lea rcx, [rsp + 0x1c8]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x90]
call fcn.14000ea40
nop
lea rcx, [rsp + 0x520]
call fcn.14000ea40
mov byte [rsp + 0x64], 1
lea rcx, [rsp + 0x2e8]
call fcn.14000ea00
nop
lea rcx, [rsp + 0xc30]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x590]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x538]
call fcn.14000ea00
nop
lea rcx, [rsp + 0x570]
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x628]
call fcn.140004ac0
nop
lea rcx, [rsp + 0x300]
call fcn.14000ea00
movzx eax, byte [rsp + 0x64]
add rsp, 0x5c28
pop rdi
pop rsi
ret